Function at 0x10029a42
Capabilities:
Accept command line arguments
Allocate thread local storage
Clear file content
Compare security identifiers
Get geographical location
Get session user name
Query environment variable
Query or enumerate registry value
Set thread local storage value

Disassembly:
mov eax, 0x100703e6
call fcn.1006fd98
sub esp, 0xf60
push ebx
push esi
mov ebx, 0x796a0b59
mov dword [ebp - 0x54], ecx
xor eax, eax
mov dword [ebp - 0x40], ebx
push edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
push 1
mov byte [ebp - 0x65], dl
pop ecx
jge 0x10029a86
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x280], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10029a71
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10029a98
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa00], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10029a8b
push 0xffffffffffffffe9
pop edi
mov dword [ebp - 0x280], 0xffffffe6
cmp dword [ebp - 0x280], edi
je 0x10029b1b
mov dword [ebp - 0x28], 8
xor ecx, ecx
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x280]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0xa00], edx
mov eax, dword [ebp - 0x27c]
cmp edx, eax
setne cl
imul eax, ecx, 0x8064
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x280]
cmp dword [ebp - 0x280], edi
jne 0x10029ab3
jmp 0x10029b1d
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10029b31
push eax
call esi
xor eax, eax
mov dword [ebp - 0x40], ebx
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], 3
jge 0x10029b55
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x29c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10029b40
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ebx
jmp 0x10029b6a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa10], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10029b5d
mov dword [ebp - 0x29c], 0xffffffe6
cmp dword [ebp - 0x29c], edi
je 0x10029be5
mov dword [ebp - 0x28], 8
xor ecx, ecx
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0xa10], edx
mov eax, dword [ebp - 0x298]
cmp edx, eax
setne cl
imul eax, ecx, 0x8064
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x294]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x29c]
cmp dword [ebp - 0x29c], edi
jne 0x10029b81
jmp 0x10029be7
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10029bf5
push eax
call esi
xor eax, eax
mov dword [ebp - 0x1c], eax
xor edx, edx
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xffffffea
cmp dword [ebp - 0x2c], 0x17
jne 0x10029c71
xor eax, eax
inc edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10029c36
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa24], 0x405b4019
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10029c1e
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10029c61
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10029c5e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa24], 0x2e6e7f73
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10029c46
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jne 0x10029c3b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x17
je 0x10029c16
jmp 0x10029c72
inc edx
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10029c9e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x124], 0x9e57ad95
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10029c86
xor eax, eax
inc dword [ebp - 0x10]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jg 0x10029e48
mov dword [ebp - 0x1c], 0x4438bea1
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10029ce1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc8], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10029cc9
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10029d86
mov dword [ebp - 0x2c], 0x41b66baf
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jl 0x10029d26
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10029d0c
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x124], 0
jne 0x10029d21
dec dword [ebp - 0x2c]
push 0
pop eax
jns 0x10029cf8
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edx
jg 0x10029d83
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x124]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x124], ecx
jne 0x10029d74
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x124]
add eax, dword [ebp - 0x120]
imul ecx, eax, 0xfffd
mov eax, dword [ebp - 0x120]
cmp eax, ecx
setle dl
xor eax, eax
mov dword [ebp - 0x28], edx
xor edx, edx
inc edx
cmp dword [ebp - 0x28], eax
je 0x10029d76
mov eax, edx
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x10029d2e
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10029ce9
cmp dword [ebp - 0xc8], eax
jne 0x10029e26
mov eax, dword [ebp - 0x124]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10029db2
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10029db7
cmp dword [ebp - 0x1c], eax
jne 0x10029db9
mov edx, eax
mov eax, dword [ebp - 0xc8]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x124]
jl 0x10029ddc
xor eax, eax
cmp dword [ebp - 0x124], eax
jne 0x10029ddc
mov ecx, eax
jmp 0x10029de1
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x120]
xor edx, edx
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0xc8]
setl dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0xc8]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xfffffffb
setle al
cmp eax, 0xd9de360a
je 0x10029e23
xor eax, eax
mov edx, eax
jmp 0x10029e26
xor edx, edx
inc edx
mov eax, dword [ebp - 0xc8]
xor ecx, ecx
cmp edx, eax
push 0
setl cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
inc edx
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], edx
jle 0x10029cb3
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x48], 0xcbbbc25
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], 0x8607
mov dword [ebp - 0x48], 0xf4846e1d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffea
jne 0x10029fe5
xor esi, esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0x6e85fcb
mov dword [ebp - 0x10], eax
jmp 0x10029eb8
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10029e9c
push eax
push 0x250d
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10029eb5
push 0x251
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jge 0x10029e85
mov dword [ebp - 0x10], 9
jmp 0x10029fc5
mov dword [ebp - 0x18], 0x272a727
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], 0x70fc
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10029ef4
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
push 0xfffffffffffffffb
mov dword [ebp - 0x18], 0xffffffeb
pop ecx
cmp dword [ebp - 0x18], ecx
jl 0x10029fbf
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], 0x2305aba9
cmp dword [ebp - 0x38], 0x1ec2
jne 0x10029f7e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x38]
neg eax
sub edx, eax
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x48], eax
jge 0x10029f55
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10029f58
lea eax, [esi + 1]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10029f6a
lea edx, [esi + 1]
cmp dword [ebp - 0x4c], eax
jne 0x10029f6c
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x10]
jl 0x10029f7e
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
test eax, eax
push 0xfffffffffffffffb
sets cl
xor edx, edx
cmp ecx, 0xfffffff6
setle dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop eax
setle cl
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
push 0
pop eax
jge 0x10029f07
dec dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], 4
jle 0x10029eca
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffea
push 0
pop eax
je 0x10029e76
mov esi, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0x40], 0x796a0b59
xor ecx, ecx
mov dword [ebp - 0x3c], 0x37bc7528
inc ecx
mov dword [ebp - 0x48], 0x5f4b
mov dword [ebp - 0x3c], ecx
push 3
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x1002a01f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe28], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002a00b
xor eax, eax
dec dword [ebp - 0x48]
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a03a
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
xor eax, eax
push 3
inc ecx
pop edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002a056
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2ac], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002a042
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1002a075
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa38], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002a061
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002a09a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcb8], 0x2eac4530
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002a081
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002a0bc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc70], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002a0a3
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002a0cb
cmp dword [ebp - 0xcb0], eax
je 0x1002a0cb
mov eax, ecx
mov dword [ebp - 0xc6c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002a0ea
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x48], 0xfffffff6
dec dword [ebp - 0x48]
jne 0x1002a0ef
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1002a0d8
mov dword [ebp - 0x2ac], 0xffffffe6
cmp dword [ebp - 0x2ac], edi
mov edi, dword [sym.imp.USER32.dll_GetDC]
je 0x1002a1f0
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x3c], 0x862f
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a130
push eax
push 0x10e6
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a148
push eax
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
xor eax, eax
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x18], 0x7e2799ac
mov dword [ebp - 0x18], eax
jmp 0x1002a18d
mov dword [ebp - 0x40], 0xfd4914d2
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a184
push 0x10c9
push eax
push eax
push 0x1423
push eax
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xe
jle 0x1002a15b
mov dword [ebp - 0x40], 2
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0xa38], edx
mov eax, dword [ebp - 0x2a8]
cmp edx, eax
setne cl
imul eax, ecx, 0x8064
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x2ac]
cmp dword [ebp - 0x2ac], 0xffffffe9
jne 0x1002a10b
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a1fe
push eax
call esi
xor eax, eax
mov dword [ebp - 0x1c], eax
xor ecx, ecx
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xffffffea
cmp dword [ebp - 0x2c], 0x17
jne 0x1002a27d
push 2
xor eax, eax
inc ecx
pop edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002a242
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa4c], 0x405b4019
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002a22a
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002a26d
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002a26a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa4c], 0x2e6e7f73
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002a252
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jne 0x1002a247
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x17
je 0x1002a222
jmp 0x1002a27e
inc ecx
mov dword [ebp - 0x10], ecx
xor edx, edx
mov dword [ebp - 0x18], 0x83648bd9
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setne dl
xor eax, eax
or ecx, 0xffffffff
cmp edx, ecx
setge al
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
imul edx, dword [ebp - 0x10]
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x5dea
setge al
add eax, dword [ebp - 0x10]
neg eax
je 0x1002a374
xor eax, eax
mov dword [ebp - 0x40], 0xe0d6
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], eax
jmp 0x1002a312
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xce8], 0x662b0a94
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002a301
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jne 0x1002a32a
cmp dword [ebp - 0x10], eax
je 0x1002a32d
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x40]
or edx, 0xffffffff
add ecx, eax
xor eax, eax
neg ecx
cmp ecx, edx
mov dword [ebp - 0xce8], ecx
push 4
setne al
pop ecx
sub ecx, eax
mov eax, 0xbf085fff
add ecx, dword [ebp - 0x10]
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfd0a
setne cl
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
add eax, 0xc1cc
mov dword [ebp - 0x40], eax
jmp 0x1002a395
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002a397
push eax
push 0x1d69
push 0x200f
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
xor eax, eax
or ecx, 0xffffffff
xor edx, edx
mov dword [ebp - 0x10], ecx
inc edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe8
jl 0x1002a3d6
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x18], eax
jmp 0x1002a3cc
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a3c9
call dword [sym.imp.USER32.dll_CreateMenu]
xor edx, edx
xor eax, eax
inc edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jne 0x1002a3b5
dec dword [ebp - 0x10]
jmp 0x1002a3a3
cmp dword [ebp - 0x10], eax
jne 0x1002a3f1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002a3f3
mov eax, edx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002a424
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10c], 0x9e57ad95
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002a40b
xor eax, eax
inc dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jg 0x1002a5ce
mov dword [ebp - 0x1c], 0x4438bea1
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002a461
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd4], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002a449
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002a506
mov dword [ebp - 0x2c], 0x41b66baf
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jl 0x1002a4a6
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a48c
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x10c], 0
jne 0x1002a4a1
dec dword [ebp - 0x2c]
push 0
pop eax
jns 0x1002a478
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edx
jg 0x1002a503
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x10c]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x10c], ecx
jne 0x1002a4f4
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x10c]
add eax, dword [ebp - 0x108]
imul ecx, eax, 0xfffd
mov eax, dword [ebp - 0x108]
cmp eax, ecx
setle dl
xor eax, eax
mov dword [ebp - 0x28], edx
xor edx, edx
inc edx
cmp dword [ebp - 0x28], eax
je 0x1002a4f6
mov eax, edx
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x1002a4ae
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002a469
cmp dword [ebp - 0xd4], eax
jne 0x1002a5a6
mov eax, dword [ebp - 0x10c]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002a532
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002a537
cmp dword [ebp - 0x1c], eax
jne 0x1002a539
mov edx, eax
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x10c]
jl 0x1002a55c
xor eax, eax
cmp dword [ebp - 0x10c], eax
jne 0x1002a55c
mov ecx, eax
jmp 0x1002a561
xor esi, esi
lea ecx, [esi + 1]
mov eax, dword [ebp - 0x108]
xor edx, edx
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0xd4]
setl dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0xd4]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xfffffffb
setle al
cmp eax, 0xd9de360a
je 0x1002a5a3
xor eax, eax
mov edx, eax
jmp 0x1002a5a6
xor edx, edx
inc edx
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
cmp edx, eax
push 0
setl cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
inc edx
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], edx
jle 0x1002a433
mov esi, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0x40], 0x796a0b59
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x48], 0xcbbbc25
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], 0x8607
mov dword [ebp - 0x48], 0xf4846e1d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffea
jne 0x1002a772
xor esi, esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0x6e85fcb
mov dword [ebp - 0x10], eax
jmp 0x1002a645
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a629
push eax
push 0x250d
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a642
push 0x251
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jge 0x1002a612
mov dword [ebp - 0x10], 9
jmp 0x1002a752
mov dword [ebp - 0x18], 0x272a727
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], 0x70fc
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a681
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
push 0xfffffffffffffffb
mov dword [ebp - 0x18], 0xffffffeb
pop ecx
cmp dword [ebp - 0x18], ecx
jl 0x1002a74c
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], 0x2305aba9
cmp dword [ebp - 0x38], 0x1ec2
jne 0x1002a70b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x38]
neg eax
sub edx, eax
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x48], eax
jge 0x1002a6e2
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002a6e5
lea eax, [esi + 1]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002a6f7
lea edx, [esi + 1]
cmp dword [ebp - 0x4c], eax
jne 0x1002a6f9
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x10]
jl 0x1002a70b
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
test eax, eax
push 0xfffffffffffffffb
sets cl
xor edx, edx
cmp ecx, 0xfffffff6
setle dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop eax
setle cl
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
push 0
pop eax
jge 0x1002a694
dec dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], 4
jle 0x1002a657
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffea
push 0
pop eax
je 0x1002a603
mov esi, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 3
xor ecx, ecx
mov dword [ebp - 0x10], eax
pop edx
inc ecx
cmp dword [ebp - 0x10], edx
jge 0x1002a794
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2bc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002a780
xor eax, eax
mov dword [ebp - 0x3c], 0x37bc7528
mov dword [ebp - 0x48], 0x5f4b
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002a7c1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe40], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002a7ad
xor eax, eax
dec dword [ebp - 0x48]
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a7dc
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
xor eax, eax
push 3
inc ecx
pop edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002a7fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa5c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002a7e5
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002a81d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbf8], 0x2eac4530
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002a805
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002a83d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc04], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002a825
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002a84c
cmp dword [ebp - 0xbf0], eax
je 0x1002a84c
mov eax, ecx
mov dword [ebp - 0xc00], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002a86b
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x48], 0xfffffff6
dec dword [ebp - 0x48]
jne 0x1002a871
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002a859
mov dword [ebp - 0x2bc], 0xffffffe6
cmp dword [ebp - 0x2bc], 0xffffffe9
je 0x1002a936
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x18], 0x7e2799ac
mov dword [ebp - 0x18], eax
jmp 0x1002a8d0
mov dword [ebp - 0x40], 0xfd4914d2
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a8c7
push 0x10c9
push eax
push eax
push 0x1423
push eax
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xe
jle 0x1002a89e
mov dword [ebp - 0x40], 2
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2bc]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0xa5c], edx
mov eax, dword [ebp - 0x2b8]
cmp edx, eax
push 3
setne cl
imul eax, ecx, 0x8064
pop edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2b4]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x2bc]
cmp dword [ebp - 0x2bc], 0xffffffe9
jne 0x1002a888
mov dword [ebp - 0x3c], 0x862f
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a954
push eax
push 0x10e6
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002a96c
push eax
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
xor eax, eax
mov dword [ebp - 0x3c], 0x70ad6f2e
xor ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
push 7
pop edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x5a8], eax
mov dword [ebp - 0x5a4], eax
mov dword [ebp - 0x5a0], eax
mov dword [ebp - 0x59c], eax
mov dword [ebp - 0x3c], 0xafa2fafd
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x3c], 0x3de0369b
mov dword [ebp - 0x48], 0x843631e1
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002a9d5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xed0], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002a9c1
xor eax, eax
inc dword [ebp - 0x48]
mov dword [ebp - 0x1c], 0xffffffeb
jmp 0x1002aa05
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x17
jl 0x1002aa02
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x17
jge 0x1002a9f1
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffea
jge 0x1002a9e1
mov byte [ebp - 0x1d], al
mov dword [ebp - 0x10], 0xb950ba1b
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x48], 0x9a6fdd8f
mov dword [ebp - 0x48], 0x5ee6d54e
mov dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x48], 0xbfae
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], eax
jmp 0x1002aa51
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc1c], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002aa40
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x10]
test edx, edx
jne 0x1002aa77
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
setne dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x48]
sub edx, eax
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x34]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
imul ecx, ecx, 0x21ad
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
setg dl
add ecx, edx
xor edx, edx
mov dword [ebp - 0xc18], ecx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x48], ecx
mov ecx, 0xb2f14481
cmp dword [ebp - 0x48], 0x9dba5c12
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
cmp byte [ebp - 0x1d], 0
je 0x1002ac88
mov dword [ebp - 0x10], 0x452a26f
xor eax, eax
mov dword [ebp - 0x30], 0xf885bd52
mov dword [ebp - 0x2c], 0x610a1434
mov dword [ebp - 0x44], 0x44ed25e4
mov dword [ebp - 0x10], 0xb21a
cmp dword [ebp - 0x10], eax
je 0x1002ab77
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
push 0xfffffffffffffffe
setne dl
pop eax
sub edx, eax
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [ebp - 0x10]
cmp ecx, 0x637c1d6b
setl al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002ab92
cmp dword [ebp - 0x10], eax
jne 0x1002ab95
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
jmp 0x1002ac7b
mov dword [ebp - 0x4c], 0x684085ef
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002abce
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd8c], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002abb5
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002abf4
mov dword [ebp - 0x44], 3
cmp dword [ebp - 0x44], eax
jl 0x1002abf1
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002abec
call edi
xor eax, eax
dec dword [ebp - 0x44]
jns 0x1002abdf
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe8
je 0x1002abd3
mov dword [ebp - 0x44], eax
jmp 0x1002ac72
mov dword [ebp - 0x40], 0x8539aea1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x1002ac6f
mov dword [ebp - 0x18], eax
jmp 0x1002ac25
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa6c], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002ac14
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0xd8c]
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffffc
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
add ecx, 0x39bb
cmp ecx, eax
setle dl
mov dword [ebp - 0xa68], edx
mov eax, dword [ebp - 0x44]
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
pop eax
jle 0x1002ac0f
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jle 0x1002abff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x19
jge 0x1002aba5
push eax
call esi
mov esi, 0x48261f9c
xor edx, edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xfffffffa
cmp dword [ebp - 0x2c], 0xffffffec
je 0x1002add2
push 2
xor eax, eax
inc edx
pop ecx
mov dword [ebp - 0x28], 0xe1c97412
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002acd0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3a0], 0x446df37d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002acb8
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002acf2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x46c], 0xd4f2887c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002acd9
xor eax, eax
mov dword [ebp - 0x468], eax
jmp 0x1002ad0c
mov dword [ebp - 0x40], 8
cmp dword [ebp - 0x40], eax
jne 0x1002ad14
inc dword [ebp - 0x468]
cmp dword [ebp - 0x468], edx
jle 0x1002acfa
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x1002adc3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002ad42
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x358], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002ad29
xor eax, eax
mov dword [ebp - 0x358], eax
jmp 0x1002ada3
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x1002ad9d
mov dword [ebp - 0x18], 0x5b1b6fd4
mov eax, dword [ebp - 0x1c]
push 2
mov ecx, dword [ebp + eax*4 - 0x3a0]
mov eax, dword [ebp - 0x358]
mov dword [ebp + eax*4 - 0x3a0], ecx
xor eax, eax
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002ad8e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3a0], 0xdca27289
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002ad7d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002ad55
xor eax, eax
inc dword [ebp - 0x358]
cmp dword [ebp - 0x358], edx
jle 0x1002ad4a
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x354], eax
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x1002ad20
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffec
jne 0x1002aca9
jmp 0x1002add3
inc edx
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xffffffea
cmp dword [ebp - 0x2c], 0x17
jne 0x1002ae52
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002ae16
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9ec], 0x405b4019
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002adfe
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002ae41
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002ae3e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9ec], 0x2e6e7f73
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002ae26
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jne 0x1002ae1b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x17
je 0x1002adf6
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
xor eax, eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002ae7a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb8], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002ae62
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002ae97
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xb8]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x1002ae7f
mov eax, dword [ebp - 0xb8]
xor ecx, ecx
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xb8]
test eax, eax
mov eax, dword [ebp - 0xb8]
setns cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0xb8]
mov byte [ebp - 0x1d], al
je 0x1002af01
cmp byte [ebp - 0x1d], al
je 0x1002af50
push 0x1fe5
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
jmp 0x1002af4e
cmp byte [ebp - 0x1d], al
je 0x1002af18
push eax
xor eax, eax
inc eax
push eax
push 0x674
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x1002af4e
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002af3a
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xb8]
inc dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jle 0x1002af20
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xfffffffa
cmp dword [ebp - 0x2c], 0xffffffec
je 0x1002b091
xor edx, edx
push 2
inc edx
pop ecx
mov dword [ebp - 0x28], 0xe1c97412
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002af91
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3a8], 0x446df37d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002af79
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002afb3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x47c], 0xd4f2887c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002af9a
xor eax, eax
mov dword [ebp - 0x478], eax
jmp 0x1002afcd
mov dword [ebp - 0x40], 8
cmp dword [ebp - 0x40], eax
jne 0x1002afd5
inc dword [ebp - 0x478]
cmp dword [ebp - 0x478], edx
jle 0x1002afbb
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x1002b084
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002b003
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x388], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002afea
xor eax, eax
mov dword [ebp - 0x388], eax
jmp 0x1002b064
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x1002b05e
mov dword [ebp - 0x18], 0x5b1b6fd4
mov eax, dword [ebp - 0x1c]
push 2
mov ecx, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x388]
mov dword [ebp + eax*4 - 0x3a8], ecx
xor eax, eax
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002b04f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3a8], 0xdca27289
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002b03e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002b016
xor eax, eax
inc dword [ebp - 0x388]
cmp dword [ebp - 0x388], edx
jle 0x1002b00b
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x384], eax
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x1002afe1
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffec
jne 0x1002af6a
mov dword [ebp - 0x28], 0x22ba3946
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002b0b9
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf1c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002b0a4
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x1002b0fe
xor edi, edi
inc edi
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002b0db
call ebx
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002b0f0
push eax
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x1002b0c7
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 3
pop ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xfffffffa
cmp dword [ebp - 0x2c], 0xffffffec
je 0x1002b23d
xor edx, edx
push 2
inc edx
pop esi
mov dword [ebp - 0x28], 0xe1c97412
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002b13f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3b8], 0x446df37d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002b127
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002b15f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x454], 0xd4f2887c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002b147
xor eax, eax
mov dword [ebp - 0x450], eax
jmp 0x1002b179
mov dword [ebp - 0x40], 8
cmp dword [ebp - 0x40], eax
jne 0x1002b181
inc dword [ebp - 0x450]
cmp dword [ebp - 0x450], edx
jle 0x1002b167
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x1002b230
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002b1a9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x37c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002b195
xor eax, eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], edx
jg 0x1002b218
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x1002b207
mov dword [ebp - 0x18], 0x5b1b6fd4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x3b8]
mov eax, dword [ebp - 0x37c]
mov dword [ebp + eax*4 - 0x3b8], ecx
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002b1f8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3b8], 0xdca27289
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002b1e7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002b1c2
xor eax, eax
inc dword [ebp - 0x37c]
cmp dword [ebp - 0x37c], edx
jle 0x1002b1b7
push 3
pop ecx
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x378], eax
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x1002b18d
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffec
jne 0x1002b118
mov esi, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edx, 0xfffc
mov dword [ebp - 0x1c], 0xea5d6c05
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffec
jg 0x1002b32e
mov edi, 0xab391500
mov dword [ebp - 0x18], 0xf0aa6e6f
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xffff
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jge 0x1002b295
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
cmp eax, 0x3248
je 0x1002b2ff
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xfffffffa
mov dword [ebp - 0x48], 0x20f620a
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x18], eax
jl 0x1002b2cf
mov dword [ebp - 0x48], 0x494dfd99
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setne dl
cmp edi, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
jmp 0x1002b314
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002b319
call ebx
push eax
call esi
mov edx, 0xfffc
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffec
jle 0x1002b268
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, eax
mov dword [ebp - 0x2c], eax
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x48], 0xee76373a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002b35f
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x404], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002b34a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x1002b453
xor esi, esi
or edi, 0xffffffff
mov dword [ebp - 0x10], 0xf8256a9e
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x1002b43a
mov dword [ebp - 0x7f8], edi
mov dword [ebp - 0x7f4], edi
mov dword [ebp - 0x7f0], edi
mov dword [ebp - 0x7ec], edi
cmp dword [ebp - 0x404], eax
jne 0x1002b3f2
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x404]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x404]
cmp edx, eax
mov eax, dword [ebp - 0x10]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
imul edx, dword [ebp + eax*4 - 0x404]
test edx, edx
jne 0x1002b3f2
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x400], eax
je 0x1002b3f5
lea edx, [esi + 1]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x404]
cmp eax, edx
setl cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x48]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x7f0], ecx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002b42e
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
dec dword [ebp - 0x10]
push 0
pop eax
jns 0x1002b388
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002b371
mov esi, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002b46f
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], 0x3644
mov dword [ebp - 0x34], 0xf6f97812
mov dword [ebp - 0x48], 0xb7136239
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002b4ae
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x230], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002b499
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002b4c4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x938], 0x1c2e9378
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002b4b3
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002b4e0
mov eax, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x938], ecx
mov eax, dword [ebp - 0x22c]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x230]
je 0x1002b522
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002b522
xor edx, edx
mov ecx, eax
inc edx
jmp 0x1002b527
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [ebp - 0x28]
imul eax, ecx
cmp dword [ebp - 0x28], eax
je 0x1002b540
xor eax, eax
cmp dword [ebp - 0x230], eax
je 0x1002b542
mov ecx, edx
jmp 0x1002b544
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x1c33c017
sete al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
or eax, 0xffffffff
mov dword [ebp - 0x30], 0x7e4fc22
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x40], 0x78ef8a6e
mov dword [ebp - 0x38], 0x7276cc72
mov dword [ebp - 0x18], eax
jmp 0x1002b58b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb10], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002b57a
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
mov eax, dword [ebp - 0x30]
neg ecx
mov eax, dword [ebp - 0x30]
sub eax, 9
add eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x30]
je 0x1002b62a
mov dword [ebp - 0x48], 0x3bd791f9
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x1002b615
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x3c], 0xe9f9034e
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0xb10]
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xb10], ecx
inc dword [ebp - 0x48]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jle 0x1002b5e5
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002b63d
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x1002b63d
inc eax
mov dword [ebp - 0x40], 0x6ac116e0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 0xffffffea
cmp dword [ebp - 0x44], 0x17
jne 0x1002bc9f
xor edi, edi
mov esi, 0xfffa
inc edi
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002b680
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe58], 0x648261f9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002b667
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002b69c
push 0x224d
push 0x2333
push eax
call dword [sym.imp.USER32.dll_InflateRect]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002b6b9
push 0x1284
push eax
push eax
push 0xcac
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
mov dword [ebp - 0x2c], 0xd5e48d32
mov dword [ebp - 0x2c], eax
jmp 0x1002b732
mov dword [ebp - 0x1c], 0x665683c8
mov dword [ebp - 0x1c], 0xe
jmp 0x1002b729
mov dword [ebp - 0x18], 0x5b40194
mov dword [ebp - 0x18], 0xb
jmp 0x1002b720
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002b70b
push eax
push 0x947
push 0x7fa
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002b71d
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x11
jg 0x1002b6e5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1b
jne 0x1002b6d5
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffee
jle 0x1002b6c5
mov dword [ebp - 0x18], 0xb22124f8
mov dword [ebp - 0x18], eax
jmp 0x1002b755
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa54], 0x387fb0b0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002b744
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002b778
mov dword [ebp - 0x48], 0xffff
inc dword [ebp - 0x48]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jg 0x1002b76b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002b7a0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x948], 0x405b4019
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002b787
xor eax, eax
push 0xfffffffffffffffe
mov dword [ebp - 0x3c], 4
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002b7cf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd74], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002b7b6
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002b7ed
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbb0], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002b7d8
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002b80c
push 0x4df
push eax
push 0x199d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
dec dword [ebp - 0xba8]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
je 0x1002bc86
push 3
pop ebx
jmp 0x1002b825
xor eax, eax
mov dword [ebp - 0x18], 0xfffb
mov dword [ebp - 0x48], 0x23498e64
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0x30467731
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1002b85b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x570], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1002b846
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1002b87c
push 0xfffffffffffffffb
pop ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x818], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1002b867
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1002b89b
or ecx, 0xffffffff
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x318], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1002b888
mov eax, dword [ebp - 0x18]
mov edx, 0xffff0001
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
sub edx, eax
add edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x80c], edx
mov eax, dword [ebp - 0x564]
cmp eax, edx
mov eax, dword [ebp - 0x56c]
mov edx, dword [ebp - 0x564]
setl cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setle bl
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0x564]
cmp edx, ebx
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x564]
setl dl
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x570]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x80c], eax
je 0x1002b9d7
mov dword [ebp - 0x34], 0xd9fa
mov dword [ebp - 0x40], 0xa1372625
mov dword [ebp - 0x28], 0xf6a1241a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002b959
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3c8], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002b946
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x314]
mov eax, dword [ebp - 0x3c4]
cmp dword [ebp - 0x80c], eax
jne 0x1002b988
mov eax, dword [ebp - 0x80c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x314]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x564]
mov eax, dword [ebp - 0x314]
mov eax, dword [ebp - 0x314]
xor eax, eax
cmp dword [ebp - 0x3c4], eax
je 0x1002b9c0
mov edx, edi
cmp dword [ebp - 0x24], eax
jne 0x1002b9c2
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
push 3
setg cl
mov dword [ebp - 0x314], ecx
pop ebx
jmp 0x1002ba00
push 3
pop ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002ba00
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002b9fb
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002b9e2
xor eax, eax
mov ecx, 0x2d4ea680
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x858], ecx
mov dword [ebp - 0x854], ecx
mov dword [ebp - 0x850], ecx
mov dword [ebp - 0x84c], ecx
mov dword [ebp - 0x28], 0x28ed
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ba4c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa80], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ba38
xor eax, eax
mov dword [ebp - 0x18], 0xcff0ea75
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x10
jne 0x1002bb6f
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x1c], 0xe5c285ce
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x1002bb3a
mov dword [ebp - 0x34], 0xeb32a831
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002ba9d
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov ecx, 0x1dda8db8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x858], ecx
mov dword [ebp - 0xa80], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp esi, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
je 0x1002bad0
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002bad2
mov edx, edi
jmp 0x1002bad4
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
sete cl
add ecx, 8
cmp ecx, dword [ebp - 0x10]
jg 0x1002baf2
xor eax, eax
mov edx, eax
cmp dword [ebp - 0xa80], eax
je 0x1002baf4
mov edx, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
neg eax
je 0x1002bb0b
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
setge dl
imul edx, dword [ebp - 0x10]
add edx, 0xffff
mov dword [ebp - 0x40], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1002ba7d
push 0xfffffffffffffffb
xor eax, eax
pop ecx
mov dword [ebp - 0x1c], eax
jmp 0x1002bb5d
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002bb5a
push eax
push eax
push 0xcf9
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0xfffffffffffffffb
xor eax, eax
pop ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002bb3f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x10
je 0x1002ba63
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002bc74
jmp 0x1002bb80
xor eax, eax
mov dword [ebp - 0x10], 0xb4ffb87
mov dword [ebp - 0x48], 0xfffffff8
mov dword [ebp - 0x40], 0xf8d36fbc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002bbb2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x58], 0x64a6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002bb9d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1002bc53
mov dword [ebp - 0x48], 2
xor ecx, ecx
mov dword [ebp - 0x48], 0x4f9dbc9b
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x58]
cmp edx, eax
setne cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x58]
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x1002bc0c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
neg eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x10]
jns 0x1002bbbe
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x948], 0x2e6e7f73
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002bb7e
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jne 0x1002b823
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x17
je 0x1002b65c
mov esi, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
or edx, 0xffffffff
mov dword [ebp - 0x1c], edx
inc ecx
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002bccd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x98], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002bcb5
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002bcea
mov dword [ebp - 0x48], edx
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x98]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x1002bcd2
mov eax, dword [ebp - 0x98]
xor ecx, ecx
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x98]
test eax, eax
mov eax, dword [ebp - 0x98]
setns cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x98]
mov byte [ebp - 0x1d], al
je 0x1002bd54
cmp byte [ebp - 0x1d], al
je 0x1002bda3
push 0x1fe5
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
jmp 0x1002bda1
cmp byte [ebp - 0x1d], al
je 0x1002bd6b
push eax
xor eax, eax
inc eax
push eax
push 0x674
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x1002bda1
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002bd8d
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x98]
inc dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jle 0x1002bd73
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov dword [ebp - 0x2c], 0xa906
inc ecx
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002bddd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x174], 0xdfddae9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002bdc5
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002bdef
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002bdf7
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x2c]
mov eax, 0xffbe6269
je 0x1002bf37
mov dword [ebp - 0x754], eax
mov dword [ebp - 0x750], eax
mov dword [ebp - 0x74c], eax
mov dword [ebp - 0x748], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002bf53
xor edi, edi
mov dword [ebp - 0x40], 0x20a048c8
mov dword [ebp - 0x4c], 0xb265d632
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x34], 0xaadaf8d9
mov dword [ebp - 0x10], eax
jmp 0x1002bf17
mov dword [ebp - 0x18], 0x7ea4c570
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002bf14
mov eax, dword [ebp - 0x10]
xor esi, esi
cmp dword [ebp + eax*4 - 0x174], esi
je 0x1002bee8
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x174], esi
je 0x1002bea3
xor eax, eax
cmp dword [ebp - 0x754], eax
je 0x1002bea5
lea edx, [edi + 1]
jmp 0x1002bea7
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x174]
mov eax, dword [ebp - 0x10]
imul ecx, dword [ebp + eax*4 - 0x174]
xor eax, eax
cmp edx, ecx
setge al
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x4c]
jle 0x1002bed4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x754]
mov eax, dword [ebp - 0x38]
lea eax, [edi + 1]
jmp 0x1002beea
xor eax, eax
or ecx, 0xffffffff
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 9
setne al
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x18]
jns 0x1002be7a
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002be67
dec dword [ebp - 0x2c]
jns 0x1002be3c
mov esi, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x1002bf53
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002bf51
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
xor eax, eax
mov dword [ebp - 0x28], 0x22ba3946
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002bf7b
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf3c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002bf66
xor eax, eax
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x1002bfbe
xor edi, edi
inc edi
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002bf9e
call ebx
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002bfb3
push eax
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x1002bf8a
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x1c], 8
cmp dword [ebp - 0x1c], 6
jne 0x1002c04c
jmp 0x1002bfd6
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x2c], eax
jmp 0x1002bff3
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9f8], 0x1220985a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002bfe2
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
mov dword [ebp - 0x9f8], ecx
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], 0x2c
jge 0x1002c043
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002c043
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002c03a
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2c
jl 0x1002c023
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 6
je 0x1002bfd4
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002c075
push 0x1669
push eax
push 0x1f53
push 0x7d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
mov dword [ebp - 0x1c], edx
inc ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002c0a1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9c], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002c089
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002c0be
mov dword [ebp - 0x48], edx
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x9c]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x1002c0a6
mov eax, dword [ebp - 0x9c]
xor ecx, ecx
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x9c]
test eax, eax
mov eax, dword [ebp - 0x9c]
setns cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x9c]
mov byte [ebp - 0x1d], al
je 0x1002c128
cmp byte [ebp - 0x1d], al
je 0x1002c179
push 0x1fe5
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
jmp 0x1002c179
cmp byte [ebp - 0x1d], al
je 0x1002c13f
push eax
xor eax, eax
inc eax
push eax
push 0x674
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x1002c179
jmp 0x1002c14b
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002c165
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x9c]
inc dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jle 0x1002c149
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x10], 0x63785551
mov dword [ebp - 0x34], 0x5d1cb6a7
mov eax, dword [ebp - 0x2c]
sub eax, 6
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c], 0x2f3c
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x2c]
cmp ecx, 0xd5493e6
je 0x1002c1de
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002c1ec
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x1002c1ea
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002c1fa
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
push 3
setle dl
sub edx, dword [ebp - 0x10]
neg edx
pop ecx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x15a4c4ae
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jge 0x1002c247
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x668], 0x67e7
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x1002c22f
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jge 0x1002c266
or edx, 0xffffffff
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x7b8], edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x1002c252
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002c428
mov dword [ebp - 0x18], 0x71867b8f
xor ecx, ecx
mov dword [ebp - 0x1c], 0x5c1d1022
inc ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jge 0x1002c2a0
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x560], 5
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x1002c288
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002c2b2
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x2c4], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1002c2a5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
sete dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x560], edx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
test eax, eax
setle cl
xor eax, eax
sub ecx, edx
sub ecx, 3
cmp ecx, 0x6f49c23e
setle al
mov dword [ebp - 0x2c4], eax
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x13
je 0x1002c49c
xor esi, esi
inc esi
or edi, 0xffffffff
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x2c], eax
jmp 0x1002c360
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002c35d
push 0x251
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x10
jle 0x1002c344
cmp dword [ebp - 0x1c], eax
jne 0x1002c3e5
cmp dword [ebp - 0x10], eax
jne 0x1002c3e5
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
xor eax, eax
imul edx, dword [ebp - 0x18]
cmp edx, 0xfffffff9
setg al
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002c399
mov eax, dword [ebp - 0x2c4]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
je 0x1002c3a4
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002c401
mov eax, dword [ebp - 0x2c4]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x7b8], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x13
push 0
pop eax
jne 0x1002c335
mov esi, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x1002c49a
mov dword [ebp - 0x48], 0x46d72d30
mov dword [ebp - 0x18], eax
jmp 0x1002c445
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb30], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c434
mov eax, dword [ebp - 0x7b0]
mov ecx, dword [ebp - 0xb24]
mov eax, dword [ebp - 0x668]
neg ecx
sbb ecx, ecx
add ecx, 0xffff6bc5
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
je 0x1002c47d
xor eax, eax
cmp dword [ebp - 0xb2c], eax
je 0x1002c47f
inc eax
jmp 0x1002c47f
xor eax, eax
imul eax, eax, 0x3791eac4
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
xor eax, eax
inc eax
mov dword [ebp - 0x7b8], eax
xor eax, eax
mov dword [ebp - 0x24], 0x48261f9c
mov dword [ebp - 0x1c], 0xea5d6c05
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffec
jg 0x1002c58e
mov edi, 0xab391500
mov ecx, 0xfffc
mov dword [ebp - 0x18], 0xf0aa6e6f
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xffff
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jge 0x1002c4f5
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
cmp eax, 0x3248
je 0x1002c55f
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xfffffffa
mov dword [ebp - 0x48], 0x20f620a
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x18], eax
jl 0x1002c52f
mov dword [ebp - 0x48], 0x494dfd99
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setne dl
cmp edi, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
jmp 0x1002c574
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002c579
call ebx
push eax
call esi
mov ecx, 0xfffc
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffec
jle 0x1002c4c8
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, eax
xor esi, esi
mov dword [ebp - 0x24], 0xfffffffa
inc esi
cmp dword [ebp - 0x24], 0xffffffec
je 0x1002df8f
mov edi, 0x1012106d
jmp 0x1002c5b1
mov dword [ebp - 0x18], 0xa3df603f
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x1c], eax
jmp 0x1002c5e2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x958], 0x6fc2e607
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002c5d1
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x34], 0x8cafa32f
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
test eax, eax
mov eax, dword [ebp - 0x18]
setns cl
add eax, 0xffff0001
add eax, ecx
xor edx, edx
imul ecx, eax, 0x2929
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
add edx, 0x9ea4
jne 0x1002c62d
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x40], eax
je 0x1002c62f
mov ecx, esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x48]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x958], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002c673
push eax
push 0x14b4
push 0x1ae4
push eax
push 0xd1d
push 0x22b8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x18], 0x6e6c8cac
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1002c6aa
push 2
pop ebx
xor eax, eax
mov dword [ebp - 0x28], 0x22ba3946
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002dfbc
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf5c], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002dfa7
xor eax, eax
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x1002dffa
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002dfe0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002dff5
push eax
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x1002dfc8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002e01f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8ac], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002e006
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002e108
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x48], 0x7f19
mov dword [ebp - 0x38], 0x1fa4c821
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002e065
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb50], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002e04c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x1002e105
cmp dword [ebp - 0x1c], ebx
jle 0x1002e027
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002e123
push esi
call dword [sym.imp.USER32.dll_ShowCursor]
xor eax, eax
or ebx, 0xffffffff
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], 0xa906
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002e15a