Function at 0x1002c6cd
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b980
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x384
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002c719
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov eax, dword [eax]
and dword [eax], 0
jmp 0x1002df9d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x230], 0x971c
mov dword [ebp - 0x354], 0x4768c0aa
mov dword [ebp - 0x1d4], 3
push 4
lea ecx, [ebp - 0x2dc]
call fcn.10016a6e
and dword [ebp - 4], 0
mov dword [ebp - 0x54], 0x3859
mov dword [ebp - 0x168], 0xfffffffd
mov dword [ebp - 0x310], 0xa97f51ef
mov dword [ebp - 0x350], 0
push 1
lea ecx, [ebp - 0x278]
call fcn.10016a6e
mov byte [ebp - 4], 1
mov dword [ebp - 0x48], 0x8f49235
mov dword [ebp - 0x1d8], 0x4643a64e
mov dword [ebp - 0x10], 0
jmp 0x1002c7a5
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002c7bb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x390], 0x978f3c34
jmp 0x1002c79e
lea eax, [ebp - 0x2dc]
push eax
push 1
push 0x44e5
lea eax, [ebp - 0x10]
push eax
push 0x1ef6
push 0x6479
call fcn.10027974
add esp, 0x18
mov dword [ebp - 0x10], 0
jmp 0x1002c7ef
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002c80b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x278]
call fcn.10016adb
mov dword [eax], 0x3eb61943
jmp 0x1002c7e8
mov dword [ebp - 0x10], 0
jmp 0x1002c81b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002c831
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x370], 5
jmp 0x1002c814
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x104], eax
push 0
lea ecx, [ebp - 0x278]
call fcn.10016adb
mov ecx, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x48]
inc ecx
mov dword [ebp - 0x48], ecx
test eax, eax
jne 0x1002c908
mov eax, dword [ebp - 0x54]
neg eax
cmp eax, dword [ebp - 0x1d4]
jle 0x1002c8cd
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x168]
cmp dword [ebp + eax - 0x370], ecx
jne 0x1002c892
mov dword [ebp - 0x1e0], 1
jmp 0x1002c899
and dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1e0], 0x5438
jle 0x1002c8b1
mov dword [ebp - 0x9c], 1
jmp 0x1002c8b8
and dword [ebp - 0x9c], 0
push 0
lea ecx, [ebp - 0x278]
call fcn.10016adb
mov ecx, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x1d8], eax
jl 0x1002c8e7
mov dword [ebp - 0x1cc], 1
jmp 0x1002c8ee
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
add eax, 4
cmp dword [ebp - 0x1d8], eax
jle 0x1002c908
and dword [ebp - 0xd8], 0
jmp 0x1002c912
mov dword [ebp - 0xd8], 1
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0xd8]
jl 0x1002c95d
mov dword [ebp - 0x54], 3
jmp 0x1002c930
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1002c958
mov dword [ebp - 0x238], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x2dc]
call fcn.10016adb
mov eax, dword [eax]
mov dword [ebp - 0x238], eax
jmp 0x1002c929
jmp 0x1002ca09
mov byte [ebp - 0x40], 0
movzx eax, byte [ebp - 0x40]
test eax, eax
je 0x1002c987
push 0x26d6
push 0x1f57
push 0x35c6
push 0x79fb
push 0
call fcn.1002af43
add esp, 0x14
mov dword [ebp - 0x48], 0
jmp 0x1002c997
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x1002ca09
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x1002c9b1
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x1002ca07
push 0x1a95
push 0xbb4
push 0
push 0
push 0x26d0
push 0x208f
push 0x22ac
push 0x119b
push 0x144b
push 0x1abe
push 0x1933
push 0x17d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
jmp 0x1002c990
push 0x76a8
lea eax, [ebp - 0x278]
push eax
push 0x7125
push 0x2be7
lea eax, [ebp - 0x168]
push eax
push 0xbd
push 0
push 0x2a17
call fcn.1002f684
add esp, 0x20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x278]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2dc]
call fcn.10016ad6
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xe0], 0xb0b0
push 0x4b0e
push 0x4171
push 0
lea eax, [ebp - 0xe0]
push eax
call fcn.100283de
add esp, 0x10
cmp dword [ebp - 0xe0], 0
je 0x1002cabd
mov byte [ebp - 0x3b], 0
movzx eax, byte [ebp - 0x3b]
test eax, eax
je 0x1002cabb
push 0x660e
push 0x2b2a
push 0
call fcn.10028452
add esp, 0xc
jmp 0x1002cadd
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x1002cadd
push 0
push 0x3016
push 0x6fae
call fcn.100284c0
add esp, 0xc
and dword [ebp - 0x94], 0
jmp 0x1002cafc
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x20]
add eax, 0x28
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x94], eax
jge 0x1002df9d
mov dword [ebp - 0x7c], 0xfffffffd
mov dword [ebp - 0x318], 0xfa147b80
mov dword [ebp - 0x2e4], 0xfffffff9
mov dword [ebp - 0x2ec], 4
mov dword [ebp - 0x6c], 0
jmp 0x1002cb46
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1002cb5c
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x2f4], 0x624039b
jmp 0x1002cb3f
mov dword [ebp - 0x7c], 0
jmp 0x1002cb6c
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x1002cc3d
mov dword [ebp - 0x74], 0x976ff55e
mov dword [ebp - 0x2fc], 7
mov dword [ebp - 0x304], 0xd1f2e966
mov dword [ebp - 0x74], 0
jmp 0x1002cba1
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jg 0x1002cc38
mov dword [ebp - 0x240], 6
mov dword [ebp - 0x84], 0
jmp 0x1002cbce
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1002cbea
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x30c], 5
jmp 0x1002cbc1
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x1002cc0e
push 0x2432
push 0
push 0
push 0
push 0x213
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
lea eax, [ebp - 0x240]
push eax
push 0x53b3
push 0x4505
push 0x1e52
push 1
push 0x2164
call fcn.10027a30
add esp, 0x18
jmp 0x1002cb9a
jmp 0x1002cb65
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x1002cc76
push 0x49a2
push 0
push 0x3f59
push 0x47b9
push 0x21cb
push 0xee5
push 0x2c76
push 0xf0a
call fcn.10028086
add esp, 0x20
mov dword [ebp - 0x50], 0xdb3ae355
mov dword [ebp - 0x68], 0
jmp 0x1002cc8d
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1002cca3
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x288], 0x38ab659d
jmp 0x1002cc86
mov dword [ebp - 0x50], 0
jmp 0x1002ccb3
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x16
je 0x1002d035
mov dword [ebp - 0x24], 6
mov dword [ebp - 0xbc], 0xffffffff
mov dword [ebp - 0x24], 0
jmp 0x1002ccde
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe5
jge 0x1002d01e
mov dword [ebp - 0x18], 0x2e8588d0
mov dword [ebp - 0x14], 0x1fbc9fa8
mov dword [ebp - 0x110], 2
mov dword [ebp - 0x18], 2
jmp 0x1002cd10
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1002cfeb
cmp dword [ebp - 0x18], 0xfaf07207
jb 0x1002cd2f
mov dword [ebp - 0xe8], 1
jmp 0x1002cd36
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x314], eax
push 0xfffffffffffffffb
pop eax
cmp eax, 0x5e82
jle 0x1002cd55
mov dword [ebp - 0x1b0], 1
jmp 0x1002cd5c
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1b0], eax
je 0x1002cd73
mov dword [ebp - 0x170], 1
jmp 0x1002cd7a
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x170]
jg 0x1002cd94
mov dword [ebp - 0xf0], 1
jmp 0x1002cd9b
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x288]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x1002cec5
mov dword [ebp - 0x248], 0x77d6446b
mov dword [ebp - 0x14], 0x18
jmp 0x1002cdd5
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff2
jg 0x1002cec3
mov dword [ebp - 0x1b8], 0xe7504ed0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x288]
mov dword [ebp - 0x31c], eax
push 3
pop eax
test eax, eax
je 0x1002ce17
cmp dword [ebp - 0x248], 0
je 0x1002ce17
mov dword [ebp - 0x220], 1
jmp 0x1002ce1e
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x288], 0
je 0x1002ce49
cmp dword [ebp - 0x1b8], 0
je 0x1002ce49
mov dword [ebp - 0x1d0], 1
jmp 0x1002ce50
and dword [ebp - 0x1d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x288]
cmp dword [ebp - 0x1d0], eax
je 0x1002ce71
mov dword [ebp - 0xf8], 1
jmp 0x1002ce78
and dword [ebp - 0xf8], 0
cmp dword [ebp - 0xf8], 0
jg 0x1002ce8d
mov dword [ebp - 0x178], 1
jmp 0x1002ce94
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x178]
jle 0x1002ceab
mov dword [ebp - 0x100], 1
jmp 0x1002ceb2
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x1b8], eax
jmp 0x1002cdce
jmp 0x1002cef4
mov dword [ebp - 0x14], 2
jmp 0x1002ced5
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1002cef4
mov byte [ebp - 0x3f], 0
push 0
push 0x48b1
lea eax, [ebp - 0x3f]
push eax
call fcn.1002f7f7
add esp, 0xc
jmp 0x1002cece
mov dword [ebp - 0x14], 0xfffffff5
jmp 0x1002cf04
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xa
jge 0x1002cfe6
mov dword [ebp - 0x214], 0xffff
cmp dword [ebp - 0x50], 0xfff9
jne 0x1002cf2d
mov dword [ebp - 0x108], 1
jmp 0x1002cf34
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x108]
jne 0x1002cf4b
mov dword [ebp - 0x180], 1
jmp 0x1002cf52
and dword [ebp - 0x180], 0
mov dword [ebp - 0x110], 0xaecaa70
mov eax, dword [ebp - 0x214]
imul ecx, dword [ebp - 0x180], 0xfffb
sub eax, ecx
add eax, 0x461d0ee3
cmp dword [ebp - 0x110], eax
jge 0x1002cf87
mov dword [ebp - 0x1e4], 1
jmp 0x1002cf8e
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1e4], eax
jne 0x1002cfa5
mov dword [ebp - 0x118], 1
jmp 0x1002cfac
and dword [ebp - 0x118], 0
cmp dword [ebp - 0x118], 0x4730
jne 0x1002cfc4
mov dword [ebp - 0x188], 1
jmp 0x1002cfcb
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x288]
add eax, dword [ebp - 0x188]
mov dword [ebp - 0xbc], eax
jmp 0x1002cefd
jmp 0x1002cd09
mov dword [ebp - 0x18], 0x10
jmp 0x1002cffb
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe7
jg 0x1002d019
cmp dword [ebp - 0xbc], 0
je 0x1002d00c
jmp 0x1002d019
cmp dword [ebp - 0xbc], 0
je 0x1002d017
jmp 0x1002cff4
jmp 0x1002cff4
jmp 0x1002ccd7
lea eax, [ebp - 0x50]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.10028639
add esp, 0xc
jmp 0x1002ccac
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x1002d04e
mov dword [ebp - 0x120], 1
jmp 0x1002d055
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0xa4], 1
mov dword [ebp - 0x34], 0xcb13638e
mov dword [ebp - 0x130], 0x3423637b
push 1
lea ecx, [ebp - 0x2d0]
call fcn.10016a6e
mov dword [ebp - 4], 2
mov dword [ebp - 0x268], 0x137d3709
mov dword [ebp - 0x1c], 0
jmp 0x1002d0aa
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002d0c0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x324], 6
jmp 0x1002d0a3
mov dword [ebp - 0x1c], 0
jmp 0x1002d0d0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002d0e6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1ec], 0
jmp 0x1002d0c9
mov dword [ebp - 0x1c], 0
jmp 0x1002d0f6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1002d10f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
and dword [eax], 0
jmp 0x1002d0ef
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x1002d2ab
cmp dword [ebp - 0x34], 0
je 0x1002d1e4
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa4]
mov dword [ebp + eax - 0x324], ecx
xor eax, eax
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
jge 0x1002d155
mov dword [ebp - 0x1c0], 1
jmp 0x1002d15c
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x1c0]
neg eax
sub eax, 0x7209c399
cmp eax, dword [ebp - 0xa4]
jl 0x1002d186
mov eax, 0x4df8e3bf
test eax, eax
je 0x1002d186
mov dword [ebp - 0x128], 1
jmp 0x1002d18d
and dword [ebp - 0x128], 0
imul eax, dword [ebp - 0x128], 0x4cc5
test eax, eax
jne 0x1002d1ad
mov eax, 0xec1f
test eax, eax
jne 0x1002d1ad
and dword [ebp - 0x190], 0
jmp 0x1002d1b7
mov dword [ebp - 0x190], 1
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1ec]
je 0x1002d1e4
mov dword [ebp - 0x1dc], 1
jmp 0x1002d1eb
and dword [ebp - 0x1dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ec]
cmp dword [ebp - 0x1dc], eax
je 0x1002d20c
mov dword [ebp - 0x138], 1
jmp 0x1002d213
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x34]
neg eax
cmp eax, dword [ebp - 0x138]
jne 0x1002d22c
mov dword [ebp - 0x198], 1
jmp 0x1002d233
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x34], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ec]
cmp dword [ebp - 0x34], eax
je 0x1002d25a
mov dword [ebp - 0xb4], 1
jmp 0x1002d261
and dword [ebp - 0xb4], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
mov ecx, dword [ebp - 0xb4]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ec]
cmp dword [ebp - 0xb4], eax
je 0x1002d297
mov dword [ebp - 0x140], 1
jmp 0x1002d29e
and dword [ebp - 0x140], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ec]
mov dword [ebp - 0x268], 0xe41b0ce7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d0]
call fcn.10016ad6
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x1002d2dd
mov dword [ebp - 0x1c8], 1
jmp 0x1002d2e4
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x2ac], 0x7f759609
mov dword [ebp - 0x2a8], 0x7f759609
mov dword [ebp - 0x2a4], 0x7f759609
mov dword [ebp - 0x2a0], 0x7f759609
lea ecx, [ebp - 0xb5]
call fcn.10008943
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x378]
call fcn.10016aea
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x90]
call fcn.10016ab0
mov dword [ebp - 4], 3
push 1
lea ecx, [ebp - 0x25c]
call fcn.10016a6e
mov byte [ebp - 4], 4
mov dword [ebp - 0x98], 2
mov dword [ebp - 0xec], 0x55d58009
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x70], 0
jmp 0x1002d393
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1002d3af
push dword [ebp - 0x70]
lea ecx, [ebp - 0x25c]
call fcn.10016adb
mov dword [eax], 2
jmp 0x1002d38c
push 3
lea ecx, [ebp - 0x90]
call fcn.10016adb
mov eax, dword [eax]
neg eax
jne 0x1002d3d4
mov eax, 0xed40
test eax, eax
jne 0x1002d3d4
and dword [ebp - 0xac], 0
jmp 0x1002d3de
mov dword [ebp - 0xac], 1
push 0
lea ecx, [ebp - 0x25c]
call fcn.10016adb
mov ecx, dword [ebp - 0xac]
mov dword [eax], ecx
cmp dword [ebp - 0xac], 0
jne 0x1002d417
push 0
lea ecx, [ebp - 0x25c]
call fcn.10016adb
cmp dword [eax], 0
jne 0x1002d417
and dword [ebp - 0x148], 0
jmp 0x1002d421
mov dword [ebp - 0x148], 1
mov eax, dword [ebp - 0x148]
add eax, 3
mov dword [ebp - 0x98], eax
mov esi, dword [ebp - 0x98]
push 0
lea ecx, [ebp - 0x90]
call fcn.10016adb
cmp esi, dword [eax]
jg 0x1002d453
mov dword [ebp - 0x1a0], 1
jmp 0x1002d45a
and dword [ebp - 0x1a0], 0
cmp dword [ebp - 0x1a0], 0x2c87
jne 0x1002d472
mov dword [ebp - 0x150], 1
jmp 0x1002d479
and dword [ebp - 0x150], 0
push 2
lea ecx, [ebp - 0x90]
call fcn.10016adb
mov esi, dword [ebp - 0x150]
sub esi, dword [eax]
push 3
lea ecx, [ebp - 0x90]
call fcn.10016adb
cmp esi, dword [eax]
jle 0x1002d4ab
mov dword [ebp - 0x1f0], 1
jmp 0x1002d4b2
and dword [ebp - 0x1f0], 0
push 3
lea ecx, [ebp - 0x90]
call fcn.10016adb
mov ecx, dword [ebp - 0x1f0]
cmp ecx, dword [eax]
je 0x1002d4d5
mov dword [ebp - 0x158], 1
jmp 0x1002d4dc
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x158], eax
jg 0x1002d4f6
mov dword [ebp - 0x1a8], 1
jmp 0x1002d4fd
and dword [ebp - 0x1a8], 0
push 0
lea ecx, [ebp - 0x90]
call fcn.10016adb
mov esi, eax
push 3
lea ecx, [ebp - 0x90]
call fcn.10016adb
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x1a8]
je 0x1002d531
mov dword [ebp - 0x160], 1
jmp 0x1002d538
and dword [ebp - 0x160], 0
push 3
lea ecx, [ebp - 0x90]
call fcn.10016adb
mov ecx, dword [ebp - 0x160]
cmp ecx, dword [eax]
jg 0x1002d55b
mov dword [ebp - 0xd0], 1
jmp 0x1002d562
and dword [ebp - 0xd0], 0
push 3
lea ecx, [ebp - 0x90]
call fcn.10016adb
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd0]
jl 0x1002d585
mov dword [ebp - 0xd4], 1
jmp 0x1002d58c
and dword [ebp - 0xd4], 0
push 3
lea ecx, [ebp - 0x90]
call fcn.10016adb
mov ecx, dword [ebp - 0xd4]
cmp ecx, dword [eax]
jne 0x1002d5af
mov dword [ebp - 0xdc], 1
jmp 0x1002d5b6
and dword [ebp - 0xdc], 0
cmp dword [ebp - 0xdc], 0xdbc2a41b
je 0x1002d5ce
mov dword [ebp - 0xe4], 1
jmp 0x1002d5d5
and dword [ebp - 0xe4], 0
push 1
lea ecx, [ebp - 0x90]
call fcn.10016adb
mov ecx, dword [ebp - 0xe4]
cmp ecx, dword [eax]
jne 0x1002d679
push 4
lea ecx, [ebp - 0x2b8]
call fcn.10016a6e
mov byte [ebp - 4], 5
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x2e0]
push eax
push 0x2670
push 0
push 0x2f15
lea eax, [ebp - 0x2b8]
push eax
call fcn.10028677
add esp, 0x14
lea eax, [ebp - 0x25c]
push eax
push 1
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.10028086
add esp, 0x20
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2b8]
call fcn.10016ad6
jmp 0x1002d6ec
push 3
lea ecx, [ebp - 0x2c4]
call fcn.10016a6e
mov byte [ebp - 4], 6
mov dword [ebp - 0x224], 0x1847726b
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x328]
push eax
push 0x5c24
push 0x4f4b
push 0x64ad
push 0x3a29
push 1
call fcn.1002820d
add esp, 0x1c
push 0x374c
lea eax, [ebp - 0x2c4]
push eax
push 1
lea eax, [ebp - 0x224]
push eax
call fcn.10028369
add esp, 0x10
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c4]
call fcn.10016ad6
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x25c]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.10016ad6
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x1002d723
mov dword [ebp - 0xf4], 1
jmp 0x1002d72a
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x38], 0xce57bf5c
mov dword [ebp - 0x2c], 0xeea53061
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x134], 9
mov dword [ebp - 0x234], 0x718bc698
mov byte [ebp - 0x3a], 0
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x1002d78c
push 0x6ad0
push 0
push 0x728e
call fcn.1002f639
add esp, 0xc
cmp dword [ebp - 0x38], 0
je 0x1002d7a4
cmp dword [ebp - 0x38], 0
je 0x1002d7a4
mov dword [ebp - 0xfc], 1
jmp 0x1002d7ab
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0xfc]
sub eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jne 0x1002d7c9
mov dword [ebp - 0x26c], 1
jmp 0x1002d7d0
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x38]
test eax, eax
je 0x1002d7f9
cmp dword [ebp - 0x22c], 0
je 0x1002d7f9
mov dword [ebp - 0xc8], 1
jmp 0x1002d800
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xc8]
jge 0x1002d817
mov dword [ebp - 0x10c], 1
jmp 0x1002d81e
and dword [ebp - 0x10c], 0
cmp dword [ebp - 0x10c], 0xcd76
jle 0x1002d836
mov dword [ebp - 0x114], 1
jmp 0x1002d83d
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x38]
jne 0x1002d860
cmp dword [ebp - 0x38], 0
jne 0x1002d860
cmp dword [ebp - 0x2c], 0
jne 0x1002d860
and dword [ebp - 0x11c], 0
jmp 0x1002d86a
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0x11c]
neg eax
add eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x2c]
jne 0x1002d886
mov dword [ebp - 0x124], 1
jmp 0x1002d88d
and dword [ebp - 0x124], 0
push 0xfffffffffffffffe
pop eax
sub eax, dword [ebp - 0x124]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x38], eax
jl 0x1002d8b3
mov dword [ebp - 0x264], 1
jmp 0x1002d8ba
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x1002d905
push 0x4000
mov eax, dword [ebp - 0x20]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x20]
push dword [eax + 8]
push 0x362b
push 0x3de7
call fcn.100254be
pop ecx
pop ecx
call eax
jmp 0x1002cae6
mov dword [ebp - 0x17c], 1
mov dword [ebp - 0x78], 0
jmp 0x1002d91f
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1002d935
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x204], 0xfffffff7
jmp 0x1002d918
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x204], 0
jmp 0x1002d963
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x204]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x204], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x204], 0x1c
je 0x1002db90
mov dword [ebp - 0x58], 0xeede0b40
mov dword [ebp - 0x27c], 3
mov dword [ebp - 0x58], 0
jmp 0x1002d998
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xffffffea
jg 0x1002db8b
mov dword [ebp - 0x80], 0
jmp 0x1002d9b2
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1002d9c8
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xc4], 1
jmp 0x1002d9ab
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x204], 0
jne 0x1002d9e7
cmp dword [ebp - 0x58], 0
jne 0x1002d9e7
and dword [ebp - 0x14c], 0
jmp 0x1002d9f1
mov dword [ebp - 0x14c], 1
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x204]
cmp dword [ebp + eax - 0xc4], ecx
jne 0x1002da19
mov dword [ebp - 0x13c], 1
jmp 0x1002da20
and dword [ebp - 0x13c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x13c]
sub ecx, dword [ebp + eax - 0xc4]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0xc4]
je 0x1002da4e
mov dword [ebp - 0x144], 1
jmp 0x1002da55
and dword [ebp - 0x144], 0
cmp dword [ebp - 0x144], 0xb42be197
jne 0x1002da6d
mov dword [ebp - 0x154], 1
jmp 0x1002da74
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x14c]
neg eax
cmp eax, dword [ebp - 0x154]
je 0x1002da90
mov dword [ebp - 0x15c], 1
jmp 0x1002da97
and dword [ebp - 0x15c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
cmp dword [ebp - 0x15c], eax
jge 0x1002dab8
mov dword [ebp - 0x164], 1
jmp 0x1002dabf
and dword [ebp - 0x164], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc4]
imul eax, dword [ebp - 0x164]
test eax, eax
jne 0x1002dae0
mov eax, 0x866193fe
test eax, eax
je 0x1002daf5
mov eax, 0x7d6c5051
test eax, eax
je 0x1002daf5
mov dword [ebp - 0x16c], 1
jmp 0x1002dafc
and dword [ebp - 0x16c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc4]
cmp dword [ebp - 0x16c], eax
jg 0x1002db1d
mov dword [ebp - 0x174], 1
jmp 0x1002db24
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xe0f758fc
jbe 0x1002db48
mov dword [ebp - 0x184], 1
jmp 0x1002db4f
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x184], eax
jle 0x1002db66
mov dword [ebp - 0x18c], 1
jmp 0x1002db6d
and dword [ebp - 0x18c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc4]
add eax, dword [ebp - 0x18c]
mov dword [ebp - 0x27c], eax
jmp 0x1002d991
jmp 0x1002d948
push 0
push 0x5cd3
push 0x7ae1
push 0x313e
push dword [ebp - 0x23c]
push dword [ebp - 0x24c]
push dword [ebp - 0x244]
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x20]
call fcn.1002e8c4
add esp, 0x24
push 0x2984
lea eax, [ebp - 0xcc]
push eax
push 0
push dword [ebp - 0x64]
push dword [ebp - 0x20]
push 0x1276
call fcn.10028835
add esp, 0x18
mov dword [ebp - 0x30], 0x1e87df2f
mov dword [ebp - 0x1ac], 0x77d7
mov dword [ebp - 0x28], 0
jmp 0x1002dc07
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002dc1d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1f8], 0xf0ea
jmp 0x1002dc00
mov dword [ebp - 0x28], 0
jmp 0x1002dc2d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002dc43
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x364], 4
jmp 0x1002dc26
mov byte [ebp - 0x3c], 0
movzx eax, byte [ebp - 0x3c]
test eax, eax
je 0x1002dc65
push 1
push 0
push 0x2202
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov dword [ebp - 0x30], 1
jmp 0x1002dc75
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1002df63
mov dword [ebp - 0x5c], 0xfffffffa
mov dword [ebp - 0x298], 0x227d373e
mov dword [ebp - 0x294], 0x227d373e
mov dword [ebp - 0x290], 0x227d373e
mov dword [ebp - 0x28c], 0x227d373e
mov dword [ebp - 0xa0], 0xffff
mov dword [ebp - 0x260], 1
mov dword [ebp - 0x5c], 1
jmp 0x1002dcd2
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1002dd79
mov dword [ebp - 0x32c], 1
mov dword [ebp - 0x2f0], 0xffffffff
mov dword [ebp - 0x348], 0xfffffff7
mov dword [ebp - 0x2f8], 0xe96b779c
push 1
lea ecx, [ebp - 0x344]
call fcn.10016a6e
mov dword [ebp - 4], 7
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x344]
push eax
push 1
push 0x6890
call fcn.100283de
add esp, 0x10
mov dword [ebp - 0x60], 0
jmp 0x1002dd42
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1002dd58
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x384], 0xc5440874
jmp 0x1002dd3b
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344]
call fcn.10016ad6
jmp 0x1002dccb
mov eax, 0x1f0ef2f3
test eax, eax
je 0x1002de14
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x30]
cmp dword [ebp + eax - 0x364], ecx
jl 0x1002dda4
mov dword [ebp - 0x194], 1
jmp 0x1002ddab
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x194], eax
je 0x1002ddc5
mov dword [ebp - 0x20c], 1
jmp 0x1002ddcc
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x1f8]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x308], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x298], 0
jne 0x1002de26
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x1002de26
mov eax, 0xfff8
test eax, eax
jne 0x1002de26
and dword [ebp - 0xa8], 0
jmp 0x1002de30
mov dword [ebp - 0xa8], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa8]
mov dword [ebp + eax - 0x364], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x1f8]
cmp eax, dword [ebp - 0xa8]
jle 0x1002de61
mov dword [ebp - 0x19c], 1
jmp 0x1002de68
and dword [ebp - 0x19c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f8]
cmp dword [ebp - 0x19c], eax
jg 0x1002de89
mov dword [ebp - 0x210], 1
jmp 0x1002de90
and dword [ebp - 0x210], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f8], 0x2a6a
jne 0x1002deaf
mov dword [ebp - 0x1a4], 1
jmp 0x1002deb6
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x1f8]
cmp eax, dword [ebp - 0x1a4]
jg 0x1002ded4
mov dword [ebp - 0xb0], 1
jmp 0x1002dedb
and dword [ebp - 0xb0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb0]
mov dword [ebp + eax - 0x298], ecx
cmp dword [ebp - 0xb0], 0
je 0x1002df0c
cmp dword [ebp - 0x1ac], 0
je 0x1002df0c
mov dword [ebp - 0x1b4], 1
jmp 0x1002df13
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1b4]
add eax, 0x4518073
cmp eax, 1
jne 0x1002df2f
mov dword [ebp - 0x1bc], 1
jmp 0x1002df36
and dword [ebp - 0x1bc], 0
cmp dword [ebp - 0x1bc], 0x395c
jl 0x1002df4e
mov dword [ebp - 0x1c4], 1
jmp 0x1002df55
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x5c], eax
jmp 0x1002dc6e
cmp dword [ebp - 0xcc], 0
jbe 0x1002df98
lea eax, [ebp - 0x338]
push eax
push dword [ebp - 0x218]
push dword [ebp - 0xcc]
mov eax, dword [ebp - 0x20]
push dword [eax + 8]
push 0x362b
push 0x2a91
call fcn.100254be
pop ecx
pop ecx
call eax
jmp 0x1002cae6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret