Function at 0x1002d0ab
Capabilities:
Check for time delay via queryperformancecounter
Compare security identifiers
Connect pipe
Create pipe
Create thread
Delete registry value
Get common file path
Get graphical window text
Get session user name
Parse pe header
Set environment variable
Set thread local storage value

Disassembly:
mov eax, 0x10086878
call fcn.10084c94
mov eax, 0x154c
call fcn.100803c0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x60], ecx
push edi
inc eax
mov byte [ebp - 0x6d], dl
push eax
lea ecx, [ebp - 0x17c]
call fcn.10016d92
xor eax, eax
xor ecx, ecx
mov dword [ebp - 4], eax
inc ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002d108
push dword [ebp - 0x20]
lea ecx, [ebp - 0x17c]
call fcn.10016e0a
mov dword [eax], 0x91a049fe
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1002d0e7
xor eax, eax
push eax
lea ecx, [ebp - 0x17c]
call fcn.10016e0a
lea ecx, [ebp - 0x17c]
mov dword [eax], 0x1a
xor eax, eax
push eax
call fcn.10016e0a
mov ebx, dword [sym.imp.USER32.dll_GetDC]
or edx, 0xffffffff
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 3
cmp dword [eax], 0x19
pop ecx
jne 0x1002d30b
jmp 0x1002d148
push 3
pop ecx
mov dword [ebp - 0x3c], edx
push ecx
mov dword [ebp - 0x48], edx
lea ecx, [ebp - 0x924]
mov dword [ebp - 0x1c], 0xfa97f51e
call fcn.10016d92
xor eax, eax
inc eax
mov byte [ebp - 4], al
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x1002d192
push dword [ebp - 0x20]
lea ecx, [ebp - 0x924]
call fcn.10016e0a
mov dword [eax], 0xfffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d174
xor eax, eax
push eax
lea ecx, [ebp - 0x17c]
call fcn.10016e0a
xor ecx, ecx
inc ecx
cmp dword [eax], ecx
je 0x1002d1dc
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002d1d4
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d1c0
push 0x11d8
call dword [sym.imp.GDI32.dll_GetStockObject]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x924]
call fcn.10016e0a
inc dword [ebp - 0x3c]
push 0
pop eax
cmp dword [ebp - 0x3c], 2
jle 0x1002d1ac
jmp 0x1002d249
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002d243
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x1002d23b
mov dword [ebp - 0x48], 2
cmp dword [ebp - 0x48], eax
jl 0x1002d21f
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d21a
push eax
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
dec dword [ebp - 0x48]
jns 0x1002d201
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d236
push 0x1973
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002d1f5
cmp dword [ebp - 0x30], eax
jne 0x1002d249
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jle 0x1002d1e9
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x17c]
xor eax, eax
push eax
call fcn.10016e0a
mov esi, eax
lea ecx, [ebp - 0x17c]
xor eax, eax
push eax
call fcn.10016e0a
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
setne dl
neg edx
jne 0x1002d285
xor eax, eax
lea ecx, [ebp - 0x17c]
push eax
call fcn.10016e0a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x17c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10016e0a
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x924]
mov eax, dword [ebp - 0x3c]
push 2
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x17c]
push eax
call fcn.10016e0a
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x924]
sete dl
xor eax, eax
cmp edx, 0xffffffff
setge al
mov dword [ebp - 0x1c], eax
xor eax, eax
mov byte [ebp - 4], al
call fcn.10016dee
xor eax, eax
lea ecx, [ebp - 0x17c]
push eax
call fcn.10016e0a
lea ecx, [ebp - 0x17c]
dec dword [eax]
xor eax, eax
push eax
call fcn.10016e0a
push 0xffffffffffffffff
pop edx
cmp dword [eax], 0x19
je 0x1002d145
or edx, edx
lea ecx, [ebp - 0x17c]
mov dword [ebp - 4], edx
call fcn.10016dee
xor eax, eax
lea ecx, [ebp - 0x164]
inc eax
push eax
call fcn.10016d92
xor eax, eax
mov dword [ebp - 4], 2
xor esi, esi
mov dword [ebp - 0x20], eax
inc esi
cmp dword [ebp - 0x20], esi
jge 0x1002d360
push dword [ebp - 0x20]
lea ecx, [ebp - 0x164]
call fcn.10016e0a
mov dword [eax], 0x91a049fe
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1002d33c
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x164]
call fcn.10016e0a
lea ecx, [ebp - 0x164]
mov dword [eax], 0x1a
xor eax, eax
push eax
call fcn.10016e0a
jmp 0x1002d53f
push 3
or eax, 0xffffffff
lea ecx, [ebp - 0x93c]
mov dword [ebp - 0x3c], eax
pop edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], 0xfa97f51e
push edx
call fcn.10016d92
push 3
pop ecx
xor eax, eax
mov byte [ebp - 4], cl
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002d3d5
push dword [ebp - 0x20]
lea ecx, [ebp - 0x93c]
call fcn.10016e0a
push 3
mov dword [eax], 0xfffa
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], eax
jl 0x1002d3b4
xor eax, eax
push eax
lea ecx, [ebp - 0x164]
call fcn.10016e0a
cmp dword [eax], esi
je 0x1002d41c
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002d414
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d400
push 0x11d8
call dword [sym.imp.GDI32.dll_GetStockObject]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x93c]
call fcn.10016e0a
inc dword [ebp - 0x3c]
push 0
pop eax
cmp dword [ebp - 0x3c], 2
jle 0x1002d3ec
jmp 0x1002d489
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002d483
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x1002d47b
mov dword [ebp - 0x48], 2
cmp dword [ebp - 0x48], eax
jl 0x1002d45f
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d45a
push eax
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
dec dword [ebp - 0x48]
jns 0x1002d441
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d476
push 0x1973
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002d435
cmp dword [ebp - 0x30], eax
jne 0x1002d489
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jle 0x1002d429
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x164]
xor eax, eax
push eax
call fcn.10016e0a
mov esi, eax
lea ecx, [ebp - 0x164]
xor eax, eax
push eax
call fcn.10016e0a
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
setne dl
neg edx
jne 0x1002d4c5
xor eax, eax
lea ecx, [ebp - 0x164]
push eax
call fcn.10016e0a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x164]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10016e0a
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x93c]
mov eax, dword [ebp - 0x3c]
push 2
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x164]
push eax
call fcn.10016e0a
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x93c]
sete dl
xor eax, eax
cmp edx, 0xffffffff
setge al
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 2
call fcn.10016dee
xor eax, eax
lea ecx, [ebp - 0x164]
push eax
call fcn.10016e0a
lea ecx, [ebp - 0x164]
dec dword [eax]
xor eax, eax
push eax
call fcn.10016e0a
push 1
pop esi
cmp dword [eax], 0x19
je 0x1002d385
or esi, 0xffffffff
lea ecx, [ebp - 0x164]
mov dword [ebp - 4], esi
call fcn.10016dee
xor eax, eax
lea ecx, [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x50], 0xe1b61bab
mov dword [ebp - 0x50], 0x2bf33880
push eax
call fcn.10016d92
xor ebx, ebx
mov dword [ebp - 4], 4
inc ebx
mov dword [ebp - 0x50], esi
push ebx
lea ecx, [ebp - 0xaec]
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002d5c1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x6e0]
call fcn.10016e0a
mov dword [eax], 0x71013923
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002d5a0
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002d5dd
push dword [ebp - 0x24]
lea ecx, [ebp - 0xaec]
call fcn.10016e0a
mov dword [eax], 0x26a056eb
inc dword [ebp - 0x24]
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002d5c6
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x50], 0xfffffff6
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x50]
setne bl
xor ecx, ecx
cmp eax, ebx
setg cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x6e0]
mov eax, dword [ebp - 0x50]
xor eax, eax
push eax
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x6e0]
push eax
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x6e0]
push eax
call fcn.10016e0a
xor eax, eax
mov dword [ebp - 0x50], 0x3860a421
push eax
lea ecx, [ebp - 0xaec]
call fcn.10016e0a
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
lea ecx, [ebp - 0xaec]
call fcn.10016dee
lea ecx, [ebp - 0x6e0]
mov dword [ebp - 4], esi
call fcn.10016dee
xor ebx, ebx
lea ecx, [ebp - 0x14c]
inc ebx
push ebx
call fcn.10016d92
mov dword [ebp - 4], 6
mov dword [ebp - 0x34], 0x97f6af11
mov dword [ebp - 0x34], 0xfffffff2
cmp dword [ebp - 0x34], 0x19
jle 0x1002d7c5
xor eax, eax
mov dword [ebp - 0x48], 0x5c19c5a6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002d6cf
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x106c], 0xa414
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002d6b6
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002d7c5
mov dword [ebp - 0x48], 0x11
jmp 0x1002d7ae
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002d708
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x80], ebx
xor eax, eax
inc dword [ebp - 0x24]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x24], eax
jl 0x1002d6ef
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002d72a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x750], 0xfffffffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002d711
xor eax, eax
mov dword [ebp - 0x80], eax
jmp 0x1002d743
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d740
call dword [sym.imp.USER32.dll_DestroyCaret]
xor eax, eax
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], ebx
jle 0x1002d72f
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], ebx
jg 0x1002d7ab
mov dword [ebp - 0x50], 0x3672d714
mov eax, dword [ebp - 0x74c]
mov eax, dword [ebp + eax*4 - 0x106c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x80], eax
je 0x1002d78e
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x80], eax
cmp eax, 0x85b6478c
je 0x1002d78e
mov eax, ebx
jmp 0x1002d790
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
inc dword [ebp - 0x74c]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x74c], eax
jle 0x1002d756
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x17
jge 0x1002d6e4
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x19
jg 0x1002d6a6
xor eax, eax
lea ecx, [ebp - 0x1054]
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xdcc], eax
mov dword [ebp - 0xdc8], eax
mov dword [ebp - 0xdc4], eax
mov dword [ebp - 0xdc0], eax
push eax
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 7
xor ebx, ebx
mov dword [ebp - 0x20], eax
inc ebx
cmp dword [ebp - 0x20], ebx
jge 0x1002d827
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1054]
call fcn.10016e0a
mov dword [eax], 0xe7eb6652
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1002d803
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d843
push 0xe4d
push 0xa53
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
neg esi
mov eax, dword [ebp - 0x38]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
setne dl
cmp edx, esi
je 0x1002d8bc
mov dword [ebp - 0x30], 0xd07
mov dword [ebp - 0x38], 0xfffffff7
cmp dword [ebp - 0x38], 0xf
jge 0x1002d8b0
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d8a7
push 0x1d2
push eax
push 0xd51
push 0x1afd
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xf
jl 0x1002d87c
mov dword [ebp - 0x30], 7
jmp 0x1002d996
xor eax, eax
lea ecx, [ebp - 0xcb4]
inc eax
mov dword [ebp - 0x14], eax
push eax
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 8
xor ebx, ebx
mov dword [ebp - 0x20], eax
inc ebx
cmp dword [ebp - 0x20], ebx
jge 0x1002d903
push dword [ebp - 0x20]
lea ecx, [ebp - 0xcb4]
call fcn.10016e0a
mov dword [eax], 0x6d9e96bb
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1002d8df
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d91c
push 0x1350
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp eax, 0x27f3
setne cl
cmp ecx, dword [ebp - 0x14]
jl 0x1002d934
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], ebx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xdc8], eax
test eax, eax
jne 0x1002d95c
cmp dword [ebp - 0x14], eax
jne 0x1002d95e
mov edi, eax
jmp 0x1002d960
xor eax, eax
mov edi, ebx
push eax
lea ecx, [ebp - 0xcb4]
call fcn.10016e0a
mov ecx, dword [ebp - 0x38]
mov esi, eax
xor eax, eax
cmp edi, 0x5c2dd78f
setg al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0xcb4]
setg dl
mov dword [esi], edx
call fcn.10016dee
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x1054]
mov byte [ebp - 4], 6
call fcn.10016dee
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002d9d3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14c]
call fcn.10016e0a
mov dword [eax], 0x91a049fe
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1002d9af
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], 8
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002d9fd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1358], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002d9e5
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002da57
mov dword [ebp - 0x48], 0x88a137b1
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002da34
push 0x686
push eax
push eax
push 0x1d70
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], ecx
jge 0x1002da54
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x1358], 0x1f782a18
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jl 0x1002da3c
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002da02
mov dword [ebp - 0x18], 0xffffffee
jmp 0x1002da83
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002da80
push eax
push eax
call edi
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
je 0x1002da66
push eax
lea ecx, [ebp - 0x14c]
call fcn.10016e0a
mov dword [eax], 0x1a
jmp 0x1002dcc8
mov dword [ebp - 0x14], 0xba772304
lea ecx, [ebp - 0xb04]
push 4
call fcn.10016d92
push 9
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002dae0
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb04]
call fcn.10016e0a
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002dac5
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002daf5
call edi
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xb04]
imul eax, dword [ebp - 0x14]
push 2
mov dword [ebp - 0x14], eax
call fcn.10016e0a
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 6
mov dword [eax], ecx
lea ecx, [ebp - 0xb04]
call fcn.10016dee
push 3
or eax, 0xffffffff
lea ecx, [ebp - 0x954]
mov dword [ebp - 0x3c], eax
pop esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], 0xfa97f51e
push esi
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002db6b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x954]
call fcn.10016e0a
mov dword [eax], 0xfffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002db4d
xor eax, eax
push eax
lea ecx, [ebp - 0x14c]
call fcn.10016e0a
cmp dword [eax], ebx
je 0x1002dbb2
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002dbaa
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002db96
push 0x11d8
call dword [sym.imp.GDI32.dll_GetStockObject]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x954]
call fcn.10016e0a
inc dword [ebp - 0x3c]
push 0
pop eax
cmp dword [ebp - 0x3c], 2
jle 0x1002db82
jmp 0x1002dc23
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002dc1d
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x1002dc15
mov dword [ebp - 0x48], 2
cmp dword [ebp - 0x48], eax
jl 0x1002dbf9
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002dbf4
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
dec dword [ebp - 0x48]
jns 0x1002dbd7
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002dc10
push 0x1973
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002dbcb
cmp dword [ebp - 0x30], eax
jne 0x1002dc23
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jle 0x1002dbbf
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x14c]
xor eax, eax
push eax
call fcn.10016e0a
mov esi, eax
lea ecx, [ebp - 0x14c]
xor eax, eax
push eax
call fcn.10016e0a
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
setne dl
neg edx
jne 0x1002dc5f
xor eax, eax
lea ecx, [ebp - 0x14c]
push eax
call fcn.10016e0a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10016e0a
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x954]
mov eax, dword [ebp - 0x3c]
push 2
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x14c]
push eax
call fcn.10016e0a
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x954]
sete dl
xor eax, eax
cmp edx, 0xffffffff
setge al
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 6
call fcn.10016dee
xor eax, eax
lea ecx, [ebp - 0x14c]
push eax
call fcn.10016e0a
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x14c]
push eax
call fcn.10016e0a
cmp dword [eax], 0x19
je 0x1002daa0
or eax, 0xffffffff
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], eax
call fcn.10016dee
mov dword [ebp - 0x3c], 0x3aa9
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], 0xad374006
mov dword [ebp - 0x1c], 0x9edca8fe
mov dword [ebp - 0x20], 0x15466bc6
mov dword [ebp - 0x50], 0x51f7ee04
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002dd55
cmp dword [ebp - 0x18], eax
je 0x1002dd55
mov eax, dword [ebp - 0x18]
add eax, 0x412124a4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002dd53
xor ebx, ebx
lea esi, [eax + 1]
inc ebx
jmp 0x1002dd57
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x3c]
mov dword [ebp - 0x20], edx
mov edx, 0xffff
mov eax, dword [ebp - 0x20]
add eax, esi
je 0x1002de11
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], 0xea5d840d
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0xfffffff8
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xa38d
setge al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x1002dddb
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002dddd
mov eax, ebx
jmp 0x1002dddd
xor eax, eax
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setne cl
add eax, 0xffff31b3
add eax, ecx
xor ecx, ecx
cmp eax, 0x92e7
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jne 0x1002de07
cmp dword [ebp - 0x50], eax
je 0x1002de09
mov eax, ebx
mov dword [ebp - 0x14], eax
jmp 0x1002df1e
mov dword [ebp - 0x48], 0xfffffff9
or esi, 0xffffffff
mov dword [ebp - 0x5b8], esi
xor eax, eax
mov dword [ebp - 0x5b4], esi
mov dword [ebp - 0x5b0], esi
mov dword [ebp - 0x5ac], esi
mov dword [ebp - 0x14], 0xf624e194
cmp dword [ebp - 0x1c], eax
jne 0x1002de5f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
neg eax
cmp eax, ebx
jle 0x1002de5d
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1002de61
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], 0x335309f3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5b8], eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002df18
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x1e
jge 0x1002df15
mov dword [ebp - 0x20], eax
jmp 0x1002dec7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa04], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002deb6
mov eax, dword [ebp - 0x5ac]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa04]
mov eax, dword [ebp - 0x5b8]
mov eax, dword [ebp - 0x5ac]
mov eax, dword [ebp - 0xa04]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x1e
push 0
pop eax
jl 0x1002deb1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x14
jl 0x1002dea1
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002df33
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
lea ecx, [ebp - 0x648]
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x50], 0xe1b61bab
mov dword [ebp - 0x50], 0x2bf33880
push eax
call fcn.10016d92
xor ebx, ebx
mov dword [ebp - 4], 0xb
inc ebx
mov dword [ebp - 0x50], esi
push ebx
lea ecx, [ebp - 0xd44]
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002df9b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x648]
call fcn.10016e0a
mov dword [eax], 0x71013923
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002df7a
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002dfb7
push dword [ebp - 0x24]
lea ecx, [ebp - 0xd44]
call fcn.10016e0a
mov dword [eax], 0x26a056eb
inc dword [ebp - 0x24]
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002dfa0
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x50], 0xfffffff6
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x50]
setne bl
xor ecx, ecx
cmp eax, ebx
setg cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x648]
mov eax, dword [ebp - 0x50]
xor eax, eax
push eax
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x648]
push eax
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x648]
push eax
call fcn.10016e0a
xor eax, eax
mov dword [ebp - 0x50], 0x3860a421
push eax
lea ecx, [ebp - 0xd44]
call fcn.10016e0a
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
lea ecx, [ebp - 0xd44]
call fcn.10016dee
lea ecx, [ebp - 0x648]
mov dword [ebp - 4], esi
call fcn.10016dee
xor eax, eax
lea ecx, [ebp - 0x96c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0x1d102278
mov dword [ebp - 0x14], 0x19adb821
mov dword [ebp - 0x48], 0x932e3ca3
mov dword [ebp - 0x4c], 0x9523dd97
push 4
call fcn.10016d92
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x50], 0xe67b38eb
mov dword [ebp - 0x20], eax
jmp 0x1002e0a6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x96c]
call fcn.10016e0a
mov dword [eax], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002e093
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002e0c6
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
je 0x1002e0dd
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002e0df
lea edx, [eax + 1]
jmp 0x1002e0e1
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
jne 0x1002e0fa
cmp dword [ebp - 0x1c], eax
je 0x1002e0fd
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002e111
cmp dword [ebp - 0x34], eax
je 0x1002e111
lea ecx, [eax + 1]
jmp 0x1002e113
mov ecx, eax
mov eax, 0x665683c8
sub eax, ecx
je 0x1002e12a
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002e12c
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002e131
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push eax
lea ecx, [ebp - 0x96c]
call fcn.10016e0a
xor ecx, ecx
push ebx
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
cmp esi, eax
sete cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x96c]
mov eax, dword [ebp - 0x50]
call fcn.10016e0a
mov ecx, dword [ebp - 0x1c]
mov esi, eax
xor eax, eax
cmp ecx, 0x7ea8
mov ecx, dword [ebp - 0x48]
setle al
xor edx, edx
add eax, 5
cmp ecx, eax
setne dl
xor eax, eax
sub edx, dword [ebp - 0x48]
cmp edx, dword [esi]
mov edx, dword [ebp - 0x48]
setle al
sub edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setle cl
xor edx, edx
dec ecx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
or esi, 0xffffffff
neg ecx
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x96c]
mov dword [ebp - 4], esi
call fcn.10016dee
push 4
lea ecx, [ebp - 0x404]
call fcn.10016d92
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x73c]
mov dword [ebp - 0x14], 0x98a59c17
push 2
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002e217
push dword [ebp - 0x24]
lea ecx, [ebp - 0x404]
call fcn.10016e0a
mov dword [eax], 0xe1a3622b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002e1f8
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002e23f
push dword [ebp - 0x24]
lea ecx, [ebp - 0x73c]
call fcn.10016e0a
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002e220
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002e25a
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x1002e424
mov dword [ebp - 0x1c], 0x22a149ce
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002e294
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9c], ebx
xor eax, eax
inc dword [ebp - 0x20]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x20], eax
jl 0x1002e278
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], ecx
jg 0x1002e2e2
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x404]
call fcn.10016e0a
cmp dword [eax], 0
jne 0x1002e2dd
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002e2ca
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
inc dword [ebp - 0x9c]
push 3
pop ecx
cmp dword [ebp - 0x9c], ecx
jle 0x1002e2a2
jmp 0x1002e2e0
push 3
pop ecx
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1002e418
mov dword [ebp - 0x44], 0x49fcfbce
lea ecx, [ebp - 0x404]
push dword [ebp - 0x1c]
call fcn.10016e0a
cmp dword [eax], 0
je 0x1002e351
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x404]
call fcn.10016e0a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x404]
mov esi, eax
call fcn.10016e0a
mov ecx, dword [esi]
push dword [ebp - 0x1c]
mov dword [eax], ecx
lea ecx, [ebp - 0x404]
call fcn.10016e0a
mov esi, eax
lea ecx, [ebp - 0x73c]
xor eax, eax
push eax
call fcn.10016e0a
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1002e40a
mov dword [ebp - 0x18], 0x592758e9
lea ecx, [ebp - 0x73c]
push ebx
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x73c]
push eax
call fcn.10016e0a
mov ecx, dword [ebp - 0x44]
xor edx, edx
add ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x9c]
cmp ecx, eax
setg dl
xor eax, eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffee
jne 0x1002e40a
push 3
pop esi
push esi
lea ecx, [ebp - 0xb1c]
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x20], eax
jmp 0x1002e3c9
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb1c]
call fcn.10016e0a
mov dword [eax], 0x55ebda18
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002e3b2
mov dword [ebp - 0x44], 0xfffffff9
jmp 0x1002e3ec
mov dword [ebp - 0x30], 0xa6001648
push ebx
call fcn.10016e0a
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffffc
lea ecx, [ebp - 0xb1c]
je 0x1002e3d7
mov byte [ebp - 4], 0xf
call fcn.10016dee
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
je 0x1002e39b
dec dword [ebp - 0x1c]
jns 0x1002e2ee
push 3
xor eax, eax
pop ecx
dec dword [ebp - 0x14]
jns 0x1002e269
or esi, 0xffffffff
lea ecx, [ebp - 0x73c]
call fcn.10016dee
lea ecx, [ebp - 0x404]
mov dword [ebp - 4], esi
call fcn.10016dee
push ebx
lea ecx, [ebp - 0x158]
call fcn.10016d92
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002e47e
push dword [ebp - 0x20]
lea ecx, [ebp - 0x158]
call fcn.10016e0a
mov dword [eax], 0x91a049fe
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1002e45a
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002e4ae
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x118], 0xfff8
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1002e490
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002e4cd
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002e4c8
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002e4b6
push 3
pop esi
mov dword [ebp - 0x18], esi
or eax, 0xffffffff
cmp dword [ebp - 0x18], eax
jl 0x1002e583
or esi, eax
mov dword [ebp - 0x20], 0xfffffff9
xor edx, edx
mov dword [ebp - 0x24], 0x2d683a7e
mov eax, dword [ebp - 0x118]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x30]
jne 0x1002e511
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002e52d
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jge 0x1002e556
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002e558
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002e574
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x1002e574
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002e580
mov dword [ebp - 0x24], 0xffffffea
jmp 0x1002e56e
cmp dword [ebp - 0x24], eax
jne 0x1002e574
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1d
je 0x1002e566
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jge 0x1002e4e1
push 3
pop esi
xor eax, eax
lea ecx, [ebp - 0x158]
push eax
call fcn.10016e0a
lea ecx, [ebp - 0x158]
mov dword [eax], 0x1a
xor eax, eax
push eax
call fcn.10016e0a
mov edi, 0xfffe
cmp dword [eax], 0x19
jne 0x10030a93
push 4
lea ecx, [ebp - 0xccc]
call fcn.10016d92
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xf24]
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x2c], 0x4f3f7e81
push ebx
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002e60c
push dword [ebp - 0x24]
lea ecx, [ebp - 0xccc]
call fcn.10016e0a
mov dword [eax], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002e5ed
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002e638
push dword [ebp - 0x24]
lea ecx, [ebp - 0xf24]
call fcn.10016e0a
mov dword [eax], 0x76fda024
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002e614
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x1002e83d
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x10f0]
push 2
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002e682
push dword [ebp - 0x20]
lea ecx, [ebp - 0x10f0]
call fcn.10016e0a
mov dword [eax], 0x35357f45
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002e663
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002e6b5
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002e699
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002e6b2
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002e687
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1002e825
mov dword [ebp - 0x34], 0x20bd035c
lea ecx, [ebp - 0x984]
push ebx
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002e70b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x984]
call fcn.10016e0a
mov dword [eax], 5
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1002e6ea
xor eax, eax
push 3
pop ebx
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], eax
jl 0x1002e807
mov dword [ebp - 0x48], 0x92f644a
mov dword [ebp - 0x2c], 0x7e3bc4ae
mov dword [ebp - 0x2c], 0x45b3659e
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], ebx
jg 0x1002e7fe
or eax, 0xffffffff
lea ecx, [ebp - 0xf0c]
mov dword [ebp - 0x2c], eax
push 2
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x20], eax
jmp 0x1002e777
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf0c]
call fcn.10016e0a
mov dword [eax], 0x36378284
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002e760
inc dword [ebp - 0x14]
lea ecx, [ebp - 0xccc]
push dword [ebp - 0x34]
call fcn.10016e0a
cmp dword [eax], 0
jne 0x1002e7cc
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x984]
xor eax, eax
push eax
call fcn.10016e0a
cmp dword [eax], 0
jne 0x1002e7b4
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002e7b4
mov edx, eax
jmp 0x1002e7b9
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setg cl
dec ecx
jne 0x1002e7cc
xor eax, eax
mov esi, eax
jmp 0x1002e7d1
xor eax, eax
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0x984]
call fcn.10016e0a
neg esi
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xf0c]
mov dword [eax], esi
call fcn.10016dee
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jle 0x1002e742
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1002e71a
lea ecx, [ebp - 0x984]
mov byte [ebp - 4], 0x14
call fcn.10016dee
dec dword [ebp - 0x1c]
push 1
pop ebx
jns 0x1002e6c6
push 3
pop esi
lea ecx, [ebp - 0x10f0]
mov byte [ebp - 4], 0x13
call fcn.10016dee
dec dword [ebp - 0x28]
jns 0x1002e644
lea ecx, [ebp - 0xf24]
call fcn.10016dee
lea ecx, [ebp - 0xccc]
mov byte [ebp - 4], 0x11
call fcn.10016dee
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], 0x97f6af11
mov dword [ebp - 0x34], 0xfffffff2
cmp dword [ebp - 0x34], 0x19
jle 0x1002e9ae
xor eax, eax
mov dword [ebp - 0x48], 0x5c19c5a6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002e8a3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1080], 0xa414
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002e88a
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002e9ae
mov dword [ebp - 0x48], 0x11
jmp 0x1002e997
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002e8df
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x84], ebx
xor eax, eax
inc dword [ebp - 0x24]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x24], eax
jl 0x1002e8c3
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002e901
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x780], 0xfffffffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002e8e8
xor eax, eax
mov dword [ebp - 0x84], eax
jmp 0x1002e920
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002e91a
call dword [sym.imp.USER32.dll_DestroyCaret]
xor eax, eax
inc dword [ebp - 0x84]
cmp dword [ebp - 0x84], ebx
jle 0x1002e909
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], ebx
jg 0x1002e994
mov dword [ebp - 0x50], 0x3672d714
mov eax, dword [ebp - 0x77c]
mov eax, dword [ebp + eax*4 - 0x1080]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x84], eax
je 0x1002e977
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x84], eax
cmp eax, 0x85b6478c
je 0x1002e977
mov eax, ebx
jmp 0x1002e979
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
inc dword [ebp - 0x77c]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x77c], eax
jle 0x1002e936
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x17
jge 0x1002e8b8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x19
jg 0x1002e87a
mov dword [ebp - 0x44], 0xfa97f51e
lea ecx, [ebp - 0x1064]
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xdfc], eax
mov dword [ebp - 0xdf8], eax
mov dword [ebp - 0xdf4], eax
mov dword [ebp - 0xdf0], eax
push eax
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x17
xor ebx, ebx
mov dword [ebp - 0x20], eax
inc ebx
cmp dword [ebp - 0x20], ebx
jge 0x1002ea11
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1064]
call fcn.10016e0a
mov dword [eax], 0xe7eb6652
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002e9f3
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002ea31
push 0xe4d
push 0xa53
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
neg esi
mov eax, dword [ebp - 0x38]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
setne dl
cmp edx, esi
je 0x1002eaae
mov dword [ebp - 0x30], 0xd07
mov dword [ebp - 0x38], 0xfffffff7
cmp dword [ebp - 0x38], 0xf
jge 0x1002eaa2
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002ea99
push 0x1d2
push eax
push 0xd51
push 0x1afd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xf
jl 0x1002ea6a
mov dword [ebp - 0x30], 7
jmp 0x1002eb7f
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0xb34]
push ebx
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002eae9
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb34]
call fcn.10016e0a
mov dword [eax], 0x6d9e96bb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002eacb
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002eb06
push 0x1350
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp eax, 0x27f3
setne cl
cmp ecx, dword [ebp - 0x14]
jl 0x1002eb1e
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], ebx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xdf8], eax
test eax, eax
jne 0x1002eb46
cmp dword [ebp - 0x14], eax
jne 0x1002eb48
mov edi, eax
jmp 0x1002eb4a
xor eax, eax
mov edi, ebx
push eax
lea ecx, [ebp - 0xb34]
call fcn.10016e0a
mov ecx, dword [ebp - 0x38]
mov esi, eax
xor eax, eax
cmp edi, 0x5c2dd78f
setg al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0xb34]
setg dl
mov dword [esi], edx
call fcn.10016dee
mov edi, 0xfffe
lea ecx, [ebp - 0x1064]
mov byte [ebp - 4], 0x11
call fcn.10016dee
push 3
pop eax
push eax
lea ecx, [ebp - 0x7d4]
call fcn.10016d92
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x18], 8
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002ebcd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1310], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002ebb5
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002ec2b
mov dword [ebp - 0x48], 0x88a137b1
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002ec08
push 0x686
push eax
push eax
push 0x1d70
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], ecx
jge 0x1002ec28
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x1310], 0x1f782a18
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jl 0x1002ec10
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002ebd2
mov dword [ebp - 0x18], 0xffffffee
jmp 0x1002ec5b
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002ec58
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
je 0x1002ec3a
mov dword [ebp - 0x14], 0xba772304
lea ecx, [ebp - 0xd5c]
push 4
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002ec9f
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd5c]
call fcn.10016e0a
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002ec84
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002ecbc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xd5c]
imul eax, dword [ebp - 0x14]
push 2
mov dword [ebp - 0x14], eax
call fcn.10016e0a
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x19
mov dword [eax], ecx
lea ecx, [ebp - 0xd5c]
call fcn.10016dee
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x1002ed12
push dword [ebp - 0x20]
lea ecx, [ebp - 0x7d4]
call fcn.10016e0a
mov dword [eax], 0xfffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002ecf4
xor eax, eax
push eax
lea ecx, [ebp - 0x158]
call fcn.10016e0a
cmp dword [eax], ebx
je 0x1002f639
mov dword [ebp - 0x1c], 0x860b4ffb
lea ecx, [ebp - 0x1140]
mov dword [ebp - 0x2c], 0x6da5043c
mov dword [ebp - 0x2c], 0xd2086bd0
mov dword [ebp - 0x2c], 0x58bfc4f2
mov dword [ebp - 0x2c], 0xd9b95031
mov dword [ebp - 0x2c], 0xb72b21a3
mov dword [ebp - 0x2c], 0x452a26f3
mov dword [ebp - 0x2c], 0xd44c039e
push 4
call fcn.10016d92
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xb4c]
mov dword [ebp - 0x2c], 0xe6bb2f14
mov dword [ebp - 0x2c], 0x7127
push 2
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x1c
push 3
mov dword [ebp - 0x38], eax
or esi, 0xffffffff
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x1002edb2
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1504], esi
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1002ed9e
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1002edda
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1140]
call fcn.10016e0a
mov dword [eax], 0x637c1d6b
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x1002edbb
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1002ee02
push dword [ebp - 0x38]
lea ecx, [ebp - 0xb4c]
call fcn.10016e0a
mov dword [eax], 4
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jl 0x1002ede3
xor eax, eax
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x1002eea3
mov dword [ebp - 0x2c], 0x9924
lea ecx, [ebp - 0xf3c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x45ba13b2
mov dword [ebp - 0x2c], 0xd5d70512
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xae4f9dbc
mov dword [ebp - 0x2c], 0xa284868f
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], esi
push ebx
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x20], eax
jmp 0x1002ee75
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf3c]
call fcn.10016e0a
mov dword [eax], 0x25ec560
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002ee5e
push ebx
lea ecx, [ebp - 0xb4c]
call fcn.10016e0a
lea ecx, [ebp - 0xf3c]
dec dword [eax]
mov byte [ebp - 4], 0x1c
call fcn.10016dee
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x1002ee12
mov dword [ebp - 0x1c], 0xffffffe9
jmp 0x1002eed4
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002eebf
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002eed1
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff6
jl 0x1002eeac
lea ecx, [ebp - 0xb4c]
call fcn.10016dee
lea ecx, [ebp - 0x1140]
mov byte [ebp - 4], 0x19
call fcn.10016dee
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jle 0x1002ef68
or edi, 0xffffffff
push 2
lea ecx, [ebp - 0x23c]
call fcn.10016d92
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xb94]
mov dword [ebp - 0x2c], 0x1e9c96c7
push ebx
call fcn.10016d92
mov byte [ebp - 4], 0x34
xor eax, eax
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1002ef5e
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x23c]
call fcn.10016e0a
mov dword [eax], 0x571177e8
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jl 0x1002ef3f
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x100308fd
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x99c]
push 2
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1002efa5
push dword [ebp - 0x38]
lea ecx, [ebp - 0x99c]
call fcn.10016e0a
mov dword [eax], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jl 0x1002ef8a
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1002efc5
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x348], 8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002efad
xor eax, eax
push 3
mov dword [ebp - 0x38], eax
pop ecx
jmp 0x1002efde
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x12ec], 0xfffffff7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1002efcd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1a
jg 0x1002f12f
jmp 0x1002effd
push 3
pop ecx
push ecx
lea ecx, [ebp - 0x558]
call fcn.10016d92
mov byte [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x14], 0xde0184dc
push 3
mov dword [ebp - 0x30], 0xc0c8fbfc
mov dword [ebp - 0x20], eax
pop esi
jmp 0x1002f033
push dword [ebp - 0x20]
call fcn.10016e0a
or dword [eax], 0xffffffff
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x558]
cmp dword [ebp - 0x20], esi
jl 0x1002f025
push ebx
call fcn.10016e0a
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002f0a4
push eax
lea ecx, [ebp - 0x558]
call fcn.10016e0a
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1002f07c
xor eax, eax
lea ecx, [ebp - 0x558]
inc eax
push eax
call fcn.10016e0a
cmp dword [eax], ebx
jne 0x1002f07c
xor eax, eax
inc ebx
mov esi, eax
jmp 0x1002f081
xor ebx, ebx
inc ebx
mov esi, ebx
push ebx
lea ecx, [ebp - 0x558]
call fcn.10016e0a
mov ecx, dword [ebp - 0x18]
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x14]
cmp ecx, dword [eax]
je 0x1002f0a2
mov eax, ebx
jmp 0x1002f0a4
xor eax, eax
cmp dword [ebp - 0x18], eax
jl 0x1002f0b4
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f0b6
mov esi, ebx
jmp 0x1002f0b8
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x99c]
call fcn.10016e0a
lea ecx, [ebp - 0x99c]
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
call fcn.10016e0a
cmp dword [eax], 0xd188
jge 0x1002f0f4
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x348], eax
je 0x1002f0f6
mov ecx, ebx
xor eax, eax
test ecx, ecx
setle al
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, 0x7a7bf748
setle cl
mov dword [ebp - 0x12ec], ecx
lea ecx, [ebp - 0x558]
mov byte [ebp - 4], 0x1e
call fcn.10016dee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1a
jle 0x1002effa
lea ecx, [ebp - 0x99c]
mov byte [ebp - 4], 0x19
call fcn.10016dee
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0xfffffff5
jmp 0x1002f32a
push 2
lea ecx, [ebp - 0x440]
call fcn.10016d92
or eax, 0xffffffff
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1002f18e
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x440]
call fcn.10016e0a
mov dword [eax], 0x7e8b72fd
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jl 0x1002f16f
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jge 0x1002f1aa
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x27c], ebx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x1002f196
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002f30c
push 3
pop esi
mov dword [ebp - 0x1c], 0x62c9cc14
lea ecx, [ebp - 0xce4]
mov dword [ebp - 0x4c], 0x3e34b64b
mov dword [ebp - 0x14], 0xb641b44a
push esi
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002f203
push dword [ebp - 0x20]
lea ecx, [ebp - 0xce4]
call fcn.10016e0a
or dword [eax], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002f1e8
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1002f2b2
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f225
push 0x11d8
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002f22d
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x440]
call fcn.10016e0a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x440]
mov esi, eax
call fcn.10016e0a
push ebx
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xce4]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x14], eax
call fcn.10016e0a
mov edx, dword [ebp - 0x14]
xor ebx, ebx
sub edx, 0x1a1f0506
mov esi, eax
imul edx, dword [ebp - 0x1c]
push 0
imul edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
mov ecx, dword [ebp - 0x4c]
setle bl
sub ecx, 5
imul ebx, ecx
xor eax, eax
cmp ebx, 0x83bc
setne al
xor ebx, ebx
mov dword [esi], eax
inc ebx
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], ebx
jle 0x1002f20f
push 3
pop esi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x440]
call fcn.10016e0a
imul eax, dword [eax], 0x280b
test eax, eax
jne 0x1002f2ea
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setle dl
imul eax, edx, 0x7cf7
cmp eax, 0x211e9a9d
jge 0x1002f2ea
mov eax, dword [ebp - 0x27c]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xce4]
mov dword [ebp - 0x14], 0xfffffff8
mov byte [ebp - 4], 0x20
call fcn.10016dee
dec dword [ebp - 0x18]
jns 0x1002f1b9
push ebx
lea ecx, [ebp - 0x440]
call fcn.10016e0a
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 0x19
call fcn.10016dee
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe7
jle 0x1002f14d
mov dword [ebp - 0x48], 0xfffffff6
xor eax, eax
mov dword [ebp - 0x2c], 0xf6d4a0d4
mov dword [ebp - 0x50], edi
push 4
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x1002f36a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1538], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002f352
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x19
jle 0x1002f3f0
mov dword [ebp - 0x2c], 0xfffffff9
lea ecx, [ebp - 0xf54]
mov dword [ebp - 0x2c], 0xe2167fa5
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x924c0001
push esi
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002f3c3
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf54]
call fcn.10016e0a
mov dword [eax], 0x39ba095a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002f3a5
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f3d3
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
inc dword [ebp - 0x50]
lea ecx, [ebp - 0xf54]
mov byte [ebp - 4], 0x19
call fcn.10016dee
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x19
jg 0x1002f373
mov byte [ebp - 0x3d], al
lea ecx, [ebp - 0xb64]
mov dword [ebp - 0x14], 0xfeba
or eax, 0xffffffff
mov dword [ebp - 0xa14], eax
mov dword [ebp - 0xa10], eax
mov dword [ebp - 0xa0c], eax
mov dword [ebp - 0xa08], eax
mov dword [ebp - 0x30], 0xf09a2b44
mov dword [ebp - 0x54], 0x40eb
push esi
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002f45b
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb64]
call fcn.10016e0a
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002f440
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002f490
mov eax, dword [ebp - 0x14]
mov ecx, 0x9e923e64
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0xa14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xa14], eax
jg 0x1002f48e
mov esi, eax
push eax
lea ecx, [ebp - 0xb64]
call fcn.10016e0a
lea ecx, [ebp - 0xb64]
mov byte [ebp - 4], 0x19
mov dword [eax], esi
call fcn.10016dee
cmp byte [ebp - 0x3d], 0
je 0x1002f4fd
mov dword [ebp - 0x1c], 5
push 3
mov dword [ebp - 0x30], 0x5dea
mov dword [ebp - 0x1c], 0x13
pop ecx
jmp 0x1002f737
xor eax, eax
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x20], eax
jmp 0x1002f675
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x190], 0xbcef054a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002f664
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x190], eax
test eax, eax
je 0x1002f696
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, 0x37c5b151
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x4c]
je 0x1002f701
push ecx
lea ecx, [ebp - 0x9b4]
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x25
push 3
mov dword [ebp - 0x20], eax
pop esi
jmp 0x1002f6d6
push dword [ebp - 0x20]
call fcn.10016e0a
mov dword [eax], 0xd99ea7eb
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x9b4]
cmp dword [ebp - 0x20], esi
jl 0x1002f6c5
push 2
call fcn.10016e0a
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x9b4]
cmp dword [eax], 0
jne 0x1002f742
call fcn.10016dee
push 3
pop ecx
jmp 0x1002f734
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002f72f
push eax
push 0x325
push 0x37f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
push 3
xor eax, eax
pop ecx
cmp dword [ebp - 0x30], eax
jne 0x1002f747
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
je 0x1002f656
jmp 0x1002f747
call fcn.10016dee
or edi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x1002ef02
jmp 0x1002f760
xor eax, eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x9cc]
push 2
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1002f79d
push dword [ebp - 0x38]
lea ecx, [ebp - 0x9cc]
call fcn.10016e0a
mov dword [eax], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jl 0x1002f782
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1002f7bd
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x2bc], 8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002f7a5
xor eax, eax
push 3
mov dword [ebp - 0x38], eax
pop ecx
jmp 0x1002f7d6
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1328], 0xfffffff7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1002f7c5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1a
jg 0x1002f926
jmp 0x1002f7f5
push 3
pop ecx
push ecx
lea ecx, [ebp - 0x51c]
call fcn.10016d92
mov byte [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x14], 0xde0184dc
push 3
mov dword [ebp - 0x30], 0xc0c8fbfc
mov dword [ebp - 0x20], eax
pop esi
jmp 0x1002f82a
push dword [ebp - 0x20]
call fcn.10016e0a
mov dword [eax], edi
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x51c]
cmp dword [ebp - 0x20], esi
jl 0x1002f81d
push ebx
call fcn.10016e0a
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002f89b
push eax
lea ecx, [ebp - 0x51c]
call fcn.10016e0a
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1002f873
xor eax, eax
lea ecx, [ebp - 0x51c]
inc eax
push eax
call fcn.10016e0a
cmp dword [eax], ebx
jne 0x1002f873
xor eax, eax
inc ebx
mov esi, eax
jmp 0x1002f878
xor ebx, ebx
inc ebx
mov esi, ebx
push ebx
lea ecx, [ebp - 0x51c]
call fcn.10016e0a
mov ecx, dword [ebp - 0x18]
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x14]
cmp ecx, dword [eax]
je 0x1002f899
mov eax, ebx
jmp 0x1002f89b
xor eax, eax
cmp dword [ebp - 0x18], eax
jl 0x1002f8ab
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f8ad
mov esi, ebx
jmp 0x1002f8af
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x9cc]
call fcn.10016e0a
lea ecx, [ebp - 0x9cc]
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
call fcn.10016e0a
cmp dword [eax], 0xd188
jge 0x1002f8eb
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x2bc], eax
je 0x1002f8ed
mov ecx, ebx
xor eax, eax
test ecx, ecx
setle al
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, 0x7a7bf748
setle cl
mov dword [ebp - 0x1328], ecx
lea ecx, [ebp - 0x51c]
mov byte [ebp - 4], 0x26
call fcn.10016dee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1a
jle 0x1002f7f2
lea ecx, [ebp - 0x9cc]
mov byte [ebp - 4], 0x19
call fcn.10016dee
mov dword [ebp - 0x44], 2
xor eax, eax
cmp dword [ebp - 0x44], eax
jl 0x1003084b
jmp 0x1002f94b
mov dword [ebp - 0x20], 0x15de
mov dword [ebp - 0x30], 0x486b6feb
mov dword [ebp - 0x50], 0x8e10e5e5
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f982
push 0x1b12
push eax
push 0x228c
push 0xca0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
setg cl
xor eax, eax
cmp ecx, 0xfffffffc
setg al
xor edx, edx
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
xor eax, eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], eax
jl 0x10030133
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x50], 0xa27289ff
push 2
call fcn.10016d92
mov byte [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x50], 0x5e3d1aa1
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x20], eax
jmp 0x1002fa03
push dword [ebp - 0x20]
call fcn.10016e0a
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
lea ecx, [ebp - 0x54c]
jl 0x1002f9f5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
xor eax, eax
push eax
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x54c]
push eax
call fcn.10016e0a
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x54c]
xor eax, eax
push eax
call fcn.10016e0a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x50], 2
mov eax, dword [ebp - 0x50]
xor eax, eax
push eax
call fcn.10016e0a
xor ecx, ecx
cmp dword [eax], ecx
setne cl
xor eax, eax
cmp ecx, edi
setl al
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1002fab8
mov dword [ebp - 0x48], 0x76cc72b7
mov dword [ebp - 0x1c], 0xa
jmp 0x1002faaf
cmp dword [ebp - 0x34], 0x18
je 0x1002fa72
lea ecx, [ebp - 0x54c]
mov byte [ebp - 4], 0x19
call fcn.10016dee
push ebx
lea ecx, [ebp - 0xc4]
call fcn.10016d92
mov byte [ebp - 4], 0x29
xor eax, eax
mov dword [ebp - 0x18], 0xf7bf48c4
mov dword [ebp - 0x1c], 0x513244d5
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1002fb18
mov dword [ebp - 0x3c], 0x69fdf99f
push 3
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], eax
pop edi
cmp dword [ebp - 0x3c], 0xfffffffc
jne 0x10030248
mov dword [ebp - 0x4c], 0x887e08a1
lea ecx, [ebp - 0xb7c]
push ebx
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10030188
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb7c]
call fcn.10016e0a
mov dword [eax], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1003016e
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100301ae
push eax
push 0x252a
push 0x260f
push eax
push 0x22bf
push 0xe84
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
jge 0x100301bf
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x3c], eax
je 0x100301c1
mov edx, ebx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setne cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x3c]
setne bl
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 0x507e
setg cl
xor eax, eax
imul edx, ecx
cmp edx, ebx
setle al
xor ebx, ebx
neg eax
inc ebx
cmp eax, ebx
jae 0x10030211
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10030213
xor eax, eax
mov esi, ebx
push eax
lea ecx, [ebp - 0xb7c]
call fcn.10016e0a
cmp esi, edi
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xb7c]
mov byte [ebp - 4], 0x19
call fcn.10016dee
dec dword [ebp - 0x3c]
jmp 0x10030143
mov dword [ebp - 0x3c], 0xf6af1124
lea ecx, [ebp - 0x1078]
or esi, 0xffffffff
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x50], esi
push 2
call fcn.10016d92
mov byte [ebp - 4], 0x2e
xor eax, eax
mov dword [ebp - 0x58], 0x1c63cc5d
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x10030298
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xa24], 0x2f7f1c74
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x1003027f
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x100302c0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1078]
call fcn.10016e0a
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jl 0x100302a1
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x100302e0
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x6c8], 6
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x100302c8
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffe6
cmp dword [ebp - 0x3c], 0xffffffe3
jle 0x1003053d
mov edi, 0xffff
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x34], 0x376fbfcc
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x6c], 0xfffffffe
mov dword [ebp - 0x30], 0xf10aa6f3
mov dword [ebp - 0x5c], esi
push 9
pop ecx
mov dword [ebp - 0x760], ecx
mov dword [ebp - 0x75c], ecx
mov dword [ebp - 0x758], ecx
mov dword [ebp - 0x754], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 5
jge 0x100304a2
lea ecx, [ebp - 0x1078]
mov byte [ebp - 4], 0x19
call fcn.10016dee
xor eax, eax
xor edx, edx
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x3c], 0xf4672159
mov dword [ebp - 0x30], 0x3773672
mov dword [ebp - 0x30], 0x8cafa32f
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x58], 5
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x5c], 0x3f6a0837
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x3c]
setl dl
sub ecx, 0x26874be7
sub esi, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp esi, ecx
setl al
xor edx, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 0xc2f9
setle al
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x5c], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100305fa
push ebx
lea ecx, [ebp - 0xcfc]
call fcn.10016d92
mov byte [ebp - 4], 0x32
xor eax, eax
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10030886
push dword [ebp - 0x20]
lea ecx, [ebp - 0xcfc]
call fcn.10016e0a
mov dword [eax], 0xeca4f833
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10030868
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100308ad
push 0x4a0
push eax
push 0xe0e
push eax
push 0x1ae3
push 0x1fb2
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
lea ecx, [ebp - 0xcfc]
call fcn.10016e0a
lea ecx, [ebp - 0xcfc]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 0x19
call fcn.10016dee
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002ef02
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x1002f75e
jmp 0x1002ef02
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xb94]
call fcn.10016e0a
mov dword [eax], edi
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x100308ea
push ebx
lea ecx, [ebp - 0x23c]
call fcn.10016e0a
mov dword [eax], ebx
jmp 0x100309a1
mov eax, 0xffff
mov dword [ebp - 0x54], 0x9b7928fb
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x23c]
mov eax, dword [ebp - 0x2c]
push ebx
call fcn.10016e0a
push ebx
lea ecx, [ebp - 0x23c]
call fcn.10016e0a
cmp dword [eax], 0
jne 0x10030947
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x23c]
push ebx
call fcn.10016e0a
mov ecx, dword [ebp - 0x54]
xor ebx, ebx
add ecx, dword [eax]
xor eax, eax
inc eax
cmp ecx, eax
lea ecx, [ebp - 0xb94]
setl bl
xor eax, eax
push eax
call fcn.10016e0a
mov dword [eax], ebx
cmp ebx, edi
jbe 0x10030985
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x10030985
xor ebx, ebx
inc ebx
jmp 0x1003098a
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x23c]
mov eax, dword [ebp - 0x54]
push ebx
mov dword [ebp - 0x30], eax
call fcn.10016e0a
inc dword [eax]
push ebx
lea ecx, [ebp - 0x23c]
call fcn.10016e0a
cmp dword [eax], 0x14
je 0x10030915
lea ecx, [ebp - 0xb94]
call fcn.10016dee
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x19
call fcn.10016dee
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x158]
xor eax, eax
push eax
call fcn.10016e0a
mov esi, eax
lea ecx, [ebp - 0x158]
xor eax, eax
push eax
call fcn.10016e0a
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
setne dl
neg edx
jne 0x10030a0c
xor eax, eax
lea ecx, [ebp - 0x158]
push eax
call fcn.10016e0a
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x158]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.10016e0a
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x7d4]
mov eax, dword [ebp - 0x24]
push 2
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x158]
push eax
call fcn.10016e0a
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x7d4]
sete dl
xor eax, eax
cmp edx, edi
setge al
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 0x11
call fcn.10016dee
xor eax, eax
lea ecx, [ebp - 0x158]
push eax
call fcn.10016e0a
lea ecx, [ebp - 0x158]
dec dword [eax]
xor eax, eax
push eax
call fcn.10016e0a
push 3
mov edi, 0xfffe
pop esi
cmp dword [eax], 0x19
je 0x1002e5b3
or eax, 0xffffffff
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], eax
call fcn.10016dee
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10030ab8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x8c], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10030aab
mov dword [ebp - 0x8c], 5
mov edx, 0xc4b7c700
jmp 0x10030b95
mov dword [ebp - 0x28], 0xfffffffe
xor ecx, ecx
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x48], 0xfffffffd
mov eax, dword [ebp - 0x28]
cmp eax, ebx
mov eax, dword [ebp - 0x8c]
setg cl
sub ecx, eax
mov eax, dword [ebp - 0x28]
imul eax, ecx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub eax, ecx
cmp edx, eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x8c], eax
jne 0x10030b72
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x10030b47
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x14c8], 4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10030b2f
xor eax, eax
mov dword [ebp - 0x48], 2
cmp dword [ebp - 0x48], eax
jl 0x10030b8f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030b6b
push 0x1e25
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
dec dword [ebp - 0x48]
jns 0x10030b53
jmp 0x10030b8a
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030b8f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov edx, 0xc4b7c700
inc dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], 0x1a
jg 0x10030ad1
mov dword [ebp - 0x3c], 0x3aa9
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], 0xad374006
mov dword [ebp - 0x1c], 0x9edca8fe
mov dword [ebp - 0x28], 0x15466bc6
mov dword [ebp - 0x30], 0x51f7ee04
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10030c03
cmp dword [ebp - 0x18], eax
je 0x10030c03
mov eax, dword [ebp - 0x18]
add eax, 0x412124a4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10030c01
mov esi, ebx
jmp 0x10030c05
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
add eax, esi
je 0x10030cbd
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x54], 0xea5d840d
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0xfffffff8
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xa38d
setge al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x10030c84
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10030c86
mov eax, ebx
jmp 0x10030c86
xor eax, eax
xor ecx, ecx
cmp eax, 0xffff
mov eax, dword [ebp - 0x18]
setne cl
add eax, 0xffff31b3
add eax, ecx
xor ecx, ecx
cmp eax, 0x92e7
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jne 0x10030cb3
cmp dword [ebp - 0x30], eax
je 0x10030cb5
mov eax, ebx
mov dword [ebp - 0x54], eax
jmp 0x10030dc7
mov dword [ebp - 0x48], 0xfffffff9
or esi, 0xffffffff
mov dword [ebp - 0x598], esi
xor eax, eax
mov dword [ebp - 0x594], esi
mov dword [ebp - 0x590], esi
mov dword [ebp - 0x58c], esi
mov dword [ebp - 0x14], 0xf624e194
cmp dword [ebp - 0x1c], eax
jne 0x10030d08
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
neg eax
cmp eax, ebx
jle 0x10030d06
mov ecx, ebx
jmp 0x10030d0a
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], 0x335309f3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10030dc1
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x1e
jge 0x10030dbe
mov dword [ebp - 0x28], eax
jmp 0x10030d70
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa7c], 0xfffffffd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10030d5f
mov eax, dword [ebp - 0x58c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa7c]
mov eax, dword [ebp - 0x598]
mov eax, dword [ebp - 0x58c]
mov eax, dword [ebp - 0xa7c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x1e
push 0
pop eax
jl 0x10030d5a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x14
jl 0x10030d4a
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030de2
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xf6c]
mov dword [ebp - 0x2c], 0x8ade19d2
mov dword [ebp - 0x2c], 0x25b0e446
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xba07e4fc
push 2
call fcn.10016d92
mov dword [ebp - 4], 0x35
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10030e48
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf6c]
call fcn.10016e0a
mov dword [eax], 0xfe30f587
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10030e29
xor eax, eax
dec dword [ebp - 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030e6a
push eax
push 0x19eb
push eax
push eax
push 0x10d9
push eax
call edi
lea ecx, [ebp - 0xf6c]
mov dword [ebp - 4], esi
call fcn.10016dee
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x660]
mov dword [ebp - 0x30], 0xe1b61bab
mov dword [ebp - 0x30], 0x2bf33880
push ebx
call fcn.10016d92
mov dword [ebp - 4], 0x36
lea ecx, [ebp - 0xd8c]
mov dword [ebp - 0x30], esi
push ebx
call fcn.10016d92
xor eax, eax
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10030ed7
push dword [ebp - 0x24]
lea ecx, [ebp - 0x660]
call fcn.10016e0a
mov dword [eax], 0x71013923
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030eb9
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10030ef3
push dword [ebp - 0x24]
lea ecx, [ebp - 0xd8c]
call fcn.10016e0a
mov dword [eax], 0x26a056eb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030edc
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x30], 0xfffffff6
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x30]
setne bl
xor ecx, ecx
cmp eax, ebx
setg cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x660]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x660]
push eax
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x660]
push eax
call fcn.10016e0a
xor eax, eax
mov dword [ebp - 0x30], 0x3860a421
push eax
lea ecx, [ebp - 0xd8c]
call fcn.10016e0a
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
lea ecx, [ebp - 0xd8c]
call fcn.10016dee
lea ecx, [ebp - 0x660]
mov dword [ebp - 4], esi
call fcn.10016dee
xor ebx, ebx
lea ecx, [ebp - 0x1bc]
inc ebx
push ebx
call fcn.10016d92
push 3
mov dword [ebp - 4], 0x38
lea ecx, [ebp - 0x300]
pop eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x563ffaf0
push 2
call fcn.10016d92
mov byte [ebp - 4], 0x39
xor eax, eax
mov dword [ebp - 0x2c], 0xc019
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x28], 0xa83acdd7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10030ffd
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1bc]
call fcn.10016e0a
mov dword [eax], 0x59d5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030fdf
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10031025
push dword [ebp - 0x24]
lea ecx, [ebp - 0x300]
call fcn.10016e0a
mov dword [eax], 0x2b4746a1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10031006
xor eax, eax
push eax
lea ecx, [ebp - 0x1bc]
call fcn.10016e0a
cmp dword [eax], 0
jne 0x100311ce
dec dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1003106b
push ebx
lea ecx, [ebp - 0x300]
call fcn.10016e0a
mov esi, dword [ebp - 0x4c]
lea ecx, [ebp - 0x300]
push ebx
call fcn.10016e0a
mov dword [eax], esi
test esi, esi
jne 0x1003106b
xor eax, eax
mov esi, eax
jmp 0x1003106f
mov esi, ebx
xor eax, eax
push eax
lea ecx, [ebp - 0x1bc]
call fcn.10016e0a
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp esi, ecx
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
dec edx
cmp edx, dword [eax]
setne cl
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 0xa705
setge cl
cmp edx, ecx
je 0x100310bd
push ebx
lea ecx, [ebp - 0x300]
call fcn.10016e0a
cmp dword [eax], 0
je 0x100310d4
push ebx
lea ecx, [ebp - 0x300]
call fcn.10016e0a
cmp dword [eax], 0
je 0x100310d4
mov esi, ebx
xor eax, eax
jmp 0x100310d8
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x1bc]
call fcn.10016e0a
xor ecx, ecx
mov eax, dword [eax]
add eax, esi
cmp eax, 0xfff6
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x20]
jg 0x10031116
push eax
lea ecx, [ebp - 0x1bc]
call fcn.10016e0a
cmp dword [eax], 0
jne 0x10031114
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10031116
mov eax, dword [ebp - 0x28]
xor eax, eax
or esi, 0xffffffff
push eax
lea ecx, [ebp - 0x1bc]
call fcn.10016e0a
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ecx, 0xc7bc
push ebx
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setg cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x300]
call fcn.10016e0a
mov dword [eax], 0x73cd9e64
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10031164
push eax
lea ecx, [ebp - 0x1bc]
call fcn.10016e0a
xor eax, eax
push eax
lea ecx, [ebp - 0x1bc]
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x300]
push eax
call fcn.10016e0a
xor eax, eax
lea ecx, [ebp - 0x1bc]
push eax
call fcn.10016e0a
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x300]
setle dl
mov dword [ebp - 0x28], edx
call fcn.10016dee
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 4], esi
call fcn.10016dee
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop edx
cmp dword [ebp - 0x28], ebx
jge 0x100311d5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x90], edx
inc dword [ebp - 0x28]
jmp 0x100311ba
xor eax, eax
jmp 0x10031119
mov dword [ebp - 0x90], 5
cmp dword [ebp - 0x90], 0x1a
jle 0x100312c0
mov esi, 0xc4b7c700
mov dword [ebp - 0x28], 0xfffffffe
xor ecx, ecx
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x48], 0xfffffffd
mov eax, dword [ebp - 0x28]
cmp eax, ebx
mov eax, dword [ebp - 0x90]
setg cl
sub ecx, eax
mov eax, dword [ebp - 0x28]
imul eax, ecx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub eax, ecx
cmp esi, eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x90], eax
jne 0x1003128f
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x10031264
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1510], 4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1003124c
xor eax, eax
mov dword [ebp - 0x48], 2
cmp dword [ebp - 0x48], eax
jl 0x100312a7
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031288
push 0x1e25
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
dec dword [ebp - 0x48]
jns 0x10031270
jmp 0x100312a7
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100312a7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
inc dword [ebp - 0x90]
cmp dword [ebp - 0x90], 0x1a
push 3
pop edx
jg 0x100311f1
or esi, 0xffffffff
push ebx
lea ecx, [ebp - 0xbac]
call fcn.10016d92
mov dword [ebp - 4], 0x3a
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x3b6182ea
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10031305
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbac]
call fcn.10016e0a
mov dword [eax], 0xda11525
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x100312e7
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003131d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
xor eax, eax
push eax
lea ecx, [ebp - 0xbac]
call fcn.10016e0a
lea ecx, [ebp - 0xbac]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], esi
call fcn.10016dee
mov dword [ebp - 0x3c], 0x3aa9
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], 0xad374006
mov dword [ebp - 0x1c], 0x9edca8fe
mov dword [ebp - 0x28], 0x15466bc6
mov dword [ebp - 0x30], 0x51f7ee04
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003139d
cmp dword [ebp - 0x18], eax
je 0x1003139d
mov eax, dword [ebp - 0x18]
add eax, 0x412124a4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1003139b
mov esi, ebx
jmp 0x1003139f
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
add eax, esi
je 0x10031457
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x54], 0xea5d840d
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0xfffffff8
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xa38d
setge al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x1003141e
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10031420
mov eax, ebx
jmp 0x10031420
xor eax, eax
xor ecx, ecx
cmp eax, 0xffff
mov eax, dword [ebp - 0x18]
setne cl
add eax, 0xffff31b3
add eax, ecx
xor ecx, ecx
cmp eax, 0x92e7
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jne 0x1003144d
cmp dword [ebp - 0x30], eax
je 0x1003144f
mov eax, ebx
mov dword [ebp - 0x54], eax
jmp 0x10031561
mov dword [ebp - 0x48], 0xfffffff9
or esi, 0xffffffff
mov dword [ebp - 0x578], esi
xor eax, eax
mov dword [ebp - 0x574], esi
mov dword [ebp - 0x570], esi
mov dword [ebp - 0x56c], esi
mov dword [ebp - 0x14], 0xf624e194
cmp dword [ebp - 0x1c], eax
jne 0x100314a2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
neg eax
cmp eax, ebx
jle 0x100314a0
mov ecx, ebx
jmp 0x100314a4
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], 0x335309f3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003155b
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x1e
jge 0x10031558
mov dword [ebp - 0x28], eax
jmp 0x1003150a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa4c], 0xfffffffd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x100314f9
mov eax, dword [ebp - 0x56c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa4c]
mov eax, dword [ebp - 0x578]
mov eax, dword [ebp - 0x56c]
mov eax, dword [ebp - 0xa4c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x1e
push 0
pop eax
jl 0x100314f4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x14
jl 0x100314e4
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003157c
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x1104]
mov dword [ebp - 0x2c], 0x8ade19d2
mov dword [ebp - 0x2c], 0x25b0e446
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xba07e4fc
push 2
call fcn.10016d92
mov dword [ebp - 4], 0x3b
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x100315e2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1104]
call fcn.10016e0a
mov dword [eax], 0xfe30f587
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x100315c3
xor eax, eax
dec dword [ebp - 0x30]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100315fe
push eax
push 0x19eb
push eax
push eax
push 0x10d9
push eax
call edi
lea ecx, [ebp - 0x1104]
mov dword [ebp - 4], esi
call fcn.10016dee
xor eax, eax
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031639
push 0x1dc6
push 0x1dac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1003164b
mov dword [ebp - 0x30], 0xe0b4074d
inc dword [ebp - 0x30]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffa
jl 0x1003163e
push 3
pop eax
push eax
lea ecx, [ebp - 0x470]
call fcn.10016d92
xor eax, eax
mov dword [ebp - 4], 0x3c
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1003168b
push 9
pop edx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd14], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10031677
xor eax, eax
mov dword [ebp - 0x24], eax
push 3
pop edi
cmp dword [ebp - 0x24], ecx
jge 0x100316b2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x470]
call fcn.10016e0a
mov dword [eax], 0x596960f5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10031696
push ebx
lea ecx, [ebp - 0x470]
call fcn.10016e0a
push ebx
lea ecx, [ebp - 0x470]
mov dword [eax], 2
call fcn.10016e0a
cmp dword [eax], 0
jl 0x1003177e
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], 0xc2dd78f4
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x10031758
mov dword [ebp - 0x4c], 0x336de018
lea ecx, [ebp - 0x470]
mov eax, dword [ebp - 0x44]
push ebx
mov esi, dword [ebp + eax*4 - 0xd14]
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xd14], esi
call fcn.10016e0a
mov ecx, dword [ebp - 0x4c]
xor edx, edx
add ecx, dword [ebp - 0x44]
neg ecx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x4c]
setne dl
xor ebx, ebx
cmp edx, eax
push 1
setge bl
xor ecx, ecx
cmp esi, 7
setne cl
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xd14]
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jle 0x100316ee
push ebx
lea ecx, [ebp - 0x470]
call fcn.10016e0a
push ebx
lea ecx, [ebp - 0x470]
dec dword [eax]
call fcn.10016e0a
cmp dword [eax], 0
jge 0x100316d9
or esi, 0xffffffff
lea ecx, [ebp - 0x470]
mov dword [ebp - 4], esi
call fcn.10016dee
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x28], eax
jmp 0x100317ad
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x600], 0xd8c53784
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003179c
mov eax, dword [ebp - 0x38]
xor edx, edx
mov dword [ebp - 0x600], 0x4774c80
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
setge dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
setge dl
xor eax, eax
sub edx, dword [ebp - 0x48]
je 0x100318a8