Function at 0x10027951
Capabilities:
Check os version
Compare security identifiers
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008ade9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x770
push esi
push edi
mov dword [ebp - 0x2c], 0xfb871c7b
mov dword [ebp - 0x118], 4
mov dword [ebp - 0x84], 0xd66c4a87
mov dword [ebp - 0x158], 0
jmp 0x100279a5
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x100279c1
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0xd0], 0x4a6847df
jmp 0x10027998
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x100279dc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov dword [ebp - 0x2c], 0
jmp 0x100279ec
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x10027c3f
mov dword [ebp - 0xe4], 0x99244325
mov dword [ebp - 0x6cc], 1
mov dword [ebp - 0x488], 1
mov dword [ebp - 0xe4], 0
jmp 0x10027a2d
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jg 0x10027c2c
mov dword [ebp - 0xbc], 5
or eax, 0xffffffff
je 0x10027a88
mov dword [ebp - 0x4ec], 0xfffffff6
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xd0]
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x10027a83
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x10027b43
mov dword [ebp - 0x320], 0x976d9935
mov dword [ebp - 0x84], 0
jmp 0x10027aab
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xfffffffb
jg 0x10027ac6
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xd0]
mov dword [ebp - 0xbc], eax
jmp 0x10027a9e
mov dword [ebp - 0x118], 0
jmp 0x10027adf
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jg 0x10027b43
mov dword [ebp - 0xbc], 0
jmp 0x10027b01
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jg 0x10027b32
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x10027b23
push 0x1f26
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
jmp 0x10027af4
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0xd0], 0
je 0x10027b41
jmp 0x10027ad2
jmp 0x10027ad2
cmp dword [ebp - 0x2c], 0
jne 0x10027b62
mov eax, dword [ebp - 0x84]
add eax, 0xd4db
cmp eax, 1
jle 0x10027b62
and dword [ebp - 0x46c], 0
jmp 0x10027b6c
mov dword [ebp - 0x46c], 1
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x46c]
test eax, eax
je 0x10027b92
mov eax, 0x4f2ca125
test eax, eax
je 0x10027b92
mov dword [ebp - 0x594], 1
jmp 0x10027b99
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xd0]
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x2c], 0xce2e7c52
jne 0x10027bc8
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0xd0], 0
jne 0x10027bc8
and dword [ebp - 0x480], 0
jmp 0x10027bd2
mov dword [ebp - 0x480], 1
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0x480], eax
jle 0x10027bec
mov dword [ebp - 0x3c8], 1
jmp 0x10027bf3
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0x3c8], eax
jle 0x10027c0d
mov dword [ebp - 0x1fc], 1
jmp 0x10027c14
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0xd0], ecx
jmp 0x10027a20
cmp dword [ebp - 0x84], 0
je 0x10027c3a
jmp 0x100279e5
jmp 0x100279e5
push 2
lea ecx, [ebp - 0x498]
call fcn.10018477
and dword [ebp - 4], 0
mov dword [ebp - 0x50], 0x667a876e
mov dword [ebp - 0x198], 0
jmp 0x10027c70
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x10027c92
push dword [ebp - 0x198]
lea ecx, [ebp - 0x498]
call fcn.10018515
mov dword [eax], 0xdf99ff60
jmp 0x10027c63
mov dword [ebp - 0x50], 0
jmp 0x10027ca2
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jg 0x10027dc1
push dword [ebp - 0x50]
lea ecx, [ebp - 0x498]
call fcn.10018515
imul eax, dword [eax], 0x5eb2
cmp eax, 0x734f
je 0x10027cd3
mov dword [ebp - 0x204], 1
jmp 0x10027cda
and dword [ebp - 0x204], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x498]
call fcn.10018515
push 0
lea ecx, [ebp - 0x498]
call fcn.10018515
push 0xfffffffffffffff9
pop eax
cmp eax, 7
jle 0x10027d09
mov dword [ebp - 0x384], 1
jmp 0x10027d10
and dword [ebp - 0x384], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x498]
call fcn.10018515
mov ecx, dword [ebp - 0x384]
cmp ecx, dword [eax]
jne 0x10027d34
mov dword [ebp - 0x38c], 1
jmp 0x10027d3b
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0x38c]
jg 0x10027d55
mov dword [ebp - 0x20c], 1
jmp 0x10027d5c
and dword [ebp - 0x20c], 0
cmp dword [ebp - 0x20c], 0xa21e
jne 0x10027d74
mov dword [ebp - 0x394], 1
jmp 0x10027d7b
and dword [ebp - 0x394], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x498]
call fcn.10018515
mov ecx, dword [ebp - 0x394]
cmp ecx, dword [eax]
jg 0x10027d9f
mov dword [ebp - 0x214], 1
jmp 0x10027da6
and dword [ebp - 0x214], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x498]
call fcn.10018515
mov ecx, dword [ebp - 0x214]
mov dword [eax], ecx
jmp 0x10027c9b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x498]
call fcn.100184f9
mov dword [ebp - 0x30], 0xfb871c7b
mov dword [ebp - 0x174], 4
mov dword [ebp - 0xc4], 0x90c4d8e5
mov dword [ebp - 0x560], 1
mov dword [ebp - 0x120], 0
jmp 0x10027e0e
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x10027e2a
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x5fc], 0x3df7
jmp 0x10027e01
mov dword [ebp - 0xc4], 0
jmp 0x10027e43
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jg 0x10027e80
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0x5fc]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x39c]
mov dword [ebp + eax*4 - 0x5fc], ecx
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x560], eax
jmp 0x10027e36
mov dword [ebp - 0xac], 0xd66c4a87
mov dword [ebp - 0x8c], 0x2c7c
mov dword [ebp - 0x624], 1
mov dword [ebp - 0x620], 1
mov dword [ebp - 0x61c], 1
mov dword [ebp - 0x618], 1
lea ecx, [ebp - 0x1b5]
call fcn.10008e83
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x74c]
call fcn.10018524
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4a8]
call fcn.100184d3
mov dword [ebp - 4], 1
push 2
lea ecx, [ebp - 0x52c]
call fcn.10018477
mov byte [ebp - 4], 2
mov dword [ebp - 0x64], 1
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0x68], 0x6896e60b
push 1
lea ecx, [ebp - 0x4dc]
call fcn.10018477
mov byte [ebp - 4], 3
mov dword [ebp - 0x4f4], 0xffff
mov dword [ebp - 0x1c], 0
jmp 0x10027f4c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10027f68
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x52c]
call fcn.10018515
mov dword [eax], 0x81f3403c
jmp 0x10027f45
mov dword [ebp - 0x1c], 0
jmp 0x10027f78
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10027f8e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1e4], 0xffffffff
jmp 0x10027f71
mov dword [ebp - 0x1c], 0
jmp 0x10027f9e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10027fba
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x4dc]
call fcn.10018515
mov dword [eax], 0xa81d5f49
jmp 0x10027f97
cmp dword [ebp - 0x8c], 0
jne 0x10028175
push 3
lea ecx, [ebp - 0x4a8]
call fcn.10018515
cmp dword [eax], 0
jne 0x10028103
push 0
lea ecx, [ebp - 0x52c]
call fcn.10018515
mov dword [eax], 5
push 5
pop eax
test eax, eax
ja 0x10028003
mov dword [ebp - 0x21c], 1
jmp 0x1002800a
and dword [ebp - 0x21c], 0
push 3
lea ecx, [ebp - 0x4a8]
call fcn.10018515
mov ecx, dword [ebp - 0x21c]
sub ecx, dword [eax]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1e4], ecx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xd8d92426
je 0x10028047
mov dword [ebp - 0x3a4], 1
jmp 0x1002804e
and dword [ebp - 0x3a4], 0
push 3
lea ecx, [ebp - 0x4a8]
call fcn.10018515
mov ecx, dword [ebp - 0x3a4]
cmp ecx, dword [eax]
jge 0x10028071
mov dword [ebp - 0x224], 1
jmp 0x10028078
and dword [ebp - 0x224], 0
push 3
lea ecx, [ebp - 0x4a8]
call fcn.10018515
mov ecx, dword [ebp - 0x224]
add ecx, dword [eax]
je 0x100280ad
push 0
lea ecx, [ebp - 0x52c]
call fcn.10018515
cmp dword [eax], 0
je 0x100280ad
mov dword [ebp - 0x3ac], 1
jmp 0x100280b4
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x3ac], eax
jl 0x100280ce
mov dword [ebp - 0x22c], 1
jmp 0x100280d5
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jne 0x10028103
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e4], 0
jne 0x10028103
and dword [ebp - 0x3b4], 0
jmp 0x1002810d
mov dword [ebp - 0x3b4], 1
mov esi, dword [ebp - 0x8c]
imul esi, dword [ebp - 0x3b4]
push 3
lea ecx, [ebp - 0x4a8]
call fcn.10018515
cmp esi, dword [eax]
jle 0x10028137
mov dword [ebp - 0x234], 1
jmp 0x1002813e
and dword [ebp - 0x234], 0
cmp dword [ebp - 0x234], 0xfffffff9
jbe 0x10028153
mov dword [ebp - 0x3bc], 1
jmp 0x1002815a
and dword [ebp - 0x3bc], 0
imul esi, dword [ebp - 0x3bc], 0x25fa
push 2
lea ecx, [ebp - 0x4a8]
call fcn.10018515
sub esi, dword [eax]
je 0x10028187
cmp dword [ebp - 0x68], 0
je 0x10028187
mov dword [ebp - 0x1cc], 1
jmp 0x1002818e
and dword [ebp - 0x1cc], 0
push 0
lea ecx, [ebp - 0x4dc]
call fcn.10018515
mov ecx, dword [ebp - 0x1cc]
mov dword [eax], ecx
cmp dword [ebp - 0x1cc], 0x74fd
jl 0x100283a1
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x570], 0x4cb070fc
mov dword [ebp - 0x3cc], 0
mov dword [ebp - 0x8c], 0
jmp 0x100281e7
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffef
jl 0x10028281
mov dword [ebp - 0x64], 4
jmp 0x10028204
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jl 0x10028250
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1e4], 1
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x34], 0
jmp 0x10028232
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff8
jle 0x1002824e
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x1002824c
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x1002822b
jmp 0x100281fd
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x1002827c
push 0
push 0x1af8
push 0x529
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x100281da
push 3
lea ecx, [ebp - 0x4a8]
call fcn.10018515
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x34], 0
je 0x100282a1
cmp dword [ebp - 0x34], 0
push 1
lea ecx, [ebp - 0x52c]
call fcn.10018515
cmp dword [eax], 1
jle 0x100282bf
mov dword [ebp - 0x23c], 1
jmp 0x100282c6
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x23c], eax
jge 0x100282dd
mov dword [ebp - 0x3c4], 1
jmp 0x100282e4
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x570]
cmp dword [ebp - 0x3c4], eax
jge 0x100282fe
mov dword [ebp - 0x4f0], 1
jmp 0x10028305
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x714], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e4]
dec eax
cmp eax, 0x2b42
jl 0x1002832f
mov dword [ebp - 0x244], 1
jmp 0x10028336
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0
jne 0x1002835a
cmp dword [ebp - 0x34], 0
jne 0x1002835a
and dword [ebp - 0x24c], 0
jmp 0x10028364
mov dword [ebp - 0x24c], 1
mov eax, 0xbbfe
sub eax, dword [ebp - 0x24c]
cmp eax, 1
je 0x10028380
mov dword [ebp - 0x3d4], 1
jmp 0x10028387
and dword [ebp - 0x3d4], 0
push 0
lea ecx, [ebp - 0x4dc]
call fcn.10018515
mov ecx, dword [ebp - 0x3d4]
mov dword [eax], ecx
jmp 0x100285be
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x4fc], 0x1aff6713
mov dword [ebp - 0x68], 0
jmp 0x100283c5
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jg 0x10028481
cmp dword [ebp - 0x68], 0x9428
jne 0x100283e4
mov dword [ebp - 0x254], 1
jmp 0x100283eb
and dword [ebp - 0x254], 0
cmp dword [ebp - 0x254], 0xbafc
jl 0x10028409
cmp dword [ebp - 0xd8], 0
jne 0x10028409
and dword [ebp - 0x3dc], 0
jmp 0x10028413
mov dword [ebp - 0x3dc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e4]
cmp dword [ebp - 0x3dc], eax
jle 0x10028434
mov dword [ebp - 0x25c], 1
jmp 0x1002843b
and dword [ebp - 0x25c], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4dc]
call fcn.10018515
mov eax, dword [eax]
cmp eax, dword [ebp - 0x25c]
jge 0x1002845f
mov dword [ebp - 0x3e4], 1
jmp 0x10028466
and dword [ebp - 0x3e4], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4dc]
call fcn.10018515
mov ecx, dword [ebp - 0x3e4]
mov dword [eax], ecx
jmp 0x100283be
cmp dword [ebp - 0xd8], 0x9839
jg 0x10028499
mov dword [ebp - 0x264], 1
jmp 0x100284a0
and dword [ebp - 0x264], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e4]
cmp dword [ebp - 0x264], eax
jg 0x100284c7
mov eax, 0xaac82c1b
test eax, eax
jne 0x100284c7
and dword [ebp - 0x3ec], 0
jmp 0x100284d1
mov dword [ebp - 0x3ec], 1
cmp dword [ebp - 0x3ec], 0x4fe9
jg 0x100284e9
mov dword [ebp - 0x26c], 1
jmp 0x100284f0
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x4f4]
sub eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x160]
sub ecx, dword [ebp - 0x26c]
cmp eax, ecx
jg 0x10028518
mov dword [ebp - 0x3f4], 1
jmp 0x1002851f
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
add eax, 0x6d1266b8
cmp eax, dword [ebp - 0x160]
jg 0x1002853e
mov dword [ebp - 0x274], 1
jmp 0x10028545
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
sub eax, 4
cmp eax, dword [ebp - 0x64]
je 0x1002855f
mov dword [ebp - 0x3fc], 1
jmp 0x10028566
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 0x1dee1550
jg 0x1002857e
mov dword [ebp - 0x27c], 1
jmp 0x10028585
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x27c], eax
jg 0x1002859f
mov dword [ebp - 0x404], 1
jmp 0x100285a6
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x4fc], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4dc]
call fcn.100184f9
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x52c]
call fcn.100184f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a8]
call fcn.100184f9
mov dword [ebp - 0x128], 0
jmp 0x10028604
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x10028620
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0xc8], 0x4a6847df
jmp 0x100285f7
mov dword [ebp - 0x180], 9
mov dword [ebp - 0x180], 0xffffffe5
jmp 0x10028643
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x13
jg 0x100286c4
mov dword [ebp - 0x130], 0x506d4441
mov dword [ebp - 0x504], 0
mov dword [ebp - 0x130], 0
jmp 0x10028679
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jg 0x100286bf
mov dword [ebp - 0x654], 0x9949
mov dword [ebp - 0x650], 0x9949
mov dword [ebp - 0x64c], 0x9949
mov dword [ebp - 0x648], 0x9949
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x654]
mov dword [ebp - 0x504], eax
jmp 0x1002866c
jmp 0x10028636
mov dword [ebp - 0x138], 0xb110c93b
push 2
lea ecx, [ebp - 0x6d8]
call fcn.10018477
mov dword [ebp - 4], 4
mov dword [ebp - 0x168], 0
jmp 0x100286fb
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x1002871a
push dword [ebp - 0x168]
lea ecx, [ebp - 0x6d8]
call fcn.10018515
or dword [eax], 0xffffffff
jmp 0x100286ee
mov dword [ebp - 0x138], 0
jmp 0x10028733
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x18
jl 0x100287e4
mov dword [ebp - 0x5c0], 0xffffffff
mov dword [ebp - 0x5bc], 0xffffffff
mov dword [ebp - 0x5b8], 0xffffffff
mov dword [ebp - 0x5b4], 0xffffffff
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x5c0], 1
jmp 0x10028796
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5c0]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x5c0], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x5c0], 0
jl 0x100287df
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x100287c2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x100287dd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x1002877b
jmp 0x10028726
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6d8]
call fcn.100184f9
mov byte [ebp - 0x75], 0
mov dword [ebp - 0x190], 0x8ec0ae97
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x10028815
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [ebp - 0x190], 0xfffffffa
jmp 0x1002882e
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xffffffe4
jne 0x10028c2c
push 4
lea ecx, [ebp - 0x4b8]
call fcn.10018477
mov dword [ebp - 4], 5
mov dword [ebp - 0x1dc], 0xc6e5c7a0
mov dword [ebp - 0x1d8], 0xc6e5c7a0
mov dword [ebp - 0x1d4], 0xc6e5c7a0
mov dword [ebp - 0x1d0], 0xc6e5c7a0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x140], 0
jmp 0x1002889a
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x100288bc
push dword [ebp - 0x140]
lea ecx, [ebp - 0x4b8]
call fcn.10018515
mov dword [eax], 0x386cce57
jmp 0x1002888d
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1dc], 0
jmp 0x100288e7
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1dc]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1dc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1dc], 3
jg 0x10028bb5
mov dword [ebp - 0x170], 0
push 3
lea ecx, [ebp - 0x53c]
call fcn.10018477
mov byte [ebp - 4], 6
mov dword [ebp - 0xe0], 0x9c4d
mov dword [ebp - 0xcc], 7
mov dword [ebp - 0x104], 0
jmp 0x10028942
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x10028961
push dword [ebp - 0x104]
lea ecx, [ebp - 0x53c]
call fcn.10018515
and dword [eax], 0
jmp 0x10028935
mov dword [ebp - 0x170], 3
jmp 0x1002897a
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jl 0x10028ba1
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x1dc]
lea ecx, [ebp - 0x4b8]
call fcn.10018515
cmp dword [eax], 0
je 0x10028a9e
push 2
lea ecx, [ebp - 0x53c]
call fcn.10018515
mov dword [eax], 0xfffb
mov eax, 0xfffb
test eax, eax
jne 0x10028a7f
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0x1dc]
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x1dc]
lea ecx, [ebp - 0x4b8]
call fcn.10018515
cmp esi, dword [eax]
je 0x100289fa
mov dword [ebp - 0x284], 1
jmp 0x10028a01
and dword [ebp - 0x284], 0
push 1
lea ecx, [ebp - 0x53c]
call fcn.10018515
mov ecx, dword [ebp - 0x284]
cmp ecx, dword [eax]
jg 0x10028a21
cmp dword [ebp - 0xe0], 0
jne 0x10028a3c
push 2
lea ecx, [ebp - 0x53c]
call fcn.10018515
cmp dword [eax], 0
jne 0x10028a3c
and dword [ebp - 0x40c], 0
jmp 0x10028a46
mov dword [ebp - 0x40c], 1
cmp dword [ebp - 0x40c], 0x75cb
jne 0x10028a5e
mov dword [ebp - 0x28c], 1
jmp 0x10028a65
and dword [ebp - 0x28c], 0
imul eax, dword [ebp - 0x28c], 0xd7c8
cmp eax, 0xfffd
ja 0x10028a7f
and dword [ebp - 0x414], 0
jmp 0x10028a89
mov dword [ebp - 0x414], 1
cmp dword [ebp - 0x414], 1
ja 0x10028a9e
mov dword [ebp - 0x294], 1
jmp 0x10028aa5
and dword [ebp - 0x294], 0
push 3
lea ecx, [ebp - 0x4b8]
call fcn.10018515
mov ecx, dword [ebp - 0x294]
sub ecx, dword [eax]
mov dword [ebp - 0x41c], ecx
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x1dc]
lea ecx, [ebp - 0x4b8]
call fcn.10018515
mov ecx, dword [ebp - 0x41c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
je 0x10028b2c
mov dword [ebp - 0x50c], 1
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x1dc]
lea ecx, [ebp - 0x4b8]
call fcn.10018515
cmp dword [eax], 0
je 0x10028b1f
jmp 0x10028ba1
cmp dword [ebp - 0x50c], 0
je 0x10028b2a
jmp 0x10028ba1
jmp 0x10028b9c
mov dword [ebp - 0xcc], 0xffffffeb
jmp 0x10028b45
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffff7
je 0x10028b9c
mov dword [ebp - 0xe0], 0
jmp 0x10028b67
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 4
jge 0x10028b89
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x4b8]
call fcn.10018515
mov dword [eax], 0x98dc509c
jmp 0x10028b5a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1dc], 0
je 0x10028b9a
jmp 0x10028b38
jmp 0x10028b38
jmp 0x1002896d
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x53c]
call fcn.100184f9
jmp 0x100288ce
mov dword [ebp - 0x148], 8
jmp 0x10028bce
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x17
jge 0x10028c18
mov dword [ebp - 0xfc], 9
mov dword [ebp - 0xfc], 0
jmp 0x10028bfa
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 4
jge 0x10028c16
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x1dc], 0xffffffff
jmp 0x10028bed
jmp 0x10028bc1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b8]
call fcn.100184f9
jmp 0x10028821
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x10028d3d
mov dword [ebp - 0x150], 0xfe223643
mov dword [ebp - 0x188], 0
jmp 0x10028c5b
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x10028c77
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x770], 0xb55b
jmp 0x10028c4e
mov dword [ebp - 0x150], 2
jmp 0x10028c90
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x10028d2e
mov dword [ebp - 0x178], 0xfffffff9
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x10028ced
push 0
push 0x653
push 0x14ad
push 0x24bb
push 0x16c6
push 0x10c5
push 0x218d
push 0x876
push 0x351
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x178], 0
jmp 0x10028d06
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jg 0x10028d29
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x10028d27
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
jmp 0x10028cf9
jmp 0x10028c83
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov dword [ebp - 0x10c], 0xfffffffa
mov dword [ebp - 0xf4], 0xffff
mov dword [ebp - 0x2ac], 0xfffffff6
push 3
lea ecx, [ebp - 0x54c]
call fcn.10018477
mov dword [ebp - 4], 7
push 2
lea ecx, [ebp - 0x5dc]
call fcn.10018477
mov byte [ebp - 4], 8
mov dword [ebp - 0x51c], 0xc6daafd5
mov dword [ebp - 0x5b0], 0xfffffff6
mov dword [ebp - 0x20], 0
jmp 0x10028da4
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10028dba
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6b0], 0xffffffff
jmp 0x10028d9d
mov dword [ebp - 0x20], 0
jmp 0x10028dca
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10028de6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x54c]
call fcn.10018515
mov dword [eax], 0x5004286a
jmp 0x10028dc3
mov dword [ebp - 0x20], 0
jmp 0x10028df6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10028e12
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5dc]
call fcn.10018515
mov dword [eax], 0x69ff9e6b
jmp 0x10028def
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x10c], 1
jle 0x10028e33
mov dword [ebp - 0x29c], 1
jmp 0x10028e3a
and dword [ebp - 0x29c], 0
cmp dword [ebp - 0x29c], 0
jge 0x10028e4f
mov dword [ebp - 0x424], 1
jmp 0x10028e56
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x10c], eax
je 0x10028e7c
mov dword [ebp - 0x514], 1
jmp 0x10028e83
and dword [ebp - 0x514], 0
mov eax, 0xc6c8951b
cmp eax, 0xb6890635
jne 0x10028e9b
mov dword [ebp - 0x2a4], 1
jmp 0x10028ea2
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x2a4]
cmp eax, 0x547507a
jne 0x10028ec1
mov dword [ebp - 0x42c], 1
jmp 0x10028ec8
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
sub eax, dword [ebp - 0xf4]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
sub eax, 0x985b
mov dword [ebp - 0x434], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x434]
mov dword [ebp + eax - 0x6b0], ecx
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x434], eax
jl 0x10028f18
mov dword [ebp - 0x2b4], 1
jmp 0x10028f1f
and dword [ebp - 0x2b4], 0
push 0
lea ecx, [ebp - 0x54c]
call fcn.10018515
mov ecx, dword [ebp - 0x2b4]
cmp ecx, dword [eax]
jl 0x10028f42
mov dword [ebp - 0x43c], 1
jmp 0x10028f49
and dword [ebp - 0x43c], 0
push 0
lea ecx, [ebp - 0x54c]
call fcn.10018515
mov ecx, dword [ebp - 0x43c]
sub ecx, dword [eax]
mov dword [ebp - 0x2bc], ecx
push 0
lea ecx, [ebp - 0x5dc]
call fcn.10018515
mov ecx, dword [ebp - 0x2bc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x2bc], eax
jge 0x10028f93
mov dword [ebp - 0x444], 1
jmp 0x10028f9a
and dword [ebp - 0x444], 0
push 2
lea ecx, [ebp - 0x54c]
call fcn.10018515
mov ecx, dword [ebp - 0x444]
cmp ecx, dword [eax]
jle 0x10028fcf
push 0
lea ecx, [ebp - 0x5dc]
call fcn.10018515
cmp dword [eax], 0
je 0x10028fcf
mov dword [ebp - 0x2c4], 1
jmp 0x10028fd6
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
add eax, 7
imul eax, eax, 0xfffd
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x5b0], 0xe9843c6b
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5dc]
call fcn.100184f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54c]
call fcn.100184f9
mov dword [ebp - 0x30], 0
jmp 0x10029023
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jg 0x1002b334
mov dword [ebp - 0x100], 0x99244325
mov dword [ebp - 0x2cc], 0xffffffff
push 3
lea ecx, [ebp - 0x5e8]
call fcn.10018477
mov dword [ebp - 4], 9
mov dword [ebp - 0x2d4], 7
mov dword [ebp - 0x580], 0x5e49
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x500], 0xfffffff9
mov dword [ebp - 0x5c], 0
jmp 0x1002908d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x100290a3
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xb0], 0xffffffff
jmp 0x10029086
mov dword [ebp - 0x5c], 0
jmp 0x100290b3
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x100290cf
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x5e8]
call fcn.10018515
mov dword [eax], 1
jmp 0x100290ac
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb0], 0
jne 0x100290eb
mov dword [ebp - 0x44c], 1
jmp 0x100290f2
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0x9c63c407
ja 0x1002910a
mov dword [ebp - 0x454], 1
jmp 0x10029111
and dword [ebp - 0x454], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb0]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
cmp eax, dword [ebp - 0x454]
jl 0x1002913e
mov dword [ebp - 0x550], 1
jmp 0x10029145
and dword [ebp - 0x550], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb0], 0
jg 0x10029161
mov dword [ebp - 0x4f8], 1
jmp 0x10029168
and dword [ebp - 0x4f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb0]
mov dword [ebp - 0x6f4], eax
push 2
lea ecx, [ebp - 0x5e8]
call fcn.10018515
push 2
lea ecx, [ebp - 0x5e8]
call fcn.10018515
mov eax, dword [eax]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x83674579
ja 0x100291b5
mov dword [ebp - 0x45c], 1
jmp 0x100291bc
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x580]
cmp dword [ebp - 0x45c], eax
je 0x100291d6
mov dword [ebp - 0x464], 1
jmp 0x100291dd
and dword [ebp - 0x464], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb0]
cmp eax, dword [ebp - 0x464]
jg 0x100291fe
mov dword [ebp - 0x2e0], 1
jmp 0x10029205
and dword [ebp - 0x2e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb0]
cmp dword [ebp - 0x2e0], eax
jle 0x10029226
mov dword [ebp - 0x440], 1
jmp 0x1002922d
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x500], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5e8]
call fcn.100184f9
mov dword [ebp - 0x6bc], 1
mov dword [ebp - 0x290], 1
mov dword [ebp - 0x100], 0
jmp 0x10029281
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jg 0x1002b1b1
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x12c], 1
push 2
lea ecx, [ebp - 0x4d0]
call fcn.10018477
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x598], 0x13236c21
mov dword [ebp - 0x638], 0xfffffff8
mov dword [ebp - 0x634], 0xfffffff8
mov dword [ebp - 0x630], 0xfffffff8
mov dword [ebp - 0x62c], 0xfffffff8
lea ecx, [ebp - 0x1a9]
call fcn.10008e83
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x734]
call fcn.10018524
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x55c]
call fcn.100184d3
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x114], 0
jmp 0x10029337
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x10029356
push dword [ebp - 0x114]
lea ecx, [ebp - 0x4d0]
call fcn.10018515
and dword [eax], 0
jmp 0x1002932a
mov dword [ebp - 0x48], 5
jmp 0x10029366
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x1d
jle 0x10029b6a
mov dword [ebp - 0x40], 0x39beb064
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x1bc], 0xffffffff
mov dword [ebp - 0x410], 1
mov dword [ebp - 0x590], 0
mov dword [ebp - 0x11c], 0
jmp 0x100293b5
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jge 0x100293d1
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x69c], 0xffffffff
jmp 0x100293a8
mov dword [ebp - 0x40], 0xb
jmp 0x100293e1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x1a
jle 0x10029b43
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x10], 0x6b13122e
mov dword [ebp - 0x38], 0
jmp 0x10029409
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffe6
jge 0x10029897
mov dword [ebp - 0x124], 0xb3921ded
mov dword [ebp - 0x94], 0x71dbcabe
mov dword [ebp - 0x134], 0x9031ea06
mov dword [ebp - 0x124], 0
jmp 0x1002944a
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xfffffff2
jne 0x10029892
mov dword [ebp - 0xe8], 0xf5452fa8
mov dword [ebp - 0x108], 0x653ddb20
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x1002951d
mov eax, 0x2f3f6085
test eax, eax
je 0x1002951d
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x48], 0x1f3813bf
jg 0x100294b2
mov eax, 0x7ea4c570
test eax, eax
jne 0x100294b2
and dword [ebp - 0x3d0], 0
jmp 0x100294bc
mov dword [ebp - 0x3d0], 1
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x3d0]
jle 0x100294dc
cmp dword [ebp - 0xe8], 0
je 0x100294dc
mov dword [ebp - 0x2f0], 1
jmp 0x100294e3
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
sub eax, dword [ebp - 0x38]
je 0x100294ff
xor eax, eax
inc eax
je 0x100294ff
mov dword [ebp - 0x4ac], 1
jmp 0x10029506
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
sub eax, dword [ebp - 0x40]
je 0x1002951d
mov dword [ebp - 0x2f8], 1
jmp 0x10029524
and dword [ebp - 0x2f8], 0
cmp dword [ebp - 0x2f8], 0
jge 0x10029539
mov dword [ebp - 0x3d8], 1
jmp 0x10029540
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
sub eax, dword [ebp - 0x12c]
mov dword [ebp - 0x94], eax
imul eax, dword [ebp - 0x94], 0
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x134], eax
jl 0x10029576
mov dword [ebp - 0x300], 1
jmp 0x1002957d
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x300]
neg eax
add eax, 0x3a52fa75
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x6c4], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x6fc], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x58], eax
jne 0x100295bc
mov dword [ebp - 0x448], 1
jmp 0x100295c3
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x448]
jl 0x100295da
mov dword [ebp - 0x308], 1
jmp 0x100295e1
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x308]
add eax, dword [ebp - 0x12c]
mov dword [ebp - 0x3e0], eax
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10018515
mov ecx, dword [ebp - 0x3e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3e0]
neg eax
cmp dword [ebp - 0x48], eax
jle 0x10029621
mov dword [ebp - 0x310], 1
jmp 0x10029628
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x12c]
imul eax, dword [ebp - 0x310]
add eax, dword [ebp - 0x48]
cmp eax, 0xfffffffa
jge 0x10029649
mov dword [ebp - 0x484], 1
jmp 0x10029650
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x484], eax
jne 0x1002966a
mov dword [ebp - 0x318], 1
jmp 0x10029671
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x318], eax
jle 0x1002968e
mov eax, 0xf0c0ed6d
test eax, eax
jne 0x1002968e
and dword [ebp - 0x3e8], 0
jmp 0x10029698
mov dword [ebp - 0x3e8], 1
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x38], 0x88558b04
je 0x100296c2
mov dword [ebp - 0x1f4], 1
jmp 0x100296c9
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1f4], eax
jge 0x100296e3
mov dword [ebp - 0x450], 1
jmp 0x100296ea
and dword [ebp - 0x450], 0
cmp dword [ebp - 0x450], 8
je 0x100296ff
mov dword [ebp - 0x328], 1
jmp 0x10029706
and dword [ebp - 0x328], 0
cmp dword [ebp - 0x328], 0xec7e
je 0x1002971e
mov dword [ebp - 0x508], 1
jmp 0x10029725
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x94], eax
jne 0x1002974e
cmp dword [ebp - 0x94], 0
jne 0x1002974e
and dword [ebp - 0x3f0], 0
jmp 0x10029758
mov dword [ebp - 0x3f0], 1
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x3f0]
je 0x10029772
mov dword [ebp - 0x330], 1
jmp 0x10029779
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
imul eax, dword [ebp - 0x330]
test eax, eax
jne 0x100297a2
cmp dword [ebp - 0x38], 0
jne 0x100297a2
and dword [ebp - 0x4c0], 0
jmp 0x100297ac
mov dword [ebp - 0x4c0], 1
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xfffffff8
jbe 0x100297cd
mov dword [ebp - 0x338], 1
jmp 0x100297d4
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x338], eax
jl 0x100297ee
mov dword [ebp - 0x3f8], 1
jmp 0x100297f5
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
sub eax, 0xa37e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jl 0x10029815
mov dword [ebp - 0x340], 1
jmp 0x1002981c
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
add eax, 0x5444fe37
jne 0x10029832
cmp dword [ebp - 0x134], 0
je 0x10029843
or eax, 0xffffffff
je 0x10029843
mov dword [ebp - 0x1b4], 1
jmp 0x1002984a
and dword [ebp - 0x1b4], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.10018515
mov ecx, dword [ebp - 0x1b4]
mov dword [eax], ecx
cmp dword [ebp - 0x1b4], 0
je 0x1002987a
cmp dword [ebp - 0x10], 0
je 0x1002987a
mov dword [ebp - 0x458], 1
jmp 0x10029881
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x410], eax
jmp 0x1002943d
jmp 0x10029402
mov dword [ebp - 0x10], 3
jmp 0x100298a7
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10029b3e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x55c]
call fcn.10018515
push 0
lea ecx, [ebp - 0x4d0]
call fcn.10018515
cmp dword [eax], 0
jne 0x100298e3
mov eax, 0x417f16c3
test eax, eax
jne 0x100298e3
and dword [ebp - 0x348], 0
jmp 0x100298ed
mov dword [ebp - 0x348], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x348], eax
jle 0x10029904
mov dword [ebp - 0x400], 1
jmp 0x1002990b
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x400], eax
jl 0x10029922
mov dword [ebp - 0x350], 1
jmp 0x10029929
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x350], eax
jle 0x10029940
mov dword [ebp - 0x48c], 1
jmp 0x10029947
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
inc eax
inc eax
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x1bc]
jg 0x10029966
mov dword [ebp - 0x358], 1
jmp 0x1002996d
and dword [ebp - 0x358], 0
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10018515
mov ecx, dword [ebp - 0x358]
cmp ecx, dword [eax]
jle 0x10029990
mov dword [ebp - 0x408], 1
jmp 0x10029997
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x408]
jne 0x100299ae
mov dword [ebp - 0x360], 1
jmp 0x100299b5
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x360]
imul eax, dword [ebp - 0x10]
test eax, eax
jne 0x100299eb
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x69c], 0
jne 0x100299eb
and dword [ebp - 0x460], 0
jmp 0x100299f5
mov dword [ebp - 0x460], 1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x55c]
call fcn.10018515
mov esi, eax
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10018515
mov ecx, dword [ebp - 0x460]
sub ecx, dword [eax]
cmp dword [esi], ecx
je 0x10029a2a
mov dword [ebp - 0x368], 1
jmp 0x10029a31
and dword [ebp - 0x368], 0
mov esi, dword [ebp - 0x368]
inc esi
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10018515
cmp esi, dword [eax]
jge 0x10029a55
mov dword [ebp - 0x370], 1
jmp 0x10029a5c
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0x370], eax
jle 0x10029a76
mov dword [ebp - 0x4bc], 1
jmp 0x10029a7d
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x590]
cmp dword [ebp - 0x4bc], eax
jge 0x10029a97
mov dword [ebp - 0x378], 1
jmp 0x10029a9e
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 0xf76caf44
ja 0x10029ab6
mov dword [ebp - 0x418], 1
jmp 0x10029abd
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 0x9c5d0792
jne 0x10029ad5
mov dword [ebp - 0x380], 1
jmp 0x10029adc
and dword [ebp - 0x380], 0
cmp dword [ebp - 0x380], 0xdee2
jl 0x10029af4
mov dword [ebp - 0x468], 1
jmp 0x10029afb
and dword [ebp - 0x468], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.10018515
mov ecx, dword [ebp - 0x468]
mov dword [eax], ecx
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x10029b39
push 0xcc7
push 0x49f
push 0x2282
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x100298a0
jmp 0x100293da
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x10029b65
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x1002935f
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x10029b86
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x55c]
call fcn.100184f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d0]
call fcn.100184f9
mov dword [ebp - 0xc0], 5
or eax, 0xffffffff
je 0x1002a582
mov dword [ebp - 0x664], 0xe559
mov dword [ebp - 0x66c], 0x7a7c2039
mov dword [ebp - 0x674], 0x167fa5c6
mov dword [ebp - 0x67c], 0x4b666a75
mov dword [ebp - 0x684], 0xf5ed9a92
mov dword [ebp - 0x68c], 0xffffffff
mov dword [ebp - 0x694], 7
mov dword [ebp - 0x388], 0xb95ae649
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x10029c19
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov eax, dword [ebp - 0x388]
dec eax
mov dword [ebp - 0x388], eax
mov dword [ebp - 0x510], 0xfffffff6
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0x24], 0x12d2c87a
mov dword [ebp - 0x3c], 0xda8ed40a
mov dword [ebp - 0xd4], 0xde64f6cb
push 2
lea ecx, [ebp - 0x56c]
call fcn.10018477
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x13c], 0
jmp 0x10029c7f
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x10029ca1
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x56c]
call fcn.10018515
mov dword [eax], 0x1a82e77e
jmp 0x10029c72
cmp dword [ebp - 0x24], 0xfffffffe
jg 0x10029cb3
mov dword [ebp - 0x420], 1
jmp 0x10029cba
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x420]
jne 0x10029cd1
mov dword [ebp - 0x390], 1
jmp 0x10029cd8
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jl 0x10029cf2
mov dword [ebp - 0x49c], 1
jmp 0x10029cf9
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
sub eax, 5
je 0x10029d15
xor eax, eax
inc eax
je 0x10029d15
mov dword [ebp - 0x398], 1
jmp 0x10029d1c
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x398]
neg eax
jne 0x10029d36
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x10029d36
and dword [ebp - 0x428], 0
jmp 0x10029d40
mov dword [ebp - 0x428], 1
mov dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x428]
jne 0x10029d64
mov dword [ebp - 0x3a0], 1
jmp 0x10029d6b
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3a0], eax
jg 0x10029d82
mov dword [ebp - 0x470], 1
jmp 0x10029d89
and dword [ebp - 0x470], 0
cmp dword [ebp - 0x470], 0xffffffff
jl 0x10029d9e
mov dword [ebp - 0x3a8], 1
jmp 0x10029da5
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x24], eax
je 0x10029dc8
cmp dword [ebp - 0x24], 0
je 0x10029dc8
mov dword [ebp - 0x430], 1
jmp 0x10029dcf
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x9c], 0
jmp 0x10029df4
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jg 0x10029ee0
mov dword [ebp - 0x3b0], 0x4ddc87
mov dword [ebp - 0x3c], 1
jmp 0x10029e1b
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10029e9e
mov dword [ebp - 0x24], 1
jmp 0x10029e31
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10029e99
mov dword [ebp - 0xd4], 0
jmp 0x10029e50
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 2
jge 0x10029e72
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x56c]
call fcn.10018515
mov dword [eax], 0x255d5800
jmp 0x10029e43
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x56c]
call fcn.10018515
mov esi, eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x56c]
call fcn.10018515
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10029e2a
jmp 0x10029e14
mov dword [ebp - 0x3c], 1
jmp 0x10029eae
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10029edb
mov eax, dword [ebp - 0x3b0]
dec eax
mov dword [ebp - 0x3b0], eax
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x10029ed9
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
jmp 0x10029ea7
jmp 0x10029de7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x56c]
call fcn.100184f9
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xc8]
mov dword [ebp - 0xac], eax
mov byte [ebp - 0x6e], 0
mov dword [ebp - 0x6b8], 0xef20fe6e
mov dword [ebp - 0x6c0], 0xbeccce1e
mov dword [ebp - 0x6c8], 2
mov dword [ebp - 0x6f0], 0xe923e64f
mov dword [ebp - 0x6f8], 0xfffffff9
mov dword [ebp - 0x700], 0x68029989
mov dword [ebp - 0x708], 1
mov dword [ebp - 0x71c], 0x6985
mov dword [ebp - 0x4c4], 0xe6b99bf0
mov dword [ebp - 0x14], 0
jmp 0x10029f79
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10029f8f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x77c], 1
jmp 0x10029f72
mov dword [ebp - 0x14], 0
jmp 0x10029f9f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10029fb5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x718], 0xfffffff6
jmp 0x10029f98
mov dword [ebp - 0x14], 0
jmp 0x10029fc5
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10029fdb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6a8], 0
jmp 0x10029fbe
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x1002a57d
and dword [ebp - 0x610], 0
and dword [ebp - 0x60c], 0
and dword [ebp - 0x608], 0
and dword [ebp - 0x604], 0
lea ecx, [ebp - 0x19d]
call fcn.10008e83
push eax
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x764]
call fcn.10018524
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1c8]
call fcn.100184d3
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x28], 0xecb302af
mov dword [ebp - 0x6c], 6
mov dword [ebp - 0x2ec], 0xffffffff
mov dword [ebp - 0xb4], 0x625c2a3d
mov dword [ebp - 0x344], 0xec3a435f
push 3
lea ecx, [ebp - 0x1c8]
call fcn.10018515
push 3
lea ecx, [ebp - 0x1c8]
call fcn.10018515
cmp dword [eax], 1
je 0x1002a0a3
mov dword [ebp - 0x3b8], 1
jmp 0x1002a0aa
and dword [ebp - 0x3b8], 0
push 3
lea ecx, [ebp - 0x1c8]
call fcn.10018515
mov ecx, dword [ebp - 0x3b8]
cmp ecx, dword [eax]
jge 0x1002a0cd
mov dword [ebp - 0x438], 1
jmp 0x1002a0d4
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 4
je 0x1002a0f2
mov eax, 0x4e80
test eax, eax
je 0x1002a0f2
mov dword [ebp - 0x3c0], 1
jmp 0x1002a0f9
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 1
je 0x1002a10e
mov dword [ebp - 0x47c], 1
jmp 0x1002a115
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x28], eax
mov esi, dword [ebp - 0x28]
push 3
lea ecx, [ebp - 0x1c8]
call fcn.10018515
sub esi, dword [eax]
push 3
lea ecx, [ebp - 0x1c8]
call fcn.10018515
add esi, dword [eax]
push 3
lea ecx, [ebp - 0x1c8]
call fcn.10018515
cmp esi, dword [eax]
jl 0x1002a15c
mov dword [ebp - 0x2d8], 1
jmp 0x1002a163
and dword [ebp - 0x2d8], 0
push 3
lea ecx, [ebp - 0x1c8]
call fcn.10018515
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2d8]
je 0x1002a186
mov dword [ebp - 0x2dc], 1
jmp 0x1002a18d
and dword [ebp - 0x2dc], 0
push 3
lea ecx, [ebp - 0x1c8]
call fcn.10018515
mov eax, dword [eax]
sub eax, dword [ebp - 0x2dc]
cmp eax, 0x6684
jge 0x1002a1b5
mov dword [ebp - 0x5a0], 1
jmp 0x1002a1bc
and dword [ebp - 0x5a0], 0
push 0
lea ecx, [ebp - 0x1c8]
call fcn.10018515
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0xf
jmp 0x1002a1df
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xffffffe8
jle 0x1002a566
mov dword [ebp - 0x154], 0x459f451d
push 4
lea ecx, [ebp - 0x5f4]
call fcn.10018477
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x144], 0
jmp 0x1002a21d
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 4
jge 0x1002a23f
push dword [ebp - 0x144]
lea ecx, [ebp - 0x5f4]
call fcn.10018515
mov dword [eax], 0xe87bb6ab
jmp 0x1002a210
mov dword [ebp - 0x28], 0
jmp 0x1002a24f
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 7
jge 0x1002a4b8
mov dword [ebp - 0xdc], 1
push 1
lea ecx, [ebp - 0x644]
call fcn.10018477
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x14c], 0
jmp 0x1002a28d
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jge 0x1002a2af
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x644]
call fcn.10018515
mov dword [eax], 0x87e17710
jmp 0x1002a280
cmp dword [ebp - 0x154], 0
jne 0x1002a479
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1002a2d8
cmp dword [ebp - 0x154], 0
je 0x1002a2d8
mov dword [ebp - 0x518], 1
jmp 0x1002a2df
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x6c], eax
jl 0x1002a2ff
mov dword [ebp - 0x2e4], 1
jmp 0x1002a306
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x2ec]
mov ecx, dword [ebp - 0xdc]
lea eax, [eax + ecx - 0x6bc9]
test eax, eax
jle 0x1002a339
mov dword [ebp - 0x2f4], 1
jmp 0x1002a340
and dword [ebp - 0x2f4], 0
cmp dword [ebp - 0x2f4], 0xad446302
jae 0x1002a358
mov dword [ebp - 0x2fc], 1
jmp 0x1002a35f
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x2fc], eax
jle 0x1002a379
mov dword [ebp - 0x304], 1
jmp 0x1002a380
and dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 0x58d3b3e2
jge 0x1002a398
mov dword [ebp - 0x30c], 1
jmp 0x1002a39f
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0xfffffffb
je 0x1002a3b4
mov dword [ebp - 0x314], 1
jmp 0x1002a3bb
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x314], eax
jne 0x1002a3d5
mov dword [ebp - 0x31c], 1
jmp 0x1002a3dc
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x31c], eax
jle 0x1002a3f6
mov dword [ebp - 0x324], 1
jmp 0x1002a3fd
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x154]
add eax, dword [ebp - 0x324]
cmp eax, 0x63b8
je 0x1002a41c
mov dword [ebp - 0x32c], 1
jmp 0x1002a423
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 0xf2b6367a
ja 0x1002a444
mov dword [ebp - 0x33c], 1
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0xb4], eax
mov esi, dword [ebp - 0xb4]
push 0
lea ecx, [ebp - 0x644]
call fcn.10018515
mov dword [eax], esi
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x644]
call fcn.100184f9
jmp 0x1002a248
mov dword [ebp - 0xb4], 0
jmp 0x1002a4d1
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xc
jne 0x1002a552
mov dword [ebp - 0x5a8], 0xffffffff
mov dword [ebp - 0x28], 0xfffffff1
jmp 0x1002a4f4
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffb
jne 0x1002a51c
push 3
lea ecx, [ebp - 0x5f4]
call fcn.10018515
mov dword [eax], 0x2350c165
mov eax, dword [ebp - 0x344]
dec eax
mov dword [ebp - 0x344], eax
jmp 0x1002a4ed
cmp dword [ebp - 0x5a8], 0
je 0x1002a539
mov esi, dword [ebp - 0x6c]
push 3
lea ecx, [ebp - 0x5f4]
call fcn.10018515
mov dword [eax], esi
jmp 0x1002a54d
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x1002a54d
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x1002a4c4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x5f4]
call fcn.100184f9
jmp 0x1002a1d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c8]
call fcn.100184f9
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x1002b04f
mov dword [ebp - 0x278], 0x976d9935
mov dword [ebp - 0x15c], 0xfffffff6
mov dword [ebp - 0x15c], 0
jmp 0x1002a5af
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 6
jne 0x1002a5d0
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x1002a5ce
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x1002a5a2
mov byte [ebp - 0x74], 0
movzx eax, byte [ebp - 0x74]
test eax, eax
je 0x1002a62a
push 0x9d0
push 0x48b
push 0x26b9
push 0
push 0xa88
push 0xf77
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x6dd
push 0x21a9
push 0xb2c
push 0x2f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov dword [ebp - 0xac], 0
jmp 0x1002a643
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffffb
jg 0x1002a65e
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xc8]
mov dword [ebp - 0xc0], eax
jmp 0x1002a636
push 2
lea ecx, [ebp - 0x57c]
call fcn.10018477
mov dword [ebp - 4], 0x10
push 4
lea ecx, [ebp - 0x4e8]
call fcn.10018477
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0xf0], 5
mov dword [ebp - 0x1a4], 8
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0x59c], 0x1b78
mov dword [ebp - 0x658], 1
mov dword [ebp - 0x18], 0
jmp 0x1002a6cf
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002a6eb
push dword [ebp - 0x18]
lea ecx, [ebp - 0x57c]
call fcn.10018515
mov dword [eax], 0xfa5c62e0
jmp 0x1002a6c8
mov dword [ebp - 0x18], 0
jmp 0x1002a6fb
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002a717
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4e8]
call fcn.10018515
mov dword [eax], 8
jmp 0x1002a6f4
mov dword [ebp - 0x18], 0
jmp 0x1002a727
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002a73d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x75c], 0xffffffff
jmp 0x1002a720
mov esi, dword [ebp - 0x1a4]
push 1
lea ecx, [ebp - 0x57c]
call fcn.10018515
add esi, dword [eax]
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
test esi, esi
je 0x1002a8ae
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1002a81f
push 1
lea ecx, [ebp - 0x4e8]
call fcn.10018515
mov eax, dword [eax]
add eax, 0xffff
jne 0x1002a7a3
push 1
lea ecx, [ebp - 0x57c]
call fcn.10018515
cmp dword [eax], 0
jne 0x1002a7a3
and dword [ebp - 0x34c], 0
jmp 0x1002a7ad
mov dword [ebp - 0x34c], 1
push 3
lea ecx, [ebp - 0x4e8]
call fcn.10018515
mov ecx, dword [ebp - 0x34c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0x354], eax
push 1
lea ecx, [ebp - 0x57c]
call fcn.10018515
mov ecx, dword [ebp - 0x354]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x354], eax
jl 0x1002a7fe
mov dword [ebp - 0x35c], 1
jmp 0x1002a805
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x35c], eax
jne 0x1002a81f
mov dword [ebp - 0x364], 1
jmp 0x1002a826
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
add eax, 9
cmp eax, 0x2c298c24
jg 0x1002a842
mov dword [ebp - 0x36c], 1
jmp 0x1002a849
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x36c], eax
jl 0x1002a863
mov dword [ebp - 0x374], 1
jmp 0x1002a86a
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x374], eax
je 0x1002a884
mov dword [ebp - 0x520], 1
jmp 0x1002a88b
and dword [ebp - 0x520], 0
push 1
lea ecx, [ebp - 0x4e8]
call fcn.10018515
mov ecx, dword [ebp - 0xa4]
cmp dword [eax], ecx
jne 0x1002a8ae
mov dword [ebp - 0x37c], 1
jmp 0x1002a8b5
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x37c], eax
jge 0x1002a8d8
cmp dword [ebp - 0x59c], 0
je 0x1002a8d8
mov dword [ebp - 0x1f8], 1
jmp 0x1002a8df
and dword [ebp - 0x1f8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1f8]
mov dword [ebp + eax - 0x75c], ecx
mov dword [ebp - 0xf0], 0
jmp 0x1002a90b
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xffffffeb
jle 0x1002aae6
mov dword [ebp - 0x164], 0
jmp 0x1002a931
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jge 0x1002a94d
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x478], 4
jmp 0x1002a924
mov dword [ebp - 0xa4], 0
jmp 0x1002a966
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xf
jge 0x1002aae1
mov dword [ebp - 0x208], 0xffff
mov dword [ebp - 0x530], 7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x478]
mov dword [ebp - 0x668], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x478], 0
jne 0x1002a9bc
cmp dword [ebp - 0x208], 0
jne 0x1002a9bc
and dword [ebp - 0x200], 0
jmp 0x1002a9c6
mov dword [ebp - 0x200], 1
cmp dword [ebp - 0x200], 0
je 0x1002a9f1
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x1002a9ec
push 0
push 0
push 0x1d53
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
jmp 0x1002aadc
mov dword [ebp - 0x16c], 0
jmp 0x1002aa0a
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 4
jge 0x1002aa26
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x72c], 0x1939efd9
jmp 0x1002a9fd
cmp dword [ebp - 0x208], 0
je 0x1002aaca
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x478], 0
jne 0x1002aa98
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x478]
push 4
pop eax
imul eax, eax, 0
mov edi, dword [ebp + eax - 0x72c]
push 1
lea ecx, [ebp - 0x4e8]
call fcn.10018515
add edi, dword [eax]
cmp esi, edi
jg 0x1002aa7c
mov dword [ebp - 0x210], 1
jmp 0x1002aa83
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0x237ddc4e
jg 0x1002aa98
and dword [ebp - 0x218], 0
jmp 0x1002aaa2
mov dword [ebp - 0x218], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x478]
cmp dword [ebp - 0x218], eax
jle 0x1002aac3
mov dword [ebp - 0x220], 1
jmp 0x1002aaca
and dword [ebp - 0x220], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x72c]
mov dword [ebp - 0x530], eax
jmp 0x1002a959
jmp 0x1002a8fe
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x4e8]
call fcn.100184f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x57c]
call fcn.100184f9
mov dword [ebp - 0x174], 0
jmp 0x1002ab1d
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jg 0x1002b04f
mov dword [ebp - 0x17c], 0
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10018477
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x4c], 0
jmp 0x1002ab58
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x1002ab6e
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x5d0], 0xffff
jmp 0x1002ab51
mov dword [ebp - 0x4c], 0
jmp 0x1002ab7e
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1002ab9a
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x6e8]
call fcn.10018515
mov dword [eax], 0x46552ded
jmp 0x1002ab77
mov dword [ebp - 0x17c], 0xffffffec
jmp 0x1002abb3
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x1c
jl 0x1002afdf
mov dword [ebp - 0x44], 0x8d581621
mov dword [ebp - 0x44], 0
jmp 0x1002abd7
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x1002afda
mov dword [ebp - 0xf8], 0
push 1
lea ecx, [ebp - 0x58c]
call fcn.10018477
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0x184], 0
jmp 0x1002ac1f
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x1002ac41
push dword [ebp - 0x184]
lea ecx, [ebp - 0x58c]
call fcn.10018515
mov dword [eax], 0x8fa8f90a
jmp 0x1002ac12
mov dword [ebp - 0xf8], 0
jmp 0x1002ac5a
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jg 0x1002af29
mov dword [ebp - 0x54], 0xfffffffc
mov dword [ebp - 0x710], 0xfffffff8
mov dword [ebp - 0x670], 1
mov dword [ebp - 0x6dc], 0xfffffffc
mov dword [ebp - 0x54], 3
jmp 0x1002ac9c
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1002acdc
push 0
lea ecx, [ebp - 0x58c]
call fcn.10018515
mov dword [eax], 0x545ee28f
mov byte [ebp - 0x78], 0
movzx eax, byte [ebp - 0x78]
test eax, eax
je 0x1002acda
push 0x10e7
push 0x1e67
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
jmp 0x1002ac95
mov dword [ebp - 0x54], 0
jmp 0x1002acec
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x1002af24
push 2
lea ecx, [ebp - 0x1f0]
call fcn.10018477
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x18c], 0
jmp 0x1002ad20
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x1002ad42
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x1f0]
call fcn.10018515
mov dword [eax], 0x9e9d60a2
jmp 0x1002ad13
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018515
and dword [eax], 0
jmp 0x1002ad78
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018515
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x228]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018515
cmp dword [eax], 3
jg 0x1002af03
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018515
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x5d0], 0
je 0x1002aede
cmp dword [ebp - 0xf8], 0x26c4
jl 0x1002adc3
mov dword [ebp - 0x230], 1
jmp 0x1002adca
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x230], eax
jg 0x1002ade1
mov dword [ebp - 0x1b0], 1
jmp 0x1002ade8
and dword [ebp - 0x1b0], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.10018515
mov ecx, dword [ebp - 0x1b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x1b0]
jne 0x1002ae2c
push 0
lea ecx, [ebp - 0x58c]
call fcn.10018515
cmp dword [eax], 0
jne 0x1002ae2c
mov eax, 0xa12a
test eax, eax
jne 0x1002ae2c
and dword [ebp - 0x238], 0
jmp 0x1002ae36
mov dword [ebp - 0x238], 1
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018515
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x5d0]
cmp dword [ebp - 0x238], eax
jne 0x1002ae60
mov dword [ebp - 0x240], 1
jmp 0x1002ae67
and dword [ebp - 0x240], 0
cmp dword [ebp - 0x240], 0xffffffff
jne 0x1002ae7c
mov dword [ebp - 0x248], 1
jmp 0x1002ae83
and dword [ebp - 0x248], 0
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018515
mov eax, dword [eax]
cmp eax, dword [ebp - 0x248]
je 0x1002aea6
mov dword [ebp - 0x250], 1
jmp 0x1002aead
and dword [ebp - 0x250], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5d0]
cmp dword [ebp - 0x250], eax
je 0x1002aece
mov dword [ebp - 0x258], 1
jmp 0x1002aed5
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x258]
sub eax, dword [ebp - 0x44]
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018515
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x5d0]
mov dword [ebp + ecx*4 - 0x5d0], eax
jmp 0x1002ad54
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1f0]
call fcn.100184f9
jmp 0x1002ace5
jmp 0x1002ac4d
mov dword [ebp - 0xb8], 0
jmp 0x1002af42
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jg 0x1002afc6
mov dword [ebp - 0x5ac], 0xa2c0
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x5d0], 0
jne 0x1002af74
cmp dword [ebp - 0x44], 1
jg 0x1002af74
mov dword [ebp - 0x260], 1
jmp 0x1002af7b
and dword [ebp - 0x260], 0
cmp dword [ebp - 0x260], 1
je 0x1002af90
mov dword [ebp - 0x268], 1
jmp 0x1002af97
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x268], eax
jge 0x1002afae
mov dword [ebp - 0x270], 1
jmp 0x1002afb5
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x5ac], eax
jmp 0x1002af35
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x58c]
call fcn.100184f9
jmp 0x1002abd0
jmp 0x1002aba6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e8]
call fcn.100184f9
mov dword [ebp - 0xc0], 0
jmp 0x1002b007
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jg 0x1002b038
mov byte [ebp - 0x7a], 0
movzx eax, byte [ebp - 0x7a]
test eax, eax
je 0x1002b029
push 0x1f26
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
jmp 0x1002affa
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xc8], 0
je 0x1002b04a
jmp 0x1002ab10
jmp 0x1002ab10
mov dword [ebp - 0x19c], 0xfffffffa
mov dword [ebp - 0x194], 0
jmp 0x1002b072
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x1002b08e
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x678], 0xffffffff
jmp 0x1002b065
mov dword [ebp - 0x19c], 0
jmp 0x1002b0a7
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jl 0x1002b0c8
mov byte [ebp - 0x7c], 0
movzx eax, byte [ebp - 0x7c]
test eax, eax
je 0x1002b0c6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
jmp 0x1002b09a
cmp dword [ebp - 0x30], 0
jne 0x1002b0e7
mov eax, dword [ebp - 0xac]
add eax, 0xd4db
cmp eax, 1
jle 0x1002b0e7
and dword [ebp - 0x280], 0
jmp 0x1002b0f1
mov dword [ebp - 0x280], 1
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x280]
test eax, eax
je 0x1002b117
mov eax, 0x4f2ca125
test eax, eax
je 0x1002b117
mov dword [ebp - 0x540], 1
jmp 0x1002b11e
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xc8]
mov dword [ebp - 0x704], eax
cmp dword [ebp - 0x30], 0xce2e7c52
jne 0x1002b14d
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xc8], 0
jne 0x1002b14d
and dword [ebp - 0x288], 0
jmp 0x1002b157
mov dword [ebp - 0x288], 1
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x288], eax
jle 0x1002b171
mov dword [ebp - 0x298], 1
jmp 0x1002b178
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x298], eax
jle 0x1002b192
mov dword [ebp - 0x2a0], 1
jmp 0x1002b199
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0xc8], ecx
jmp 0x10029274
mov dword [ebp - 0x60], 0x97f6af11
mov dword [ebp - 0x2a8], 0xc38ec326
mov dword [ebp - 0x110], 0
jmp 0x1002b1db
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jge 0x1002b1f7
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x744], 0xdfc3e8ce
jmp 0x1002b1ce
mov dword [ebp - 0x60], 0
jmp 0x1002b207
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xffffffea
jg 0x1002b321
mov dword [ebp - 0xec], 0xf4672159
mov dword [ebp - 0x5a4], 0xfff9
mov dword [ebp - 0xec], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xec], eax
je 0x1002b246
mov dword [ebp - 0x2c0], 1
jmp 0x1002b24d
and dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2a8], 0xdb78
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x680], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x60], 0
je 0x1002b287
cmp dword [ebp - 0x60], 0
je 0x1002b287
mov dword [ebp - 0x2b0], 1
jmp 0x1002b28e
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0x4292
jl 0x1002b2a6
mov dword [ebp - 0x2b8], 1
jmp 0x1002b2ad
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0x5a4]
imul eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0x2c0]
sub ecx, eax
jne 0x1002b2e2
or eax, 0xffffffff
jne 0x1002b2e2
cmp dword [ebp - 0xec], 0
jne 0x1002b2e2
and dword [ebp - 0x2c8], 0
jmp 0x1002b2ec
mov dword [ebp - 0x2c8], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x2c8], eax
jne 0x1002b303
mov dword [ebp - 0x2d0], 1
jmp 0x1002b30a
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp + eax - 0x744], ecx
jmp 0x1002b200
cmp dword [ebp - 0xac], 0
je 0x1002b32f
jmp 0x1002901c
jmp 0x1002901c
push 0x1f26
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret