Function at 0x1002bb88
Capabilities:
Allocate thread local storage
Create thread
Delete registry value
Get common file path
Get geographical location
Get graphical window text
Get keyboard layout
Get memory capacity
Log keystrokes via polling
Parse pe header
Query environment variable
Set thread local storage value

Disassembly:
mov eax, 0x10074eb0
call fcn.100735a0
mov eax, 0x15e4
call fcn.1006fa90
push ebx
push esi
push edi
push 2
pop ebx
mov dword [ebp - 0x210], ecx
lea ecx, [ebp - 0x944]
mov dword [ebp - 0x3c], 0xb642c70b
mov dword [ebp - 0x40], 0xd6f1860e
mov dword [ebp - 0x28], 0x29a3df60
push ebx
mov byte [ebp - 0x61], dl
call fcn.100157dc
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], eax
jmp 0x1002bbe7
push dword [ebp - 0x18]
call fcn.1001587a
mov dword [eax], 0x19c5a654
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x944]
cmp dword [ebp - 0x18], ebx
jl 0x1002bbd6
xor edi, edi
mov dword [ebp - 0x28], 0x124f01c0
inc edi
push edi
call fcn.1001587a
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002bc35
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002bc32
push 0xd6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1002bc0e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x944]
call fcn.1001585e
movdqa xmm0, xmmword [0x10009570]
xor eax, eax
mov dword [ebp - 0x54], eax
mov ecx, 0xaafe30f5
mov dword [ebp - 0x24], 0xbe1d925b
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x884], ecx
mov dword [ebp - 0x880], ecx
mov dword [ebp - 0x87c], ecx
mov dword [ebp - 0x878], ecx
lea ecx, [ebp - 0x1498]
mov dword [ebp - 0x40], 0xd8cf4c59
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1224]
push eax
lea eax, [ebp - 0x1234]
push eax
movdqu xmmword [ebp - 0x1234], xmm0
call fcn.10015889
lea ecx, [ebp - 0x21b]
mov esi, eax
call fcn.1000a413
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x56c]
push dword [esi]
call fcn.10015838
mov dword [ebp - 4], edi
lea ecx, [ebp - 0xb6c]
mov dword [ebp - 0x28], edi
push edi
call fcn.100157dc
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x48], 0xffff
mov dword [ebp - 0x50], 0xab385fae
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002bd0b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x35c], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002bcf3
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002bd31
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb6c]
call fcn.1001587a
mov dword [eax], 0xe7dfbf73
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002bd13
xor eax, eax
push eax
lea ecx, [ebp - 0x56c]
call fcn.1001587a
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x56c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push ebx
call fcn.1001587a
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x56c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
push eax
call fcn.1001587a
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x56c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.1001587a
mov ecx, dword [ebp - 0x28]
mov edx, 0x276c
sub edx, ecx
xor ecx, ecx
add edx, dword [ebp - 0x28]
cmp edx, dword [eax]
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x40]
setne cl
sub ecx, 0xfff7
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
xor ecx, ecx
cmp eax, 0xffffffff
setg cl
xor eax, eax
sub esi, ecx
lea ecx, [ebp - 0x56c]
push eax
call fcn.1001587a
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
sub esi, eax
mov eax, dword [ebp - 0x24]
cmp eax, esi
setle cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov dword [ebp - 0x87c], edi
mov eax, dword [ebp - 0x18]
cmp eax, edi
mov eax, dword [ebp - 0x18]
setg cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0xb6c]
setl bl
xor eax, eax
push eax
call fcn.1001587a
mov dword [eax], ebx
test ebx, ebx
jne 0x1002be14
mov eax, dword [ebp - 0x35c]
mov eax, dword [ebp - 0x35c]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
test eax, eax
mov eax, 0xffff
setg cl
cmp eax, ecx
mov eax, dword [ebp - 0x28]
push 0xfffffffffffffffc
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xb6c]
mov eax, dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x18], eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
call fcn.1001585e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x56c]
call fcn.1001585e
xor eax, eax
lea ecx, [ebp - 0xfd4]
mov dword [ebp - 0x4c], eax
push edi
call fcn.100157dc
mov dword [ebp - 4], 3
lea eax, [ebp - 0x1164]
movdqa xmm0, xmmword [0x10009530]
lea ecx, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x1174]
mov dword [ebp - 0x44], 0xbf0b96ca
mov dword [ebp - 0x44], 0x2443250e
push eax
movdqu xmmword [ebp - 0x1174], xmm0
call fcn.10015889
lea ecx, [ebp - 0x212]
mov esi, eax
call fcn.1000a413
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe98]
push dword [esi]
call fcn.10015838
xor eax, eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002bf03
push dword [ebp - 0x18]
lea ecx, [ebp - 0xfd4]
call fcn.1001587a
mov dword [eax], 0x47dfa860
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002bee5
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002bf55
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x30
push 0x16b0
push 0x7a7
push eax
push 0x872
push 0x156a
call ebx
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x247
push 0x629
push 0x1abf
push 0x548
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push edi
lea ecx, [ebp - 0xe98]
call fcn.1001587a
lea ecx, [ebp - 0xe98]
dec dword [eax]
call fcn.1001585e
or esi, 0xffffffff
lea ecx, [ebp - 0xfd4]
mov dword [ebp - 4], esi
call fcn.1001585e
mov dword [ebp - 0x38], 0xebd004dd
lea ecx, [ebp - 0x790]
mov dword [ebp - 0x44], 0xc29478c9
mov dword [ebp - 0x14], 0xddc85f70
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x48], esi
push 3
call fcn.100157dc
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x95c]
mov dword [ebp - 4], 5
call fcn.100157dc
xor eax, eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002bfe3
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x67c], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002bfcb
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002c007
push dword [ebp - 0x24]
lea ecx, [ebp - 0x790]
call fcn.1001587a
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002bfec
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002c02d
push dword [ebp - 0x24]
lea ecx, [ebp - 0x95c]
call fcn.1001587a
mov dword [eax], 0x9639
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002c00f
xor eax, eax
mov dword [ebp - 0x14], 0xb
jmp 0x1002c061
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002c056
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x60c], 0x58d32ffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002c03e
xor eax, eax
cmp dword [ebp - 0x60c], eax
jne 0x1002c067
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jle 0x1002c036
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff5
push 0xfffffffffffffff8
pop ecx
je 0x1002c1e6
jmp 0x1002c07b
xor eax, eax
mov dword [ebp - 0x28], 0xe6d058a8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x18], eax
jmp 0x1002c09d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1028], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002c090
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff6
jg 0x1002c1d9
mov dword [ebp - 0x50], 0xd4595a2e
xor ecx, ecx
mov dword [ebp - 0x40], 0xf7762406
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x20], 0xe6a83b1d
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, edi
setge cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x24], eax
mov eax, 0xffff
cmp dword [ebp - 0x24], eax
sbb eax, eax
add eax, 0xffff2027
neg eax
sbb eax, eax
add eax, 0x56fe18be
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
je 0x1002c15e
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x95c]
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], 0x44f8a3d3
mov dword [ebp - 0x44], 0xb1dcede6
push edi
mov dword [ebp - 0x44], eax
call fcn.1001587a
inc dword [eax]
jmp 0x1002c1c9
mov dword [ebp - 0x1c], 0x7e410f71
cmp dword [ebp - 0x20], eax
jne 0x1002c1d6
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setle dl
cmp edx, 0xd979
jge 0x1002c188
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x790]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.1001587a
xor eax, eax
lea ecx, [ebp - 0x790]
push eax
call fcn.1001587a
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, 0x19d44e41
setge dl
add edx, dword [ebp - 0x1c]
mov dword [eax], edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff6
jle 0x1002c0b7
push 0xfffffffffffffff8
pop ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff5
jne 0x1002c079
lea ecx, [ebp - 0x95c]
call fcn.1001585e
lea ecx, [ebp - 0x790]
mov dword [ebp - 4], esi
call fcn.1001585e
mov dword [ebp - 0x44], 0x67f5aee0
xor eax, eax
mov dword [ebp - 0x44], 0x59785734
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x18], eax
jmp 0x1002c228
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1044], 0x40424b96
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c217
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffe5
jg 0x1002c36e
mov dword [ebp - 0x1c], 0x961c0f80
lea ecx, [ebp - 0xcb0]
mov dword [ebp - 0x20], eax
push edi
call fcn.100157dc
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x40], 0x94bf7d6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002c289
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x240], 0xd0176df7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002c271
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c2a5
push dword [ebp - 0x14]
lea ecx, [ebp - 0xcb0]
call fcn.1001587a
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002c28e
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002c2be
mov esi, edi
cmp dword [ebp - 0x1c], eax
jne 0x1002c2c0
mov esi, eax
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0xcb0]
mov eax, dword [ebp - 0x240]
mov eax, dword [ebp - 0x240]
xor eax, eax
push eax
call fcn.1001587a
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
add eax, 0xffff97bb
add eax, esi
jne 0x1002c308
mov ecx, eax
cmp dword [ebp - 0x1044], eax
je 0x1002c30a
mov ecx, edi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
add edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1044]
setl cl
cmp ecx, 0xa6d983a5
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x103c]
jl 0x1002c345
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002c347
mov eax, edi
mov dword [ebp - 0x240], eax
lea ecx, [ebp - 0xcb0]
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.1001585e
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffe5
push 0
pop eax
jle 0x1002c243
mov dword [ebp - 0x24], 0xb642c70b
mov dword [ebp - 0x40], 0xd6f1860e
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x5c], 0xebd004dd
mov dword [ebp - 0x44], 0xc29478c9
mov dword [ebp - 0x44], 0x67f5aee0
mov dword [ebp - 0x44], 0x59785734
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x18], eax
jmp 0x1002c3b7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x105c], 0x40424b96
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c3a6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe5
jg 0x1002c4fd
mov dword [ebp - 0x1c], 0x961c0f80
lea ecx, [ebp - 0x974]
mov dword [ebp - 0x20], eax
push edi
call fcn.100157dc
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x40], 0x94bf7d6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002c418
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x248], 0xd0176df7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002c400
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c434
push dword [ebp - 0x14]
lea ecx, [ebp - 0x974]
call fcn.1001587a
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002c41d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002c44d
mov esi, edi
cmp dword [ebp - 0x1c], eax
jne 0x1002c44f
mov esi, eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x974]
mov eax, dword [ebp - 0x248]
mov eax, dword [ebp - 0x248]
xor eax, eax
push eax
call fcn.1001587a
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
add eax, 0xffff97bb
add eax, esi
jne 0x1002c497
mov ecx, eax
cmp dword [ebp - 0x105c], eax
je 0x1002c499
mov ecx, edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x5c]
add edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x105c]
setl cl
cmp ecx, 0xa6d983a5
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x1054]
jl 0x1002c4d4
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002c4d6
mov eax, edi
mov dword [ebp - 0x248], eax
lea ecx, [ebp - 0x974]
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.1001585e
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe5
push 0
pop eax
jle 0x1002c3d2
mov dword [ebp - 0x24], 0xb642c70b
mov dword [ebp - 0x40], 0xd6f1860e
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x5c], 0xebd004dd
mov dword [ebp - 0x44], 0xc29478c9
mov dword [ebp - 0x44], 0x67f5aee0
mov dword [ebp - 0x44], 0x59785734
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x18], eax
jmp 0x1002c546
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1078], 0x40424b96
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c535
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe5
jg 0x1002c68c
mov dword [ebp - 0x1c], 0x961c0f80
lea ecx, [ebp - 0xb84]
mov dword [ebp - 0x20], eax
push edi
call fcn.100157dc
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x40], 0x94bf7d6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002c5a7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x274], 0xd0176df7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002c58f
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c5c3
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb84]
call fcn.1001587a
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002c5ac
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002c5dc
mov esi, edi
cmp dword [ebp - 0x1c], eax
jne 0x1002c5de
mov esi, eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xb84]
mov eax, dword [ebp - 0x274]
mov eax, dword [ebp - 0x274]
xor eax, eax
push eax
call fcn.1001587a
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
add eax, 0xffff97bb
add eax, esi
jne 0x1002c626
mov ecx, eax
cmp dword [ebp - 0x1078], eax
je 0x1002c628
mov ecx, edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x5c]
add edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1078]
setl cl
cmp ecx, 0xa6d983a5
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x1070]
jl 0x1002c663
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002c665
mov eax, edi
mov dword [ebp - 0x274], eax
lea ecx, [ebp - 0xb84]
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.1001585e
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe5
push 0
pop eax
jle 0x1002c561
push 0xfffffffffffffff7
mov dword [ebp - 0x28], 0xb505
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
jmp 0x1002c6ab
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x160], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002c69e
mov eax, dword [ebp - 0x28]
mov ecx, ebx
sub ecx, eax
je 0x1002c727
xor eax, eax
mov dword [ebp - 0x38], 0x4794
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x1002c7e4
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x160]
mov eax, dword [ebp - 0x160]
cmp eax, edi
mov eax, dword [ebp - 0x28]
setg cl
xor ebx, ebx
cmp ecx, edx
mov eax, dword [ebp + eax*4 - 0x160]
setl bl
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
cmp ecx, 0xfffffff7
setge al
neg eax
jne 0x1002c710
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002c712
mov eax, edi
mov dword [ebp - 0x1c], eax
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002c6ce
push 2
pop ebx
jmp 0x1002c7e4
mov dword [ebp - 0x30], edx
xor eax, eax
mov dword [ebp - 0x38], 0xfffe
mov dword [ebp - 0x4c], 0x3b19d88c
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x54], 0xdf7d
mov dword [ebp - 0x4c], 0xba27438e
cmp dword [ebp - 0x30], eax
jne 0x1002c7a7
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg eax
je 0x1002c77d
mov dword [ebp - 0x1c], 0xffffd4d2
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002c76a
mov eax, edi
push 0xfffffffffffffff8
pop ecx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x1002c77d
mov edx, edi
jmp 0x1002c781
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x30]
je 0x1002c799
cmp dword [ebp - 0x38], eax
je 0x1002c799
mov eax, edi
cmp eax, edi
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
jne 0x1002c7a7
xor eax, eax
jmp 0x1002c7a9
mov eax, edi
mov dword [ebp - 0x40], eax
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x160]
setne dl
xor ecx, ecx
sub edx, 0x3c394a73
cmp edx, eax
setle cl
mov dword [ebp - 0x4c], ecx
push ebx
lea ecx, [ebp - 0x6f4]
call fcn.100157dc
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c822
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6f4]
call fcn.1001587a
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c804
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c846
push dword [ebp - 0x28]
call fcn.1001587a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x6f4]
mov esi, eax
call fcn.1001587a
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x6f4]
cmp dword [ebp - 0x28], edi
jle 0x1002c827
or dword [ebp - 4], 0xffffffff
call fcn.1001585e
push 4
lea ecx, [ebp - 0xeb0]
call fcn.100157dc
push 0xfffffffffffffffc
mov dword [ebp - 4], 0xb
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002c89b
push dword [ebp - 0x18]
lea ecx, [ebp - 0xeb0]
call fcn.1001587a
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c87f
xor eax, eax
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x1002c8d9
mov dword [ebp - 0x38], 0x3fbb4ebb
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002c8cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
xor eax, eax
mov dword [ebp - 0x38], 0xefc07e17
dec dword [ebp - 0x1c]
jns 0x1002c8a7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeb0]
call fcn.1001585e
mov dword [ebp - 0x30], 0xb642c70b
lea ecx, [ebp - 0x98c]
mov dword [ebp - 0x28], 0x29a3df60
push ebx
call fcn.100157dc
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x18], eax
jmp 0x1002c921
push dword [ebp - 0x18]
call fcn.1001587a
mov dword [eax], 0x19c5a654
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x98c]
cmp dword [ebp - 0x18], ebx
jl 0x1002c910
mov dword [ebp - 0x28], 0x124f01c0
push edi
call fcn.1001587a
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c96c
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002c969
push 0xd6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1002c945
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98c]
call fcn.1001585e
movdqa xmm0, xmmword [0x10009570]
lea ecx, [ebp - 0x1538]
mov dword [ebp - 0x40], 0xd6f1860e
mov eax, 0xaafe30f5
mov dword [ebp - 0x24], 0xbe1d925b
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x89c], eax
mov dword [ebp - 0x898], eax
mov dword [ebp - 0x894], eax
mov dword [ebp - 0x890], eax
xor eax, eax
mov dword [ebp - 0x40], 0xd8cf4c59
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x12d4]
push eax
movdqu xmmword [ebp - 0x12d4], xmm0
call fcn.10015889
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.1000a413
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x4c4]
push dword [esi]
call fcn.10015838
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0xc8c]
mov dword [ebp - 0x28], edi
push edi
call fcn.100157dc
mov byte [ebp - 4], 0xe
mov eax, 0xffff
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xab385fae
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002ca4c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x33c], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002ca34
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002ca72
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc8c]
call fcn.1001587a
mov dword [eax], 0xe7dfbf73
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002ca54
xor eax, eax
push eax
lea ecx, [ebp - 0x4c4]
call fcn.1001587a
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x4c4]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push ebx
call fcn.1001587a
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x4c4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
push eax
call fcn.1001587a
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x894], eax
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.1001587a
mov ecx, dword [ebp - 0x28]
mov edx, 0x276c
sub edx, ecx
xor ecx, ecx
add edx, dword [ebp - 0x28]
cmp edx, dword [eax]
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x40]
setne cl
sub ecx, 0xfff7
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
xor ecx, ecx
cmp eax, 0xffffffff
setg cl
xor eax, eax
sub esi, ecx
lea ecx, [ebp - 0x4c4]
push eax
call fcn.1001587a
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
sub esi, eax
mov eax, dword [ebp - 0x24]
cmp eax, esi
setle cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov dword [ebp - 0x894], edi
mov eax, dword [ebp - 0x18]
cmp eax, edi
mov eax, dword [ebp - 0x18]
setg cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0xc8c]
setl bl
xor eax, eax
push eax
call fcn.1001587a
mov dword [eax], ebx
test ebx, ebx
jne 0x1002cb55
mov eax, dword [ebp - 0x33c]
mov eax, dword [ebp - 0x33c]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
test eax, eax
mov eax, 0xffff
setg cl
cmp eax, ecx
mov eax, dword [ebp - 0x28]
push 0xfffffffffffffffc
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xc8c]
mov eax, dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x18], eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
call fcn.1001585e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c4]
call fcn.1001585e
xor eax, eax
lea ecx, [ebp - 0xec8]
mov dword [ebp - 0x5c], eax
push edi
call fcn.100157dc
mov dword [ebp - 4], 0xf
lea eax, [ebp - 0x1184]
movdqa xmm0, xmmword [0x10009530]
lea ecx, [ebp - 0x1428]
push eax
lea eax, [ebp - 0x1194]
mov dword [ebp - 0x44], 0xbf0b96ca
mov dword [ebp - 0x44], 0x2443250e
push eax
movdqu xmmword [ebp - 0x1194], xmm0
call fcn.10015889
lea ecx, [ebp - 0x216]
mov esi, eax
call fcn.1000a413
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x10ac]
push dword [esi]
call fcn.10015838
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002cc44
push dword [ebp - 0x18]
lea ecx, [ebp - 0xec8]
call fcn.1001587a
mov dword [eax], 0x47dfa860
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002cc26
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002cc98
push 0x30
push 0x16b0
push 0x7a7
push eax
push 0x872
push 0x156a
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x247
push 0x629
push 0x1abf
push 0x548
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push edi
lea ecx, [ebp - 0x10ac]
call fcn.1001587a
lea ecx, [ebp - 0x10ac]
dec dword [eax]
call fcn.1001585e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec8]
call fcn.1001585e
xor eax, eax
lea ecx, [ebp - 0x844]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], 0xddc85f70
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x38], 0xffffffff
push 3
call fcn.100157dc
push 2
pop esi
push esi
lea ecx, [ebp - 0x9a4]
mov dword [ebp - 4], 0x11
call fcn.100157dc
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002cd23
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x600], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002cd0b
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002cd48
push dword [ebp - 0x24]
lea ecx, [ebp - 0x844]
call fcn.1001587a
or dword [eax], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002cd2c
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002cd6e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9a4]
call fcn.1001587a
mov dword [eax], 0x9639
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002cd50
xor eax, eax
mov dword [ebp - 0x14], 0xb
jmp 0x1002cda2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002cd97
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5f8], 0x58d32ffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002cd7f
xor eax, eax
cmp dword [ebp - 0x5f8], eax
jne 0x1002cda8
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jle 0x1002cd77
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff5
je 0x1002cf2b
push 0xfffffffffffffff8
pop ecx
jmp 0x1002cdbc
xor eax, eax
mov dword [ebp - 0x28], 0xe6d058a8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x18], eax
jmp 0x1002cdde
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1030], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002cdd1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff6
jg 0x1002cf1e
mov dword [ebp - 0x4c], 0xd4595a2e
xor ecx, ecx
mov dword [ebp - 0x40], 0xf7762406
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x20], 0xe6a83b1d
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, edi
setge cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x3c], eax
mov eax, 0xffff
cmp dword [ebp - 0x3c], eax
sbb eax, eax
add eax, 0xffff2027
neg eax
sbb eax, eax
add eax, 0x56fe18be
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
je 0x1002cea3
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x9a4]
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], 0x44f8a3d3
mov dword [ebp - 0x44], 0xb1dcede6
push edi
mov dword [ebp - 0x44], eax
call fcn.1001587a
inc dword [eax]
jmp 0x1002cf0e
mov dword [ebp - 0x1c], 0x7e410f71
cmp dword [ebp - 0x20], eax
jne 0x1002cf1b
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setle dl
cmp edx, 0xd979
jge 0x1002cecd
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x844]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.1001587a
xor eax, eax
lea ecx, [ebp - 0x844]
push eax
call fcn.1001587a
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, 0x19d44e41
setge dl
add edx, dword [ebp - 0x1c]
mov dword [eax], edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff6
jle 0x1002cdf8
push 0xfffffffffffffff8
pop ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff5
jne 0x1002cdba
lea ecx, [ebp - 0x9a4]
call fcn.1001585e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x844]
call fcn.1001585e
mov dword [ebp - 0x50], 0xebd004dd
xor eax, eax
mov dword [ebp - 0x40], 0xc8b166c1
mov dword [ebp - 0x40], 0x1f6f49c2
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002cf84
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1e0], 0xdb50
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002cf6b
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002cfa4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x27c], 0x9523dd97
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002cf8c
xor eax, eax
cmp dword [ebp - 0x1d8], eax
jne 0x1002d053
mov eax, dword [ebp - 0x1d8]
xor edx, edx
mov ecx, dword [ebp - 0x1e0]
cmp eax, 0x4d2b5f79
mov eax, dword [ebp - 0x1e0]
setge dl
imul ecx, edx
imul eax, ecx
cmp eax, dword [ebp - 0x1d8]
jge 0x1002cfe4
xor eax, eax
cmp dword [ebp - 0x1d8], eax
je 0x1002cfe6
mov eax, edi
mov dword [ebp - 0x40], eax
xor ecx, ecx
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
cmp eax, 0x2659
setge cl
xor eax, eax
cmp ecx, 0xb76e1ee6
jbe 0x1002d022
cmp dword [ebp - 0x27c], eax
je 0x1002d022
mov eax, edi
mov dword [ebp - 0x40], eax
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0x1d8]
mov eax, dword [ebp - 0x1d8]
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x1dc]
jge 0x1002d053
xor eax, eax
jmp 0x1002d055
mov eax, edi
mov dword [ebp - 0x38], eax
mov eax, 0xbb743d83
mov dword [ebp - 0x44], 0xc29478c9
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002d09c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x15d0], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002d087
xor eax, eax
mov dword [ebp - 0x45c], 3
cmp dword [ebp - 0x45c], eax
jl 0x1002d128
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d0cf
push eax
push eax
push 0x9bc
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002d11a
mov dword [ebp - 0x18], 0x79c4185a
mov dword [ebp - 0x18], eax
jmp 0x1002d111
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d0fc
push 0x179
push 0x10e4
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d10e
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1002d0e0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jle 0x1002d0d4
dec dword [ebp - 0x45c]
jns 0x1002d0ae
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x45c], eax
xor eax, eax
mov dword [ebp - 0x44], 0x67f5aee0
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x34], 0xd3f46721
mov dword [ebp - 0x18], eax
jmp 0x1002d164
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6b0], 0x91e29ea4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002d153
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x6b0], eax
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002d194
push 0x1991
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
mov dword [ebp - 0x44], 0x59785734
mov dword [ebp - 0x40], 0x1ad386cc
mov dword [ebp - 0x38], 0xc5416513
mov dword [ebp - 0x44], 0xa0d72276
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002d1d2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1554], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002d1b9
xor eax, eax
dec dword [ebp - 0x40]
je 0x1002d1dc
mov dword [ebp - 0x38], edi
jmp 0x1002d1f6
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d1f6
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov dword [ebp - 0x24], 0xac204e2d
xor eax, eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x24], 0x17
cmp dword [ebp - 0x24], 0xffffffee
jle 0x1002d2bb
jmp 0x1002d233
xor eax, eax
mov dword [ebp - 0x28], 0xa290be4
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x38], 0x64361a6b
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x28], eax
jne 0x1002d298
mov dword [ebp - 0x184], 0x4952f341
cmp dword [ebp - 0x28], 0x4952f341
jne 0x1002d26a
mov ecx, edi
cmp dword [ebp - 0x28], eax
jne 0x1002d26c
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setle dl
xor eax, eax
sub edx, dword [ebp - 0x28]
je 0x1002d29a
cmp dword [ebp - 0x28], eax
je 0x1002d29a
mov eax, edi
mov dword [ebp - 0x4c], eax
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002d2ae
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffee
jg 0x1002d231
mov eax, dword [ebp - 0x188]
xor ecx, ecx
cmp eax, edi
setg cl
xor eax, eax
mov dword [ebp - 0x184], ecx
test ecx, ecx
je 0x1002d2ef
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002d4d9
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
jmp 0x1002d4d7
mov dword [ebp - 0x18], 0xa0c8
mov dword [ebp - 0x40], 0x4d75f053
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], eax
jl 0x1002d4d7
mov edi, 0xfa0b5bcd
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jge 0x1002d332
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xcc], 0x3e3f36a5
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x1002d31a
xor eax, eax
push 4
mov dword [ebp - 0x3c], eax
pop ecx
cmp dword [ebp - 0x3c], ecx
jge 0x1002d355
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1500], 0x1244
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jl 0x1002d33d
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002d36b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1518], 0x5d9aeb8e
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jl 0x1002d35a
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x190], 0
jne 0x1002d4d4
xor eax, eax
mov dword [ebp - 0xcc], 3
cmp dword [ebp - 0xcc], eax
jl 0x1002d4c8
mov dword [ebp - 0x38], 0xef22
mov dword [ebp - 0x4c], 0xfffffff6
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x190], 0
je 0x1002d3fe
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x190], 0xffffffff
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x190], ecx
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x184], 0xe9505c0
mov eax, dword [ebp - 0x38]
cmp edi, eax
mov eax, dword [ebp - 0xc8]
sbb ecx, ecx
xor edx, edx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb edx, edx
inc edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1500]
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x4c]
setl cl
xor edx, edx
cmp ecx, 0x42c8cda
setge dl
sub edx, eax
sub edx, 0x484c0579
mov dword [ebp - 0x150c], edx
dec dword [ebp - 0xcc]
jns 0x1002d399
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1002d312
xor edi, edi
inc edi
xor eax, eax
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x44], edi
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d4f5
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d51c
push eax
push eax
push 0x1354
push eax
push 0x25c0
push eax
push 0xe22
push 0x2e3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x18], 0x99841b3c
mov dword [ebp - 0x18], 0xffffffe7
jmp 0x1002d604
movdqa xmm0, xmmword [0x100094f0]
lea ecx, [ebp - 0x14a8]
mov eax, 0xfffe
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x1244]
push eax
lea eax, [ebp - 0x1254]
push eax
movdqu xmmword [ebp - 0x1254], xmm0
call fcn.10015889
lea ecx, [ebp - 0x224]
mov esi, eax
call fcn.1000a413
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x5b4]
push dword [esi]
call fcn.10015838
push 2
pop esi
push esi
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 4], 0x13
call fcn.1001587a
mov dword [eax], 3
jmp 0x1002d5e1
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002d5c3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d5d3
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push esi
lea ecx, [ebp - 0x5b4]
call fcn.1001587a
dec dword [eax]
push esi
lea ecx, [ebp - 0x5b4]
call fcn.1001587a
cmp dword [eax], 0
jge 0x1002d5b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b4]
call fcn.1001585e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xc
jne 0x1002d52f
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002d620
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002d642
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10a0], 0x40424b96
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002d629
xor eax, eax
mov dword [ebp - 0x28], 0x90ac204e
mov dword [ebp - 0x38], 0x8ee41b66
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x28], 0xfffffff3
jmp 0x1002d6a3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002d67f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5bc], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002d667
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1002d6a0
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x5bc], 0
jne 0x1002d69e
inc dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jle 0x1002d687
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x15
jne 0x1002d65c
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xee0]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
push edi
call fcn.100157dc
mov dword [ebp - 4], 0x14
lea eax, [ebp - 0x11a4]
movdqa xmm0, xmmword [0x10009530]
lea ecx, [ebp - 0x1438]
push eax
lea eax, [ebp - 0x11b4]
mov dword [ebp - 0x44], 0xbf0b96ca
mov dword [ebp - 0x44], 0x2443250e
push eax
movdqu xmmword [ebp - 0x11b4], xmm0
call fcn.10015889
lea ecx, [ebp - 0x241]
mov esi, eax
call fcn.1000a413
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xfe8]
push dword [esi]
call fcn.10015838
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002d74f
push dword [ebp - 0x18]
lea ecx, [ebp - 0xee0]
call fcn.1001587a
mov dword [eax], 0x47dfa860
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002d731
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d7a3
push 0x30
push 0x16b0
push 0x7a7
push eax
push 0x872
push 0x156a
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x247
push 0x629
push 0x1abf
push 0x548
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push edi
lea ecx, [ebp - 0xfe8]
call fcn.1001587a
lea ecx, [ebp - 0xfe8]
dec dword [eax]
call fcn.1001585e
or esi, 0xffffffff
lea ecx, [ebp - 0xee0]
mov dword [ebp - 4], esi
call fcn.1001585e
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe5
jg 0x1002e60c
jmp 0x1002d7e4
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x28], 0x34ab462a
mov dword [ebp - 0x14], eax
push 0xfffffffffffffffc
pop edx
cmp dword [ebp - 0x14], edi
jge 0x1002d811
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002d7fd
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002d831
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x63c], 0x90aec51
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002d819
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002d8e2
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8c], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x8c]
imul eax, dword [ebp - 0x8c]
test eax, eax
je 0x1002d8ae
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x24]
cmp ecx, dword [ebp + eax*4 - 0x8c]
je 0x1002d898
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], 0x6cef
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x34]
test eax, eax
je 0x1002d8ae
mov ecx, edi
jmp 0x1002d8b2
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 7
push 0
setg al
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x63c], eax
dec dword [ebp - 0x24]
pop eax
jns 0x1002d83d
mov dword [ebp - 0x28], 0xffffffe4
jmp 0x1002d90a
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x24], 0xfffffffd
jmp 0x1002d901
dec dword [ebp - 0x40]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff5
jg 0x1002d8fb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 6
jge 0x1002d8eb
mov dword [ebp - 0x1c], 0x961c0f80
mov dword [ebp - 0x34], 0x53aa
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x44], 0xfc3938dd
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x44], 0x13ec752f
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], 0x229edca8
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0x9d089051
mov dword [ebp - 0x14], 0x657e3b6f
mov dword [ebp - 0x44], 0x7ab6dad8
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002d989
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14f0], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d974
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d9a0
push eax
push 0xbf7
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002d9ac
dec dword [ebp - 0x28]
mov edx, edi
jne 0x1002d9ae
mov edx, eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x4c]
add ecx, 0xffffadd7
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, dword [ebp - 0x14]
cmp ecx, 0xdf3
setne al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x1c]
je 0x1002daa8
mov dword [ebp - 0x28], eax
jmp 0x1002da2a
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002da27
push eax
push 0x114e
push 0x872
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x2d
jg 0x1002da01
push 2
pop ecx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x44], 0x328a062b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002da66
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc0], 0x1871
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002da4e
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002dbcf
mov dword [ebp - 0x44], 0x1d2250db
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002daa0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1458], 0xb036
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002da88
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002dbc3
mov dword [ebp - 0x40], 0x509b955
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002dad2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x108c], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002daba
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffef
jge 0x1002da33
mov edx, 0xfff7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002db04
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5d4], 0x1f9531de
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002daec
xor eax, eax
dec dword [ebp - 0x40]
mov dword [ebp - 0x108c], edx
mov dword [ebp - 0x5d4], edx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffef
jl 0x1002dae4
jmp 0x1002da33
movdqa xmm0, xmmword [0x100095a0]
lea eax, [ebp - 0x12a4]
push eax
lea eax, [ebp - 0x12b4]
push eax
lea ecx, [ebp - 0x1520]
movdqu xmmword [ebp - 0x12b4], xmm0
call fcn.10015889
lea ecx, [ebp - 0x209]
mov esi, eax
call fcn.1000a413
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1364]
push dword [esi]
call fcn.10015838
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x1068]
mov dword [ebp - 0x44], 0xe4b28306
push 3
call fcn.100157dc
xor eax, eax
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x18], eax
jmp 0x1002db9b
push dword [ebp - 0x18]
call fcn.1001587a
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
lea ecx, [ebp - 0x1068]
jl 0x1002db8e
inc dword [ebp - 0x40]
call fcn.1001585e
or esi, 0xffffffff
lea ecx, [ebp - 0x1364]
mov dword [ebp - 4], esi
call fcn.1001585e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jl 0x1002db21
jmp 0x1002dc0b
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], eax
jl 0x1002dc0b
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002dc06
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002dbf3
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002dc28
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002dc25
push eax
push eax
call dword [sym.imp.USER32.dll_CopyRect]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1002dc12
movdqa xmm0, xmmword [0x100095a0]
lea ecx, [ebp - 0x1468]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x11c4]
push eax
lea eax, [ebp - 0x11d4]
mov dword [ebp - 0x14], esi
push eax
movdqu xmmword [ebp - 0x11d4], xmm0
call fcn.10015889
lea ecx, [ebp - 0x26d]
mov esi, eax
call fcn.1000a413
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xef8]
push dword [esi]
call fcn.10015838
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x38], 0xf14186e1
push 3
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x1002dcad
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a8], 0xeac8b13e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002dc95
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x1002ddd2
push edi
lea ecx, [ebp - 0xb9c]
call fcn.100157dc
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], eax
jmp 0x1002dceb
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb9c]
call fcn.1001587a
mov dword [eax], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002dcd4
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a8]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x1a8], 0
jne 0x1002dd2b
xor eax, eax
lea ecx, [ebp - 0xb9c]
push eax
call fcn.1001587a
mov dword [eax], 0x76e5b14f
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a8]
mov eax, dword [ebp - 0x1a0]
xor eax, eax
cmp dword [ebp - 0x1a8], eax
jne 0x1002dd48
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x14]
push 2
mov ecx, dword [ebp + eax*4 - 0x1a8]
mov eax, dword [ebp - 0x1a8]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1a8]
cmp edx, eax
mov eax, 0xffff
setne cl
add ecx, dword [ebp - 0x1a0]
cmp eax, ecx
lea ecx, [ebp - 0xef8]
sbb esi, esi
inc esi
call fcn.1001587a
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x14]
mov esi, 0xffffc484
setl dl
sub esi, edx
add esi, dword [ebp + ecx*4 - 0x1a8]
lea ecx, [ebp - 0xb9c]
mov dword [eax], esi
mov byte [ebp - 4], 0x18
call fcn.1001585e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1002dcba
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xef8]
mov dword [ebp - 0x38], eax
or dword [ebp - 4], 0xffffffff
call fcn.1001585e
push edi
lea ecx, [ebp - 0xcec]
call fcn.100157dc
mov dword [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x28], 0x34ab462a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002de29
push 0xfffffffffffffffc
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002de15
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002de49
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6b4], 0x90aec51
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002de31
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002deff
jmp 0x1002de59
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x38], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa0], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xa0]
imul eax, dword [ebp - 0xa0]
test eax, eax
je 0x1002dece
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x24]
cmp ecx, dword [ebp + eax*4 - 0xa0]
je 0x1002deb8
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 7
setg al
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x6b4], eax
dec dword [ebp - 0x24]
jns 0x1002de57
mov dword [ebp - 0x28], 0xffffffe4
jmp 0x1002df27
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x24], 0xfffffffd
jmp 0x1002df1e
cmp dword [ebp - 0x28], 6
jge 0x1002df08
mov dword [ebp - 0x24], 0x94bf7d6
lea ecx, [ebp - 0xfc]
push 4
call fcn.100157dc
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x34], eax
push 0xfffffffffffffff8
mov dword [ebp - 0x38], 0xfeac8e4c
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], 0x83395465
mov dword [ebp - 0x18], eax
jmp 0x1002df74
mov dword [ebp - 0x28], 0xfffa
push 0xfffffffffffffff7
pop edx
mov dword [ebp - 0xd70], edx
mov dword [ebp - 0xd6c], edx
mov dword [ebp - 0xd68], edx
mov dword [ebp - 0xd64], edx
mov dword [ebp - 0x18], eax
jmp 0x1002e644
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9d4], 0xa35f394
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002e633
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [ebp - 0x9cc], eax
mov dword [ebp - 0xd6c], eax
xor eax, eax
push 2
mov dword [ebp - 0x28], eax
pop ebx
cmp dword [ebp - 0x28], ebx
jg 0x1002e6a1
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e67f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov eax, dword [ebp - 0x28]
push 0
mov ecx, dword [ebp + eax*4 - 0x9d4]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x9d4], ecx
inc dword [ebp - 0x28]
pop eax
cmp dword [ebp - 0x28], ebx
jle 0x1002e66c
push 0xfffffffffffffff7
pop edx
mov dword [ebp - 0x28], 0xb505
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
jmp 0x1002e6bd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x168], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002e6b0
mov eax, dword [ebp - 0x28]
mov ecx, ebx
sub ecx, eax
je 0x1002e73b
xor eax, eax
mov dword [ebp - 0x38], 0x4794
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x1002e801
mov eax, dword [ebp - 0x28]
xor ecx, ecx
push 0xfffffffffffffff7
mov edx, dword [ebp + eax*4 - 0x168]
mov eax, dword [ebp - 0x168]
cmp eax, edi
mov eax, dword [ebp - 0x28]
setg cl
xor ebx, ebx
cmp ecx, edx
pop edx
mov eax, dword [ebp + eax*4 - 0x168]
setl bl
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
cmp ecx, edx
setge al
neg eax
jne 0x1002e724
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002e726
mov eax, edi
mov dword [ebp - 0x1c], eax
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002e6e0
push 2
pop ebx
jmp 0x1002e7ff
mov dword [ebp - 0x30], edx
xor eax, eax
mov dword [ebp - 0x38], 0xfffe
mov dword [ebp - 0x4c], 0x3b19d88c
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x54], 0xdf7d
mov dword [ebp - 0x4c], 0xba27438e
cmp dword [ebp - 0x30], eax
jne 0x1002e7bf
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg eax
je 0x1002e795
mov dword [ebp - 0x1c], 0xffffd4d2
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002e782
mov eax, edi
push 0xfffffffffffffff8
pop ecx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x1002e795
mov edx, edi
jmp 0x1002e799
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x30]
je 0x1002e7b1
cmp dword [ebp - 0x38], eax
je 0x1002e7b1
mov eax, edi
cmp eax, edi
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
jne 0x1002e7bf
xor eax, eax
jmp 0x1002e7c1
mov eax, edi
xor edx, edx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
push 0xfffffffffffffff7
setne cl
xor edx, edx
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x168]
setne dl
xor ecx, ecx
sub edx, 0x3c394a73
cmp edx, eax
pop edx
setle cl
mov dword [ebp - 0x4c], ecx
xor eax, eax
mov dword [ebp - 0x28], 0xb505
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
jmp 0x1002e81d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x170], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002e810
mov eax, dword [ebp - 0x28]
mov ecx, ebx
sub ecx, eax
je 0x1002e899
xor eax, eax
mov dword [ebp - 0x38], 0x4794
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x1002e95a
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x170]
mov eax, dword [ebp - 0x170]
cmp eax, edi
mov eax, dword [ebp - 0x28]
setg cl
xor ebx, ebx
cmp ecx, edx
mov eax, dword [ebp + eax*4 - 0x170]
setl bl
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
cmp ecx, 0xfffffff7
setge al
neg eax
jne 0x1002e882
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002e884
mov eax, edi
mov dword [ebp - 0x1c], eax
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002e840
push 2
pop ebx
jmp 0x1002e95a
mov dword [ebp - 0x30], edx
xor eax, eax
mov dword [ebp - 0x38], 0xfffe
mov dword [ebp - 0x4c], 0x3b19d88c
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x54], 0xdf7d
mov dword [ebp - 0x4c], 0xba27438e
cmp dword [ebp - 0x30], eax
jne 0x1002e91d
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg eax
je 0x1002e8f3
mov dword [ebp - 0x1c], 0xffffd4d2
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002e8e0
mov eax, edi
push 0xfffffffffffffff8
pop ecx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x1002e8f3
mov edx, edi
jmp 0x1002e8f7
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x30]
je 0x1002e90f
cmp dword [ebp - 0x38], eax
je 0x1002e90f
mov eax, edi
cmp eax, edi
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
jne 0x1002e91d
xor eax, eax
jmp 0x1002e91f
mov eax, edi
mov dword [ebp - 0x40], eax
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x170]
setne dl
xor ecx, ecx
sub edx, 0x3c394a73
cmp edx, eax
setle cl
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x28], 0x29a3df60
lea ecx, [ebp - 0xbb4]
push ebx
call fcn.100157dc
xor eax, eax
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x18], eax
jmp 0x1002e98c
push dword [ebp - 0x18]
call fcn.1001587a
mov dword [eax], 0x19c5a654
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xbb4]
cmp dword [ebp - 0x18], ebx
jl 0x1002e97b
mov dword [ebp - 0x28], 0x124f01c0
push edi
call fcn.1001587a
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002e9d7
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e9d4
push 0xd6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1002e9b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbb4]
call fcn.1001585e
mov dword [ebp - 0x28], 0xfffa
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0xd90], eax
mov dword [ebp - 0xd8c], eax
mov dword [ebp - 0xd88], eax
mov dword [ebp - 0xd84], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002ea25
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9ec], 0xa35f394
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002ea14
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x9e4], eax
mov dword [ebp - 0xd8c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002ea6e
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ea54
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov eax, dword [ebp - 0x28]
push 0
mov ecx, dword [ebp + eax*4 - 0x9ec]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x9ec], ecx
inc dword [ebp - 0x28]
pop eax
cmp dword [ebp - 0x28], ebx
jle 0x1002ea41
mov dword [ebp - 0x18], 0xffffffff
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
imul eax, dword [ebp - 0x18]
neg eax
sub edx, eax
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
add ecx, 0xfc4b
je 0x1002eab8
mov dword [ebp - 0x38], 0x868bb4a
mov dword [ebp - 0x38], eax
jmp 0x1002eacd
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002eacf
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
mov dword [ebp - 0x28], 0xfffa
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0xd60], ecx
mov dword [ebp - 0xd5c], ecx
mov dword [ebp - 0xd58], ecx
mov dword [ebp - 0xd54], ecx
mov dword [ebp - 0x18], eax
jmp 0x1002eb07