Function at 0x1002ac19
Capabilities:
Clear file content
Compare security identifiers
Create process on windows
Delete file
Delete registry value
Enumerate files on windows
Get graphical window text
Parse pe header
Query environment variable
Set environment variable
Set thread local storage value
Write and execute a file

Disassembly:
mov eax, 0x10072a44
call fcn.100714d0
mov eax, 0x150c
call fcn.1006dc80
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x58], ecx
push edi
inc eax
mov dword [ebp - 0x34], 0xda11525
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0xf64]
mov dword [ebp - 0x34], 0x3c69aed2
push eax
mov byte [ebp - 0x59], dl
call fcn.100139c6
xor eax, eax
mov ecx, 0xfffb
mov dword [ebp - 4], eax
xor esi, esi
mov dword [ebp - 0x4c], ecx
inc esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002ac93
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf64]
call fcn.10013a64
or dword [eax], 0xffffffff
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002ac72
xor esi, esi
xor eax, eax
inc esi
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002acbf
push eax
push 0x2163
push 0x14d8
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
inc dword [ebp - 0x4c]
lea ecx, [ebp - 0xf64]
or dword [ebp - 4], 0xffffffff
call fcn.10013a48
mov dword [ebp - 0x34], 0xda11525
push 0xfffffffffffffffa
mov dword [ebp - 0x1c], 0xcea5d6c0
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffd
cmp dword [ebp - 0x1c], eax
jl 0x1002ad17
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002ad12
push eax
push 0x63
push 0x7f7
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
inc dword [ebp - 0x1c]
jns 0x1002acf3
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x3e4]
mov dword [ebp - 0x28], eax
push 2
mov dword [ebp - 0x34], 0xffffffff
pop eax
mov dword [ebp - 0x20], 0x3f0b
mov dword [ebp - 0x1c], 0x7ecc2443
mov dword [ebp - 0x10], 0xdcd16652
push eax
call fcn.100139c6
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0x36c745d0
push 2
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x1c], eax
pop esi
jmp 0x1002ad77
push dword [ebp - 0x1c]
call fcn.10013a64
mov dword [eax], 0xbdbdf7cd
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x3e4]
cmp dword [ebp - 0x1c], esi
jl 0x1002ad66
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
xor eax, eax
mov esi, dword [ebp - 0x10]
push eax
call fcn.10013a64
lea ecx, [ebp - 0x3e4]
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.10013a64
xor eax, eax
lea ecx, [ebp - 0x3e4]
inc eax
push eax
call fcn.10013a64
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3e4]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.10013a64
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x3e4]
imul esi, dword [eax]
xor eax, eax
inc eax
push eax
call fcn.10013a64
mov dword [eax], esi
test esi, esi
jne 0x1002ae04
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002ae04
mov edx, eax
jmp 0x1002ae09
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x10]
jle 0x1002ae1b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x10]
test eax, eax
je 0x1002ae47
xor eax, eax
lea ecx, [ebp - 0x3e4]
inc eax
push eax
call fcn.10013a64
cmp dword [eax], 0
je 0x1002ae47
xor eax, eax
lea edx, [eax + 1]
jmp 0x1002ae4b
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002ae81
cmp dword [ebp - 0x10], eax
jne 0x1002ae81
mov edx, eax
jmp 0x1002ae86
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x2c21
lea ecx, [ebp - 0x3e4]
setl al
mov dword [ebp - 0x28], eax
or dword [ebp - 4], 0xffffffff
call fcn.10013a48
xor esi, esi
mov dword [ebp - 0x34], 0x3c69aed2
inc esi
lea ecx, [ebp - 0xdf4]
push esi
call fcn.100139c6
push 2
pop edx
mov dword [ebp - 4], edx
mov eax, 0xfffb
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002aefc
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xdf4]
call fcn.10013a64
or dword [eax], 0xffffffff
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002aedb
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002af1c
push eax
push 0x2163
push 0x14d8
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
inc dword [ebp - 0x4c]
lea ecx, [ebp - 0xdf4]
or dword [ebp - 4], 0xffffffff
call fcn.10013a48
xor eax, eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002af4e
push 0x1d7e
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002af65
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_EndPage]
xor eax, eax
mov dword [ebp - 0x34], 0x8c6a53d0
lea ecx, [ebp - 0xef0]
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x34], eax
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x21dfe4b2
push 3
call fcn.100139c6
push 3
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x4c], 0x2250db85
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002afcd
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xef0]
call fcn.10013a64
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002afb1
xor eax, eax
dec dword [ebp - 0x4c]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002afed
push eax
push eax
push eax
push eax
push 0x1a1c
push esi
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xef0]
call fcn.10013a48
push esi
lea ecx, [ebp - 0x218]
call fcn.100139c6
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x1ce3cb5a
mov dword [ebp - 0x48], 0x1932e3ca
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002b04b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.10013a64
mov dword [eax], 0xb8f5
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002b02a
xor eax, eax
push eax
lea ecx, [ebp - 0x218]
call fcn.10013a64
xor eax, eax
lea ecx, [ebp - 0x218]
push eax
call fcn.10013a64
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x218]
xor eax, eax
push eax
call fcn.10013a64
xor eax, eax
lea ecx, [ebp - 0x218]
push eax
call fcn.10013a64
xor eax, eax
lea ecx, [ebp - 0x218]
push eax
call fcn.10013a64
xor eax, eax
lea ecx, [ebp - 0x218]
push eax
call fcn.10013a64
xor eax, eax
lea ecx, [ebp - 0x218]
push eax
call fcn.10013a64
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002b0c9
push dword [ebp - 0x24]
call fcn.10013a64
or dword [eax], 0xffffffff
inc dword [ebp - 0x24]
xor eax, eax
lea ecx, [ebp - 0x218]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002b0bb
or dword [ebp - 4], 0xffffffff
call fcn.10013a48
xor esi, esi
mov dword [ebp - 0x34], 0xda11525
inc esi
lea ecx, [ebp - 0xe0c]
push esi
call fcn.100139c6
push 5
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x18], 0x4f833fcb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002b12e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe0c]
call fcn.10013a64
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002b10d
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002b174
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x1c], eax
jmp 0x1002b16a
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002b167
push 0x26ad
push 0x2407
push 0x2103
push 0xb38
call dword [sym.imp.GDI32.dll_CreateRectRgn]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002b142
dec dword [ebp - 0x18]
jns 0x1002b136
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0c]
call fcn.10013a48
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0xab8]
push esi
call fcn.100139c6
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002b1d2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xab8]
call fcn.10013a64
mov dword [eax], 0xec2e
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002b1ae
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002b1ec
push 0x2430
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002b21d
mov dword [ebp - 0x18], 0x3d9532bb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002b21a
push dword [ebp - 0x24]
lea ecx, [ebp - 0xab8]
call fcn.10013a64
cmp dword [eax], 0
jne 0x1002b218
dec dword [ebp - 0x18]
jns 0x1002b200
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002b1f1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab8]
call fcn.10013a48
mov dword [ebp - 0x34], 0x3c69aed2
lea ecx, [ebp - 0xf9c]
push esi
call fcn.100139c6
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x20], 0xb036
mov dword [ebp - 0x30], 0x13717be9
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x4c], 0xae734f1
push 2
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002b285
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf6c], 0x697
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002b274
cmp dword [ebp - 0x20], 0x1f78
jle 0x1002b2cc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x20]
jg 0x1002b2b4
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002b2ad
cmp dword [ebp - 0x30], eax
je 0x1002b2af
mov eax, esi
add dword [ebp - 0x30], eax
je 0x1002b2bf
xor eax, eax
cmp eax, dword [ebp - 0x20]
je 0x1002b2cc
mov eax, esi
jmp 0x1002b2c1
xor eax, eax
cmp eax, dword [ebp - 0x20]
jle 0x1002b2cc
xor eax, eax
mov edx, eax
jmp 0x1002b2d4
xor eax, eax
xor esi, esi
inc esi
lea edx, [eax + 1]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
add ecx, 0xffff
imul ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
imul ecx, ecx, 0xfffd
sub ecx, dword [ebp - 0x20]
sub ecx, 0x397bde51
cmp ecx, 0xffffffff
setl al
cmp eax, dword [ebp - 0x30]
jne 0x1002b33a
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002b33c
mov eax, esi
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002b34b
cmp dword [ebp - 0x30], eax
je 0x1002b34d
mov eax, esi
xor ecx, ecx
cmp eax, 0xffffffff
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
neg ecx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xa9025b0d
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0xf6c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xfffb
setle cl
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x2c], 0xcd9d7
mov dword [ebp - 0x28], 0x42573927
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002b3e1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x350], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002b3c8
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002b3f7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1288], 0xe31bb000
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002b3e6
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x348], 8
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x348]
mov eax, dword [ebp - 0x348]
add ecx, eax
mov eax, dword [ebp - 0x350]
add eax, ecx
mov ecx, dword [ebp - 0x350]
imul ecx, eax
mov eax, dword [ebp - 0x24]
imul eax, ecx
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x348], eax
je 0x1002b453
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], 0xffff6eb0
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002b45f
cmp dword [ebp - 0x34c], eax
jne 0x1002b45f
mov ecx, eax
jmp 0x1002b467
xor eax, eax
xor esi, esi
inc esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
sete dl
xor ecx, ecx
mov dword [ebp - 0x1284], edx
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x344]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x344]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x348]
setne cl
sub ecx, eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2c], eax
jl 0x1002b4de
mov dword [ebp - 0x2c], 7
cmp dword [ebp - 0x2c], 6
jl 0x1002b55b
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002b4d3
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
xor eax, eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 6
jge 0x1002b4c1
jmp 0x1002b55b
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002b503
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa78], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002b4eb
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002b529
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x75c], 0xffffffff
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1002b50b
xor esi, esi
xor eax, eax
inc esi
cmp dword [ebp - 0x344], eax
je 0x1002b54f
mov eax, dword [ebp - 0xa78]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0xa78]
jne 0x1002b54d
mov eax, esi
jmp 0x1002b54f
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x75c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002b576
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf9c]
call fcn.10013a64
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002b562
mov dword [ebp - 0x10], 0x8d327cb3
mov dword [ebp - 0x24], 0xdb505206
mov dword [ebp - 0x4c], 0xf6f49c23
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002b6dd
movdqa xmm0, xmmword [0x10007ef0]
lea eax, [ebp - 0x1108]
push eax
lea eax, [ebp - 0x1118]
push eax
lea ecx, [ebp - 0x136c]
movdqu xmmword [ebp - 0x1118], xmm0
call fcn.10013a73
lea ecx, [ebp - 0x1b9]
mov esi, eax
call fcn.10008d63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x948]
push dword [esi]
call fcn.10013a22
xor esi, esi
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x948]
inc esi
mov dword [ebp - 0x24], eax
push esi
call fcn.10013a64
xor ebx, ebx
lea ecx, [ebp - 0x948]
push esi
cmp dword [eax], esi
setne bl
call fcn.10013a64
mov esi, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov edi, eax
mov eax, dword [ebp - 0x24]
imul esi, ebx
cmp ecx, esi
setne dl
cmp edx, 0xffff
sbb ecx, ecx
neg ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10]
cmp eax, 8
sbb eax, eax
neg eax
mov dword [edi], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002b6be
xor eax, eax
lea ecx, [ebp - 0xbf0]
inc eax
push eax
call fcn.100139c6
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x1c], eax
inc eax
cmp dword [ebp - 0x1c], eax
jge 0x1002b68c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbf0]
call fcn.10013a64
xor edx, edx
inc edx
mov dword [eax], edx
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002b66e
push eax
lea ecx, [ebp - 0x948]
call fcn.10013a64
mov esi, eax
lea ecx, [ebp - 0xbf0]
xor eax, eax
push eax
call fcn.10013a64
mov ecx, dword [esi]
mov byte [ebp - 4], 8
mov dword [eax], ecx
lea ecx, [ebp - 0xbf0]
call fcn.10013a48
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe
jge 0x1002b650
lea ecx, [ebp - 0x948]
call fcn.10013a48
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetDC]
jmp 0x1002b6f2
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002b6f2
push eax
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002b71e
push eax
push 0x2163
push 0x14d8
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
inc dword [ebp - 0x44]
lea ecx, [ebp - 0xf9c]
or dword [ebp - 4], 0xffffffff
call fcn.10013a48
mov dword [ebp - 0x3c], 0x1e87df2f
xor ecx, ecx
mov dword [ebp - 0x1c], 0x56890c54
inc ecx
mov dword [ebp - 0x54], ecx
xor eax, eax
mov dword [ebp - 0x28], 0x7d24b5e4
mov dword [ebp - 0x4c], 0xe360de57
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x44], 0x61e33ecd
push 2
pop edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x2c], 0x14ff6a91
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002b799
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd0], 0
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002b77e
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002b835
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002b802
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x4c]
jg 0x1002b7bd
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x24]
cmp ecx, eax
jg 0x1002b7d1
xor eax, eax
lea edx, [eax + 1]
jmp 0x1002b7d5
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
cmp ecx, 0x9e149cf
setge dl
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x4c]
imul edx, eax
mov eax, dword [ebp - 0xd0]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x44]
jge 0x1002b833
xor esi, esi
inc esi
mov eax, esi
jmp 0x1002b838
xor eax, eax
xor esi, esi
inc esi
mov dword [ebp - 0x54], eax
xor eax, eax
dec dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002b85e
push 0x1d7e
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002b875
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_EndPage]
xor eax, eax
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x4c], 0xfff6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002b8a5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14c4], 0xc64a6847
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002b88c
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002b8c3
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002b8c0
push 0x47e
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1002b8aa
inc dword [ebp - 0x4c]
push 0xfffffffffffffffa
mov dword [ebp - 0x1c], 0xcea5d6c0
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0xfffffffd
cmp dword [ebp - 0x1c], eax
jl 0x1002b909
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002b904
push eax
push 0x63
push 0x7f7
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
inc dword [ebp - 0x1c]
jns 0x1002b8e5
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xad0]
mov dword [ebp - 0x28], eax
push esi
call fcn.100139c6
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002b954
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xad0]
call fcn.10013a64
mov dword [eax], 0xec2e
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002b933
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002b96e
push 0x2430
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002b99f
mov dword [ebp - 0x18], 0x3d9532bb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002b99c
push dword [ebp - 0x24]
lea ecx, [ebp - 0xad0]
call fcn.10013a64
cmp dword [eax], 0
jne 0x1002b99a
dec dword [ebp - 0x18]
jns 0x1002b982
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002b973
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad0]
call fcn.10013a48
push 2
pop esi
mov dword [ebp - 0x20], 0x3f0b
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x1c], 0x7ecc2443
mov dword [ebp - 0x10], 0xdcd16652
push esi
call fcn.100139c6
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0x36c745d0
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x1c], eax
jmp 0x1002ba07
push dword [ebp - 0x1c]
call fcn.10013a64
mov dword [eax], 0xbdbdf7cd
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x450]
cmp dword [ebp - 0x1c], esi
jl 0x1002b9f6
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
xor eax, eax
mov esi, dword [ebp - 0x10]
push eax
call fcn.10013a64
lea ecx, [ebp - 0x450]
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.10013a64
xor eax, eax
lea ecx, [ebp - 0x450]
inc eax
push eax
call fcn.10013a64
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x450]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.10013a64
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x450]
imul esi, dword [eax]
xor eax, eax
inc eax
push eax
call fcn.10013a64
mov dword [eax], esi
test esi, esi
jne 0x1002ba94
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002ba94
mov edx, eax
jmp 0x1002ba99
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x10]
jle 0x1002baab
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor esi, esi
mov dword [ebp - 0x10], eax
inc esi
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x10]
test eax, eax
je 0x1002bad4
push esi
lea ecx, [ebp - 0x450]
call fcn.10013a64
cmp dword [eax], 0
je 0x1002bad4
mov edx, esi
jmp 0x1002bad8
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002bb0c
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x1002bb0e
mov edx, esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x2c21
lea ecx, [ebp - 0x450]
setl al
mov dword [ebp - 0x28], eax
or dword [ebp - 4], 0xffffffff
call fcn.10013a48
mov dword [ebp - 0x34], 0xda11525
xor eax, eax
mov dword [ebp - 0x20], 0xb036
mov dword [ebp - 0x30], 0x13717be9
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x4c], 0xae734f1
push 2
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002bb76
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd64], 0x697
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002bb65
cmp dword [ebp - 0x20], 0x1f78
jle 0x1002bbbd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x20]
jg 0x1002bba5
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002bb9e
cmp dword [ebp - 0x30], eax
je 0x1002bba0
mov eax, esi
add dword [ebp - 0x30], eax
je 0x1002bbb0
xor eax, eax
cmp eax, dword [ebp - 0x20]
je 0x1002bbbd
mov eax, esi
jmp 0x1002bbb2
xor eax, eax
cmp eax, dword [ebp - 0x20]
jle 0x1002bbbd
xor eax, eax
mov edx, eax
jmp 0x1002bbbf
mov edx, esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
add ecx, 0xffff
imul ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
imul ecx, ecx, 0xfffd
sub ecx, dword [ebp - 0x20]
sub ecx, 0x397bde51
cmp ecx, 0xffffffff
setl al
cmp eax, dword [ebp - 0x30]
jne 0x1002bc25
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002bc27
mov eax, esi
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002bc36
cmp dword [ebp - 0x30], eax
je 0x1002bc38
mov eax, esi
xor ecx, ecx
cmp eax, 0xffffffff
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
neg ecx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xa9025b0d
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0xd64]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x2c], 0xcd9d7
mov dword [ebp - 0x28], 0x42573927
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002bccb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x370], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002bcb2
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002bce1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12b8], 0xe31bb000
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002bcd0
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x368], 8
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x368]
mov eax, dword [ebp - 0x368]
add ecx, eax
mov eax, dword [ebp - 0x370]
add eax, ecx
mov ecx, dword [ebp - 0x370]
imul ecx, eax
mov eax, dword [ebp - 0x24]
imul eax, ecx
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x368], eax
je 0x1002bd3d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], 0xffff6eb0
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002bd47
mov ecx, eax
cmp dword [ebp - 0x36c], eax
je 0x1002bd49
mov ecx, esi
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
sete dl
xor ecx, ecx
mov dword [ebp - 0x12b4], edx
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x364]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x364]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x368]
setne cl
sub ecx, eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2c], eax
jl 0x1002bdc0
mov dword [ebp - 0x2c], 7
cmp dword [ebp - 0x2c], 6
jl 0x1002be37
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002bdb5
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
xor eax, eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 6
jge 0x1002bda3
jmp 0x1002be37
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002bde5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9d0], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002bdcd
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002be05
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x788], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002bded
xor eax, eax
cmp dword [ebp - 0x364], eax
je 0x1002be2b
mov eax, dword [ebp - 0x9d0]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x9d0]
jne 0x1002be29
mov eax, esi
jmp 0x1002be2b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x788], eax
mov dword [ebp - 0x34], 0x3c69aed2
mov dword [ebp - 0x10], 0x8d327cb3
mov dword [ebp - 0x24], 0xdb505206
mov dword [ebp - 0x4c], 0xf6f49c23
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002bf92
movdqa xmm0, xmmword [0x10007ef0]
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1018]
push eax
lea ecx, [ebp - 0x142c]
movdqu xmmword [ebp - 0x1018], xmm0
call fcn.10013a73
lea ecx, [ebp - 0x20b]
mov esi, eax
call fcn.10008d63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x960]
push dword [esi]
call fcn.10013a22
xor esi, esi
mov dword [ebp - 4], 0xc
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x960]
inc esi
mov dword [ebp - 0x24], eax
push esi
call fcn.10013a64
xor ebx, ebx
lea ecx, [ebp - 0x960]
push esi
cmp dword [eax], esi
setne bl
call fcn.10013a64
mov esi, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov edi, eax
mov eax, dword [ebp - 0x24]
imul esi, ebx
cmp ecx, esi
setne dl
cmp edx, 0xffff
sbb ecx, ecx
neg ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10]
cmp eax, 8
sbb eax, eax
neg eax
mov dword [edi], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xe
jl 0x1002bf81
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0xca4]
call fcn.100139c6
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x1c], eax
jmp 0x1002bf44
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xca4]
call fcn.10013a64
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002bf31
push ebx
lea ecx, [ebp - 0x960]
call fcn.10013a64
mov esi, eax
lea ecx, [ebp - 0xca4]
xor eax, eax
push eax
call fcn.10013a64
mov ecx, dword [esi]
mov byte [ebp - 4], 0xc
mov dword [eax], ecx
lea ecx, [ebp - 0xca4]
call fcn.10013a48
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe
jge 0x1002bf1a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x960]
call fcn.10013a48
jmp 0x1002bfa7
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002bfa7
push eax
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0x4c]
xor edi, edi
mov ecx, dword [ebp - 0x24]
inc edi
sub ecx, eax
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xe24]
push edi
call fcn.100139c6
mov dword [ebp - 4], 0xe
mov eax, 0xfffb
mov dword [ebp - 0x44], eax
push 0xfffffffffffffffa
mov dword [ebp - 0x1c], 0xcea5d6c0
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffd
cmp dword [ebp - 0x1c], eax
jl 0x1002c017
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002c012
push eax
push 0x63
push 0x7f7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
inc dword [ebp - 0x1c]
jns 0x1002bfeb
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x3fc]
push 2
mov dword [ebp - 0x28], eax
pop ebx
mov dword [ebp - 0x20], 0x3f0b
mov dword [ebp - 0x1c], 0x7ecc2443
mov dword [ebp - 0x10], 0xdcd16652
push ebx
call fcn.100139c6
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0x36c745d0
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x1c], eax
jmp 0x1002c06e
push dword [ebp - 0x1c]
call fcn.10013a64
mov dword [eax], 0xbdbdf7cd
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x3fc]
cmp dword [ebp - 0x1c], ebx
jl 0x1002c05d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
xor eax, eax
mov esi, dword [ebp - 0x10]
push eax
call fcn.10013a64
lea ecx, [ebp - 0x3fc]
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.10013a64
push edi
lea ecx, [ebp - 0x3fc]
call fcn.10013a64
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3fc]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.10013a64
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x3fc]
push edi
imul esi, dword [eax]
call fcn.10013a64
mov dword [eax], esi
test esi, esi
jne 0x1002c0f3
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x1002c0f5
mov edx, edi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x10]
jle 0x1002c107
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x10]
test eax, eax
je 0x1002c12d
push edi
lea ecx, [ebp - 0x3fc]
call fcn.10013a64
cmp dword [eax], 0
je 0x1002c12d
mov edx, edi
jmp 0x1002c131
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002c165
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x1002c167
mov edx, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x2c21
lea ecx, [ebp - 0x3fc]
setl al
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xe
call fcn.10013a48
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002c1b3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe24]
call fcn.10013a64
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002c198
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x4c], 0xe5034859
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002c1e1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x98], 0x4ec2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002c1c9
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002c1fd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf88], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002c1e9
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002c2b5
xor ebx, ebx
lea eax, [ebp - 0x1208]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x1218]
push eax
lea ecx, [ebp - 0x137c]
movdqu xmmword [ebp - 0x1218], xmm0
call fcn.10013a73
lea ecx, [ebp - 0x1e9]
mov esi, eax
call fcn.10008d63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x708]
push dword [esi]
call fcn.10013a22
push edi
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 0x10
call fcn.10013a64
push edi
lea ecx, [ebp - 0x708]
mov dword [eax], ebx
call fcn.10013a64
jmp 0x1002c299
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002c27d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
lea ecx, [ebp - 0x708]
call fcn.10013a64
push edi
lea ecx, [ebp - 0x708]
dec dword [eax]
call fcn.10013a64
xor ebx, ebx
cmp dword [eax], ebx
jge 0x1002c26d
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 0xe
call fcn.10013a48
dec dword [ebp - 0x24]
jns 0x1002c20b
mov dword [ebp - 0x24], 0xffff
mov ecx, edi
mov eax, dword [ebp - 0x98]
xorps xmm0, xmm0
sub ecx, eax
mov eax, dword [ebp - 0x98]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, eax
mov eax, dword [ebp - 0x98]
cmp ecx, eax
mov eax, dword [ebp - 0x98]
sete dl
xor ecx, ecx
cmp edx, edi
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x98]
setge dl
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x98]
setge cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x13dc]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xf88], eax
xor eax, eax
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x1038]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], 0xf5047c4d
push eax
movdqu xmmword [ebp - 0x1038], xmm0
call fcn.10013a73
lea ecx, [ebp - 0x196]
mov esi, eax
call fcn.10008d63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x2f0]
push dword [esi]
call fcn.10013a22
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x1c], 0xffffffff
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
imul esi, dword [ebp - 0x20], 0x75cb
mov eax, 0xfffb
push 3
sub esi, eax
neg esi
sbb esi, esi
inc esi
call fcn.10013a64
mov dword [eax], esi
xor eax, eax
cmp esi, dword [ebp - 0x10]
jle 0x1002c3e9
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], eax
jmp 0x1002c3cf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x140c], 0x6eab3cf8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002c3be
mov eax, dword [ebp - 0x1400]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
jmp 0x1002c548
mov dword [ebp - 0x18], 0xbc698dc5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1c
jne 0x1002c54a
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
jmp 0x1002c416
push dword [ebp - 0x10]
call fcn.10013a64
mov dword [eax], 0xb7d6b592
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0x2f0]
jl 0x1002c405
push 3
call fcn.10013a64
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [eax]
cmp dword [ebp - 0x18], ecx
jl 0x1002c437
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x2f0]
push 3
call fcn.10013a64
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
push 3
cmp dword [eax], ecx
lea ecx, [ebp - 0x2f0]
sete bl
call fcn.10013a64
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
xor eax, eax
cmp ebx, 0xd050b7f4
setne al
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
je 0x1002c520
xor eax, eax
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002c4c2
push 0x4d3
push eax
push eax
push 0x738
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x2f0]
mov eax, dword [ebp - 0x3c]
push edi
call fcn.10013a64
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x2f0]
mov esi, dword [ebp - 0x18]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.10013a64
mov dword [eax], esi
mov eax, 0x96fb6c71
cmp eax, esi
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, dword [ebp - 0x28]
jle 0x1002c51b
cmp dword [ebp - 0x3c], eax
je 0x1002c51b
mov eax, edi
mov dword [ebp - 0x1c], eax
jmp 0x1002c538
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002c538
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1c
push 0
pop eax
je 0x1002c3fd
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002c560
push dword [ebp - 0x24]
call fcn.10013a64
mov dword [eax], 0xf9c85207
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
lea ecx, [ebp - 0x2f0]
jl 0x1002c54f
call fcn.10013a48
cmp byte [ebp - 0x11], 0
je 0x1002c6ff
mov dword [ebp - 0x10], 0xfffffffc
xor eax, eax
mov dword [ebp - 0x20], 0xf98a59c1
mov dword [ebp - 0x3c], 0xffffffff
push 2
mov dword [ebp - 0x4c], 0xa043
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002c5b2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf8], 0xc07e17f7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c5a1
mov eax, dword [ebp - 0x10]
xor esi, esi
mov dword [ebp - 0x10], eax
inc esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002c6da
mov dword [ebp - 0x18], 0xc2a41b87
mov dword [ebp - 0x10], eax
jmp 0x1002c62c
mov dword [ebp - 0x24], 0xc79e672c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x1002c629
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002c60f
push 0x5ff
push 0x711
push eax
push eax
push 0x173c
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xf8], 0
jne 0x1002c627
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], esi
jle 0x1002c5ef
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1002c5e0
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xf8]
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, esi
jg 0x1002c662
cmp dword [ebp - 0x3c], eax
je 0x1002c662
mov eax, esi
cmp eax, dword [ebp - 0x20]
jge 0x1002c66a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf8]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
push 0
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xf8]
cmp eax, 0x684a08de
setg cl
sub ecx, dword [ebp - 0x4c]
cmp ecx, 0xc15d0d65
sbb eax, eax
neg eax
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x20]
pop eax
jns 0x1002c5d4
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x2163
push 0x14d8
call ebx
mov edi, dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
jmp 0x1002c70e
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor esi, esi
mov edi, dword [sym.imp.USER32.dll_GetDC]
inc esi
inc dword [ebp - 0x44]
lea ecx, [ebp - 0xe24]
or dword [ebp - 4], 0xffffffff
call fcn.10013a48
push 2
pop edx
push edx
lea ecx, [ebp - 0x978]
call fcn.100139c6
xor eax, eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x24], eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002c76c
push ecx
pop esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x978]
call fcn.10013a64
mov dword [eax], 0x204e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002c748
xor esi, esi
xor eax, eax
push 2
inc esi
pop ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x1002c8e4
jmp 0x1002c77d
push 2
pop ecx
push ecx
lea ecx, [ebp - 0x604]
call fcn.100139c6
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x28], 9
push 2
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x1002c7c2
push edx
pop esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x604]
call fcn.10013a64
mov dword [eax], 0x29bf39
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002c7a3
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x604]
call fcn.10013a64
and dword [eax], 0
jmp 0x1002c8b3
mov dword [ebp - 0x3c], 0x9576c3a0
lea ecx, [ebp - 0xae8]
push esi
call fcn.100139c6
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002c815
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xae8]
call fcn.10013a64
mov dword [eax], 0x52f34111
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002c7f7
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002c891
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1002c887
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x1002c882
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1002c87d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x978]
call fcn.10013a64
push dword [ebp - 0x24]
lea ecx, [ebp - 0x978]
mov esi, eax
call fcn.10013a64
mov ecx, dword [eax]
xor eax, eax
mov dword [esi], ecx
lea ecx, [ebp - 0xae8]
push eax
call fcn.10013a64
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x18]
jns 0x1002c83f
xor esi, esi
xor eax, eax
inc esi
dec dword [ebp - 0x2c]
jns 0x1002c834
dec dword [ebp - 0x1c]
jns 0x1002c829
mov dword [ebp - 0x28], 0xffffffff
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jle 0x1002c81a
lea ecx, [ebp - 0xae8]
mov byte [ebp - 4], 0x13
call fcn.10013a48
push esi
lea ecx, [ebp - 0x604]
call fcn.10013a64
inc dword [eax]
push esi
lea ecx, [ebp - 0x604]
call fcn.10013a64
cmp dword [eax], esi
jle 0x1002c7d6
lea ecx, [ebp - 0x604]
mov byte [ebp - 4], 0x12
call fcn.10013a48
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1002c77a
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002c8f9
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_EndPage]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x978]
call fcn.10013a48
mov dword [ebp - 0x3c], 0x1e87df2f
mov dword [ebp - 0x1c], 0x56890c54
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x28], 0x7d24b5e4
mov dword [ebp - 0x4c], 0xe360de57
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x44], 0x61e33ecd
push 2
pop eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x14ff6a91
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002c96b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x114], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002c953
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002ca01
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002c9d1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x4c]
jg 0x1002c98f
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x24]
cmp ecx, eax
jg 0x1002c9a0
mov edx, esi
jmp 0x1002c9a4
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
cmp ecx, 0x9e149cf
setge dl
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x114]
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x4c]
imul edx, eax
mov eax, dword [ebp - 0x114]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x44]
jge 0x1002c9ff
mov eax, esi
jmp 0x1002ca01
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
dec dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002ca27
push 0x1d7e
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002ca3e
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_EndPage]
xor eax, eax
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x4c], 0xfff6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002ca6e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14e4], 0xc64a6847
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002ca55
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002ca8c
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002ca89
push 0x47e
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1002ca73
inc dword [ebp - 0x4c]
lea ecx, [ebp - 0x990]
push 2
pop eax
push eax
call fcn.100139c6
xor eax, eax
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x24], eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002cae1
push ecx
pop esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x990]
call fcn.10013a64
mov dword [eax], 0x204e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002cabd
xor esi, esi
xor eax, eax
push 2
inc esi
pop ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x1002cc57
push ecx
lea ecx, [ebp - 0x688]
call fcn.100139c6
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x1c], eax
push 2
pop eax
cmp dword [ebp - 0x1c], eax
jge 0x1002cb32
push eax
pop esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x688]
call fcn.10013a64
mov dword [eax], 0x29bf39
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002cb13
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x688]
call fcn.10013a64
and dword [eax], 0
jmp 0x1002cc23
mov dword [ebp - 0x3c], 0x9576c3a0
lea ecx, [ebp - 0xc08]
push esi
call fcn.100139c6
xor eax, eax
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002cb85
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc08]
call fcn.10013a64
mov dword [eax], 0x52f34111
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002cb67
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002cc01
cmp dword [ebp - 0x3c], esi
jle 0x1002cb8a
push esi
lea ecx, [ebp - 0x688]
call fcn.10013a64
cmp dword [eax], esi
jle 0x1002cb46
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0x15
call fcn.10013a48
inc dword [ebp - 0x24]
push 2
pop ecx
cmp dword [ebp - 0x24], esi
jle 0x1002caed
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002cc6c
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_EndPage]
or ebx, 0xffffffff
lea ecx, [ebp - 0x990]
mov dword [ebp - 4], ebx
call fcn.10013a48
mov dword [ebp - 0x3c], 0x1e87df2f
xor eax, eax
mov dword [ebp - 0x1c], 0x56890c54
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x28], 0x7d24b5e4
mov dword [ebp - 0x4c], 0xe360de57
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x44], 0x61e33ecd
push 2
pop edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x14ff6a91
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002ccdc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe0], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002ccc4
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002cd72
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002cd42
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x4c]
jg 0x1002cd00
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x24]
cmp eax, ecx
jg 0x1002cd11
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xe0]
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x4c]
imul edx, eax
mov eax, dword [ebp - 0xe0]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x44]
jge 0x1002cd70
mov eax, esi
jmp 0x1002cd72
xor eax, eax
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0xf08]
dec dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x46721591
mov dword [ebp - 0x34], 0x9ea41449
mov dword [ebp - 0x34], 0xb04800fa
mov dword [ebp - 0x34], 0xcc58a012
mov dword [ebp - 0x34], 0x91df82d8
mov dword [ebp - 0x34], 0x89226c31
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x34], 0x33037736
mov dword [ebp - 0x34], 0x2fd2d1a4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x6478c38e
mov dword [ebp - 0x34], 0x4be76d23
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xd8ef068c
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x76a47cde
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x34], 0x9fa553fc
mov dword [ebp - 0x34], 0xb333ee6
mov dword [ebp - 0x34], 0x3f6a0837
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x200279e5
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x34], 0x68993dd6
mov dword [ebp - 0x34], ebx
push esi
call fcn.100139c6
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x1c], eax
jmp 0x1002ce64
push dword [ebp - 0x1c]
call fcn.10013a64
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0xf08]
cmp dword [ebp - 0x1c], esi
jl 0x1002ce53
inc dword [ebp - 0x4c]
mov dword [ebp - 0x28], 0xa9961215
mov dword [ebp - 4], ebx
call fcn.10013a48
push 3
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x9a8]
pop ebx
push ebx
call fcn.100139c6
xor eax, eax
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002cec2