Function at 0x1002ba37
Capabilities:
Accept command line arguments
Delete file
Delete registry key
Get file attributes
Get session user name
Get thread local storage value
Query environment variable
Query or enumerate registry value
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x1007bf36
call fcn.1007b8f0
mov eax, 0x1194
call fcn.100780a0
push ebx
push esi
push edi
push 9
pop edi
mov byte [ebp - 0xb1], dl
xor eax, eax
mov edx, 0xce125d16
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x38], edi
push 3
mov dword [ebp - 0x10], eax
pop ebx
cmp dword [ebp - 0x10], ebx
jge 0x1002ba8a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xde0], 0xfff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002ba72
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x24], ecx
mov esi, 0xf782
cmp dword [ebp - 0x24], eax
jl 0x1002baa7
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], eax
jne 0x1002baa7
dec dword [ebp - 0x24]
jns 0x1002ba9a
mov dword [ebp - 0x24], edi
push 8
pop edi
cmp dword [ebp - 0x24], edi
jge 0x1002bac5
mov eax, dword [ebp - 0xddc]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002bab2
xor eax, eax
mov dword [ebp - 0x24], edx
push 9
pop edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002baee
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd2c], 0xfff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002bad6
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x1002bb03
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], eax
jne 0x1002bb03
dec dword [ebp - 0x24]
jns 0x1002baf6
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], edi
jge 0x1002bb1e
mov eax, dword [ebp - 0xd28]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002bb0b
xor eax, eax
mov edi, 0x76ff55e0
mov esi, 0x76820624
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x5fc], edi
mov dword [ebp - 0x5f8], edi
mov dword [ebp - 0x5f4], edi
mov dword [ebp - 0x5f0], edi
mov dword [ebp - 0x18], eax
jmp 0x1002bb6d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x1002bb6a
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x5fc], 0
jne 0x1002bb68
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1002bb53
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xd
jle 0x1002bb48
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff1
je 0x1002bb9f
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jne 0x1002bb9c
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff1
push 0
pop eax
jne 0x1002bb7c
push 2
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002bbbf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x36c], 0x68206240
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002bba7
xor eax, eax
mov dword [ebp - 0x36c], 0xffffffee
jmp 0x1002bc2f
cmp byte [ebp - 0x39], 0
je 0x1002bc29
push 0x9f3
push 0x1501
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
inc dword [ebp - 0x36c]
cmp dword [ebp - 0x36c], 0x15
mov byte [ebp - 0x39], al
je 0x1002bc10
cmp byte [ebp - 0x39], 0
je 0x1002bc4f
push eax
push 0x22f6
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov dword [ebp - 0x24], 0xce125d16
xor ebx, ebx
mov dword [ebp - 0x38], 9
inc ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x38], 0xfffffff7
push 6
mov dword [ebp - 0x4c], eax
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002bc96
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x564], 0xb78acc4b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002bc7e
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002bcac
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1e4], 0x4a90c6d2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002bc9b
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x564], ecx
mov eax, dword [ebp - 0x1e4]
add eax, ecx
mov ecx, ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1e4]
sub ecx, eax
xor eax, eax
cmp ecx, 0x3e86
push 0xfffffffffffffffb
setg al
xor ecx, ecx
pop edx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x40e1
mov ecx, 0xccd20446
setne al
sub eax, 0xa3c3d214
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x38]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1e4]
add eax, dword [ebp - 0x4c]
cmp eax, 0x78e6
setle cl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x40], 0x61f9c28a
mov dword [ebp - 0x1c], 0x1d925b0e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], 0x7d3d
dec dword [ebp - 0x24]
mov dword [ebp - 0x1c], 0xffffffe2
cmp dword [ebp - 0x1c], 0xffffffe6
jg 0x1002be5c
push 5
pop edi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], 0x27a4ef21
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002bd93
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd44], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002bd7a
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002bdf1
mov eax, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setg bl
sub ebx, dword [ebp - 0x18]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
sub ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ebx, edi
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x24]
jle 0x1002bdee
inc ebx
mov eax, ebx
jmp 0x1002bdf1
xor eax, eax
inc ebx
cmp eax, dword [ebp - 0x18]
je 0x1002bdff
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002be01
mov ecx, ebx
mov eax, dword [ebp - 0x24]
sub ecx, eax
cmp ecx, ebx
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x1002be16
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002be2d
mov edx, ebx
cmp dword [ebp - 0x40], eax
jne 0x1002be2f
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x5faafe30
setg al
mov dword [ebp - 0xd3c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe6
jle 0x1002bd65
mov edi, 0x76ff55e0
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1002be81
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd5c], 0xfff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002be69
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x48], 0xffffffff
cmp dword [ebp - 0x24], eax
jl 0x1002bf5a
mov esi, dword [ebp - 0x48]
jmp 0x1002be9e
xor eax, eax
mov dword [ebp - 0x58], 0xf782
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], 0x31ea062
mov dword [ebp - 0x18], eax
jmp 0x1002bf16
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xdfddae9
mov dword [ebp - 0x4c], 0x94ff5452
cmp dword [ebp - 0x10], eax
jne 0x1002bf1c
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
dec edx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x18]
jle 0x1002befb
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
push 2
pop ecx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xfffffff1
jne 0x1002beb4
mov dword [ebp - 0x18], 0xffffffe4
jmp 0x1002bf3c
mov dword [ebp - 0x38], 0xf23d37f4
mov dword [ebp - 0x30], 0xaffa898c
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
jg 0x1002bf25
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x1002bf52
dec dword [ebp - 0x24]
jns 0x1002be9c
push 3
mov esi, 0x76820624
pop edx
push 9
pop eax
mov dword [ebp - 0x24], eax
push 8
pop eax
cmp dword [ebp - 0x24], eax
jge 0x1002bf80
push eax
pop edi
mov eax, dword [ebp - 0xd58]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002bf6a
mov edi, 0x76ff55e0
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x60c], edi
mov dword [ebp - 0x608], edi
mov dword [ebp - 0x604], edi
mov dword [ebp - 0x600], edi
mov dword [ebp - 0x18], eax
jmp 0x1002bfc7
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jg 0x1002bfc4
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x60c], 0
jne 0x1002bfc2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1002bfad
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xd
jle 0x1002bfa2
mov dword [ebp - 0x18], eax
jmp 0x1002bfec
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jne 0x1002bff2
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xfffffff1
jne 0x1002bfd2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0x76270e7a
mov dword [ebp - 0x2c], 0x1f7d9671
mov dword [ebp - 0x2c], 0xdc0223de
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x9b95
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002c03c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1110], 0x77c422d5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c023
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002c05c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa90], 0xfff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002c044
xor eax, eax
mov dword [ebp - 0x10], 0xac70c309
mov ecx, 0xffff
cmp dword [ebp - 0x10], eax
jne 0x1002c0a2
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
cmp eax, 0xcabf
jge 0x1002c094
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002c096
mov eax, ebx
cmp dword [ebp - 0x10], eax
je 0x1002c0a2
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002c0a4
mov eax, ebx
xor edx, edx
cmp eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0xa8c]
mov dword [ebp - 0x10], 0x5b9b55bb
mov dword [ebp - 0x4c], 0xedad94e8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff2
jge 0x1002c1a3
mov dword [ebp - 0x20], eax
jmp 0x1002c13d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x468], 0xbdbdf7c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002c12c
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x468]
cmp eax, 0x82d5
setg cl
xor eax, eax
test ecx, ecx
setns al
cmp eax, dword [ebp - 0x468]
jl 0x1002c16b
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x4c], 0xfffffffd
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x468], 0x9d73
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002c193
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff2
push 0
pop eax
jl 0x1002c0dc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002c1c5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x384], 0x68206240
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002c1ac
xor eax, eax
mov dword [ebp - 0x384], 0xffffffee
jmp 0x1002c1f0
cmp byte [ebp - 0x39], 0
je 0x1002c1ea
push 0x9f3
push 0x1501
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
inc dword [ebp - 0x384]
cmp dword [ebp - 0x384], 0x15
mov byte [ebp - 0x39], al
je 0x1002c1d1
cmp byte [ebp - 0x39], 0
je 0x1002c210
push eax
push 0x22f6
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x38], 0xfffffff7
push 6
mov dword [ebp - 0x4c], eax
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c246
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5b0], 0xb78acc4b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c22e
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c25c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x238], 0x4a90c6d2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c24b
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x5b0], ecx
mov eax, dword [ebp - 0x238]
add eax, ecx
mov ecx, ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x238]
sub ecx, eax
xor eax, eax
cmp ecx, 0x3e86
push 9
setg al
xor ecx, ecx
cmp eax, 0xfffffffb
setne cl
xor eax, eax
cmp ecx, 0x40e1
mov ecx, 0xccd20446
setne al
sub eax, 0xa3c3d214
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x38]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x238]
add eax, dword [ebp - 0x4c]
cmp eax, 0x78e6
pop eax
setle cl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], 0xce125d16
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 0x61f9c28a
mov dword [ebp - 0x1c], 0x1d925b0e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], 0x7d3d
dec dword [ebp - 0x24]
mov dword [ebp - 0x1c], 0xffffffe2
cmp dword [ebp - 0x1c], 0xffffffe6
jg 0x1002c417
push 5
pop esi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], 0x27a4ef21
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002c34e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd74], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002c335
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002c3ac
mov eax, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setg bl
sub ebx, dword [ebp - 0x18]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
sub ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ebx, esi
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x24]
jle 0x1002c3a9
inc ebx
mov eax, ebx
jmp 0x1002c3ac
xor eax, eax
inc ebx
cmp eax, dword [ebp - 0x18]
je 0x1002c3ba
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002c3bc
mov ecx, ebx
mov eax, dword [ebp - 0x24]
sub ecx, eax
cmp ecx, ebx
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x1002c3d1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002c3e8
mov edx, ebx
cmp dword [ebp - 0x40], eax
jne 0x1002c3ea
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x5faafe30
setg al
mov dword [ebp - 0xd6c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe6
jle 0x1002c320
mov esi, 0x76820624
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], 0x31ea062
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff1
je 0x1002c4a0
mov edi, dword [ebp - 0x48]
push 5
pop esi
push 8
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0xdfddae9
mov dword [ebp - 0x4c], 0x94ff5452
cmp dword [ebp - 0x10], eax
jne 0x1002c496
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
dec edx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x18]
jle 0x1002c474
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], 2
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff1
push 0
pop eax
jne 0x1002c432
mov edi, 0x76ff55e0
mov esi, 0x76820624
mov dword [ebp - 0x18], 0xffffffe4
jmp 0x1002c4c0
mov dword [ebp - 0x38], 0xf23d37f4
mov dword [ebp - 0x30], 0xaffa898c
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
jg 0x1002c4a9
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002c4eb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd8c], 0xfff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c4d3
xor eax, eax
mov dword [ebp - 0x10], 0x394a
mov edx, 0x773196e8
mov dword [ebp - 0x38], 0x8ee1d110
mov dword [ebp - 0xa2c], edx
mov dword [ebp - 0xa28], edx
mov dword [ebp - 0xa24], edx
mov dword [ebp - 0xa20], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002c536
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xaa4], 0x65f4e26c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002c51e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c556
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5d0], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c53e
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002c59e
cmp dword [ebp - 0x38], eax
jne 0x1002c567
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x1002c569
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x8c007c7b
jbe 0x1002c587
mov ecx, ebx
cmp dword [ebp - 0xaa4], eax
jne 0x1002c589
mov ecx, eax
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x10]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xa2c], eax
xor eax, eax
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], eax
jl 0x1002c7d9
mov esi, dword [ebp - 0x48]
xor edx, edx
mov dword [ebp - 0x20], 0x477862f
inc edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], 0xac3a6081
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002c5f1
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x20], 2
jmp 0x1002c76c
mov dword [ebp - 0x18], 0x98070ade
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002c62c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb38], 0x756a3367
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c613
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002c64e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1064], 0xfe936be8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002c635
xor eax, eax
mov dword [ebp - 0x18], 0xb
jmp 0x1002c6ea
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002c67a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x15c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002c662
xor eax, eax
mov dword [ebp - 0x15c], edx
cmp dword [ebp - 0x15c], eax
jl 0x1002c6df
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002c6ae
push eax
push 0x1b0a
push 0x2078
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002c6d4
push eax
push 0x1002
push 0xeba
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
dec dword [ebp - 0x15c]
jns 0x1002c688
xor edx, edx
inc edx
cmp dword [ebp - 0xb34], eax
jne 0x1002c6f4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x10
jne 0x1002c65a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffef
je 0x1002c766
mov dword [ebp - 0x4c], 0xfc3
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002c729
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc68], 0xbb101eb6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002c710
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002c73c
mov eax, dword [ebp - 0x40]
mov ecx, edx
inc dword [ebp - 0x40]
sub ecx, eax
jne 0x1002c73e
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xc64], edx
mov eax, dword [ebp - 0x18]
cmp eax, edx
push 0
setl cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffef
pop eax
push 1
pop edx
jne 0x1002c6fd
inc dword [ebp - 0x20]
push 1
pop edx
cmp dword [ebp - 0x20], 0xf
jl 0x1002c5fd
mov dword [ebp - 0x38], 0xf782
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], 0xffffffe9
jmp 0x1002c7c0
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002c7a7
push eax
push eax
push 0x931
push 0x13b0
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002c7bd
push 0x1d7d
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
jge 0x1002c789
cmp dword [ebp - 0x38], eax
jne 0x1002c7d4
dec dword [ebp - 0x24]
jns 0x1002c5c8
mov esi, 0x76820624
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x2c], 0xa0a9f4f9
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xcc72b752
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x16e074f0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002c81d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1004], 0x64bda99d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c804
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002c83f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xac8], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c826
xor eax, eax
mov dword [ebp - 0xac8], eax
xor ecx, ecx
mov eax, dword [ebp - 0x38]
test eax, eax
push 9
pop edx
push 8
setns cl
pop eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
push 0xfffffffffffffff6
pop eax
jge 0x1002ca21
xor edi, edi
mov esi, 0x1c37
inc edi
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], eax
mov dword [ebp - 0x3fc], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xfcb50bf3
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x4c], 0x83d1f0df
mov dword [ebp - 0x20], 0x3e469209
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x1002c9e4
mov dword [ebp - 0x10], 0x39c9d940
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002c8f0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9ac], 0x4d9a54e5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002c8d7
xor eax, eax
mov dword [ebp - 0x44], edi
cmp dword [ebp - 0x404], edi
je 0x1002c902
mov edx, eax
cmp dword [ebp - 0x40], eax
je 0x1002c904
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0x408]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, 0x43ee
mov eax, dword [ebp + eax*4 - 0x408]
setg dl
xor ecx, ecx
cmp eax, dword [ebp - 0x48]
setne cl
xor ebx, ebx
cmp ecx, edx
setl bl
sub ebx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x3fc]
setg cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x408]
inc eax
cmp eax, ecx
setge dl
xor ecx, ecx
mov dword [ebp - 0x9a8], edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, 0xd683
setne cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x9ac]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x3fc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x408], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x9a8], esi
mov eax, dword [ebp - 0x30]
cmp eax, esi
pop eax
setge cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x1c]
push 9
pop edx
jns 0x1002c8c4
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002c9f9
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov eax, dword [ebp - 0xd88]
push 8
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], eax
push 9
pop edx
push 0xfffffffffffffff6
pop eax
jl 0x1002c86f
mov edi, 0x76ff55e0
mov esi, 0x76820624
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x61c], edi
mov dword [ebp - 0x618], edi
mov dword [ebp - 0x614], edi
mov dword [ebp - 0x610], edi
mov dword [ebp - 0x18], eax
jmp 0x1002ca6e
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x1002ca6b
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x61c], 0
jne 0x1002ca69
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1002ca53
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xd
jle 0x1002ca43
mov dword [ebp - 0x18], eax
jmp 0x1002ca93
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jne 0x1002ca99
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xfffffff1
jne 0x1002ca79
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 0x24], eax
inc ecx
mov dword [ebp - 0x38], 0x76270e7a
mov dword [ebp - 0x2c], 0x1f7d9671
mov dword [ebp - 0x2c], 0xdc0223de
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0x9b95
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002cae6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1130], 0x77c422d5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002cacd
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002cb08
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xab8], 0xfff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002caef
xor eax, eax
mov dword [ebp - 0x10], 0xac70c309
cmp dword [ebp - 0x10], eax
jne 0x1002cb4e
mov eax, dword [ebp - 0x24]
mov edx, 0xffff
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub eax, edx
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
cmp eax, 0xcabf
jge 0x1002cb40
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002cb42
mov eax, ecx
cmp dword [ebp - 0x10], eax
je 0x1002cb4e
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002cb50
mov eax, ecx
xor edx, edx
cmp eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x38], ecx
xor edx, edx
dec dword [ebp - 0xab4]
inc edx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x44], 0xe713a473
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x4c], 0x4f77722a
mov dword [ebp - 0x2c], ecx
mov ecx, 0x711a
mov dword [ebp - 0x630], ecx
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 0x628], ecx
mov dword [ebp - 0x624], ecx
mov dword [ebp - 0x4c], 0xa2f
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x10], eax
jmp 0x1002cc16
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x914], 0xd513c61c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002cc05
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002cc64
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x628]
mov eax, dword [ebp - 0x628]
je 0x1002cc51
mov eax, dword [ebp - 0x914]
cmp dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x630]
sbb ecx, ecx
inc ecx
sub ecx, eax
je 0x1002cc51
mov eax, edx
jmp 0x1002cc53
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x20]
jl 0x1002cc62
mov ecx, edx
jmp 0x1002cc66
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
imul eax, ecx
cmp eax, edx
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x910], edx
mov eax, dword [ebp - 0x44]
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0x76270e7a
mov dword [ebp - 0x2c], 0x1f7d9671
mov dword [ebp - 0x2c], 0xdc0223de
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0x9b95
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002ccdf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1170], 0x77c422d5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002ccc6
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002cd01
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xaf4], 0xfff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002cce8
xor eax, eax
mov dword [ebp - 0x10], 0xac70c309
cmp dword [ebp - 0x10], eax
jne 0x1002cd47
mov eax, dword [ebp - 0x24]
mov edx, 0xffff
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub eax, edx
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
cmp eax, 0xcabf
jge 0x1002cd39
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002cd3b
mov eax, ecx
cmp dword [ebp - 0x10], eax
je 0x1002cd47
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002cd49
mov eax, ecx
xor edx, edx
cmp eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0xaf0]
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002cd8f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb08], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002cd76
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002cdae
push 0x1cad
push eax
push 0x1c77
push 0x1230
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 0xb00]
xor ecx, ecx
mov eax, dword [ebp - 0xb08]
inc ecx
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], edx
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x44], 0xde21e525
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002ce00
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1058], 0xdc85f70a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002cde7
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002ce1e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1070], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002ce09
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x1002ce9f
mov dword [ebp - 0x2c], 0x835a23e8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002ce4e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x620], 0xb315
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002ce36
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002ce64
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x107c], 0x7c8748af
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002ce53
dec dword [ebp - 0x4c]
xor edx, edx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x620]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
push 0
setne cl
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
pop eax
push 1
pop ecx
jle 0x1002ce27
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x38], 0x65d3384f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002cecb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x490], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002ceb2
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002cee1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe4], 0x9a2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002ced0
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x490]
mov eax, dword [ebp - 0x490]
cmp ecx, eax
mov eax, dword [ebp - 0x490]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
lea eax, [ecx + 0x6c79]
mov ecx, dword [ebp - 0x10]
imul ecx, eax
xor eax, eax
test ecx, ecx
je 0x1002cf24
cmp dword [ebp - 0x48c], eax
je 0x1002cf24
inc eax
add eax, 0x6ee4e912
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1c], 0xe069
xor eax, eax
mov dword [ebp - 0x24], 0x35cb5140
inc eax
mov dword [ebp - 0x40], 0x56d4c01e
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002cf68
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xda4], 0x2b873148
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002cf57
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe4]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
sub eax, edx
je 0x1002cfa7
xor eax, eax
cmp dword [ebp - 0xe4], eax
je 0x1002cfa9
lea ecx, [eax + 1]
jmp 0x1002cfab
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0xf5b872a
setl al
cmp dword [ebp - 0x24], eax
jne 0x1002cfc1
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002cfd1
mov eax, dword [ebp - 0x484]
mov edx, dword [ebp - 0x490]
mov eax, dword [ebp - 0x1c]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x490], ecx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x10]
imul ecx, eax
cmp ecx, dword [ebp - 0x1c]
jg 0x1002d010
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x10], eax
jl 0x1002d021
cmp dword [ebp - 0x24], eax
je 0x1002d021
lea ecx, [eax + 1]
jmp 0x1002d023
mov ecx, eax
mov eax, dword [ebp - 0xe4]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
push 3
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x30]
cmp edx, eax
mov edx, dword [ebp - 0x48]
setg cl
xor eax, eax
mov dword [ebp - 0xda0], ecx
mov dword [ebp - 0x34], esi
xor esi, esi
mov dword [ebp - 0x20], 0xf4727cad
inc esi
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x4c], 0xf42c60ed
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], 0x51acae7
mov dword [ebp - 0x5c], 0x14e76493
mov dword [ebp - 0x10], eax
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], 0xd66e5dc6
mov dword [ebp - 0x44], 0x3cfcb8f1
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x50], 0xbaf1ba13
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x34], 0x8d342731
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002d0c4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb1c], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002d0ac
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002d0e4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x81c], 0x4bca925f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002d0cc
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002d0fa
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x304], 0xfff9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002d0e9
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x814]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp edx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x24], eax
jl 0x1002d27e
mov dword [ebp - 0x28], 7
xor eax, eax
mov dword [ebp - 0x44], 0x864ea5f7
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x40], 0x4c81e2e8
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
jmp 0x1002d19d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4f0], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002d18c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x304]
sub eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, eax, 0xffff
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x4ec]
mov eax, dword [ebp - 0x4ec]
cmp ecx, eax
mov eax, 0xa6da23ae
setge dl
cmp eax, edx
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
neg ecx
dec dword [ebp - 0x1c]
cmp eax, ecx
jg 0x1002d1f4
mov ecx, esi
jmp 0x1002d1f8
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x4ec]
sub ecx, eax
mov eax, dword [ebp - 0x10]
add eax, ecx
mov dword [ebp - 0x58], eax
jne 0x1002d20d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], esi
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb18]
cmp ecx, eax
mov eax, dword [ebp - 0x4ec]
setle dl
imul eax, edx
test eax, eax
jne 0x1002d23d
mov ecx, eax
cmp dword [ebp - 0x5c], eax
je 0x1002d23f
mov ecx, esi
mov eax, dword [ebp - 0x24]
imul eax, ecx
test eax, eax
jne 0x1002d24f
mov eax, dword [ebp - 0x304]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
test eax, eax
setns cl
imul ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x40]
je 0x1002d270
mov eax, dword [ebp - 0x4ec]
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x818], eax
jmp 0x1002d2f8
xor eax, eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002d2a3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd20], 0x768238a5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002d28b
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002d2c3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd50], 0x6f3b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002d2ab
xor eax, eax
inc dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffef
jne 0x1002d300
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0xd20], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002d2ef
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffef
je 0x1002d2cf
mov edx, dword [ebp - 0x48]
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x658], edi
mov dword [ebp - 0x654], edi
mov dword [ebp - 0x650], edi
mov dword [ebp - 0x64c], edi
push 7
pop edi
mov dword [ebp - 0x37c], edi
mov dword [ebp - 0x378], edi
mov dword [ebp - 0x374], edi
mov dword [ebp - 0x370], edi
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jg 0x1002d3fe
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002d35b
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov eax, dword [ebp - 0x28]
push 9
mov eax, dword [ebp + eax*4 - 0x37c]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x37c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x37c]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp + eax*4 - 0x37c]
mov eax, dword [ebp - 0x28]
add edx, dword [ebp + eax*4 - 0x37c]
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x28]
pop ecx
mov edx, dword [ebp + eax*4 - 0x37c]
mov eax, dword [ebp - 0x4c]
sub ecx, eax
cmp ecx, edx
je 0x1002d3dd
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x37c], 0
je 0x1002d3dd
mov ecx, esi
jmp 0x1002d3e1
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x28]
inc ecx
push 3
mov dword [ebp + eax*4 - 0x37c], ecx
inc dword [ebp - 0x28]
pop ecx
push 0
pop eax
cmp dword [ebp - 0x28], ecx
jle 0x1002d34c
mov dword [ebp - 0x4c], 0xbf90350d
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], 0x8d5feaf8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], eax
jmp 0x1002d424
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2b0], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d417
mov eax, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x2ac]
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax, 0x237f
mov eax, dword [ebp - 0x2b0]
cmp ecx, eax
mov eax, dword [ebp - 0x2b0]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x2ac], ecx
mov eax, dword [ebp - 0x44]
imul eax, ecx
test eax, eax
je 0x1002d49f
xor eax, eax
cmp dword [ebp - 0x2ac], eax
je 0x1002d4a1
mov eax, esi
jmp 0x1002d4a1
xor eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002d4bf
push eax
push 0xeed
push eax
call edi
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xd
jg 0x1002dd60
mov edi, dword [ebp - 0x48]
mov ecx, 0x5530c4e2
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0x5d1cb6a7
mov dword [ebp - 0x644], ecx
mov dword [ebp - 0x640], ecx
mov dword [ebp - 0x63c], ecx
mov dword [ebp - 0x638], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe6
jne 0x1002d573
push 5
pop edi
mov dword [ebp - 0x40], 0xba07e4fc
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp eax, 0x4dc80ca4
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x28]
setne cl
dec ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
sub edx, 0x866
sub esi, edx
neg esi
sbb esi, esi
sub eax, edi
inc esi
xor ecx, ecx
cmp eax, esi
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x40]
jl 0x1002d553
cmp dword [ebp - 0x28], eax
je 0x1002d553
xor esi, esi
inc esi
mov edx, esi
jmp 0x1002d558
xor esi, esi
mov edx, eax
inc esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe6
je 0x1002d502
mov edi, dword [ebp - 0x48]
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop ecx
jmp 0x1002d6a4
mov dword [ebp - 0x1c], 0xc25
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x4c], 0x418f7f2f
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x1002d688
mov dword [ebp - 0x10], 0xcb6d64bd
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x1002d5e1
push 0xfffffffffffffffb
pop edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jg 0x1002d5dc
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002d5d1
push 0x1325
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x1002d5b8
push 0xfffffffffffffffb
pop edx
dec dword [ebp - 0x10]
jns 0x1002d5ad
mov eax, dword [ebp - 0x24]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0x644]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp + eax*4 - 0x644]
mov eax, dword [ebp - 0x24]
cmp eax, 0x5b167d3d
setle cl
xor eax, eax
cmp edx, ecx
setg al
xor edx, edx
cmp eax, edi
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, 0xfffffff9
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x644]
cmp ecx, eax
mov eax, 0xffff
setge dl
sub edx, eax
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
mov dword [ebp + eax*4 - 0x644], edx
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x28]
pop eax
push 3
pop ecx
jns 0x1002d59b
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002d6a1
push 0x1d2b
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x1002d57e
push 2
pop edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], 0x20f89b54
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], 0xa3c3d214
mov dword [ebp - 0x2c], 0x44653ff
mov dword [ebp - 0x2c], 0xc6a3f154
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x58], 0x99843334
mov dword [ebp - 0x2c], 0xd170
mov dword [ebp - 0x30], edi
mov dword [ebp - 0xc4], 0xbd42f903
mov dword [ebp - 0xc0], 0xbd42f903
mov dword [ebp - 0xbc], 0xbd42f903
mov dword [ebp - 0xb8], 0xbd42f903
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002d738
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x19c], 0x85f70ad6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002d720
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002d754
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe9c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002d740
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jg 0x1002d973
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0xfffd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002d788
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xef4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002d773
xor eax, eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x1002d83c
mov edi, 0xffff
mov dword [ebp - 0x4c], 0x5b8b78ac
mov dword [ebp - 0x38], 0x6364d64e
mov dword [ebp - 0x4c], 0xfffffffc
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x194], edi
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
neg edx
mov esi, dword [ebp + eax*4 - 0x19c]
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
imul esi, ecx
mov eax, dword [ebp + eax*4 - 0x19c]
cmp esi, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x19c]
cmp eax, edx
mov eax, dword [ebp - 0x18]
setg cl
add ecx, dword [ebp + eax*4 - 0x19c]
cmp ecx, 0xc279a20b
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002d82b
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
dec dword [ebp - 0x10]
jns 0x1002d799
mov edi, dword [ebp - 0x48]
xor eax, eax
push 2
pop edx
dec dword [ebp - 0x40]
xor esi, esi
mov dword [ebp - 0x24], edx
inc esi
cmp dword [ebp - 0x24], eax
jl 0x1002d964
push 5
pop edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d871
push 0xfffffffffffffffb
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x54c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d85f
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x19c], 0
jne 0x1002d95f
mov dword [ebp - 0x20], edx
xor eax, eax
cmp dword [ebp - 0x20], eax
jl 0x1002d953
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x4c], 0xcf54ceaa
mov dword [ebp - 0x38], 0x3d7fba34
mov dword [ebp - 0xef4], 0x1dcede6a
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x4c]
neg eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x19c]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
add edx, 0x1d319d7f
mov eax, dword [ebp + eax*4 - 0x19c]
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x38], ecx
je 0x1002d8fe
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002d900
mov edx, esi
jmp 0x1002d902
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
neg edx
mov eax, dword [ebp + eax*4 - 0x19c]
sub edx, eax
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x19c]
cmp edx, edi
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
sete dl
sub edx, dword [ebp + eax*4 - 0x19c]
sub edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x58]
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x54c], edx
dec dword [ebp - 0x20]
jns 0x1002d890
push 2
pop edx
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1002d851
mov edi, dword [ebp - 0x48]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1002d760
push 3
pop ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jg 0x1002dd48
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x38], 0x65d3384f
push 4
mov dword [ebp - 0x18], eax
pop edi
cmp dword [ebp - 0x18], edi
jge 0x1002d9ac
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4a8], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002d994
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002d9c2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc], 0x9a2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d9b1
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x4a8]
mov eax, dword [ebp - 0x4a8]
cmp ecx, eax
mov eax, dword [ebp - 0x4a8]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
lea eax, [ecx + 0x6c79]
mov ecx, dword [ebp - 0x10]
imul ecx, eax
xor eax, eax
test ecx, ecx
je 0x1002da06
cmp dword [ebp - 0x4a4], eax
je 0x1002da06
mov eax, esi
add eax, 0x6ee4e912
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x18], 0xe069
xor eax, eax
mov dword [ebp - 0x1c], 0x35cb5140
mov dword [ebp - 0x40], 0x56d4c01e
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], eax
jmp 0x1002da47
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xdf8], 0x2b873148
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002da36
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xdc]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
sub eax, edx
je 0x1002da85
inc dword [ebp - 0x34]
mov ecx, 0x5530c4e2
cmp dword [ebp - 0x34], 0xd
jle 0x1002d4d4
mov edi, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 5
pop edx
mov dword [ebp - 0x38], edx
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002dd89
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1150], 0x313d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002dd71
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002dda5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002dd91
xor eax, eax
push 3
pop edx
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], edx
jg 0x1002ddf4
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002ddd3
push 0x240d
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
push 3
pop edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
imul eax, dword [ebp - 0x40], 0x690f
push 0
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x844]
pop eax
cmp dword [ebp - 0x844], edx
jle 0x1002ddb6
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff1
je 0x1002ebde
jmp 0x1002dead
push 6
pop ecx
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002ded5
push eax
push 0x24a0
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002defb
push eax
push 0xaaf
push 0x1e98
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
xor eax, eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x4c], 0xc93e
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], 0x1c5860bc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002df39
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xec], 0x8c6a53d0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002df21
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002df59
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x318], 0x40826f39
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002df41
xor eax, eax
mov dword [ebp - 0xec], 0xffffffef
cmp dword [ebp - 0xec], 0xfffffff3
je 0x1002e038
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], eax
jmp 0x1002df8c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf0c], 0x68939f5f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002df7b
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp eax, 0x5637
mov dword [ebp - 0xf00], eax
setge cl
xor eax, eax
cmp ecx, 0x168aa2d3
setge al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x318]
cmp esi, eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x4c]
cmp eax, 0xfff4
mov eax, dword [ebp - 0x38]
setle cl
xor ebx, ebx
cmp ecx, eax
mov ecx, dword [ebp - 0x318]
mov eax, dword [ebp - 0x24]
setne bl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xec]
setge dl
xor ecx, ecx
cmp ebx, edx
setle cl
sub ecx, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x24], 0xfffffff8
jmp 0x1002e019
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x11
jge 0x1002e00d
inc dword [ebp - 0xec]
cmp dword [ebp - 0xec], 0xfffffff3
push 0
pop eax
jne 0x1002df70
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002ebd9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], 0x1b
cmp dword [ebp - 0x10], 0x19
jg 0x1002e08f
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002e06a
call dword [sym.imp.USER32.dll_CreateMenu]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002e083
push 0x240d
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x19
jle 0x1002e059
mov ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x28], eax
je 0x1002e898
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x4c], 0x86a6c65b
mov dword [ebp - 0x30], 0x1094
mov dword [ebp - 0x10], 0x69c9
mov dword [ebp - 0x20], 0xaec51ac0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x58], 0x17d239f9
mov dword [ebp - 0x2c], 0x218ad385
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002e0f1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1e0], 0xa1220985
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002e0d8
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ebx
jmp 0x1002e10a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x810], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e0f9
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x38], 0xc80ae7b1
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x80c]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setg dl
lea eax, [edx - 0xf36a]
test eax, eax
jne 0x1002e161
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x1002e163
mov edx, esi
mov eax, dword [ebp - 0x1e0]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x80c]
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002e197
push 2
mov dword [ebp - 0x10], eax
pop ebx
cmp dword [ebp - 0x10], ebx
jge 0x1002e8bb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x394], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002e8a3
xor eax, eax
mov dword [ebp - 0x390], eax
jmp 0x1002e8f0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e8ea
push 0x1941
push 0x1b15
push eax
push eax
push 0x1270
push 0x933
call dword [sym.imp.USER32.dll_ToUnicode]
xor eax, eax
dec dword [ebp - 0x390]
cmp dword [ebp - 0x390], 0xfffffff9
jl 0x1002e8c3
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], 0x20f89b54
push 3
pop edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], 0xa3c3d214
mov dword [ebp - 0x2c], 0x44653ff
mov dword [ebp - 0x2c], 0xc6a3f154
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x58], 0x99843334
mov dword [ebp - 0x2c], 0xd170
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc4], 0xbd42f903
mov dword [ebp - 0xc0], 0xbd42f903
mov dword [ebp - 0xbc], 0xbd42f903
mov dword [ebp - 0xb8], 0xbd42f903
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002e987
push 3
xor eax, eax
pop edx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], 0x55fff839
mov dword [ebp - 0x10], 0x3d37f4a1
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x744], esi
mov dword [ebp - 0x740], esi
mov dword [ebp - 0x73c], esi
mov dword [ebp - 0x738], esi
cmp dword [ebp - 0x34], eax
jne 0x1002ec1e
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov ecx, 0xfc39fa23
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
add eax, 0x6085e071
je 0x1002ec8e
push 9
pop eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x1002ec4a
mov ecx, esi
mov eax, dword [ebp - 0x20]
sub ecx, eax
xor eax, eax
cmp ecx, 0xe58e
setl al
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002ec69
cmp dword [ebp - 0x34], eax
je 0x1002ec75
cmp dword [ebp - 0x20], eax
je 0x1002ec75
mov edx, esi
cmp dword [ebp - 0x10], eax
jne 0x1002ec77
mov edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
xor ecx, ecx
cmp eax, edx
push 3
setge cl
mov dword [ebp - 0x24], ecx
pop edx
jmp 0x1002edbf
mov dword [ebp - 0x10], 0x39c1d55e
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x24], eax
jmp 0x1002edb6
mov dword [ebp - 0x97c], ecx
mov dword [ebp - 0x978], ecx
mov dword [ebp - 0x974], ecx
mov dword [ebp - 0x970], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x1002ed63
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x1002ed52
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x1002ed46
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x20], eax
jmp 0x1002ecfd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe94], 0x4446
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002ecec
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x744], 0
jne 0x1002ed44
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, esi
setg cl
xor eax, eax
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], eax
jne 0x1002ed26
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
push 0
mov eax, dword [ebp + eax*4 - 0x744]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xe94], eax
inc dword [ebp - 0x34]
pop eax
cmp dword [ebp - 0x34], edx
jle 0x1002ece4
xor eax, eax
mov dword [ebp - 0x20], 0x26b13122
dec dword [ebp - 0x10]
jns 0x1002ecd5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002ecca
mov ecx, 0xfc39fa23
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x1002edb3
push 4
pop ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002ed8e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x744], 0x1cf
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002ed76
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002edae
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x97c], 0xd6df81f9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002ed96
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002ed6e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x1002eca6
mov ecx, dword [ebp - 0x48]
mov ebx, 0xe713a473
mov dword [ebp - 0x20], edx
xor eax, eax
mov dword [ebp - 0x44], ebx
mov edi, 0x711a
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x4c], 0x4f77722a
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x66c], edi
mov dword [ebp - 0x668], edi
mov dword [ebp - 0x664], edi
mov dword [ebp - 0x660], edi
mov dword [ebp - 0x4c], 0xa2f
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], eax
jmp 0x1002ee19
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x884], 0xd513c61c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002ee08
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002ee66
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x664]
mov eax, dword [ebp - 0x664]
je 0x1002ee53
mov eax, dword [ebp - 0x884]
cmp ecx, eax
mov eax, dword [ebp - 0x66c]
sbb ecx, ecx
inc ecx
sub ecx, eax
je 0x1002ee53
mov eax, esi
jmp 0x1002ee55
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x20]
jl 0x1002ee64
mov ecx, esi
jmp 0x1002ee68
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
imul eax, ecx
push 2
cmp eax, esi
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x880], edx
mov eax, dword [ebp - 0x44]
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x4c], 0x4f77722a
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x680], edi
mov dword [ebp - 0x67c], edi
mov dword [ebp - 0x678], edi
mov dword [ebp - 0x674], edi
mov dword [ebp - 0x4c], 0xa2f
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], eax
pop edi
jmp 0x1002eee9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8cc], 0xd513c61c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002eed8
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002ef35