Function at 0x1002b413
Capabilities:
Compare security identifiers
Create pipe
Create thread
Delete file
Delete registry key
Delete registry value
Enumerate files on windows
Get session user name
Get thread local storage value
Parse pe header
Terminate process

Disassembly:
mov eax, 0x1008be37
call fcn.1008a868
mov eax, 0x197c
call fcn.100736f0
mov dword [ebp - 0x2c], 0x743d837b
xor eax, eax
push ebx
mov dword [ebp - 0x3c], 0xca2961c0
push esi
mov dword [ebp - 0x3c], 0x7b5ca98
mov dword [ebp - 0x3c], 7
push edi
mov dword [ebp - 0x3c], 0xfa147b80
mov dword [ebp - 0x3c], 0x43b8a277
push 3
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x24], eax
pop ecx
mov byte [ebp - 0x75], dl
cmp dword [ebp - 0x24], ecx
jge 0x1002b47f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1838], 0x20624039
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002b467
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop edx
cmp dword [ebp - 0x24], edx
jge 0x1002b4a2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1678], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002b48a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002b4c2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe04], 0xee0cd979
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002b4aa
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jl 0x1002b546
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x3c], 0x60ec01e6
mov dword [ebp - 0x3c], 0x3aeb5900
mov dword [ebp - 0x3c], 0xb060d2f3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002b50e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x18b4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002b4f5
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b53b
push eax
push 0x1463
push 0x16c5
push 0x24c5
push 0x16a1
push 0xf27
push 0xf98
push eax
call esi
xor eax, eax
dec dword [ebp - 0xe00]
dec dword [ebp - 0x2c]
jns 0x1002b4d0
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b570
push eax
push 0x12f1
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
mov dword [ebp - 0x2c], 0x743d837b
mov dword [ebp - 0x3c], 0xca2961c0
mov dword [ebp - 0x3c], 0x7b5ca98
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x3c], 0xfa147b80
mov dword [ebp - 0x3c], 0x43b8a277
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002b5bd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1820], 0x20624039
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002b5a5
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop edx
cmp dword [ebp - 0x24], edx
jge 0x1002b5e0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1798], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002b5c8
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002b600
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1168], 0xee0cd979
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002b5e8
xor eax, eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jl 0x1002b67e
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x3c], 0x60ec01e6
mov dword [ebp - 0x3c], 0x3aeb5900
mov dword [ebp - 0x3c], 0xb060d2f3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002b646
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x18d4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002b62d
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b673
push eax
push 0x1463
push 0x16c5
push 0x24c5
push 0x16a1
push 0xf27
push 0xf98
push eax
call esi
xor eax, eax
dec dword [ebp - 0x1164]
dec dword [ebp - 0x2c]
jns 0x1002b608
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b69c
push eax
push 0x12f1
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
mov dword [ebp - 0x2c], 0x743d837b
mov dword [ebp - 0x3c], 0xca2961c0
mov dword [ebp - 0x3c], 0x7b5ca98
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x3c], 0xfa147b80
mov dword [ebp - 0x3c], 0x43b8a277
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002b6e9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1868], 0x20624039
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002b6d1
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop edx
cmp dword [ebp - 0x24], edx
jge 0x1002b70c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1728], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002b6f4
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002b72c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe1c], 0xee0cd979
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002b714
xor eax, eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jl 0x1002b7aa
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x3c], 0x60ec01e6
mov dword [ebp - 0x3c], 0x3aeb5900
mov dword [ebp - 0x3c], 0xb060d2f3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002b772
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1934], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002b759
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b79f
push eax
push 0x1463
push 0x16c5
push 0x24c5
push 0x16a1
push 0xf27
push 0xf98
push eax
call esi
xor eax, eax
dec dword [ebp - 0xe18]
dec dword [ebp - 0x2c]
jns 0x1002b734
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b7c8
push eax
push 0x12f1
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
mov dword [ebp - 0x28], 0xdd1e1e87
mov ecx, 0xffff
mov dword [ebp - 0x3c], 0xe856
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002b7f9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x348], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002b7e4
xor eax, eax
push 1
mov dword [ebp - 0x28], eax
pop ecx
jmp 0x1002b920
mov dword [ebp - 0x1c], 0xa9ef72d4
mov dword [ebp - 0x44], 0x35900b08
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002b91d
mov dword [ebp - 0x10], 0xfffffffd
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x348]
cmp eax, dword [ebp - 0x1c]
jge 0x1002b8d8
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x348], 0
jne 0x1002b8c6
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x348]
cmp eax, 0x5537
setge cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x348]
cmp eax, ecx
mov eax, dword [ebp - 0x340]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 9
jle 0x1002b8a0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x348]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x348]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x344]
mov eax, dword [ebp - 0x34]
xor esi, esi
xor ecx, ecx
inc esi
cmp eax, esi
setge cl
mov dword [ebp - 0x44], ecx
jmp 0x1002b90b
mov dword [ebp - 0x40], 0x12d49381
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002b8ed
mov edx, ecx
cmp dword [ebp - 0x44], eax
jne 0x1002b8ef
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
push 1
pop ecx
jle 0x1002b81f
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1002b804
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x1698]
mov dword [ebp - 0x28], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x11d0]
push eax
lea eax, [ebp - 0x11e0]
push eax
movdqu xmmword [ebp - 0x11e0], xmm0
call fcn.10019ea9
lea ecx, [ebp - 0x175]
mov esi, eax
call fcn.1000aa23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe34]
push dword [esi]
call fcn.10019e6f
push 3
xor eax, eax
lea ecx, [ebp - 0xfe8]
pop esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x8094a188
push esi
call fcn.10019e2d
xor eax, eax
inc eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002b9bb
push dword [ebp - 0x10]
lea ecx, [ebp - 0xfe8]
call fcn.10019e9a
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002b99d
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002b9db
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe34]
call fcn.10019e9a
cmp dword [eax], 0
jne 0x1002b9db
dec dword [ebp - 0x10]
jns 0x1002b9c3
lea ecx, [ebp - 0xfe8]
call fcn.10019e95
or eax, 0xffffffff
lea ecx, [ebp - 0xe34]
mov dword [ebp - 4], eax
call fcn.10019e95
xor eax, eax
mov dword [ebp - 0x20], 0xa48bbca6
mov dword [ebp - 0x20], eax
jmp 0x1002ba6c
mov dword [ebp - 0x2c], 0xb0647dc4
mov dword [ebp - 0x3c], 0x50707dfe
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x2c], 0xffffffee
jmp 0x1002ba63
mov dword [ebp - 0x10], 0xfaaaeb9a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002ba4c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1778], 0xd9e2a8d3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002ba33
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002ba5a
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x40]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffed
jle 0x1002ba51
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x18
jne 0x1002ba23
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff7
je 0x1002ba05
push 0xfffffffffffffff9
mov dword [ebp - 0x20], 0xfffffffb
pop ecx
jmp 0x1002ba9c
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002ba99
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
push 0xfffffffffffffff9
xor eax, eax
pop ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jg 0x1002ba7e
mov dword [ebp - 0x914], ecx
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0x90c], ecx
mov dword [ebp - 0x908], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], 0x1f90ef30
mov dword [ebp - 0x38], 0xd1d25bb0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002baea
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x17cc], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002bad5
jmp 0x1002baed
xor esi, esi
inc esi
dec dword [ebp - 0x908]
mov dword [ebp - 0x2c], 0x1c
jmp 0x1002bbac
push 4
lea ecx, [ebp - 0x494]
call fcn.10019e2d
xor eax, eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], eax
jmp 0x1002bb2e
push dword [ebp - 0x10]
call fcn.10019e9a
mov dword [eax], 0x8e17b844
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0x494]
jl 0x1002bb1d
push 3
call fcn.10019e9a
mov ecx, dword [ebp - 0x38]
xor edx, edx
inc dword [eax]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x908]
setg dl
xor ecx, ecx
sub eax, 0x7fa3dfad
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x494]
push eax
call fcn.10019e9a
push 3
lea ecx, [ebp - 0x494]
call fcn.10019e9a
xor eax, eax
lea ecx, [ebp - 0x494]
push eax
call fcn.10019e9a
xor ecx, ecx
cmp dword [eax], esi
sete cl
or eax, 0xffffffff
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x494]
mov dword [ebp - 4], eax
call fcn.10019e95
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe3
jle 0x1002baff
xor eax, eax
mov dword [ebp - 0x48], 0x743d837b
inc eax
mov dword [ebp - 0x1c], 0x4a12b57e
mov dword [ebp - 0x34], 0x6de6eab3
lea ecx, [ebp - 0x644]
push eax
call fcn.10019e2d
mov dword [ebp - 4], 3
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x58], 5
mov dword [ebp - 0x18], eax
inc ecx
push 0xfffffffffffffffa
pop edx
cmp dword [ebp - 0x18], ecx
jge 0x1002bc09
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x64], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002bbf8
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002bc2e
push dword [ebp - 0x18]
lea ecx, [ebp - 0x644]
call fcn.10019e9a
xor ecx, ecx
inc ecx
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002bc11
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002bd5c
or eax, 0xffffffff
mov dword [ebp - 0x38], 0x5e97312b
mov dword [ebp - 0x40], eax
xor ecx, ecx
mov dword [ebp - 0x40], 0x6d56a426
mov dword [ebp - 0x4c], 0xe8f88485
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x64]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x64]
test eax, eax
setne cl
xor edx, edx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x40]
dec eax
cmp ecx, eax
mov eax, dword [ebp - 0x64]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x644]
mov esi, dword [ebp - 0x40]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.10019e9a
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x64]
cmp ecx, esi
setne dl
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
inc ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x64]
sub ecx, eax
mov edx, dword [ebp - 0x64]
xor eax, eax
cmp ecx, 0x8a8c
setne al
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x64]
cmp edx, eax
setl cl
sub ecx, 0x6c14
je 0x1002bd05
xor eax, eax
lea ecx, [ebp - 0x644]
push eax
call fcn.10019e9a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x644]
mov eax, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.10019e9a
cmp dword [eax], 0
jne 0x1002bd2c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x64]
mov ecx, dword [ebp - 0x58]
sub ecx, eax
mov eax, 0xfff7
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub dword [ebp - 0x4c], eax
dec dword [ebp - 0x1c]
jns 0x1002bc3a
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002bd7c
push eax
push 0x26c7
push 0x498
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
or eax, 0xffffffff
lea ecx, [ebp - 0x644]
mov dword [ebp - 4], eax
call fcn.10019e95
movdqa xmm0, xmmword [0x100096e0]
lea eax, [ebp - 0x1310]
push eax
mov dword [ebp - 0x3c], 0xca2961c0
lea eax, [ebp - 0x1320]
mov dword [ebp - 0x3c], 0xfffffffe
lea ecx, [ebp - 0x16a8]
mov dword [ebp - 0x10], 0xa32b1cec
mov dword [ebp - 0x28], 0xd149febb
push eax
movdqu xmmword [ebp - 0x1320], xmm0
call fcn.10019ea9
lea ecx, [ebp - 0x17b]
mov esi, eax
call fcn.1000aa23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xbc8]
push dword [esi]
call fcn.10019e6f
mov dword [ebp - 4], 4
or ecx, 0xffffffff
mov dword [ebp - 0x2c], 0xb9dd952e
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x20], 0x42b48371
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], 0x3a34c865
dec dword [ebp - 0x40]
push 3
mov dword [ebp - 0x20], 7
pop esi
cmp dword [ebp - 0x20], 0x10
je 0x1002bfff
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jg 0x1002bff7
push esi
lea ecx, [ebp - 0x654]
call fcn.10019e2d
push 5
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffff7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002be7e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x654]
call fcn.10019e9a
mov dword [eax], 0xff609d70
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002be60
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x1002bfd7
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], 0x901516ea
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002beb7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x678], 0xb72b416c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002be9f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jg 0x1002bfcb
mov dword [ebp - 0x40], 0xf2bba2d3
lea ecx, [ebp - 0x654]
push eax
call fcn.10019e9a
or ecx, 0xffffffff
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1002bf07
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x30]
je 0x1002bf02
xor eax, eax
lea ecx, [ebp - 0x654]
push eax
call fcn.10019e9a
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
lea ecx, [ebp - 0x654]
call fcn.10019e9a
xor edx, edx
cmp dword [eax], 0xb65c
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xbc8]
push dword [ebp - 0x28]
call fcn.10019e9a
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp dword [eax], ecx
setne dl
xor eax, eax
mov dword [ebp - 0x678], edx
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x44], eax
jl 0x1002bfb9
mov ecx, 0xffff
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x4c], 0x5a47b6c4
cmp dword [ebp - 0x18], eax
jne 0x1002bf89
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0xbc8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x28]
call fcn.10019e9a
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x44], 0x9e96
jg 0x1002bf97
cmp dword [ebp - 0x18], eax
je 0x1002bf9a
xor eax, eax
inc eax
or ecx, 0xffffffff
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
push 0
setle dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x44]
jns 0x1002bf56
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], esi
jle 0x1002bec3
xor ecx, ecx
inc ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1002be8d
lea ecx, [ebp - 0x654]
mov byte [ebp - 4], 4
call fcn.10019e95
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1002be3d
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x20]
jmp 0x1002be24
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0xbc8]
call fcn.10019e95
mov dword [ebp - 0x3c], 0x7b5ca98
xor eax, eax
push 4
pop ecx
mov dword [ebp - 0xa20], ecx
inc eax
mov dword [ebp - 0xa1c], ecx
mov dword [ebp - 0xa18], ecx
mov dword [ebp - 0xa14], ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x38], 0xe71cc545
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002c05e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1178], 0xd62a04f7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c046
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002c0b0
mov dword [ebp - 0x10], 0x1738ab65
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002c08e
push eax
push 0x208
push 0x111b
push 0x18b6
call edi
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002c0ad
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002c0a8
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1002c096
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002c063
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1002c1c9
mov dword [ebp - 0x40], 0xfffffffc
lea ecx, [ebp - 0xbe0]
push esi
call fcn.10019e2d
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x38], 0x8f6a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002c104
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10d4], 0xfffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002c0ec
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c120
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbe0]
call fcn.10019e9a
mov dword [eax], 0x83acdd71
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002c109
mov ecx, dword [ebp - 0x10d0]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10d4]
mov dword [ebp - 0x1170], eax
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0xa1c], 0x2377d644
je 0x1002c165
cmp dword [ebp - 0x1170], eax
je 0x1002c165
lea esi, [eax + 1]
jmp 0x1002c167
mov esi, eax
push 2
lea ecx, [ebp - 0xbe0]
call fcn.10019e9a
xor ecx, ecx
cmp esi, dword [eax]
sete cl
cmp ecx, dword [ebp - 0x38]
jne 0x1002c18e
xor eax, eax
cmp dword [ebp - 0xa1c], eax
jne 0x1002c18e
mov ecx, eax
jmp 0x1002c193
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0x44d5
lea ecx, [ebp - 0xbe0]
setg al
mov dword [ebp - 0x38], eax
xor eax, eax
inc eax
mov dword [ebp - 0x1170], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10019e95
dec dword [ebp - 0x1c]
push 3
pop esi
jns 0x1002c0c1
xor eax, eax
mov dword [ebp - 0x3c], 7
xor ecx, ecx
mov dword [ebp - 0x18], 0x184dcc8
inc ecx
mov dword [ebp - 0x20], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 0xef9f3b06
mov dword [ebp - 0x10], eax
jmp 0x1002c200
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x324], 0x6335c0de
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002c1ef
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
mov ecx, 0xb2c41ac3
neg eax
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, eax
mov dword [ebp - 0x320], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
sete cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
test ecx, ecx
jne 0x1002c26e
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002c26e
mov edx, eax
jmp 0x1002c273
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], 0x10
je 0x1002c3b4
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002c2af
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x157c], 0xfffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002c297
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffec
jle 0x1002c3a7
xor eax, eax
lea ecx, [ebp - 0xbf8]
inc eax
mov dword [ebp - 0x1c], eax
push esi
call fcn.10019e2d
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x10], eax
jmp 0x1002c2f3
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbf8]
call fcn.10019e9a
mov dword [eax], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002c2dc
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x1c], eax
inc edx
mov dword [ebp - 0x1c], edx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x1002c387
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jg 0x1002c37f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x324], 0
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c370
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x324]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x324]
mov eax, dword [ebp - 0x18]
add ecx, dword [ebp + eax*4 - 0x324]
cmp ecx, edx
je 0x1002c356
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x157c], eax
je 0x1002c358
mov esi, edx
push 2
lea ecx, [ebp - 0xbf8]
call fcn.10019e9a
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x18]
inc edx
cmp dword [ebp - 0x18], edx
jle 0x1002c328
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x1002c313
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002c30b
push 3
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0xbf8]
mov dword [ebp - 4], eax
call fcn.10019e95
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffec
jg 0x1002c2bc
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x10
jne 0x1002c28f
mov dword [ebp - 0x3c], 0xfa147b80
lea ecx, [ebp - 0x170]
push 2
call fcn.10019e2d
mov dword [ebp - 4], 8
lea ecx, [ebp - 0xe4c]
mov dword [ebp - 0x40], 0xbe135e1f
mov dword [ebp - 0x30], 0x84e5a945
push esi
call fcn.10019e2d
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x3c], 0xc866
mov dword [ebp - 0x4c], 0x6f9a4d91
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002c41d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x358], 0xd7f825e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002c405
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002c445
push dword [ebp - 0x24]
lea ecx, [ebp - 0x170]
call fcn.10019e9a
mov dword [eax], 9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002c426
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002c46a
push dword [ebp - 0x24]
lea ecx, [ebp - 0xe4c]
call fcn.10019e9a
xor ecx, ecx
inc ecx
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002c44d
xor eax, eax
push eax
lea ecx, [ebp - 0x170]
call fcn.10019e9a
lea ecx, [ebp - 0x170]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10019e9a
cmp dword [eax], 2
jg 0x1002c5f3
push 2
pop esi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], 0xc62bb2c5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jg 0x1002c586
push eax
lea ecx, [ebp - 0x170]
call fcn.10019e9a
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x358], 0
jne 0x1002c584
xor eax, eax
lea ecx, [ebp - 0x170]
push eax
call fcn.10019e9a
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x358], 0
je 0x1002c51a
xor eax, eax
lea ecx, [ebp - 0x170]
push eax
call fcn.10019e9a
mov esi, eax
lea ecx, [ebp - 0x170]
xor eax, eax
push eax
call fcn.10019e9a
mov ecx, dword [eax]
mov ecx, dword [ebp + ecx*4 - 0x358]
mov eax, dword [esi]
cmp dword [ebp + eax*4 - 0x358], ecx
jg 0x1002c51a
xor eax, eax
lea esi, [eax + 1]
jmp 0x1002c51e
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x170]
call fcn.10019e9a
xor ecx, ecx
push 2
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x358]
cmp esi, eax
pop esi
sete cl
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], 0x4f3d4e6
mov eax, dword [ebp - 0x350]
imul eax, dword [ebp - 0x18]
push 0
cmp eax, 0xf0f5
mov eax, dword [ebp - 0x40]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp eax, edx
pop eax
setne cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1002c4ab
xor eax, eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1002c5cc
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], eax
jl 0x1002c5aa
dec dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x358]
dec dword [ebp - 0x30]
jns 0x1002c596
xor eax, eax
push eax
lea ecx, [ebp - 0x170]
call fcn.10019e9a
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x358], 0
jne 0x1002c5ca
dec dword [ebp - 0x18]
push 0
pop eax
jns 0x1002c58e
xor eax, eax
push eax
lea ecx, [ebp - 0x170]
call fcn.10019e9a
lea ecx, [ebp - 0x170]
inc dword [eax]
xor eax, eax
push eax
call fcn.10019e9a
cmp dword [eax], esi
jle 0x1002c493
push 3
pop esi
lea ecx, [ebp - 0xe4c]
call fcn.10019e95
or eax, 0xffffffff
lea ecx, [ebp - 0x170]
mov dword [ebp - 4], eax
call fcn.10019e95
mov dword [ebp - 0x3c], 0x43b8a277
lea ecx, [ebp - 0x4d0]
push 2
call fcn.10019e2d
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x10], eax
jmp 0x1002c642
push dword [ebp - 0x10]
call fcn.10019e9a
mov dword [eax], 0x9b55bb2c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
lea ecx, [ebp - 0x4d0]
jl 0x1002c631
xor eax, eax
inc eax
push eax
call fcn.10019e9a
and dword [eax], 0
jmp 0x1002c698
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002c674
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002c687
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetMenu]
xor eax, eax
lea ecx, [ebp - 0x4d0]
inc eax
push eax
call fcn.10019e9a
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4d0]
inc eax
push eax
call fcn.10019e9a
xor ecx, ecx
inc ecx
cmp dword [eax], ecx
jl 0x1002c65c
or eax, 0xffffffff
lea ecx, [ebp - 0x4d0]
mov dword [ebp - 4], eax
call fcn.10019e95
xor eax, eax
mov dword [ebp - 0x1c], 0x96dd1e1e
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
inc ecx
mov edx, 0xfffd
cmp dword [ebp - 0x10], ecx
jge 0x1002c6ef
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x94], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c6db
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002c724
mov dword [ebp - 0x10], 0x56a9ef72
mov dword [ebp - 0x10], eax
jmp 0x1002c717
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002c714
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002c703
dec dword [ebp - 0x1c]
jns 0x1002c6f7
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002c80e
jmp 0x1002c734
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x34], 0x22803359
mov dword [ebp - 0x10], eax
jmp 0x1002c757
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14ec], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002c746
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp + eax*4 - 0x94], 0x96b7
cmp eax, 0x6ec1
je 0x1002c7fa
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x94]
cmp ecx, eax
sete dl
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x94]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x94]
cmp dword [ebp - 0x34], eax
jg 0x1002c7c9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x94]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x54dbbe5
setge al
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002c7fc
cmp dword [ebp - 0x10], eax
je 0x1002c7fc
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x1002c7ff
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14e4], eax
dec dword [ebp - 0x1c]
jns 0x1002c732
push ecx
lea ecx, [ebp - 0x268]
call fcn.10019e2d
xor ecx, ecx
mov dword [ebp - 4], 0xb
inc ecx
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002c852
push dword [ebp - 0x10]
lea ecx, [ebp - 0x268]
call fcn.10019e9a
mov dword [eax], 0xf6af1124
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1002c831
xor eax, eax
push eax
lea ecx, [ebp - 0x268]
call fcn.10019e9a
lea ecx, [ebp - 0x268]
mov dword [eax], 0xffffffe6
xor eax, eax
push eax
call fcn.10019e9a
jmp 0x1002c93a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002c898
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x664], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002c884
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002c8a8
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov eax, dword [ebp - 0x660]
lea ecx, [ebp - 0x268]
xor eax, eax
push eax
call fcn.10019e9a
mov ecx, dword [ebp - 0x660]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
jne 0x1002c8e5
xor eax, eax
lea ecx, [ebp - 0x268]
push eax
call fcn.10019e9a
cmp dword [eax], 0
jne 0x1002c8e5
xor eax, eax
mov esi, eax
jmp 0x1002c8ea
xor eax, eax
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0x268]
call fcn.10019e9a
mov ecx, dword [ebp - 0x664]
xor edx, edx
imul ecx, dword [eax]
mov eax, dword [ebp - 0x660]
cmp ecx, esi
lea ecx, [ebp - 0x268]
setle dl
sub edx, eax
mov eax, dword [ebp - 0x660]
add eax, edx
mov dword [ebp - 0x38], eax
xor eax, eax
push eax
call fcn.10019e9a
lea ecx, [ebp - 0x268]
inc dword [eax]
xor eax, eax
push eax
call fcn.10019e9a
push 3
pop esi
cmp dword [eax], 0xfffffff7
jl 0x1002c877
or eax, 0xffffffff
lea ecx, [ebp - 0x268]
mov dword [ebp - 4], eax
call fcn.10019e95
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop esi
jmp 0x1002c96f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1898], 0x20624039
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002c95e
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x44], 0xe1d925b0
lea ecx, [ebp - 0xc10]
mov dword [ebp - 0x38], eax
xor eax, eax
inc eax
push eax
call fcn.10019e2d
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x10], eax
jmp 0x1002c9b5
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc10]
call fcn.10019e9a
mov dword [eax], 0x34e6d4f2
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1002c99e
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, 0xfffffffe
setge cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x44], eax
jmp 0x1002c9e3
push dword [ebp - 0x44]
call fcn.10019e9a
mov dword [eax], 0xe5664dc9
inc dword [ebp - 0x44]
xor eax, eax
lea ecx, [ebp - 0xc10]
inc eax
cmp dword [ebp - 0x44], eax
jl 0x1002c9d2
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10019e95
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002ca21
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1738], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002ca09
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002ca41
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1140], 0xee0cd979
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002ca29
xor eax, eax
mov dword [ebp - 0x28], 0xdd1e1e87
mov dword [ebp - 0x3c], 0xe856
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002ca6f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3e8], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002ca57
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jg 0x1002cba7
mov dword [ebp - 0x1c], 0xa9ef72d4
mov dword [ebp - 0x44], 0x35900b08
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jg 0x1002cb98
mov dword [ebp - 0x10], 0xfffffffd
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3e8]
cmp eax, dword [ebp - 0x1c]
jge 0x1002cb51
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x3e8], 0
jne 0x1002cb3f
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x3e8]
cmp eax, 0x5537
setge cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x3e8]
cmp eax, ecx
mov eax, dword [ebp - 0x3e0]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 9
jle 0x1002cb19
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3e8]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3e8]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3e4]
mov eax, dword [ebp - 0x34]
xor esi, esi
xor ecx, ecx
inc esi
cmp eax, esi
setge cl
mov dword [ebp - 0x44], ecx
jmp 0x1002cb87
mov dword [ebp - 0x40], 0x12d49381
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002cb69
cmp dword [ebp - 0x44], eax
je 0x1002cb69
lea edx, [eax + 1]
jmp 0x1002cb6b
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
inc dword [ebp - 0x1c]
push 2
pop ecx
cmp dword [ebp - 0x1c], ecx
jle 0x1002ca95
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jle 0x1002ca7b
push 3
pop esi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
jl 0x1002de33
xor ebx, ebx
inc ebx
push 4
lea ecx, [ebp - 0x84]
call fcn.10019e2d
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], 0xf12a83a0
mov dword [ebp - 0x24], 0xbb2c593c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002cc0d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x84]
call fcn.10019e9a
mov dword [eax], 0xab60e704
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002cbee
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002cc23
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002cc12
push 2
lea ecx, [ebp - 0x84]
call fcn.10019e9a
push 2
lea ecx, [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
call fcn.10019e9a
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x84]
push 2
call fcn.10019e9a
xor eax, eax
lea ecx, [ebp - 0x84]
push eax
call fcn.10019e9a
push 2
lea ecx, [ebp - 0x84]
call fcn.10019e9a
push esi
lea ecx, [ebp - 0x84]
call fcn.10019e9a
xor eax, eax
mov dword [ebp - 0x34], ebx
push eax
lea ecx, [ebp - 0x84]
call fcn.10019e9a
mov ecx, dword [ebp - 0x34]
xor edx, edx
push 2
cmp ecx, dword [eax]
lea ecx, [ebp - 0x84]
setg dl
mov dword [ebp - 0x24], edx
call fcn.10019e9a
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
push 2
cmp ecx, dword [eax]
lea ecx, [ebp - 0x84]
setl bl
call fcn.10019e9a
xor ecx, ecx
cmp ebx, dword [eax]
sete cl
xor eax, eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x1002cf6b
xor ebx, ebx
inc ebx
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], 0xc86e89be
push dword [ebp - 0x24]
call fcn.10019e9a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x84]
mov esi, eax
call fcn.10019e9a
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002cd19
mov eax, ebx
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002cd2a
mov edi, ebx
cmp dword [ebp - 0x2c], eax
jne 0x1002cd2c
mov edi, eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x84]
call fcn.10019e9a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x84]
mov esi, eax
call fcn.10019e9a
mov ecx, dword [esi]
add ecx, dword [eax]
neg ecx
cmp ecx, edi
jle 0x1002cd6d
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002ce30
push 0xcf2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xc42fa43d
mov dword [ebp - 0x10], eax
jmp 0x1002cd92
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x688], 0x6e9f81a7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002cd81
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x84]
push dword [ebp - 0x24]
call fcn.10019e9a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x84]
call fcn.10019e9a
mov ecx, dword [ebp - 0x40]
xor edx, edx
inc ecx
push 2
cmp dword [eax], ecx
lea ecx, [ebp - 0x84]
setle dl
mov dword [ebp - 0x4c], edx
call fcn.10019e9a
mov esi, dword [ebp - 0x4c]
lea ecx, [ebp - 0x84]
push dword [ebp - 0x24]
add esi, dword [eax]
call fcn.10019e9a
xor ebx, ebx
lea ecx, [ebp - 0x84]
cmp esi, dword [eax]
setg bl
xor eax, eax
inc eax
push eax
call fcn.10019e9a
cmp ebx, dword [eax]
jge 0x1002ce04
mov eax, dword [ebp - 0xa4]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x84]
call fcn.10019e9a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x84]
call fcn.10019e9a
xor ebx, ebx
mov eax, dword [eax]
add eax, 0x56a96dad
inc ebx
mov dword [ebp - 0x688], eax
push 2
lea ecx, [ebp - 0x84]
call fcn.10019e9a
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp ecx, ebx
setl dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
xor eax, eax
mov dword [ebp - 0xa4], ecx
cmp dword [ebp - 0x38], 0xcb93
jge 0x1002ceff
mov dword [ebp - 0x40], 0x80cd
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x2c], eax
je 0x1002cefa
mov eax, dword [ebp - 0xa4]
xor edx, edx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
lea ecx, [ebp - 0x84]
setle dl
mov dword [ebp - 0xa4], edx
push dword [ebp - 0x24]
mov dword [ebp - 0x58], edx
call fcn.10019e9a
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x38]
sub ecx, dword [eax]
push dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x66ca
lea ecx, [ebp - 0x84]
setne al
xor ebx, ebx
cmp dword [ebp - 0x58], eax
sete bl
call fcn.10019e9a
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, 0xcae3
setge dl
xor ebx, ebx
imul eax, edx
test eax, eax
je 0x1002cef7
inc ebx
mov eax, ebx
jmp 0x1002cefa
xor eax, eax
inc ebx
mov dword [ebp - 0x2c], eax
jmp 0x1002cf0e
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002cf10
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002cf54
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0xa4]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa4], ecx
xor eax, eax
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002cf51
push 0x159f
push eax
push 0x162
push eax
push 0x5e9
push 0x73
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002cf15
dec dword [ebp - 0x24]
jns 0x1002cce1
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 3
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], eax
call fcn.10019e95
xor ebx, ebx
mov dword [ebp - 0x3c], 9
inc ebx
mov dword [ebp - 0x3c], 0xfffffff6
push ebx
lea ecx, [ebp - 0xc28]
call fcn.10019e2d
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002cfc8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc28]
call fcn.10019e9a
mov dword [eax], 0xfff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002cfaa
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002cfdc
call edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
push eax
lea ecx, [ebp - 0xc28]
call fcn.10019e9a
lea ecx, [ebp - 0xc28]
inc dword [eax]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10019e95
mov dword [ebp - 0x3c], 0x60ec01e6
lea ecx, [ebp - 0xda0]
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xcc25fa5f
push esi
call fcn.10019e2d
xor eax, eax
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002d049
push dword [ebp - 0x10]
lea ecx, [ebp - 0xda0]
call fcn.10019e9a
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d02e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xd
je 0x1002d128
or ebx, 0xffffffff
push 2
lea ecx, [ebp - 0xe64]
call fcn.10019e2d
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1000]
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x3c], 0x65925ef2
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x3c], 0x6ec6e54e
mov dword [ebp - 0x3c], 0x7cfa
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x70012af0
push esi
call fcn.10019e2d
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x3c], 0xc6b7
mov dword [ebp - 0x40], 0x3403
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002d0e4
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe64]
call fcn.10019e9a
mov dword [eax], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d0c5
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002d0f6
push dword [ebp - 0x18]
call fcn.10019e9a
mov dword [eax], ebx
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x1000]
cmp dword [ebp - 0x18], esi
jl 0x1002d0e9
inc dword [ebp - 0x40]
call fcn.10019e95
lea ecx, [ebp - 0xe64]
mov byte [ebp - 4], 0xf
call fcn.10019e95
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jne 0x1002d059
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0xda0]
mov dword [ebp - 4], eax
call fcn.10019e95
push 5
mov dword [ebp - 0x3c], 0x3aeb5900
lea ecx, [ebp - 0x4e8]
pop eax
mov dword [ebp - 0x18], 0x4e2db58
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], eax
push esi
call fcn.10019e2d
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x674]
mov dword [ebp - 0x38], 0xfffffffe
push 4
call fcn.10019e2d
push ebx
lea ecx, [ebp - 0xc40]
mov byte [ebp - 4], 0x13
call fcn.10019e2d
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002d1c0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x4e8]
call fcn.10019e9a
mov dword [eax], 9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002d1a2
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002d1e4
push dword [ebp - 0x24]
lea ecx, [ebp - 0x674]
call fcn.10019e9a
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002d1c9
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002d20a
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc40]
call fcn.10019e9a
mov dword [eax], 0x89fa
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002d1ec
xor eax, eax
mov dword [ebp - 0x18], 0xffffffe6
cmp dword [ebp - 0x18], 0xfffffff8
je 0x1002d429
jmp 0x1002d21f
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x54], 0xff2fd6b2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002d255
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x24c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002d23c
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002d25d
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x4e8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
sub eax, esi
mov dword [ebp - 0x28], eax
xor eax, eax
mov esi, dword [ebp - 0x28]
push eax
call fcn.10019e9a
mov dword [eax], esi
cmp esi, dword [ebp - 0x2c]
jg 0x1002d316
mov dword [ebp - 0x38], 0xfffffffb
xor eax, eax
mov dword [ebp - 0x58], 0xe3f36a5b
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d2c9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf88], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d2b5
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x18
jge 0x1002d306
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002d2f5
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002d2f2
push eax
push eax
call dword [sym.imp.GDI32.dll_RectInRegion]
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff6
jl 0x1002d2df
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x18
jl 0x1002d2d2
xor eax, eax
push eax
lea ecx, [ebp - 0xc40]
call fcn.10019e9a
dec dword [eax]
jmp 0x1002d387
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
je 0x1002d34a
push ebx
lea ecx, [ebp - 0x4e8]
call fcn.10019e9a
xor ebx, ebx
cmp dword [eax], ebx
je 0x1002d34a
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x28]
cmp eax, 0xc0f3
jge 0x1002d34a
xor eax, eax
inc eax
jmp 0x1002d34e
xor eax, eax
xor ebx, ebx
cmp eax, dword [ebp - 0x24c]
je 0x1002d370
push 2
lea ecx, [ebp - 0x674]
call fcn.10019e9a
cmp dword [eax], ebx
jne 0x1002d370
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x1002d375
xor ebx, ebx
inc ebx
mov esi, ebx
push 3
lea ecx, [ebp - 0x674]
call fcn.10019e9a
mov dword [eax], esi
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x248], eax
test eax, eax
je 0x1002d3f2
xor eax, eax
cmp dword [ebp - 0x248], eax
jne 0x1002d3d8
mov esi, dword [ebp - 0x248]
lea ecx, [ebp - 0x674]
push 3
call fcn.10019e9a
mov dword [eax], esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x248]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
neg eax
je 0x1002d3d2
xor eax, eax
cmp dword [ebp - 0x24c], eax
jne 0x1002d3da
jmp 0x1002d3d4
xor eax, eax
mov esi, eax
jmp 0x1002d3dc
xor eax, eax
mov esi, ebx
push eax
lea ecx, [ebp - 0x4e8]
call fcn.10019e9a
cmp esi, dword [eax]
je 0x1002d3f2
mov esi, ebx
xor eax, eax
jmp 0x1002d3f6
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x4e8]
call fcn.10019e9a
xor edx, edx
push 3
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
pop esi
setl dl
mov dword [ebp - 0x38], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff8
jne 0x1002d21d
lea ecx, [ebp - 0xc40]
call fcn.10019e95
lea ecx, [ebp - 0x674]
call fcn.10019e95
or eax, 0xffffffff
lea ecx, [ebp - 0x4e8]
mov dword [ebp - 4], eax
call fcn.10019e95
push 8
pop eax
mov dword [ebp - 0x3c], 0xb060d2f3
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xfffffffe
push 7
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], 0x254e7f13
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002d498
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x400], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002d47f
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002d4a7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002d49d
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3f4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x400]
setge cl
xor edx, edx
cmp ecx, eax
setg dl
neg edx
cmp edx, dword [ebp - 0x28]
jne 0x1002d4e8
mov eax, dword [ebp - 0x400]
mov eax, dword [ebp - 0x3f4]
cmp eax, dword [ebp - 0x3f8]
jle 0x1002d4fc
mov eax, dword [ebp - 0x3f4]
mov eax, dword [ebp - 0x3f4]
mov eax, dword [ebp - 0x28]
inc eax
cmp eax, dword [ebp - 0x400]
jl 0x1002d52e
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x3c], 0x8b39d205
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 6
dec dword [ebp - 0x34]
jmp 0x1002d6c0
mov dword [ebp - 0x44], 0x437ffeac
xor eax, eax
mov dword [ebp - 0x30], 0x8d9a65c8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002d6af
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
jmp 0x1002d563
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc58], 0xba2937bb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d552
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x6c]
add ecx, eax
mov eax, dword [ebp - 0x400]
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
setge dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x44]
mov eax, 0xa96dad8b
setle cl
cmp eax, ecx
sbb eax, eax
neg eax
add eax, 0xffff9161
sub edx, eax
mov eax, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
add ecx, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x6c]
add eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x6c]
cmp eax, 0x6af83395
mov eax, dword [ebp - 0x1c]
setg cl
xor ebx, ebx
mov dword [ebp + eax*4 - 0x6c], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x6c], ebx
jne 0x1002d683
mov edx, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x6c], edx
mov ecx, dword [ebp - 0x3f4]
imul ecx, dword [ebp - 0x30]
neg ecx
cmp edx, ecx
setge al
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setg dl
xor ecx, ecx
sub edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xc50]
cmp edx, eax
setge cl
cmp ecx, 0x8a51
jle 0x1002d656
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x6c], ebx
jne 0x1002d656
xor eax, eax
inc ebx
mov edx, eax
jmp 0x1002d65b
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0xc50], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0xc50]
cmp eax, dword [ebp - 0x28]
jne 0x1002d686
xor eax, eax
mov ecx, eax
jmp 0x1002d688
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x40]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
neg ecx
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002d54a
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002d6c2
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
push 0xfffffffffffffffb
pop edx
mov dword [ebp - 0x2c], edx
or ecx, 0xffffffff
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x58], 0xd0b827be
mov dword [ebp - 0x40], 0x4f952012
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0xfffffffd
je 0x1002d966
jmp 0x1002d6f8
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x41c]
push 4
call fcn.10019e2d
mov dword [ebp - 4], 0x15
mov eax, 0xfff7
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x34], 0x79191d4d
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002d748
push dword [ebp - 0x24]
lea ecx, [ebp - 0x41c]
call fcn.10019e9a
and dword [eax], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002d72c
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002d768
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1e4], 0xc2674d90
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002d750
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002d78a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x10bc], 0xc0f86f4c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002d771
xor eax, eax
mov dword [ebp - 0x20], 0xffffffe2
jmp 0x1002d874
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x1002d871
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x41c]
push dword [ebp - 0x28]
call fcn.10019e9a
cmp dword [eax], 0
je 0x1002d851
push ebx
lea ecx, [ebp - 0x9c0]
call fcn.10019e2d
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x10], eax
jmp 0x1002d7ed
cmp dword [ebp - 0x10], ebx
jl 0x1002d7d6
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002d862
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x1002d7a5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x11
je 0x1002d796
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002d894
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1e4]
cmp eax, dword [ebp - 0x10]
jl 0x1002d8ad
mov dword [ebp - 0x2c], 0x9e57ad95
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d98d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc8], 0x4e2db58
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d975
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002d9d4
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x10], eax
jmp 0x1002d9ca
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002d9c7
push eax
push 0x1e6d
push 0x2606
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002d9a1
dec dword [ebp - 0x2c]
jns 0x1002d995
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002d9ea
push 0x182
call dword [sym.imp.USER32.dll_GetSysColor]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002da0c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x18f4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002d9f3
xor eax, eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x684]
push ebx
call fcn.10019e2d
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x38], 0xfaa32f3f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002da51
push dword [ebp - 0x10]
lea ecx, [ebp - 0x684]
call fcn.10019e9a
mov dword [eax], 0xa439beb0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002da33
xor eax, eax
push eax
lea ecx, [ebp - 0x684]
call fcn.10019e9a
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002dac1
mov eax, 0x45c8100c
mov dword [ebp - 0xd84], eax
mov dword [ebp - 0xd80], eax
mov dword [ebp - 0xd7c], eax
mov dword [ebp - 0xd78], eax
push dword [ebp - 0x20]
call fcn.10019e9a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x684]
mov esi, eax
call fcn.10019e9a
mov ecx, dword [eax]
xor eax, eax
cmp ecx, 0x3c67
mov dword [esi], ecx
mov dword [ebp - 0xd84], ecx
sete al
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x20]
xor eax, eax
lea ecx, [ebp - 0x684]
cmp dword [ebp - 0x20], eax
jle 0x1002da6f
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10019e95
xor eax, eax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe7
jle 0x1002dbbb
jmp 0x1002daf3
cmp byte [ebp - 0x11], 0
je 0x1002dd74
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 7
jmp 0x1002deab
mov dword [ebp - 0x48], 0x394a
xor edx, edx
mov dword [ebp - 0x38], 0xff8ee1d1
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
neg ecx
je 0x1002de98
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002dea8
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x1002dea8
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002dea8
call dword [sym.imp.USER32.dll_WaitMessage]
dec dword [ebp - 0x28]
xor eax, eax
inc eax
cmp dword [ebp - 0x28], eax
jge 0x1002de42
mov dword [ebp - 0x2c], 0xfffffffe
lea ecx, [ebp - 0xe7c]
push 4
call fcn.10019e2d
xor eax, eax
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002def8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe7c]
call fcn.10019e9a
mov dword [eax], 0x2f4a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002ded9
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff5
cmp dword [ebp - 0x2c], 0xfffffffd
jle 0x1002df46
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002df27
mov dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x10]
jns 0x1002df16
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002df3d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffd
jg 0x1002df08
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002df60
push 0x1fe7
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
or eax, 0xffffffff
lea ecx, [ebp - 0xe7c]
mov dword [ebp - 4], eax
call fcn.10019e95
xor eax, eax
lea ecx, [ebp - 0x44c]
xor ebx, ebx
mov byte [ebp - 0x4d], al
inc ebx
mov dword [ebp - 0x28], 0x1e1e87df
mov dword [ebp - 0x48], 0xc25b054d
push ebx
call fcn.10019e2d
mov dword [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x38], 0xc0336ae3
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0xc0ac
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], eax
jmp 0x1002dfc8
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44c]
call fcn.10019e9a
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002dfb5
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, dword [ebp - 0x28]
jne 0x1002dfe8
mov edx, ebx
cmp dword [ebp - 0x48], eax
jne 0x1002dfea
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
inc eax
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x44c]
setg bl
xor eax, eax
push eax
call fcn.10019e9a
mov dword [eax], ebx
test ebx, ebx
jne 0x1002e02b
xor eax, eax
lea ecx, [ebp - 0x44c]
push eax
call fcn.10019e9a
cmp dword [eax], ebx
jne 0x1002e02b
xor eax, eax
inc ebx
mov ecx, eax
jmp 0x1002e030
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x48]
imul eax, ecx
cmp dword [ebp - 0x28], eax
jle 0x1002e055
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002e14a
push eax
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
jmp 0x1002e14a
mov dword [ebp - 0x44], 0x856cd833
lea ecx, [ebp - 0x44c]
xor eax, eax
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x4c], 0xe48c0c84
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.10019e9a
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
lea ecx, [ebp - 0x44c]
mov eax, dword [ebp - 0x38]
xor eax, eax
push eax
call fcn.10019e9a
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp eax, 0x5a4a
setge cl
xor edx, edx
cmp ecx, ebx
setg dl
xor eax, eax
imul edx, dword [ebp - 0x28]
cmp edx, ebx
setg al
cmp eax, dword [ebp - 0x28]
jle 0x1002e0df
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002e0e1
mov eax, ebx
jmp 0x1002e0e1
xor eax, eax
mov edx, dword [ebp - 0x44]
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
setg cl
cmp ecx, 0x3814
jg 0x1002e110
xor eax, eax
mov dword [ebp - 0x38], ebx
push eax
lea ecx, [ebp - 0x44c]
call fcn.10019e9a
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1002e14a
mov dword [ebp - 0x3c], 0xd959
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0xffffffff
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
inc dword [ebp - 0x4c]
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x44c]
or dword [ebp - 4], 0xffffffff
call fcn.10019e95
cmp byte [ebp - 0x4d], 0
je 0x1002e213
or eax, 0xffffffff
mov dword [ebp - 0x10], 0xe0a8eac8
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x1018]
push 4
call fcn.10019e2d
xor eax, eax
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002e1b3
or ebx, 0xffffffff
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1018]
call fcn.10019e9a
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002e195
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e1ce
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002e1e3
mov dword [ebp - 0x38], 0x68876942
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
jge 0x1002e1d3
or eax, 0xffffffff
lea ecx, [ebp - 0x1018]
mov dword [ebp - 4], eax
call fcn.10019e95
xor eax, eax
push eax
push 0x12f1
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
push 2
lea ecx, [ebp - 0xe94]
call fcn.10019e2d
or eax, 0xffffffff
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xc70]
push 2
call fcn.10019e2d
xor eax, eax
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002e268
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe94]
call fcn.10019e9a
mov dword [eax], 0x204e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002e249
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002e290
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc70]
call fcn.10019e9a
mov dword [eax], 0xf390
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002e271
xor eax, eax
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], eax
jl 0x1002e2b3
push eax
lea ecx, [ebp - 0xc70]
call fcn.10019e9a
cmp dword [eax], 0
jne 0x1002e2b1
dec dword [ebp - 0x48]
push 0
pop eax
jns 0x1002e298
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e2c4
call ebx
lea ecx, [ebp - 0xc70]
call fcn.10019e95
or eax, 0xffffffff
lea ecx, [ebp - 0xe94]
mov dword [ebp - 4], eax
call fcn.10019e95
mov dword [ebp - 0x28], 0xdd1e1e87
xor eax, eax
mov dword [ebp - 0x3c], 0xe856
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002e311
mov ecx, 0xffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x368], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002e2fd
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x1002e44a
mov dword [ebp - 0x1c], 0xa9ef72d4
mov dword [ebp - 0x44], 0x35900b08
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002e43a
mov dword [ebp - 0x10], 0xfffffffd
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x368]
cmp eax, dword [ebp - 0x1c]
jge 0x1002e3f5
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x368], 0
jne 0x1002e3e3
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x368]
cmp eax, 0x5537
setge cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x368]
cmp eax, ecx
mov eax, dword [ebp - 0x360]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 9
jle 0x1002e3bd
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x368]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x368]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x364]
mov eax, dword [ebp - 0x34]
xor esi, esi
xor ecx, ecx
inc esi
cmp eax, esi
setge cl
mov dword [ebp - 0x44], ecx
jmp 0x1002e42b
mov dword [ebp - 0x40], 0x12d49381
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002e40d
cmp dword [ebp - 0x44], eax
je 0x1002e40d
lea edx, [eax + 1]
jmp 0x1002e40f
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1002e339
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1002e31e
push 3
pop esi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0x184dcc8
inc eax
mov dword [ebp - 0x20], eax
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x30], 0xef9f3b06
mov dword [ebp - 0x10], eax
jmp 0x1002e482
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x370], 0x6335c0de
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002e471
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
mov ecx, 0xb2c41ac3
neg eax
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, eax
mov dword [ebp - 0x36c], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
sete cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
test ecx, ecx
jne 0x1002e4f0
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002e4f0
mov edx, eax
jmp 0x1002e4f5
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], 0x10
je 0x1002e636
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002e531
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x15f4], 0xfffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002e519
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffec
jle 0x1002e629
xor eax, eax
lea ecx, [ebp - 0xc88]
inc eax
mov dword [ebp - 0x1c], eax
push esi
call fcn.10019e2d
xor eax, eax
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x10], eax
jmp 0x1002e575
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc88]
call fcn.10019e9a
mov dword [eax], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002e55e
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x1c], eax
inc edx
mov dword [ebp - 0x1c], edx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x1002e609
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x10
jne 0x1002e511
mov dword [ebp - 0x28], 0xdd1e1e87
xor eax, eax
mov dword [ebp - 0x3c], 0xe856
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002e667
mov ecx, 0xffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3ac], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002e653
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002e78e
mov dword [ebp - 0x1c], 0xa9ef72d4
mov dword [ebp - 0x44], 0x35900b08
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002e78b
mov dword [ebp - 0x10], 0xfffffffd
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3ac]
cmp eax, dword [ebp - 0x1c]
jge 0x1002e746
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1002e66f
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x10ec]
mov dword [ebp - 0x28], eax
push 2
call fcn.10019e2d
mov dword [ebp - 4], 0x1f
lea ecx, [ebp - 0xca0]
or esi, 0xffffffff
mov dword [ebp - 0x48], esi
push 2
call fcn.10019e2d
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002e7f3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10ec]
call fcn.10019e9a
mov dword [eax], 0x204e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002e7d4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002e81b