Function at 0x1002f1ef
Capabilities:
Check for time delay via gettickcount
Create thread
Delete registry key
Delete registry value
Enumerate files on windows
Get common file path
Get geographical location
Get thread local storage value
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x10089ded
call fcn.10089778
mov eax, 0x11e8
call fcn.100739c0
push ebx
mov ebx, dword [sym.imp.USER32.dll_SetPropA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 1
mov dword [ebp - 0x54], ecx
pop ecx
push 0
pop eax
mov dword [ebp - 0x30], 0x4504cd45
dec dword [ebp - 0x30]
push 2
mov byte [ebp - 0x59], dl
mov dword [ebp - 0x30], 3
pop edx
jmp 0x1002f2e0
mov dword [ebp - 0x2c], 0xea983111
mov dword [ebp - 0x2c], 0xfffffffd
cmp dword [ebp - 0x2c], 0x16
jne 0x1002f2dd
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f27a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf74], 0x3244d513
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f261
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f28f
push eax
push eax
call edi
push eax
call ebx
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x1c], 0xffffffe6
jmp 0x1002f2c7
mov dword [ebp - 0x18], 0x7dcd66a0
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x1002f2c4
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f2bc
push 0x1244
push eax
push eax
push eax
call esi
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002f2a7
push 2
pop edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jg 0x1002f298
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x16
push 1
pop ecx
je 0x1002f255
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x13
jne 0x1002f23d
mov dword [ebp - 0x30], 0x4504cd45
dec dword [ebp - 0x30]
mov dword [ebp - 0x30], 3
jmp 0x1002f39c
mov dword [ebp - 0x2c], 0xea983111
mov dword [ebp - 0x2c], 0xfffffffd
jmp 0x1002f38c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f335
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1034], 0x3244d513
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f31c
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f347
push eax
push eax
call edi
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffe6
jmp 0x1002f380
mov dword [ebp - 0x18], 0x7dcd66a0
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], eax
jl 0x1002f37d
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f378
push 0x1244
push eax
push eax
push eax
call esi
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002f363
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jg 0x1002f350
inc dword [ebp - 0x2c]
push 1
pop ecx
cmp dword [ebp - 0x2c], 0x16
je 0x1002f310
inc dword [ebp - 0x30]
push 1
pop ecx
cmp dword [ebp - 0x30], 0x13
jne 0x1002f300
mov dword [ebp - 0x44], 0x720e
xor ebx, ebx
mov byte [ebp - 0x39], al
inc ebx
cmp byte [ebp - 0x39], 0
je 0x1002f3c8
push eax
push ebx
push 0x1428
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f3de
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
mov dword [ebp - 0x24], 0x2e91a049
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002f404
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6c0], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f3f0
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f417
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffec
push 0xffffffffffffffff
pop edx
jg 0x1002f5c8
push 2
pop ecx
mov dword [ebp - 0x14], 0x2124f84b
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x48], 0x92357994
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x48], 0x4384f3ac
mov dword [ebp - 0x1c], eax
jmp 0x1002f45b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x89c], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f44a
mov dword [ebp - 0x14], 0xfffffff3
cmp dword [ebp - 0x14], 3
jge 0x1002f5b8
mov dword [ebp - 0x30], 0xe19f
mov dword [ebp - 0x20], 0x1db95674
mov dword [ebp - 0x48], 0xfffffffa
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
jne 0x1002f495
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x1002f497
mov ecx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x20], eax
or eax, 0xffffffff
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
sub edx, 0xc3e1b8d8
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0xea1b1489
setl cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jne 0x1002f4ff
cmp dword [ebp - 0x24], eax
jne 0x1002f4ff
xor ebx, ebx
inc ebx
jmp 0x1002f504
xor ebx, ebx
inc ebx
mov eax, ebx
cmp eax, dword [ebp - 0x30]
jne 0x1002f514
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002f516
mov eax, ebx
jmp 0x1002f516
xor eax, eax
xor ecx, ecx
cmp eax, 0xf7d5
setg cl
xor edx, edx
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
mov dword [ebp - 0x898], edx
lea eax, [edx - 0x1cf0b513]
mov dword [ebp - 0x48], eax
mov eax, 0xffff
mov ecx, dword [ebp - 0x48]
sub ecx, eax
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x14]
jle 0x1002f599
mov eax, dword [ebp - 0x898]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x6c0], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002f471
push 2
pop ecx
or edx, 0xffffffff
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffec
push 0
pop eax
jle 0x1002f42a
mov dword [ebp - 0x38], 0x4504cd45
mov dword [ebp - 0x2c], 0x1f7e2799
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x48], 0xb7e280bf
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f606
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xce0], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f5ed
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffe2
jg 0x1002f73a
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x1c], eax
jmp 0x1002f62c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x208], 0x678e045
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f61b
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0xd
cmp dword [ebp - 0x30], 0xffffffee
jne 0x1002f72a
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x1002f670
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2b4], 0x48214d2f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002f658
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002f68e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xecc], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002f679
xor eax, eax
cmp dword [ebp - 0x2b4], eax
je 0x1002f704
mov eax, dword [ebp - 0x2b4]
xor ecx, ecx
mov eax, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2b4]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x208]
mov eax, dword [ebp - 0x208]
cmp eax, edx
mov eax, dword [ebp - 0x2b4]
setg cl
xor edx, edx
test ecx, ecx
setns dl
xor ebx, ebx
cmp edx, eax
setle bl
xor ecx, ecx
cmp ebx, 0xfffffffe
mov dword [ebp - 0x208], ebx
mov eax, dword [ebp - 0x2b4]
setne cl
xor edx, edx
cmp ecx, eax
setl dl
xor ebx, ebx
mov dword [ebp - 0xec4], edx
test edx, edx
je 0x1002f701
inc ebx
mov edx, ebx
jmp 0x1002f706
xor eax, eax
inc ebx
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x30], eax
jne 0x1002f727
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffee
je 0x1002f64b
or edx, 0xffffffff
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe2
push 0
pop eax
jle 0x1002f613
dec dword [ebp - 0x38]
mov dword [ebp - 0x38], 3
jmp 0x1002fcc0
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0x8a11015a
mov dword [ebp - 0x44], 0xe4f1f13b
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x44], 0xf97812a3
mov dword [ebp - 0x44], 0x4e1c2e93
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x44], 0x3af7806a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002f7ac
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1074], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002f793
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002f7ce
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1144], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002f7b5
xor eax, eax
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], eax
jl 0x1002f808
mov dword [ebp - 0x44], 0x696a485b
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002f800
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa70], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f7ec
xor eax, eax
inc dword [ebp - 0x48]
dec dword [ebp - 0x18]
jns 0x1002f7da
mov dword [ebp - 0x2c], 0xea983111
mov dword [ebp - 0x2c], 0xfffffffd
cmp dword [ebp - 0x2c], 0x16
jne 0x1002fcbd
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe4
jl 0x1002f9ea
mov dword [ebp - 0x28], 0xeec5
mov dword [ebp - 0x478], 0x74aa0d72
mov dword [ebp - 0x474], 0x74aa0d72
mov dword [ebp - 0x470], 0x74aa0d72
mov dword [ebp - 0x46c], 0x74aa0d72
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x470], edx
cmp dword [ebp - 0x30], 0xd1b9849b
mov ecx, dword [ebp - 0x28]
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, edx
sub ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x28]
cmp ecx, 0xeea5
setne al
cmp eax, dword [ebp - 0x30]
jle 0x1002f99e
mov dword [ebp - 0x24], 0xfffffffd
xor ecx, ecx
mov eax, dword [ebp - 0x474]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
test eax, eax
setns cl
xor eax, eax
cmp ecx, 0x7c71
setg al
cmp dword [ebp - 0x28], eax
jg 0x1002f8e5
xor eax, eax
mov dword [ebp - 0x48], 0x1718bc69
mov dword [ebp - 0x24], eax
jmp 0x1002f8dd
dec dword [ebp - 0x48]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1002f8d7
jmp 0x1002f94c
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x1002f94a
mov dword [ebp - 0x28], eax
jmp 0x1002f920
mov dword [ebp - 0x1c], 0xf19716e2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1002f91d
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x478], 0
jne 0x1002f91b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1002f905
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jle 0x1002f8f5
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f945
push eax
push 0x129e
push eax
push eax
push 0x261a
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc dword [ebp - 0x24]
jmp 0x1002f8ea
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002f97b
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xb8f3be
setg cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setne al
cmp eax, dword [ebp - 0x24]
je 0x1002f97b
xor eax, eax
mov ecx, eax
jmp 0x1002f97d
mov ecx, ebx
mov eax, dword [ebp - 0x46c]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x470], ecx
jmp 0x1002f9bc
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002f9b7
push 0xc57
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002f9e8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002f9db
or ecx, 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x478], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002f9c8
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe4
jge 0x1002f833
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x4c], 0xeaa32b1c
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002fa17
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x498], 0xfffffffe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002f9ff
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002fa39
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe64], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002fa20
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002fa5b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9d0], 0x7cec
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002fa42
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ebx
jg 0x1002fc2e
mov dword [ebp - 0x40], 0xabbf9acf
xor edx, edx
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x34], 0x66969e96
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
sub ecx, 0x52a5ae63
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x494]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
inc edx
imul eax, edx
xor edx, edx
cmp eax, 0xc1464f16
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
sub ecx, 0x47d1afd0
je 0x1002face
mov ecx, ebx
cmp dword [ebp - 0x498], eax
jne 0x1002fad0
mov ecx, eax
mov eax, dword [ebp - 0x4c]
sub ecx, eax
dec ecx
je 0x1002fb7b
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x48], 0xfffe
jne 0x1002faf4
cmp eax, dword [ebp - 0x40]
je 0x1002faf9
mov eax, ebx
cmp eax, dword [ebp - 0x40]
jl 0x1002fb04
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002fb06
mov edx, ebx
jmp 0x1002fb08
xor eax, eax
mov edx, eax
mov dword [ebp - 0x30], 0x5290ce96
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x494]
jle 0x1002fb3b
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002fbbc
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1002fbbc
mov dword [ebp - 0x18], 0x430688cd
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
push 2
setle dl
pop eax
cmp eax, edx
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x40]
neg eax
cmp eax, 0x16c28cbd
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
jmp 0x1002fbbc
mov dword [ebp - 0x44], 0xa227283a
mov dword [ebp - 0x44], ebx
push 8
pop eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x48], 0x111919b1
mov dword [ebp - 0x1c], eax
jmp 0x1002fbb3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x104c], 0xade45a91
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002fba2
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x9d0], eax
je 0x1002fc00
mov eax, dword [ebp - 0x498]
xor edx, edx
cmp eax, 0x4f7d9fd5
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x9d0]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
imul eax, edx
test eax, eax
je 0x1002fbfe
mov eax, ebx
jmp 0x1002fc00
xor eax, eax
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0xe60], ecx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jle 0x1002fa67
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002fc50
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1064], 0x3244d513
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002fc37
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fc66
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetPropA]
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffe6
cmp dword [ebp - 0x1c], 0xffffffe7
jle 0x1002fcab
push 2
pop ecx
mov dword [ebp - 0x18], 0x7dcd66a0
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x1002fca2
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fc9a
push 0x1244
push eax
push eax
push eax
call esi
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002fc85
push 2
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jg 0x1002fc76
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x16
push 0xffffffffffffffff
pop edx
je 0x1002f820
or edx, edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x13
jne 0x1002f749
mov dword [ebp - 0x44], 0x720e
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fce9
push eax
push ebx
push 0x1428
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fcff
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
mov dword [ebp - 0x40], 0x801897a4
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002fd28
or edx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x844], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002fd14
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002fd46
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc38], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002fd31
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fd68
push 0x2237
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
xor eax, eax
mov dword [ebp - 0x40], ebx
push 7
pop edx
cmp dword [ebp - 0x40], eax
jl 0x1002fe72
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x50], 0x483b
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fd9f
push eax
call dword [sym.imp.USER32.dll_ShowCursor]
push 7
xor eax, eax
pop edx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jg 0x1002fe66
mov dword [ebp - 0x18], 0xb0fe2cf4
mov dword [ebp - 0x34], 0x9d012742
mov dword [ebp - 0x34], 4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc30], 0x67bb
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0x844]
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x844], ecx
mov dword [ebp - 0x48], ecx
mov ecx, 0xc5c3c3ae
mov eax, dword [ebp - 0x40]
neg eax
cmp eax, edx
sbb eax, eax
neg eax
cmp ecx, eax
mov eax, dword [ebp - 0x48]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setl dl
add edx, 0xffff334c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002fe55
push 0x22ee
push 0x2eb
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
inc dword [ebp - 0x30]
push 7
pop edx
cmp dword [ebp - 0x30], ebx
jle 0x1002fdab
xor eax, eax
dec dword [ebp - 0x40]
push 7
pop edx
jns 0x1002fd77
mov dword [ebp - 0x24], 0x2e91a049
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fe98
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6e0], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002fe84
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002feab
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffec
push 2
pop edi
jg 0x10030059
or ecx, 0xffffffff
mov dword [ebp - 0x14], 0x2124f84b
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x48], 0x92357994
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], 0x4384f3ac
mov dword [ebp - 0x1c], eax
jmp 0x1002feef
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x83c], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002fede
mov dword [ebp - 0x14], 0xfffffff3
cmp dword [ebp - 0x14], 3
jge 0x10030049
mov dword [ebp - 0x38], 0xe19f
mov dword [ebp - 0x20], 0x1db95674
mov dword [ebp - 0x48], 0xfffffffa
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
jne 0x1002ff29
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x1002ff2b
mov ecx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x20], eax
or eax, 0xffffffff
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
sub edx, 0xc3e1b8d8
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0xea1b1489
setl cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jne 0x1002ff93
cmp dword [ebp - 0x24], eax
jne 0x1002ff93
xor ebx, ebx
inc ebx
jmp 0x1002ff98
xor ebx, ebx
inc ebx
mov eax, ebx
cmp eax, dword [ebp - 0x38]
jne 0x1002ffa8
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002ffaa
mov eax, ebx
jmp 0x1002ffaa
xor eax, eax
xor ecx, ecx
cmp eax, 0xf7d5
setg cl
xor edx, edx
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
mov dword [ebp - 0x838], edx
lea eax, [edx - 0x1cf0b513]
mov dword [ebp - 0x48], eax
mov eax, 0xffff
mov ecx, dword [ebp - 0x48]
sub ecx, eax
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x14]
jle 0x1003002d
mov eax, dword [ebp - 0x838]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x6e0], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002ff05
or ecx, 0xffffffff
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffec
push 0
pop eax
jle 0x1002febe
mov dword [ebp - 0x2c], 0x4504cd45
mov dword [ebp - 0x38], 0x1f7e2799
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x48], 0xb7e280bf
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10030097
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd40], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003007e
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffe2
jg 0x100301cb
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], eax
jmp 0x100300c0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1f0], 0x678e045
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100300af
mov eax, dword [ebp - 0xd40]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0xd
cmp dword [ebp - 0x30], 0xffffffee
jne 0x100301bb
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10030101
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2fc], 0x48214d2f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100300e9
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1003011f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf34], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003010a
xor eax, eax
cmp dword [ebp - 0x2fc], eax
je 0x10030195
mov eax, dword [ebp - 0x2fc]
xor ecx, ecx
mov eax, dword [ebp - 0x2f8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1f0]
cmp eax, edi
mov eax, dword [ebp - 0x2fc]
setg cl
xor edx, edx
test ecx, ecx
setns dl
xor ebx, ebx
cmp edx, eax
setle bl
xor ecx, ecx
cmp ebx, 0xfffffffe
mov dword [ebp - 0x1f0], ebx
mov eax, dword [ebp - 0x2fc]
setne cl
xor edx, edx
cmp ecx, eax
setl dl
xor ebx, ebx
mov dword [ebp - 0xf2c], edx
test edx, edx
je 0x10030192
inc ebx
mov edx, ebx
jmp 0x10030197
xor eax, eax
inc ebx
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x30], eax
jne 0x100301b8
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffee
je 0x100300df
or ecx, 0xffffffff
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe2
push 0
pop eax
jle 0x100300a7
dec dword [ebp - 0x2c]
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x44], eax
push 6
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0x8a11015a
mov dword [ebp - 0x44], 0xe4f1f13b
mov dword [ebp - 0x44], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x44], 0xf97812a3
mov dword [ebp - 0x44], 0x4e1c2e93
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], 0x3af7806a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1003022f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10a4], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10030216
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10030251
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11a4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10030238
xor eax, eax
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], eax
jl 0x1003028b
mov dword [ebp - 0x44], 0x696a485b
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030283
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa80], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003026f
xor eax, eax
inc dword [ebp - 0x48]
dec dword [ebp - 0x18]
jns 0x1003025d
mov edi, dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov dword [ebp - 0x2c], 3
cmp dword [ebp - 0x2c], 0x13
je 0x1003157a
jmp 0x100302a9
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe4
jl 0x10030471
or edi, 0xffffffff
mov dword [ebp - 0x28], 0xeec5
mov eax, 0x74aa0d72
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x488], edx
cmp dword [ebp - 0x30], 0xd1b9849b
mov ecx, dword [ebp - 0x28]
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, edx
sub ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x28]
cmp ecx, 0xeea5
setne al
cmp eax, dword [ebp - 0x30]
jle 0x1003041c
mov dword [ebp - 0x24], 0xfffffffd
xor ecx, ecx
mov eax, dword [ebp - 0x48c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
test eax, eax
setns cl
xor eax, eax
cmp ecx, 0x7c71
setg al
cmp dword [ebp - 0x28], eax
jg 0x10030366
xor eax, eax
mov dword [ebp - 0x48], 0x1718bc69
mov dword [ebp - 0x24], eax
jmp 0x1003035e
dec dword [ebp - 0x48]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x10030358
jmp 0x100303cd
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x100303cb
mov dword [ebp - 0x28], eax
jmp 0x100303a1
mov dword [ebp - 0x1c], 0xf19716e2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1003039e
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x490], 0
jne 0x1003039c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x10030386
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jle 0x10030376
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100303c6
push eax
push 0x129e
push eax
push eax
push 0x261a
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc dword [ebp - 0x24]
jmp 0x1003036b
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100303f9
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xb8f3be
setg cl
xor eax, eax
cmp ecx, edi
setne al
cmp eax, dword [ebp - 0x24]
je 0x100303f9
xor eax, eax
mov ecx, eax
jmp 0x100303fb
mov ecx, ebx
mov eax, dword [ebp - 0x484]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x488], ecx
jmp 0x1003043a
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10030435
push 0xc57
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10030469
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1003045c
or ecx, 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x490], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10030446
or edi, 0xffffffff
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe4
jge 0x100302bf
mov edi, dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor eax, eax
mov dword [ebp - 0x28], 0xea983111
mov dword [ebp - 0x4c], 0xeaa32b1c
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x100304a2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4b0], 0xfffffffe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1003048a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x100304c4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xdb4], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x100304ab
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x100304e6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa1c], 0x7cec
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x100304cd
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ebx
jg 0x100306bd
push 2
pop edi
mov dword [ebp - 0x40], 0xabbf9acf
xor edx, edx
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x34], 0x66969e96
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
sub ecx, 0x52a5ae63
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x4ac]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
inc edx
imul eax, edx
xor edx, edx
cmp eax, 0xc1464f16
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
sub ecx, 0x47d1afd0
je 0x1003055c
mov ecx, ebx
cmp dword [ebp - 0x4b0], eax
jne 0x1003055e
mov ecx, eax
mov eax, dword [ebp - 0x4c]
sub ecx, eax
dec ecx
je 0x10030603
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x48], 0xfffe
jne 0x10030582
cmp eax, dword [ebp - 0x40]
je 0x10030587
mov eax, ebx
cmp eax, dword [ebp - 0x40]
jl 0x10030592
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10030594
mov edx, ebx
jmp 0x10030596
xor eax, eax
mov edx, eax
mov dword [ebp - 0x30], 0x5290ce96
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x4ac]
jle 0x100305c6
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10030644
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x10030644
mov dword [ebp - 0x18], 0x430688cd
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
cmp edi, edx
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x40]
neg eax
cmp eax, 0x16c28cbd
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
jmp 0x10030644
mov dword [ebp - 0x44], 0xa227283a
mov dword [ebp - 0x44], ebx
push 8
pop eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x48], 0x111919b1
mov dword [ebp - 0x1c], eax
jmp 0x1003063b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf68], 0xade45a91
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003062a
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0xa1c], eax
je 0x10030688
mov eax, dword [ebp - 0x4b0]
xor edx, edx
cmp eax, 0x4f7d9fd5
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xa1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
imul eax, edx
test eax, eax
je 0x10030686
mov eax, ebx
jmp 0x10030688
xor eax, eax
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0xdb0], ecx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jle 0x100304f5
mov edi, dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 2
pop ecx
mov dword [ebp - 0x28], 0xfffffffd
jmp 0x10031563
mov dword [ebp - 0x34], 0x327cb3f4
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
mov byte [ebp - 0x39], al
je 0x10030709
cmp byte [ebp - 0x39], al
je 0x100306f1
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003072e
push eax
push 0x1a49
push eax
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
jmp 0x1003072c
cmp byte [ebp - 0x39], al
je 0x1003072e
push 0xfd2
push 0x2589
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
xor eax, eax
mov dword [ebp - 0x30], ebx
or ecx, 0xffffffff
mov dword [ebp - 0x40], 0xfffffffd
push 5
pop edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0x373b2c57
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], 0x8444
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1003077a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x774], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10030761
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10030798
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdc4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10030783
xor eax, eax
mov dword [ebp - 0x40], 0xffffffe7
cmp dword [ebp - 0x40], edx
je 0x100309d0
push 2
pop edi
jmp 0x100307af
xor eax, eax
mov dword [ebp - 0x1c], 0xba1a
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], 0x2b441a62
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100307e0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x194], 0xa4ba31e4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100307c8
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10030802
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xba0], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100307e9
xor eax, eax
cmp dword [ebp - 0x194], eax
jne 0x10030841
imul edx, dword [ebp - 0x20], 0xfff8
mov eax, dword [ebp - 0xdb8]
sub edx, 0x9a67b9c5
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x770]
mov ecx, dword [ebp - 0x770]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
push 0xfffffffffffffff8
pop edx
sub esi, eax
mov eax, dword [ebp - 0x48]
cmp eax, edx
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp edi, ecx
sbb eax, eax
xor ecx, ecx
neg eax
sub eax, 0xb4a1
cmp esi, eax
setle cl
xor eax, eax
cmp ecx, 0x7638
setl al
xor edx, edx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x24]
imul eax, edx, 0x85ca
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0x30], 0xfffffffb
jmp 0x100309a8
mov dword [ebp - 0x20], 0x8aa1
xor eax, eax
mov dword [ebp - 0x48], 0xfcb277ce
mov dword [ebp - 0x48], 0xd128b415
mov dword [ebp - 0x4c], 0x49f72e73
mov dword [ebp - 0x38], 0xaa25
mov dword [ebp - 0x48], edi
cmp dword [ebp - 0x20], eax
jne 0x10030913
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x48], eax
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x48], eax
je 0x10030915
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, 0xfffffff9
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor ebx, ebx
mov dword [ebp - 0x38], ecx
inc ebx
mov eax, dword [ebp - 0x38]
xor edx, edx
add eax, 9
mov dword [ebp - 0xb98], eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x768]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov dword [ebp - 0x20], 0x4f7a324c
setl dl
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
inc eax
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jl 0x100309a0
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x100309a2
mov eax, ebx
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x17
jge 0x100308d4
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 5
push 0xffffffffffffffff
pop ecx
jne 0x100307ad
mov edi, dword [sym.imp.GDI32.dll_CreateBrushIndirect]
or ecx, ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x14], 0x1824a8c6
xor eax, eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100309fa
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x62c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100309e5
xor eax, eax
mov dword [ebp - 0x14], 0x13
jmp 0x10030a4e
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xf
je 0x10030a4b
push 2
pop ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10030a36
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7bc], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030a1e
xor eax, eax
dec dword [ebp - 0x624]
dec dword [ebp - 0x7b8]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xf
jne 0x10030a16
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffd
jne 0x10030a03
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x10
jl 0x10030b17
mov dword [ebp - 0x5ec], 0xfdb6968
xor edx, edx
mov dword [ebp - 0x5e8], 0xfdb6968
mov dword [ebp - 0x5e4], 0xfdb6968
mov dword [ebp - 0x5e0], 0xfdb6968
mov dword [ebp - 0x34], 0x72a67f8b
mov dword [ebp - 0x1c], 0xdd1edb6b
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x5e4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x62c]
mov eax, dword [ebp - 0x624]
cmp ecx, eax
mov ecx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x48]
setge dl
imul ecx, edx
imul eax, ecx
xor ecx, ecx
cmp eax, 0x6ba0
setl cl
xor eax, eax
cmp dword [ebp - 0x5ec], ecx
jg 0x10030ae9
cmp dword [ebp - 0x1c], eax
je 0x10030ae9
mov eax, ebx
mov dword [ebp - 0x1c], eax
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x5ec]
mov eax, dword [ebp - 0x5e4]
neg edx
cmp edx, eax
sete cl
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
jge 0x10030a61
xor eax, eax
mov dword [ebp - 0x14], 0x9dada439
mov dword [ebp - 0x48], 0xd9e2a8d3
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10030b47
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9e4], 0xfffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10030b2e
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jg 0x10030b8f
mov dword [ebp - 0x48], 0x4d9edbda
mov ecx, 0x921ded69
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9e4], 8
mov dword [ebp - 0x48], 0xfffffff9
mov eax, dword [ebp - 0x48]
sub ecx, eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x9e4]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x10030b52
xor eax, eax
mov dword [ebp - 0x14], 0xffffffe7
cmp dword [ebp - 0x14], eax
jl 0x10030ba5
cmp dword [ebp - 0x48], eax
jne 0x10030ba5
inc dword [ebp - 0x14]
jns 0x10030b9b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10030bc7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1028], 0x3244d513
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10030bae
xor eax, eax
mov dword [ebp - 0x30], 0x5d6c05ba
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10030bf3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc50], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10030bde
xor eax, eax
mov dword [ebp - 0x30], 6
cmp dword [ebp - 0x30], 0x19
jl 0x10030cee
jmp 0x10030c08
xor eax, eax
mov dword [ebp - 0x24], 0xb844
cmp dword [ebp - 0x24], eax
jg 0x10030c17
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x10030c7b
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10030c71
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030c4e
push eax
call edi
push 2
xor eax, eax
pop edx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030c6e
push 0x506
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 2
xor eax, eax
pop edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x10030c3d
mov eax, dword [ebp - 0x24]
jmp 0x10030cde
mov dword [ebp - 0x38], 0x639e6a4
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfff6
jne 0x10030c97
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x38], eax
je 0x10030c99
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xc48]
sete cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xb1dab551
setl cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x19
push 2
pop edx
jge 0x10030c06
xor eax, eax
mov dword [ebp - 0x20], 0x13532fe2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10030d16
push 7
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe14], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10030d02
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x10030d45
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030d40
push 0x22ee
push 0x2eb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x10030d1e
mov byte [ebp - 0xd], al
mov dword [ebp - 0x38], 0x860b4ffb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10030d70
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcf8], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10030d5b
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030d8d
push eax
push 0x1d11
push 0x463
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
push 2
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jg 0x10030daf
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xcf8], 0
jne 0x10030dad
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jle 0x10030d98
xor eax, eax
cmp byte [ebp - 0xd], 0
je 0x10030e94
mov dword [ebp - 0x48], 0x817d1dc6
mov dword [ebp - 0x34], 0x660d64c9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10030de9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xabc], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10030dd0
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10030e09
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbc], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030df1
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030e27
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov eax, dword [ebp - 0xbc]
xor ecx, ecx
cmp eax, 6
mov eax, dword [ebp - 0xab0]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xbc]
sete dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xab8]
mov eax, dword [ebp - 0xbc]
neg eax
jne 0x10030e71
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xab8]
mov eax, dword [ebp - 0xbc]
xor eax, eax
mov dword [ebp - 0x34], ebx
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 2
pop ecx
mov dword [ebp - 0x30], 0xffffffe6
cmp dword [ebp - 0x30], 0xffffffe7
jle 0x10031560
mov dword [ebp - 0x24], 0xffb871c7
xor eax, eax
mov dword [ebp - 0x20], 0x12def906
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], 0x70f3f850
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10030edf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x19c], 0xa684
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030ec7
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x10030f77
xor edi, edi
mov dword [ebp - 0x784], 0x27d2703d
mov dword [ebp - 0x780], 0x27d2703d
mov dword [ebp - 0x77c], 0x27d2703d
mov dword [ebp - 0x778], 0x27d2703d
mov dword [ebp - 0x48], 0x24f63abe
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x19c], edi
je 0x10030ff4
xor eax, eax
mov dword [ebp - 0x38], 0x3250e6da
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030f4a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x38], eax
jmp 0x10030f5c
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x19c], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x10030f4f
xor edi, edi
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x24]
jns 0x10030eed
xor eax, eax
cmp dword [ebp - 0x19c], eax
jne 0x10030f88
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x20], 0x7dcd66a0
mov dword [ebp - 0x20], 0x6e838462
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0x21009d43
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], 0x2465
mov dword [ebp - 0x34], 0xd7582ba8
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10030fec
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10c], 0x43b2b74c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030fd4
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003109f
mov dword [ebp - 0x48], 0x3f29c8dd
xor ecx, ecx
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x19c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x19c]
mov eax, dword [ebp - 0x48]
test eax, eax
sets cl
cmp ecx, dword [ebp - 0x24]
jne 0x1003103a
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x19c], edi
je 0x1003103a
mov eax, ebx
jmp 0x1003103e
xor eax, eax
xor edi, edi
add eax, 0xbd52
mov dword [ebp - 0x780], 0xc9e53e58
push 0xfffffffffffffff7
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
push 2
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x20]
setge dl
add ecx, edx
xor edx, edx
cmp ecx, eax
pop ecx
setne dl
xor eax, eax
cmp edx, 0xc9e53e58
setge al
sub eax, 0x950c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
jmp 0x10030f63
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa00], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10031092
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, 0x2a7e
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10c]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp dword [ebp - 0x20], ecx
jg 0x100310d9
cmp dword [ebp - 0x10c], eax
je 0x100310d9
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor edx, edx
neg eax
inc dword [ebp - 0x18]
mov dword [ebp - 0xa00], eax
mov ecx, dword [ebp - 0x48]
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
add ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x50]
jg 0x10031127
cmp dword [ebp - 0x1c], eax
je 0x10031127
mov eax, ebx
push 2
mov dword [ebp - 0x10c], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x1003154d
mov dword [ebp - 0x48], 0xe7bf1993
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10031165
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x450], 0xdf75dcec
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003114d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10031185
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1b4], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003116d
xor eax, eax
mov dword [ebp - 0x1b4], ebx
cmp dword [ebp - 0x1b4], eax
jl 0x10031291
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x48], 0xfe3d2f55
mov dword [ebp - 0x34], 0xee01e6e8
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x10031285
mov dword [ebp - 0x34], 0xe5dc64f6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100311d8
push 0x1035
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
xor eax, eax
cmp dword [ebp - 0x1b4], eax
jne 0x1003123f
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x450], 0
jne 0x100311f3
mov eax, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x24]
push 0xfffffffffffffff8
mov eax, dword [ebp + eax*4 - 0x450]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x450]
mov ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
pop eax
cmp dword [ebp - 0x24], eax
jne 0x1003123f
xor eax, eax
mov edx, eax
jmp 0x10031241
mov edx, ebx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1b4]
push 0
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x450]
cmp eax, edx
setg cl
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 0xed4bca92
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x24]
pop eax
jns 0x100311b4
dec dword [ebp - 0x1b4]
jns 0x10031197
mov dword [ebp - 0x1c], 0x48bbca63
or edi, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe2
jg 0x10031313
mov dword [ebp - 0x48], edi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100312fd
push eax
push 0xee2
push 0xb30
push 0x920
push 0x23f1
push 0x52c
push 0x1488
push 0xd1c
push 0xb49
push 0x1371
push 0x18e4
push 0x1bfc
push 0xca2
push 0x5e3
call dword [sym.imp.GDI32.dll_CreateFontA]
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10031304
mov eax, ebx
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe2
push 0
pop eax
jle 0x100312a7
mov byte [ebp - 0x39], al
mov dword [ebp - 0x44], 0xfffffffe
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031336
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031349
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
xor eax, eax
cmp byte [ebp - 0x39], 0
je 0x1003153e
mov dword [ebp - 0x24], 0x2e91a049
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10031379
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x614], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031365
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003138c
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffec
jg 0x10031534
push 2
pop ecx
mov dword [ebp - 0x14], 0x2124f84b
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x48], 0x92357994
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x48], 0x4384f3ac
mov dword [ebp - 0x1c], eax
jmp 0x100313cd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x84c], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100313bc
mov dword [ebp - 0x14], 0xfffffff3
cmp dword [ebp - 0x14], 3
jge 0x10031524
mov dword [ebp - 0x38], 0xe19f
mov dword [ebp - 0x18], 0x1db95674
mov dword [ebp - 0x48], 0xfffffffa
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
jne 0x10031407
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x10031409
mov ecx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, edi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
setg dl
sub edx, 0xc3e1b8d8
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0xea1b1489
setl cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jne 0x1003146e
cmp dword [ebp - 0x24], eax
jne 0x1003146e
xor ebx, ebx
inc ebx
jmp 0x10031473
xor ebx, ebx
inc ebx
mov eax, ebx
cmp eax, dword [ebp - 0x38]
jne 0x10031483
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10031485
mov eax, ebx
jmp 0x10031485
xor eax, eax
xor ecx, ecx
cmp eax, 0xf7d5
setg cl
xor edx, edx
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
mov dword [ebp - 0x848], edx
lea eax, [edx - 0x1cf0b513]
mov dword [ebp - 0x48], eax
mov eax, 0xffff
mov ecx, dword [ebp - 0x48]
sub ecx, eax
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x14]
jle 0x10031508
mov eax, dword [ebp - 0x848]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x614], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100313e3
push 2
pop ecx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffec
push 0
pop eax
jle 0x1003139c
push 0x1244
push eax
push eax
push eax
call esi
dec dword [ebp - 0x20]
push 0
pop eax
push 2
pop ecx
jns 0x1003113e
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe7
jg 0x10030ea5
mov edi, dword [sym.imp.GDI32.dll_CreateBrushIndirect]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x16
je 0x100306c9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x13
jne 0x100302a4
xor eax, eax
mov dword [ebp - 0x44], 0x720e
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003159a
push eax
push ebx
push 0x1428
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100315b0
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100315d9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10c4], 0x8e97eede
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100315c0
xor eax, eax
inc dword [ebp - 0x2c]
mov ebx, dword [sym.imp.GDI32.dll_ExtFloodFill]
push 3
mov dword [ebp - 0x2c], eax
pop esi
jmp 0x10031618
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031615
push 0x25eb
push eax
push 0x1bef
push 0x1a80
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x100315ea
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10031646
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1164], 0x8e97eede
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1003162d
xor eax, eax
inc dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
jmp 0x1003167c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031679
push 0x25eb
push eax
push 0x1bef
push 0x1a80
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1003164e
xor ecx, ecx
mov dword [ebp - 0x24], 0xbac64a68
inc ecx
or edx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x100316b4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa0], 0xdba33992
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003169c
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100316e9
mov dword [ebp - 0x2c], 0xda5043c4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x100316e6
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa0], ecx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x100316c8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1d
jne 0x100316b9
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x40]
sete cl
xor ebx, ebx
cmp ecx, 0xfe924f63
push 7
setne bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0xa0]
setg dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x40]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
pop eax
setne cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x20], 0x653b1dab
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x16
jne 0x100319ce
xor edi, edi
push 2
inc edi
pop ebx
mov dword [ebp - 0x18], 0xa1e1c5a3
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], eax
jmp 0x100317cb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x69c], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100317be
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jle 0x100317df
mov eax, edi
mov dword [ebp - 0x24], eax
mov eax, 0xffff
cmp dword [ebp - 0x24], eax
jbe 0x100317f7
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100317f9
mov ecx, edi
jmp 0x100317fb
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
sub ecx, eax
add ecx, 0x1ba6b42b
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, eax
setge dl
imul eax, dword [ebp - 0x14], 6
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, dword [ebp - 0x20]
jl 0x100319ab
xor eax, eax
mov dword [ebp - 0x48], 0xc1731d49
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003187e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xad8], 0x1c2fbf3f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10031865
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x10031988
mov dword [ebp - 0x34], 0xc5adf6f6
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x69c]
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x100318c3
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x69c]
mov eax, dword [ebp - 0x24]
imul ecx, dword [ebp + eax*4 - 0x69c]
xor eax, eax
mov edx, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x100318c5
mov edx, edi
mov eax, dword [ebp - 0xacc]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
imul eax, dword [ebp - 0xacc], 0x3df2a3a4
cmp eax, edi
setg cl
xor eax, eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], eax
jl 0x1003197d
mov dword [ebp - 0x1c], eax
jmp 0x1003190d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc68], 0xf74b76fe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100318fc
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0xc64], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x69c]
cmp eax, edx
setl cl
xor eax, eax
imul ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x1003193d
mov esi, edi
cmp dword [ebp - 0x18], eax
jne 0x1003193f
mov esi, eax
mov eax, dword [ebp - 0x40]
xor edx, edx
push 0
mov ecx, dword [ebp + eax*4 - 0xad8]
mov eax, dword [ebp - 0x69c]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
sub edx, esi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop eax
setge cl
neg ecx
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x40]
push 3
pop esi
jns 0x100318f7
dec dword [ebp - 0x24]
jns 0x1003188a
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100319a3
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100319a0
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe2
jl 0x1003198d
jmp 0x100319b8
mov dword [ebp - 0x34], 0x51f3
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
push 0
pop eax
je 0x100317ac
mov edi, dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x40], 0x1928c176
xor ebx, ebx
mov dword [ebp - 0x48], ecx
inc ebx
or ecx, 0xffffffff
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffff6
push 2
pop esi
je 0x10031b2b
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0x520f3038
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10031a1e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1bc], 0x9ac70c30
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10031a06
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x10031b1b
mov dword [ebp - 0x20], 0x31defcec
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x24]
neg edx
dec edx
neg edx
mov eax, dword [ebp + eax*4 - 0x1bc]
sbb edx, edx
neg edx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
cmp ecx, dword [ebp + eax*4 - 0x1bc]
jge 0x10031aab
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031aa4
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10031b0c
jmp 0x10031ab6
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10031b09
cmp dword [ebp - 0x20], eax
jne 0x10031b07
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
test eax, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
mov ecx, 0xd707d8eb
setge dl
cmp ecx, eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x24]
sub edx, dword [ebp + eax*4 - 0x1bc]
imul edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1bc], edx
mov eax, ebx
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], ebx
jle 0x10031a2a
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xfffffff6
jne 0x100319f4
or ecx, 0xffffffff
mov dword [ebp - 0x44], 0x720e
mov eax, 0x17a540f8
mov dword [ebp - 0x38], 0xefa20bd0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x6dc], eax
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], eax
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], eax
jmp 0x10031b74
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xeac], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10031b63
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0x63978472
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x30], eax
jne 0x10031baf
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x10031bb1
mov ecx, ebx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
imul eax, ecx
neg eax
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jne 0x10031c9e
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10031be5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x738], 0x4471
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10031bd4
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp eax, 8
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
je 0x10031c19
xor eax, eax
cmp dword [ebp - 0x6d4], eax
jne 0x10031c23
jmp 0x10031c1b
xor eax, eax
cmp dword [ebp - 0x738], eax
je 0x10031c25
mov eax, ebx
mov edx, dword [ebp - 0x730]
xor ecx, ecx
sub edx, dword [ebp - 0x730]
imul eax, eax, 0xede
cmp eax, 0x4ac0
setg cl
sub edx, ecx
mov ecx, 0xc01a0776
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x6d4]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x730]
mov eax, dword [ebp - 0x30]
add edx, 0x227a2491
neg edx
sbb edx, edx
inc edx
sub edx, eax
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x2c], eax
jmp 0x10031d03
mov dword [ebp - 0x34], 0x5adb561
xor eax, eax
mov dword [ebp - 0x50], 0xfffffffe
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031ccd
push 0x22ee
push 0x2eb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [ebp - 0x38]
neg eax
push 0
sbb eax, eax
neg eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
pop edx
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jne 0x10031cf8
cmp dword [ebp - 0x34], eax
je 0x10031cfa
mov eax, ebx
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10031d27
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x460], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031d13
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031d43
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x214], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031d2f
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x45c], eax
je 0x10031db4
mov dword [ebp - 0x1c], 0x5ae649f6
xor ecx, ecx
mov dword [ebp - 0x34], 0x3d6c1dfe
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
test eax, eax
setg cl
xor edx, edx
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x45c]
imul eax, ecx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setge dl
imul edx, dword [ebp - 0x45c]
mov dword [ebp - 0x1c], edx
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x460]
cmp eax, ecx
setge dl
cmp edx, 0xcdf11bbb
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
jmp 0x10031dd2
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031dc6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
xor eax, eax
mov byte [ebp - 0x39], al
mov dword [ebp - 0x2c], 0x860b4ffb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10031dff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd70], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10031dea
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031e1c
push eax
push 0x1d11
push 0x463
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
push 2
mov dword [ebp - 0x2c], eax
pop ecx
jmp 0x10031e34
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0xd70], 0
jne 0x10031e39
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x10031e24
cmp byte [ebp - 0x39], 0
je 0x10031f15
mov eax, 0x6282
mov dword [ebp - 0x8ac], eax
mov dword [ebp - 0x8a8], eax
mov dword [ebp - 0x8a4], eax
mov dword [ebp - 0x8a0], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031e7f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64], 0xa6de
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031e6a
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10031e95
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1f8], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031e84
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1f8], eax
test eax, eax
je 0x10031eb5
xor eax, eax
cmp dword [ebp - 0x1f8], eax
je 0x10031eb7
mov eax, ebx
jmp 0x10031eb7
xor eax, eax
cmp eax, ebx
mov eax, dword [ebp - 0x64]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
cmp edx, dword [ebp - 0x64]
jle 0x10031ed1
mov eax, dword [ebp - 0x1f8]
mov eax, dword [ebp - 0x64]
xor ecx, ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
cmp eax, 0xa37d7c86
setne cl
xor eax, eax
mov dword [ebp - 0x8a4], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031f08
call dword [sym.imp.USER32.dll_GetCapture]
xor eax, eax
push eax
push ebx
push 0x1428
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
mov dword [ebp - 0x24], 0xb722ba7b
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10031f40
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x744], 0x76c51653
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10031f27
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031f5d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7c], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031f48
xor eax, eax
cmp dword [ebp - 0x73c], eax
je 0x10031faa
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x24]
add eax, ecx
mov ecx, dword [ebp - 0x73c]
imul ecx, eax
dec dword [ebp - 0x24]
test ecx, ecx
jne 0x10031f86
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x10031f88
mov ecx, ebx
mov eax, dword [ebp - 0x7c]
add eax, ecx
jne 0x10031f92
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x73c]
jl 0x10031fa8
xor eax, eax
cmp dword [ebp - 0x7c], eax
je 0x10031fa8
mov eax, ebx
jmp 0x10031faa
xor eax, eax
push 0xfffffffffffffff8
pop ecx
sub ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x73c]
cmp ecx, eax
mov eax, dword [ebp - 0x7c]
setne dl
imul eax, edx
cmp eax, dword [ebp - 0x7c]
jge 0x10031ff2
xor eax, eax
cmp dword [ebp - 0x7c], eax
jne 0x10031ff4
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x24], eax
jmp 0x10031fea
mov dword [ebp - 0x50], 0x77201043
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x12
jge 0x10031fda
jmp 0x1003205a
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1003201c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc80], 0x2718b962
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10032003
xor eax, eax
cmp dword [ebp - 0x20], 0xfffffff6
je 0x10032029
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x1003202b
mov ecx, ebx
mov eax, dword [ebp - 0x20]
imul eax, ecx
test eax, eax
je 0x10032041
or eax, 0xffffffff
cmp dword [ebp - 0x24], eax
jge 0x10032041
mov eax, ebx
jmp 0x10032043
xor eax, eax
mov dword [ebp - 0xc7c], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003205a
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x7c], 0x7221ebc5
or eax, 0xffffffff
mov dword [ebp - 0x18], 0xd976ff55
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x18], eax
mov eax, 0x643b8a2
mov dword [ebp - 0x44], 0x176df7e
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0xde6fc608
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x44], 0x5aee0cd9
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0x4ce10b49
mov dword [ebp - 0x50], 0xfffc
mov dword [ebp - 0x44], 0xfff8
mov dword [ebp - 0x1c], eax
jmp 0x100320c9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100320bc
mov eax, dword [ebp - 0x11c]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x11c]
cmp eax, 0xd6f1860e
mov eax, dword [ebp - 0x48]
setne cl
sub eax, ecx
mov ecx, dword [ebp - 0x11c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x11c]
setl dl
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x18]
setge cl
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x20]
cmp eax, ebx
jne 0x10032137
mov eax, ebx
jmp 0x10032139
xor eax, eax
mov dword [ebp - 0x50], eax
xor eax, eax
push 0xfffffffffffffff9
mov byte [ebp - 0x39], al
pop edx
mov dword [ebp - 0x30], 0x5d6c05ba
mov dword [ebp - 0x48], edx
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1003216d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd10], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10032159
xor eax, eax
mov dword [ebp - 0x30], 6
cmp dword [ebp - 0x30], 0x19
jl 0x1003226e
jmp 0x10032182
xor eax, eax
mov dword [ebp - 0x24], 0xb844
cmp dword [ebp - 0x24], eax
jg 0x10032191
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x100321f8
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
jmp 0x100321ee
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100321cb
push eax
call edi
push 2
xor eax, eax
pop ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100321eb
push 0x506
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x100321ba
mov eax, dword [ebp - 0x24]
jmp 0x1003225b
mov dword [ebp - 0x2c], 0x639e6a4
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfff6
jne 0x10032214
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x2c], eax
je 0x10032216
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xd08]
sete cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xb1dab551
setl cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x19
jge 0x10032180
push 3
pop ecx
push 0xfffffffffffffff9
pop edx
cmp byte [ebp - 0x39], 0
je 0x10032583
mov dword [ebp - 0x2c], 0xd41e
xor eax, eax
mov dword [ebp - 0x30], 0xb2c41ac3
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x100322b4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf80], 0xa000286f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003229c
xor eax, eax
push 2
pop edi
cmp dword [ebp - 0x2c], eax
je 0x100324bd
mov dword [ebp - 0x40], eax
mov eax, 0xa60813c2
mov dword [ebp - 0x79c], eax
mov dword [ebp - 0x798], eax
mov dword [ebp - 0x794], eax
mov dword [ebp - 0x790], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100322ff
push 7
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xdc], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100322ed
mov eax, dword [ebp - 0xd8]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1003233d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0xd8]
sub edx, eax
mov eax, dword [ebp - 0xd8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0xdc]
jge 0x1003233d
xor eax, eax
mov edx, eax
jmp 0x1003233f
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xbe85
mov ecx, 0xffff
setl al
cmp ecx, eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x790]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xd8]
setge cl
xor edx, edx
cmp ecx, 0x8bbd1883
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, 0xffff
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xdc]
setne dl
add eax, edx
xor edx, edx
cmp eax, 0x97867a7b
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffe5
jne 0x10032576
push 7
pop ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], 0xba8a7e8b
mov dword [ebp - 0x48], 0x4efc7101
cmp dword [ebp - 0x40], eax
jne 0x10032576
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffef
jge 0x100324ab
mov dword [ebp - 0x1c], eax
jmp 0x1003240f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7d4], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10032402
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1003243f
mov eax, dword [ebp - 0xd8]
xor ecx, ecx
cmp eax, 0x315b
setg cl
add ecx, 0xfffe
mov dword [ebp - 0x20], ecx
jne 0x10032442
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x7d4]
mov eax, dword [ebp - 0x7d4]
mov eax, dword [ebp - 0x18]
cmp ebx, eax
push 0
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x790]
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ebx, ebx
cmp edx, 0x862
setge bl
xor ecx, ecx
cmp ebx, eax
pop eax
setne cl
push 1
mov dword [ebp - 0xd8], ecx
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffef
pop ebx
push 7
pop ecx
jl 0x100323fd
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffe5
je 0x100323d3
jmp 0x10032576
mov dword [ebp - 0x44], 0x3351f4a1
mov dword [ebp - 0x1c], 0x441147c0
mov dword [ebp - 0x48], 0x66c79a83
mov dword [ebp - 0x710], edx
mov dword [ebp - 0x70c], edx
mov dword [ebp - 0x708], edx
mov dword [ebp - 0x704], edx
or edx, 0xffffffff
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x50], 6
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1003251a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa24], 0xf1475ac
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10032502
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003252c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc98], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003251f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x708]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0xc90], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x70c]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa20], ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x2c], 0x4504cd45
dec dword [ebp - 0x2c]
mov dword [ebp - 0x2c], 3
jmp 0x1003264b
mov dword [ebp - 0x38], 0xea983111
mov dword [ebp - 0x38], 0xfffffffd
cmp dword [ebp - 0x38], 0x16
jne 0x10032648
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100325d8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xff8], 0x3244d513
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100325bf
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100325f2
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffe6
cmp dword [ebp - 0x1c], 0xffffffe7
jle 0x1003263b
push 2
pop ecx
mov dword [ebp - 0x20], 0x7dcd66a0
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x10032632
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003262a
push 0x1244
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x10032611
push 2
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jg 0x10032602
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x16
je 0x100325b3
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x13
jne 0x10032599
xor eax, eax
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10032680
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10e4], 0x8e97eede
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10032667
xor eax, eax
inc dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
jmp 0x100326ba
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100326b7
push 0x25eb
push eax
push 0x1bef
push 0x1a80
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x10032688
mov dword [ebp - 0x34], 0xef6f0c3d
mov dword [ebp - 0x50], 0xa0197cbb
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100326f0
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x550], 0xf70ad6f2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100326d7
xor eax, eax
push 2
mov dword [ebp - 0x28], eax
pop edi
cmp dword [ebp - 0x28], edi
jge 0x1003270f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x144], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100326fb
xor eax, eax
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x28], ebx
jge 0x1003272e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x670], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003271a
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1003274e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x380], 0x2044653f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10032736
xor eax, eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], edi
jg 0x10032867
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], eax
jmp 0x100327d4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], edi
cmp dword [ebp - 0x40], eax
jl 0x1003278b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032786
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
dec dword [ebp - 0x40]
jns 0x10032773
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], edi
jg 0x100327d1
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x144]
cmp dword [ebp + eax*4 - 0x550], 0
jne 0x100327cf
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x100327c1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x550], 0x7e780ca9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x100327b0
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jle 0x10032793
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jle 0x10032768
mov eax, dword [ebp - 0x37c]
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp + eax*4 - 0x550]
mov eax, dword [ebp - 0x37c]
mov eax, dword [ebp - 0x550]
mov eax, dword [ebp - 0x37c]
xor eax, eax
cmp dword [ebp - 0x37c], eax
jne 0x10032815
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp + eax*4 - 0x550]
mov eax, dword [ebp - 0x144]
push 0
pop ecx
push 0
mov eax, dword [ebp + eax*4 - 0x550]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
mov eax, dword [ebp - 0x38]
setns cl
xor edx, edx
cmp ecx, eax
pop eax
setg dl
mov dword [ebp - 0x37c], edx
mov dword [ebp - 0x50], edx
inc dword [ebp - 0x144]
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x144], edi
jle 0x10032760
mov edi, 0xbac64a68
or ecx, 0xffffffff
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10032898
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb4], 0xdba33992
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032880
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100328cd
mov dword [ebp - 0x2c], 0xda5043c4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x100328ca
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0xb4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb4], ecx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x100328ac
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1d
jne 0x1003289d
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov edx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x40]
sete cl
xor edx, edx
cmp ecx, 0xfe924f63
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setge bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0xb4]
setg dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0x40]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x24], ecx
xor ebx, ebx
mov dword [ebp - 0x44], 0x720e
inc ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10032987
push eax
push ebx
push 0x1428
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003299d
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
mov dword [ebp - 0x24], edi
or ecx, 0xffffffff
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100329c9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb8], 0xdba33992
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100329b1
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100329fe
mov dword [ebp - 0x2c], 0xda5043c4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x100329fb
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb8], ecx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x100329dd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1d
jne 0x100329ce
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov edx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x40]
sete cl
xor edx, edx
cmp ecx, 0xfe924f63
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setge bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0xb8]
setg dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xb8]
mov edx, dword [ebp - 0x40]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x24], ecx
inc ebx
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], eax
or edx, 0xffffffff
cmp dword [ebp - 0x14], 3
jge 0x10032abe
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd58], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10032aa9
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10032ae0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa30], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10032ac7
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 2
pop ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x10032c06
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10032b17
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x408], 0x5a654fdd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10032afe
xor eax, eax
mov dword [ebp - 0x400], ecx
cmp dword [ebp - 0x400], eax
jl 0x10032be3
mov dword [ebp - 0x24], 0x449c9fb3
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x10032b62
mov eax, dword [ebp - 0x400]
cmp dword [ebp + eax*4 - 0xd58], 0
jne 0x10032b60
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jg 0x10032bd4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032bf7
push 0x1381
push eax
push eax
call edi
xor eax, eax
dec dword [ebp - 0x20]
push 2
pop ecx
push 0xffffffffffffffff
pop edx
jns 0x10032af5
mov dword [ebp - 0x2c], 0x4504cd45
dec dword [ebp - 0x2c]
mov dword [ebp - 0x2c], 3
jmp 0x10032cc7
mov dword [ebp - 0x38], 0xea983111
mov dword [ebp - 0x38], 0xfffffffd
jmp 0x10032cba
cmp dword [ebp - 0x38], 0x16
je 0x10032c2f
cmp dword [ebp - 0x2c], 0x13
jne 0x10032c1c
mov dword [ebp - 0x2c], 0x860b4ffb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10032cf9
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcb0], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10032ce4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032d16