Function at 0x1002bd75
Capabilities:
Accept command line arguments
Allocate thread local storage
Create thread
Get keyboard layout
Get session user name
Parse pe header
Terminate process

Disassembly:
mov eax, 0x10067848
call fcn.1006604c
mov eax, 0x1724
call fcn.10065c50
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ecx
inc ebx
mov byte [ebp - 0x75], dl
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x80c]
push 3
call fcn.10013fe8
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
push 0xfffffffffffffff9
pop esi
jge 0x1002bdd1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x80c]
call fcn.10014055
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002bdb6
xor eax, eax
push 0xfffffffffffffff7
pop ecx
push 0xfffffffffffffffc
pop edi
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0xffffffe7
push 9
pop edx
jle 0x1002bf13
jmp 0x1002bdeb
xor eax, eax
mov dword [ebp - 0x28], 0xad67a4be
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x34], 0xc75dfcc9
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002be1f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002be07
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002be31
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x39c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002be24
dec dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
jne 0x1002becc
push 2
lea ecx, [ebp - 0x80c]
call fcn.10014055
mov ecx, dword [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0xa0]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
push 8
setge cl
xor ebx, ebx
cmp ecx, eax
pop eax
setne bl
sub ebx, eax
mov eax, dword [ebp - 0x28]
neg ebx
push 2
sbb ebx, ebx
xor edx, edx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x80c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xa0]
call fcn.10014055
cmp dword [ebp - 0x28], 0xfe3d2f55
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, dword [eax]
jg 0x1002becb
xor eax, eax
inc ebx
jmp 0x1002bece
inc ebx
mov eax, ebx
mov dword [ebp - 0x28], eax
mov ecx, 0xea0e
mov eax, dword [ebp - 0x40]
sub ecx, eax
add ecx, dword [ebp - 0x28]
xor eax, eax
cmp ecx, dword [ebp - 0x34]
jne 0x1002beef
mov esi, ebx
cmp dword [ebp - 0x39c], eax
jne 0x1002bef1
mov esi, eax
push 2
lea ecx, [ebp - 0x80c]
call fcn.10014055
push 9
pop edx
mov dword [eax], esi
mov dword [ebp - 0x4c], esi
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe7
jg 0x1002bde9
or esi, 0xffffffff
lea ecx, [ebp - 0x80c]
mov dword [ebp - 4], esi
call fcn.10014050
mov dword [ebp - 0x48], ebx
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], 0xfffffffe
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], al
je 0x1002bf44
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002bf53
mov dword [ebp - 0x34], 4
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002bf49
push 3
lea ecx, [ebp - 0xabc]
call fcn.10013fe8
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002bf8c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1514], 0x3df7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002bf73
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002bfac
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x174], 0x490c4d8e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002bf94
xor eax, eax
mov dword [ebp - 0x174], ebx
cmp dword [ebp - 0x174], eax
jl 0x1002bfe8
mov dword [ebp - 0x20], 0x31d83293
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002bfe0
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002bfdb
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002bfc9
dec dword [ebp - 0x174]
jns 0x1002bfba
mov dword [ebp - 0x18], eax
jmp 0x1002c004
push dword [ebp - 0x18]
lea ecx, [ebp - 0xabc]
call fcn.10014055
mov dword [eax], 2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002bfed
mov dword [ebp - 0x28], 0x25b9b55b
lea ecx, [ebp - 0x358]
push 2
call fcn.10013fe8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3b4]
mov dword [ebp - 0x24], 0xfffffffb
push 4
call fcn.10013fe8
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002c064
push dword [ebp - 0x14]
lea ecx, [ebp - 0x358]
call fcn.10014055
mov dword [eax], 0x7689
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002c045
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002c08c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3b4]
call fcn.10014055
mov dword [eax], 0xee72c34c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002c06d
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c26d
mov dword [ebp - 0x1c], 0x260417be
mov dword [ebp - 0x2c], 0xf03f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002c1f3
push 3
lea ecx, [ebp - 0x894]
call fcn.10013fe8
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x30], 0xafddf34f
mov dword [ebp - 0x18], eax
jmp 0x1002c0dd
push dword [ebp - 0x18]
call fcn.10014055
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
lea ecx, [ebp - 0x894]
jl 0x1002c0d0
push ebx
call fcn.10014055
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x358]
inc dword [eax]
call fcn.10014055
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x3b4]
xor eax, eax
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x358]
push eax
call fcn.10014055
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x358]
call fcn.10014055
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x358]
call fcn.10014055
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x358]
push dword [ebp - 0x1c]
call fcn.10014055
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x358]
call fcn.10014055
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x358]
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x894]
push eax
call fcn.10014055
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x3b4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x30], ebx
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x3b4]
setne dl
xor eax, eax
cmp edx, 0xecc2
setl al
xor ebx, ebx
cmp eax, 0x308faa83
setle bl
xor eax, eax
push eax
call fcn.10014055
xor edx, edx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x894]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 3
call fcn.10014050
dec dword [ebp - 0x1c]
push 1
pop ebx
jns 0x1002c0b1
xor eax, eax
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], eax
jl 0x1002c26a
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x1002c262
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x1002c25d
mov dword [ebp - 0x2c], eax
jmp 0x1002c237
push dword [ebp - 0x2c]
call fcn.10014055
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3b4]
mov esi, eax
call fcn.10014055
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
lea ecx, [ebp - 0x3b4]
jle 0x1002c218
push dword [ebp - 0x14]
call fcn.10014055
cmp dword [eax], 0
jne 0x1002c25b
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], ebx
jle 0x1002c213
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002c20b
dec dword [ebp - 0x14]
jns 0x1002c1ff
or esi, 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002c094
lea ecx, [ebp - 0x3b4]
call fcn.10014050
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], bl
call fcn.10014050
mov edi, dword [sym.imp.USER32.dll_SetWindowLongA]
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x1002c2cf
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], eax
jmp 0x1002c2c6
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002c2c3
push 0x2fc
push 0x1fdd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe7
jge 0x1002c2a5
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x16
je 0x1002c29d
mov dword [ebp - 0x48], eax
jmp 0x1002c406
mov dword [ebp - 0x14], 0xf47a6dee
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x13
jne 0x1002c403
mov dword [ebp - 0x28], 0x1b6eab3c
lea ecx, [ebp - 0x9b4]
push 3
call fcn.10013fe8
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x40], 0x7673ed13
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002c33a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9b4]
call fcn.10014055
mov dword [eax], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002c31b
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002c36c
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x9b4]
push ebx
call fcn.10014055
mov dword [eax], esi
test esi, esi
je 0x1002c357
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x48]
test eax, eax
jne 0x1002c36c
mov ecx, eax
jmp 0x1002c36e
mov ecx, ebx
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xdacd
setg cl
sub eax, ecx
add eax, dword [ebp - 0x48]
je 0x1002c39a
push ebx
lea ecx, [ebp - 0x9b4]
call fcn.10014055
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x14], 0xffff
test eax, eax
je 0x1002c3b9
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002c3bb
mov eax, ebx
jmp 0x1002c3bb
xor eax, eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xabc]
mov eax, dword [ebp - 0x40]
push 2
call fcn.10014055
mov ecx, dword [ebp - 0x14]
mov esi, eax
xor eax, eax
mov byte [ebp - 4], bl
cmp ecx, ebx
mov ecx, dword [ebp - 0x48]
setge al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x9b4]
setl dl
mov dword [esi], edx
call fcn.10014050
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x13
je 0x1002c2f1
xor eax, eax
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xffffffed
jle 0x1002c2dd
or esi, 0xffffffff
lea ecx, [ebp - 0xabc]
mov dword [ebp - 4], esi
call fcn.10014050
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x77c]
push 3
call fcn.10013fe8
xor eax, eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002c467
push 0xfffffffffffffff9
pop edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x77c]
call fcn.10014055
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002c446
mov edi, dword [sym.imp.USER32.dll_SetWindowLongA]
xor eax, eax
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0xffffffe7
jle 0x1002c5b1
push 8
pop edi
jmp 0x1002c47e
xor eax, eax
mov dword [ebp - 0x28], 0xad67a4be
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x34], 0xc75dfcc9
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c4ba
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c4a2
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c4cc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x428], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c4bf
dec dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa8]
jne 0x1002c564
push 2
lea ecx, [ebp - 0x77c]
call fcn.10014055
mov ecx, dword [ebp - 0xa8]
xor edx, edx
mov eax, dword [ebp - 0xa8]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
push 2
setge cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne bl
sub ebx, edi
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x428], ecx
lea ecx, [ebp - 0x77c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xa8]
call fcn.10014055
cmp dword [ebp - 0x28], 0xfe3d2f55
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, dword [eax]
jg 0x1002c563
xor eax, eax
inc ebx
jmp 0x1002c566
inc ebx
mov eax, ebx
mov dword [ebp - 0x28], eax
mov ecx, 0xea0e
mov eax, dword [ebp - 0x40]
sub ecx, eax
add ecx, dword [ebp - 0x28]
xor eax, eax
cmp ecx, dword [ebp - 0x34]
jne 0x1002c587
mov esi, ebx
cmp dword [ebp - 0x428], eax
jne 0x1002c589
mov esi, eax
push 2
lea ecx, [ebp - 0x77c]
call fcn.10014055
mov dword [eax], esi
mov dword [ebp - 0x4c], esi
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe7
jg 0x1002c47c
mov edi, dword [sym.imp.USER32.dll_SetWindowLongA]
or esi, 0xffffffff
lea ecx, [ebp - 0x77c]
mov dword [ebp - 4], esi
call fcn.10014050
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], 0xfffffffe
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], al
je 0x1002c5dc
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c5eb
mov dword [ebp - 0x34], 4
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffc
jl 0x1002c5e1
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002c616
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1694], 0x3df7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002c5fd
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c636
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x164], 0x490c4d8e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c61e
xor eax, eax
mov dword [ebp - 0x164], ebx
cmp dword [ebp - 0x164], eax
jl 0x1002c672
mov dword [ebp - 0x20], 0x31d83293
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002c66a
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002c665
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002c653
dec dword [ebp - 0x164]
jns 0x1002c644
push 3
lea ecx, [ebp - 0xab0]
call fcn.10013fe8
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x34c]
mov dword [ebp - 0x28], 0x25b9b55b
push 2
call fcn.10013fe8
push 8
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x24], 0xfffffffb
push 4
call fcn.10013fe8
push 9
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002c6e4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34c]
call fcn.10014055
mov dword [eax], 0x7689
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002c6c5
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002c70c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x434]
call fcn.10014055
mov dword [eax], 0xee72c34c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002c6ed
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c8ef
mov dword [ebp - 0x1c], 0x260417be
mov dword [ebp - 0x2c], 0xf03f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002c875
push 3
lea ecx, [ebp - 0x9cc]
call fcn.10013fe8
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x30], 0xafddf34f
mov dword [ebp - 0x18], eax
jmp 0x1002c75d
push dword [ebp - 0x18]
call fcn.10014055
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
lea ecx, [ebp - 0x9cc]
jl 0x1002c750
push ebx
call fcn.10014055
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x34c]
inc dword [eax]
call fcn.10014055
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x434]
xor eax, eax
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x34c]
push eax
call fcn.10014055
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x34c]
call fcn.10014055
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x34c]
call fcn.10014055
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x34c]
push dword [ebp - 0x1c]
call fcn.10014055
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x34c]
call fcn.10014055
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x34c]
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x9cc]
push eax
call fcn.10014055
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x434]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x30], ebx
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x434]
setne dl
xor eax, eax
cmp edx, 0xecc2
setl al
xor ebx, ebx
cmp eax, 0x308faa83
setle bl
xor eax, eax
push eax
call fcn.10014055
xor edx, edx
push 9
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x9cc]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
pop eax
mov byte [ebp - 4], al
call fcn.10014050
dec dword [ebp - 0x1c]
push 1
pop ebx
jns 0x1002c731
xor eax, eax
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], eax
jl 0x1002c8ec
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x1002c8e4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x1002c8df
mov dword [ebp - 0x2c], eax
jmp 0x1002c8b9
push dword [ebp - 0x2c]
call fcn.10014055
push dword [ebp - 0x14]
lea ecx, [ebp - 0x434]
mov esi, eax
call fcn.10014055
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
lea ecx, [ebp - 0x434]
jle 0x1002c89a
push dword [ebp - 0x14]
call fcn.10014055
cmp dword [eax], 0
jne 0x1002c8dd
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], ebx
jle 0x1002c895
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002c88d
dec dword [ebp - 0x14]
jns 0x1002c881
or esi, 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002c714
lea ecx, [ebp - 0x434]
call fcn.10014050
lea ecx, [ebp - 0x34c]
mov byte [ebp - 4], 7
call fcn.10014050
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c935
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7d4], 0x2799ac78
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c91d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c951
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb8], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c93d
xor eax, eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], ebx
jge 0x1002c980
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x7d4], 0x57e8b72f
inc dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], ebx
jl 0x1002c95f
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002c9a8
push dword [ebp - 0x18]
lea ecx, [ebp - 0xab0]
call fcn.10014055
mov dword [eax], 2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002c989
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x16
jne 0x1002d56e
push ebx
lea ecx, [ebp - 0x124]
call fcn.10013fe8
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x38], 0x3a0b8ee4
mov ecx, 0xffff
mov dword [ebp - 0x40], 0x8753e1e0
mov dword [ebp - 0x40], 0x72b90f99
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ca0a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x124]
call fcn.10014055
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c9ef
xor eax, eax
push eax
lea ecx, [ebp - 0x124]
call fcn.10014055
xor ebx, ebx
lea ecx, [ebp - 0x124]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.10014055
lea ecx, [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x124]
setne dl
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
xor eax, eax
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x124]
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x124]
push eax
call fcn.10014055
xor eax, eax
mov dword [ebp - 0x38], ebx
push eax
lea ecx, [ebp - 0x124]
call fcn.10014055
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
cmp ecx, 0x4d021f91
lea ecx, [ebp - 0x124]
setg bl
sub ebx, dword [eax]
neg ebx
sbb ebx, ebx
xor eax, eax
push eax
inc ebx
call fcn.10014055
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor eax, eax
cmp ecx, 0xc80a
setl al
cmp eax, dword [ebp - 0x24]
jle 0x1002cafd
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x38], eax
inc ebx
cmp dword [ebp - 0x38], ebx
jge 0x1002cc40
push dword [ebp - 0x38]
lea ecx, [ebp - 0x124]
call fcn.10014055
mov dword [eax], 0xfff8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002cada
xor eax, eax
jmp 0x1002cc40
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xa80]
call fcn.10013fe8
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002cb37
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa80]
call fcn.10014055
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002cb1d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002cb57
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1138], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002cb3f
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jg 0x1002cc2c
mov dword [ebp - 0x30], 0x221494fb
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], eax
jg 0x1002cc1a
mov dword [ebp - 0x4c], 0x42c8cdab
lea ecx, [ebp - 0x124]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], 0xd1ac8c6d
push dword [ebp - 0x38]
call fcn.10014055
lea ecx, [ebp - 0xa80]
mov esi, dword [eax]
xor eax, eax
inc eax
neg esi
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp ecx, esi
setne dl
cmp edx, dword [eax]
jne 0x1002cbb9
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x124]
dec esi
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x1138], esi
push dword [ebp - 0x38]
call fcn.10014055
push dword [ebp - 0x38]
lea ecx, [ebp - 0x124]
mov edi, dword [eax]
sub edi, 0x9783
add edi, esi
neg edi
sbb edi, edi
add edi, 0x2dc606b7
neg edi
sbb edi, edi
inc edi
call fcn.10014055
xor ecx, ecx
cmp dword [eax], edi
mov eax, dword [ebp - 0x34]
setle cl
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jle 0x1002cb76
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x1002cb63
mov edi, dword [sym.imp.USER32.dll_SetWindowLongA]
lea ecx, [ebp - 0xa80]
mov byte [ebp - 4], 0xb
call fcn.10014050
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], eax
jl 0x1002cc94
push dword [ebp - 0x48]
lea ecx, [ebp - 0x124]
call fcn.10014055
cmp dword [eax], 0
jne 0x1002cc94
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1002cc8a
mov dword [ebp - 0x24], eax
jmp 0x1002cc82
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002cc7f
push 0x1d8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002cc67
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x1002cc62
dec dword [ebp - 0x48]
jns 0x1002cc48
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 7
call fcn.10014050
or esi, 0xffffffff
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x48], 0xb7ce
push 4
call fcn.10013fe8
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x34], 0x96d5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002ccf2
push dword [ebp - 0x18]
lea ecx, [ebp - 0x800]
call fcn.10014055
mov dword [eax], 0x8e045dce
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002ccd3
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002ccfa
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x48]
cmp eax, esi
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x48]
jle 0x1002ce8b
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x3f0d3ecf
mov dword [ebp - 0x40], 0x2570
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xf
jg 0x1002ce9a
mov edi, 0xfffe
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x3c], 0xf4f2d891
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffe2
jne 0x1002ce73
mov dword [ebp - 0x50], 0x146df800
mov eax, dword [ebp - 0x24]
sub eax, 6
jne 0x1002cd62
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x800]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
push 2
call fcn.10014055
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
sub edx, ecx
imul ecx, edx, 0xca1a
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002ce5a
mov dword [ebp - 0x28], 0x5d5ec7e0
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setne dl
cmp edx, 0x1904
je 0x1002cdb7
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002cdd8
push eax
lea ecx, [ebp - 0x800]
call fcn.10014055
cmp dword [eax], 0
je 0x1002cdd6
mov eax, ebx
jmp 0x1002cdd8
xor eax, eax
xor ecx, ecx
cmp eax, 0xe9b8
setl cl
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
cmp ecx, ebx
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x3c]
je 0x1002ce1b
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], edi
jne 0x1002ce29
mov esi, ebx
cmp dword [ebp - 0x3c], eax
jne 0x1002ce2b
mov esi, eax
push 2
lea ecx, [ebp - 0x800]
call fcn.10014055
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp esi, ecx
setge dl
mov dword [eax], edx
xor eax, eax
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], al
je 0x1002ce57
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1a
jle 0x1002cd92
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe2
je 0x1002cd50
xor eax, eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xf
jle 0x1002cd39
mov edi, dword [sym.imp.USER32.dll_SetWindowLongA]
or esi, 0xffffffff
jmp 0x1002ce9a
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], al
je 0x1002ce9a
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
lea ecx, [ebp - 0x800]
mov byte [ebp - 4], 7
call fcn.10014050
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002d555
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], 0xc0dcee05
push 0xfffffffffffffff7
mov dword [ebp - 0x4c], 0x3eb61943
mov dword [ebp - 0x14], eax
pop esi
jmp 0x1002ceea
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002cee7
push 0x238a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1002cecf
cmp dword [ebp - 0x14], eax
je 0x1002d01b
push 3
lea ecx, [ebp - 0x3cc]
call fcn.10013fe8
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x54], 0xfffffff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002cf3a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3cc]
call fcn.10014055
mov dword [eax], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002cf1b
xor eax, eax
push eax
lea ecx, [ebp - 0x3cc]
call fcn.10014055
lea ecx, [ebp - 0x3cc]
inc dword [eax]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.10014055
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x3cc]
xor eax, eax
push eax
call fcn.10014055
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x3cc]
xor eax, eax
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x3cc]
mov dword [ebp - 0x14], eax
push eax
call fcn.10014055
mov edx, dword [ebp - 0x20]
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
cmp ecx, edx
setle bl
imul ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [esi]
setle al
xor ecx, ecx
cmp eax, 0xa237
mov eax, dword [ebp - 0x20]
setg cl
add eax, ecx
je 0x1002cfed
xor eax, eax
lea ecx, [ebp - 0x3cc]
push eax
call fcn.10014055
cmp dword [eax], 0
je 0x1002cfed
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1002cff2
xor ebx, ebx
xor eax, eax
inc ebx
mov edx, dword [ebp - 0x54]
add edx, eax
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x3cc]
mov byte [ebp - 4], 7
call fcn.10014050
jmp 0x1002d032
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002d034
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
mov dword [ebp - 0x14], ebx
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0x2c4475ee
mov dword [ebp - 0x48], ecx
mov ecx, 0xf00f
mov dword [ebp - 0x858], ecx
mov dword [ebp - 0x854], ecx
mov dword [ebp - 0x850], ecx
mov dword [ebp - 0x84c], ecx
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002d089
push eax
push 0x736
push 0xe7e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
neg esi
mov eax, dword [ebp - 0x14]
sbb esi, esi
neg esi
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
add edx, 0xd42c
cmp edx, 0xfff7
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, 0x34859bb7
je 0x1002d0dc
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp esi, 9
sete al
inc eax
inc eax
je 0x1002d28c
push 3
lea ecx, [ebp - 0x5ec]
call fcn.10013fe8
mov byte [ebp - 4], 0xf
or eax, 0xffffffff
mov dword [ebp - 0x40], 0x69dda314
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002d13a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5ec]
call fcn.10014055
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002d11b
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x1002d278
xor edi, edi
inc edi
mov dword [ebp - 0x40], 0xbec7a429
lea ecx, [ebp - 0xcf0]
push 2
call fcn.10013fe8
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x18], eax
jmp 0x1002d180
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcf0]
call fcn.10014055
mov dword [eax], 0x845d487c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d169
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x5ec]
dec eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x40], eax
push dword [ebp - 0x48]
call fcn.10014055
mov ecx, dword [ebp - 0x40]
push 8
pop edx
cmp edx, ecx
push edi
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x5ec]
setl dl
xor ebx, ebx
cmp edx, 0x46a6f4da
setne bl
call fcn.10014055
mov ecx, dword [ebp - 0x48]
xor edx, edx
push dword [ebp - 0x48]
cmp ebx, ecx
lea ecx, [ebp - 0x5ec]
sete dl
xor ebx, ebx
cmp edx, dword [eax]
setne bl
call fcn.10014055
xor ecx, ecx
push 2
cmp dword [eax], ebx
mov eax, dword [ebp - 0x34]
setl cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x5ec]
setge bl
call fcn.10014055
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ebx, ecx
mov esi, eax
mov ecx, dword [ebp - 0x14]
setge dl
push 0xfffffffffffffff7
pop eax
cmp eax, edx
sbb edx, edx
xor eax, eax
neg edx
cmp edx, ecx
lea ecx, [ebp - 0xcf0]
setle al
xor ebx, ebx
cmp eax, dword [esi]
setle bl
xor eax, eax
push eax
call fcn.10014055
mov dword [eax], ebx
xor eax, eax
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], al
je 0x1002d253
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0xcf0]
mov byte [ebp - 4], 0xf
call fcn.10014050
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 2
jle 0x1002d14a
mov edi, dword [sym.imp.USER32.dll_SetWindowLongA]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x5ec]
mov byte [ebp - 4], 7
call fcn.10014050
jmp 0x1002d3af
xor eax, eax
mov dword [ebp - 0x40], 0x6fbb1220
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002d2b3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf54], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002d29e
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x1002d3a5
mov dword [ebp - 0x30], 0x1a91f101
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x4c], 0x16b841a
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x1002d3a2
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0xf54]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, 0xfffe9b5b
mov eax, dword [ebp - 0x38]
setne cl
sub eax, ecx
cmp eax, 0x9f2f7bd1
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x733f7cfe
mov eax, dword [ebp - 0x38]
setg cl
xor edx, edx
cmp ecx, 0x5d954113
mov ecx, dword [ebp + eax*4 - 0x858]
setle dl
sub ecx, edx
xor edx, edx
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x858]
cmp ecx, eax
setne dl
sub edx, 0x8ba4
neg edx
sbb edx, edx
xor eax, eax
inc edx
sub edx, 0xa1fb
je 0x1002d354
mov ecx, ebx
cmp dword [ebp - 0xf4c], eax
jne 0x1002d356
mov ecx, eax
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
sub edx, 0x3a57
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp + eax*4 - 0x858]
mov eax, dword [ebp - 0x48]
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], eax
je 0x1002d390
cmp dword [ebp - 0x14], eax
je 0x1002d390
mov eax, ebx
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jle 0x1002d2d9
xor eax, eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x30
jle 0x1002d2bb
movdqa xmm0, xmmword [0x100066a0]
lea ecx, [ebp - 0x15fc]
xor eax, eax
mov byte [ebp - 0xd], al
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x48], 0xf55e00fe
mov dword [ebp - 0x868], eax
mov dword [ebp - 0x864], eax
mov dword [ebp - 0x860], eax
mov dword [ebp - 0x85c], eax
lea eax, [ebp - 0x12c8]
push eax
lea eax, [ebp - 0x12d8]
push eax
movdqu xmmword [ebp - 0x12d8], xmm0
call fcn.10014064
lea ecx, [ebp - 0x265]
mov esi, eax
call fcn.10006c7f
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x9e4]
push dword [esi]
call fcn.1001402a
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x24], 0x6fc6088b
mov dword [ebp - 0x28], 0x643b8a27
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x868]
mov eax, dword [ebp - 0x868]
xor eax, eax
cmp dword [ebp - 0x868], eax
jne 0x1002d461
mov esi, eax
cmp dword [ebp - 0x48], eax
je 0x1002d463
mov esi, ebx
push 2
lea ecx, [ebp - 0x9e4]
call fcn.10014055
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x1002d4e0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002d4d7
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x1002d4bc
push dword [ebp - 0x48]
lea ecx, [ebp - 0x9e4]
call fcn.10014055
push dword [ebp - 0x48]
lea ecx, [ebp - 0x9e4]
mov esi, eax
call fcn.10014055
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jle 0x1002d48f
xor eax, eax
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002d4d4
push eax
push 0xda6
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1002d486
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 3
jle 0x1002d479
lea ecx, [ebp - 0x9e4]
mov byte [ebp - 4], 7
call fcn.10014050
or esi, 0xffffffff
cmp byte [ebp - 0xd], 0
je 0x1002d54f
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], eax
jmp 0x1002d519
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1148], 0x38a1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d508
mov eax, dword [ebp - 0x1148]
add eax, 7
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002d53c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x2fc
push 0x1fdd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
dec dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], 0xffffffe7
jge 0x1002ceb3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
je 0x1002c9b5
xor eax, eax
mov dword [ebp - 0x3c], 9
push 2
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x34], 0xaaed6b65
mov dword [ebp - 0x18], eax
jmp 0x1002d5a2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1534], 0x63ab
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002d591
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x40], edx
imul eax, dword [ebp - 0x40], 0xf90e
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffed
jg 0x1002df59
jmp 0x1002d5e0
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], 0x37b1891f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d613
push 0x2243
push 0x5b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffff6
jge 0x1002d726
push 8
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], 0xf251d69f
mov dword [ebp - 0x14], 4
cmp dword [ebp - 0x14], 0xfffffff8
jl 0x1002d719
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xb
cmp dword [ebp - 0x2c], 0xffffffe9
jge 0x1002d709
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], eax
jmp 0x1002d6c8
mov dword [ebp - 0x34], 0x168aa2
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
inc eax
cmp eax, dword [ebp - 0x24]
jl 0x1002d67f
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x14], eax
je 0x1002d681
mov ecx, ebx
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0x8a06
setle al
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002d6c5
push 0x1f9c
push 0x18be
call dword [sym.imp.KERNEL32.dll_Beep]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xb
jl 0x1002d65d
push 9
pop eax
mov dword [ebp - 0x24], eax
jmp 0x1002d6f3
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002d6f0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1a
jle 0x1002d6d6
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe9
push 0
pop eax
jl 0x1002d652
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff8
jge 0x1002d63e
push 8
pop ecx
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xfffffff6
jl 0x1002d623
mov dword [ebp - 0x38], 0xf47a6dee
lea ecx, [ebp - 0x1154]
push 2
call fcn.10013fe8
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x18], 0x9bdba76a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002d76f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1154]
call fcn.10014055
mov dword [eax], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d750
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002d796
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d793
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1002d774
lea ecx, [ebp - 0x1154]
mov byte [ebp - 4], 7
call fcn.10014050
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x13
jne 0x1002df46
jmp 0x1002d7bd
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002d7df
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x794], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002d7c6
xor eax, eax
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], eax
jne 0x1002d93d
push 3
lea ecx, [ebp - 0xa98]
call fcn.10013fe8
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002d82c
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa98]
call fcn.10014055
mov dword [eax], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002d80d
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002d842
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x580], 0xb659d568
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002d831
push ebx
lea ecx, [ebp - 0xa98]
call fcn.10014055
mov ecx, dword [ebp - 0x78c]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x57c], 2
cmp dword [ebp - 0x57c], eax
jl 0x1002d922
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002d895
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x43c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d880
xor eax, eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 2
jg 0x1002d8f4
mov dword [ebp - 0x40], 0x756
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002d8e3
push 0x4d6
push eax
push 0x1e23
push 0x2194
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
inc dword [ebp - 0x43c]
cmp dword [ebp - 0x43c], 2
jle 0x1002d8a4
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d916
push 0xdc4
push 0x6e8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
dec dword [ebp - 0x57c]
jns 0x1002d874
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 7
call fcn.10014050
inc dword [ebp - 0x790]
je 0x1002d7f1
mov dword [ebp - 0x2c], 0x1b6eab3c
lea ecx, [ebp - 0x9fc]
push 3
call fcn.10013fe8
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x30], 0xf48c443e
mov dword [ebp - 0x18], 0x3009ce45
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x3c], 0xe3e76316
mov dword [ebp - 0x50], 0xaa9dade6
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x20], 0xc2076acb
push 0xfffffffffffffffd
pop edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x34], 0xa53fde75
mov dword [ebp - 0x54], 0x1260
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002da1f
mov dword [ebp - 0x18], 0x7207
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x14]
cmp eax, ecx
je 0x1002d9ba
mov eax, ebx
jmp 0x1002d9bc
xor eax, eax
cmp eax, dword [ebp - 0x30]
jge 0x1002da10
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x30]
imul eax, eax, 0x818f
cmp eax, 0x3d076c56
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x4c]
jge 0x1002d9f9
mov edx, ebx
cmp dword [ebp - 0x20], eax
jne 0x1002d9fb
mov edx, eax
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x54]
jl 0x1002da10
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x54], 0x1dd5
jge 0x1002da1f
xor eax, eax
mov ecx, eax
jmp 0x1002da21
mov ecx, ebx
mov eax, dword [ebp - 0x20]
sub ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, ebx
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x50]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x1002da50
mov dword [ebp - 0x34], 0xfff8
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
jmp 0x1002dab8
push ebx
lea ecx, [ebp - 0xf6c]
call fcn.10013fe8
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x44], 0x9c85
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002da8f
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf6c]
call fcn.10014055
mov dword [eax], 0x333db962
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002da71
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x14], eax
jmp 0x1002daa4
mov dword [ebp - 0x40], 0x4404179b
dec dword [ebp - 0x40]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1002da97
lea ecx, [ebp - 0xf6c]
mov byte [ebp - 4], 0x14
call fcn.10014050
mov dword [ebp - 0x40], 0x7673ed13
lea ecx, [ebp - 0x1098]
push 4
mov dword [ebp - 0x28], 7
pop eax
mov dword [ebp - 0x40], 0xad386cce
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x43e2
mov dword [ebp - 0x34], eax
push eax
call fcn.10013fe8
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002db17
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1098]
call fcn.10014055
mov dword [eax], 0x2e6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002daf8
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002db27
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28]
jl 0x1002db3a
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002db3c
mov edx, ebx
jmp 0x1002db3e
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
add edx, 0x4ddb84c6
imul edx, dword [ebp - 0x20]
cmp edx, 0x229a
setg al
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, ebx
mov eax, 0x7c4d
setle cl
sub eax, ecx
cmp eax, dword [ebp - 0x28]
jg 0x1002db8a
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002db8c
mov eax, ebx
jmp 0x1002db8c
xor eax, eax
mov ecx, 0xfffb
cmp ecx, eax
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
setle bl
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x1098]
mov byte [ebp - 4], 0x14
call fcn.10014050
mov dword [ebp - 0x24], 0x9a92
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x40], 0xeb4c8f0d
push 4
call fcn.10013fe8
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xc30]
xor ebx, ebx
mov dword [ebp - 0x30], 0x7ddbf4df
inc ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x40], 0x38009552
mov dword [ebp - 0x3c], esi
push ebx
call fcn.10013fe8
xor eax, eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1002dc3b
push dword [ebp - 0x48]
lea ecx, [ebp - 0x818]
call fcn.10014055
mov dword [eax], edi
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 4
jl 0x1002dc20
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], ebx
jge 0x1002dc5b
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x720], 0x9b996a53
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jl 0x1002dc43
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x1002dc77
push dword [ebp - 0x48]
lea ecx, [ebp - 0xc30]
call fcn.10014055
mov dword [eax], 2
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jl 0x1002dc60
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x818]
xor eax, eax
push eax
call fcn.10014055
mov edx, dword [ebp - 0x24]
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x818]
setge al
mov dword [esi], eax
mov dword [ebp - 0x40], 0xfffffffc
mov eax, dword [ebp - 0x40]
xor eax, eax
push eax
call fcn.10014055
xor ecx, ecx
cmp ecx, dword [eax]
sbb edx, edx
inc edx
mov dword [ebp - 0x720], edx
mov eax, dword [ebp - 0x24]
sub edx, eax
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xc30]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
xor eax, eax
push eax
call fcn.10014055
mov esi, eax
lea ecx, [ebp - 0x818]
xor eax, eax
push eax
call fcn.10014055
xor edx, edx
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x24]
cmp dword [esi], ecx
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xc30]
call fcn.10014050
lea ecx, [ebp - 0x818]
mov byte [ebp - 4], 0x14
call fcn.10014050
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002dd70
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9fc]
call fcn.10014055
mov dword [eax], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002dd51
xor eax, eax
mov dword [ebp - 0x44], 0x6b0f7383
or edi, 0xffffffff
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0x580849f8
mov dword [ebp - 0x44], 0xf07b4bc6
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x1120]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x44], 0xfecafe8b
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0x3ec752f6
mov dword [ebp - 0x44], 0xfffffffd
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0xcf7921e1
mov dword [ebp - 0x44], 0x890
mov dword [ebp - 0x44], 0xbc657e3b
mov dword [ebp - 0x44], 0x17ab6dad
mov dword [ebp - 0x44], 0xbd5de1fc
mov dword [ebp - 0x44], 0x18bd8502
push 2
call fcn.10013fe8
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1002de24
push dword [ebp - 0x48]
lea ecx, [ebp - 0x1120]
call fcn.10014055
mov dword [eax], 0xb0cf5aa0
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 2
jl 0x1002de05
xor eax, eax
push 3
mov dword [ebp - 0x48], eax
pop ecx
cmp dword [ebp - 0x48], ecx
jge 0x1002de47
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xf84], 0x4edc0223
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jl 0x1002de2f
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x1002de5d
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x16e0], 0x22d5fba2
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jl 0x1002de4c
dec dword [ebp - 0xf80]
lea ecx, [ebp - 0x1120]
mov byte [ebp - 4], 0x14
call fcn.10014050
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002deab
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x9fc]
push ebx
call fcn.10014055
mov dword [eax], esi
test esi, esi
je 0x1002de96
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
test eax, eax
jne 0x1002deab
mov ecx, eax
jmp 0x1002dead
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xdacd
setg cl
sub eax, ecx
add eax, dword [ebp - 0x1c]
je 0x1002ded9
push ebx
lea ecx, [ebp - 0x9fc]
call fcn.10014055
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x38], 0xffff
test eax, eax
je 0x1002def8
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002defa
mov eax, ebx
jmp 0x1002defa
xor eax, eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xab0]
mov eax, dword [ebp - 0x40]
push 2
call fcn.10014055
mov ecx, dword [ebp - 0x38]
mov esi, eax
xor eax, eax
mov byte [ebp - 4], 7
cmp ecx, ebx
mov ecx, dword [ebp - 0x1c]
setge al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x9fc]
setl dl
mov dword [esi], edx
call fcn.10014050
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x13
push 0xffffffffffffffff
pop esi
je 0x1002d7bb
or esi, esi
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffed
jle 0x1002d5de
mov edi, dword [sym.imp.USER32.dll_SetWindowLongA]
lea ecx, [ebp - 0xab0]
mov dword [ebp - 4], esi
call fcn.10014050
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xdb0]
push 3
call fcn.10013fe8
xor eax, eax
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002dfa8
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdb0]
call fcn.10014055
mov dword [eax], 2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002df89
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002dfdf
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], eax
jmp 0x1002dfd6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002dfd3
push 0x2fc
push 0x1fdd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe7
jge 0x1002dfb5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
je 0x1002dfad
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffed
jg 0x1002e129
mov dword [ebp - 0x14], 0xf47a6dee
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x13
jne 0x1002e119
mov dword [ebp - 0x28], 0x1b6eab3c
lea ecx, [ebp - 0xa14]
push 3
call fcn.10013fe8
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x40], 0x7673ed13
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002e04f
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa14]
call fcn.10014055
mov dword [eax], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002e030
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002e081
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0xa14]
push ebx
call fcn.10014055
mov dword [eax], esi
test esi, esi
je 0x1002e06c
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
test eax, eax
jne 0x1002e081
mov ecx, eax
jmp 0x1002e083
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xdacd
setg cl
sub eax, ecx
add eax, dword [ebp - 0x1c]
je 0x1002e0af
push ebx
lea ecx, [ebp - 0xa14]
call fcn.10014055
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x14], 0xffff
test eax, eax
je 0x1002e0ce
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002e0d0
mov eax, ebx
jmp 0x1002e0d0
xor eax, eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xdb0]
mov eax, dword [ebp - 0x40]
push 2
call fcn.10014055
mov ecx, dword [ebp - 0x14]
mov esi, eax
xor eax, eax
mov byte [ebp - 4], 0x1a
cmp ecx, ebx
mov ecx, dword [ebp - 0x1c]
setge al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0xa14]
setl dl
mov dword [esi], edx
call fcn.10014050
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x13
je 0x1002e006
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffed
jle 0x1002dff2
or esi, 0xffffffff
lea ecx, [ebp - 0xdb0]
mov dword [ebp - 4], esi
call fcn.10014050
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xac8]
push 3
call fcn.10013fe8
xor eax, eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002e178
push dword [ebp - 0x18]
lea ecx, [ebp - 0xac8]
call fcn.10014055
mov dword [eax], 2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002e159
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002e1af
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], eax
jmp 0x1002e1a6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e1a3
push 0x2fc
push 0x1fdd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe7
jge 0x1002e185
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
je 0x1002e17d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffed
jg 0x1002e2f9
mov dword [ebp - 0x14], 0xf47a6dee
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x13
jne 0x1002e2e9
mov dword [ebp - 0x28], 0x1b6eab3c
lea ecx, [ebp - 0x960]
push 3
call fcn.10013fe8
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x40], 0x7673ed13
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002e21f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x960]
call fcn.10014055
mov dword [eax], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002e200
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002e251
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x960]
push ebx
call fcn.10014055
mov dword [eax], esi
test esi, esi
je 0x1002e23c
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
test eax, eax
jne 0x1002e251
mov ecx, eax
jmp 0x1002e253
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xdacd
setg cl
sub eax, ecx
add eax, dword [ebp - 0x1c]
je 0x1002e27f
push ebx
lea ecx, [ebp - 0x960]
call fcn.10014055
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x14], 0xffff
test eax, eax
je 0x1002e29e
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002e2a0
mov eax, ebx
jmp 0x1002e2a0
xor eax, eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xac8]
mov eax, dword [ebp - 0x40]
push 2
call fcn.10014055
mov ecx, dword [ebp - 0x14]
mov esi, eax
xor eax, eax
mov byte [ebp - 4], 0x1c
cmp ecx, ebx
mov ecx, dword [ebp - 0x1c]
setge al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x960]
setl dl
mov dword [esi], edx
call fcn.10014050
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x13
je 0x1002e1d6
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffed
jle 0x1002e1c2
or esi, 0xffffffff
lea ecx, [ebp - 0xac8]
mov dword [ebp - 4], esi
call fcn.10014050
mov dword [ebp - 0x50], 5
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x14], ebx
push 3
call fcn.10013fe8
mov dword [ebp - 4], 0x1e
mov eax, 0xffff
mov dword [ebp - 0x2c], 0xd015b01d
mov dword [ebp - 0x24], 0xabac8ef3
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x20], 0xcf62
mov dword [ebp - 0x1c], 0x55ef1c8d
mov dword [ebp - 0x18], eax
jmp 0x1002e363
push dword [ebp - 0x18]
lea ecx, [ebp - 0x224]
call fcn.10014055
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002e350
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002e3b5
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x224]
push ebx
call fcn.10014055
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x14], eax
push 2
call fcn.10014055
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x224]
inc dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.10014055
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x224]
xor eax, eax
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x224]
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp ecx, ebx
mov esi, eax
lea ecx, [ebp - 0x224]
setge dl
sub edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x2c]
sub edx, 0xcd5
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x24]
sub edx, 0xbe72f236
neg edx
sbb edx, edx
inc edx
cmp edx, ebx
sbb eax, eax
xor ebx, ebx
neg eax
cmp eax, dword [esi]
setle bl
xor eax, eax
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ebx, ecx
mov esi, eax
mov ecx, dword [ebp - 0x24]
setge dl
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
setle al
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0x224]
setle bl
xor eax, eax
add ebx, dword [esi]
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x224]
push 2
sete dl
xor ebx, ebx
cmp edx, dword [eax]
setg bl
call fcn.10014055
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x24]
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
cmp edx, eax
setg bl
sub ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
neg ebx
sbb ebx, ebx
inc ebx
mov edi, dword [sym.imp.USER32.dll_TranslateMDISysAccel]
xor ecx, ecx
cmp ebx, eax
setge cl
dec ecx
mov dword [ebp - 0x24], ecx
je 0x1002e4e5
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002e4bc
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x1c], eax
or esi, 0xffffffff
cmp dword [ebp - 0x1c], 3
jge 0x1002e524
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x224]
call fcn.10014055
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002e4c8
xor eax, eax
jmp 0x1002e524
mov dword [ebp - 0x34], 0xf3c8
xor eax, eax
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], eax
jl 0x1002e518
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e513
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x1002e4fa
xor eax, eax
mov dword [ebp - 0x34], 0xd14a140c
or esi, 0xffffffff
mov dword [ebp - 0x14], eax
jmp 0x1002e54b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e548
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffea
jg 0x1002e529
lea ecx, [ebp - 0x224]
mov dword [ebp - 4], esi
call fcn.10014050
xor ebx, ebx
mov dword [ebp - 0x50], 5
inc ebx
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x14], ebx
push 3
call fcn.10013fe8
mov dword [ebp - 4], 0x1f
mov eax, 0xffff
mov dword [ebp - 0x2c], 0xd015b01d
mov dword [ebp - 0x24], 0xabac8ef3
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x20], 0xcf62
mov dword [ebp - 0x1c], 0x55ef1c8d
mov dword [ebp - 0x18], eax
jmp 0x1002e5be
push dword [ebp - 0x18]
lea ecx, [ebp - 0x234]
call fcn.10014055
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002e5ab
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002e610
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x234]
push ebx
call fcn.10014055
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x14], eax
push 2
call fcn.10014055
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x234]
inc dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.10014055
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x234]
xor eax, eax
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x234]
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp ecx, ebx
mov esi, eax
lea ecx, [ebp - 0x234]
setge dl
sub edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x2c]
sub edx, 0xcd5
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x24]
sub edx, 0xbe72f236
neg edx
sbb edx, edx
inc edx
cmp edx, ebx
sbb eax, eax
xor ebx, ebx
neg eax
cmp eax, dword [esi]
setle bl
xor eax, eax
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ebx, ecx
mov esi, eax
mov ecx, dword [ebp - 0x24]
setge dl
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
setle al
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0x234]
setle bl
xor eax, eax
add ebx, dword [esi]
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x234]
push 2
sete dl
xor ebx, ebx
cmp edx, dword [eax]
setg bl
call fcn.10014055
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x24]
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
cmp edx, eax
setg bl
sub ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
neg ebx
sbb ebx, ebx
inc ebx
xor ecx, ecx
cmp ebx, eax
setge cl
dec ecx
mov dword [ebp - 0x24], ecx
je 0x1002e73a
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002e711
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x1c], eax
or esi, 0xffffffff
cmp dword [ebp - 0x1c], 3
jge 0x1002e779
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x234]
call fcn.10014055
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002e71d
xor eax, eax
jmp 0x1002e779
mov dword [ebp - 0x34], 0xf3c8
xor eax, eax
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], eax
jl 0x1002e76d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e768
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x1002e74f
xor eax, eax
mov dword [ebp - 0x34], 0xd14a140c
or esi, 0xffffffff
mov dword [ebp - 0x14], eax
jmp 0x1002e7a0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e79d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffea
jg 0x1002e77e
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], esi
call fcn.10014050
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x17
jg 0x1002e814
xor edi, edi
inc edi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e7eb
push 0xdc4
push 0x6e8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e805
push edi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x17
jle 0x1002e7c9
mov edi, dword [sym.imp.USER32.dll_TranslateMDISysAccel]
xor ebx, ebx
mov dword [ebp - 0x50], 5
inc ebx
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x14], ebx
push 3
call fcn.10013fe8
mov dword [ebp - 4], 0x20
mov eax, 0xffff
mov dword [ebp - 0x2c], 0xd015b01d
mov dword [ebp - 0x24], 0xabac8ef3
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x20], 0xcf62
mov dword [ebp - 0x1c], 0x55ef1c8d
mov dword [ebp - 0x18], eax
jmp 0x1002e873
push dword [ebp - 0x18]
lea ecx, [ebp - 0x244]
call fcn.10014055
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002e860
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002e8c5
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x244]
push ebx
call fcn.10014055
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x14], eax
push 2
call fcn.10014055
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x244]
inc dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.10014055
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x244]
xor eax, eax
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x244]
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp ecx, ebx
mov esi, eax
lea ecx, [ebp - 0x244]
setge dl
sub edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x2c]
sub edx, 0xcd5
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x24]
sub edx, 0xbe72f236
neg edx
sbb edx, edx
inc edx
cmp edx, ebx
sbb eax, eax
xor ebx, ebx
neg eax
cmp eax, dword [esi]
setle bl
xor eax, eax
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ebx, ecx
mov esi, eax
mov ecx, dword [ebp - 0x24]
setge dl
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
setle al
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0x244]
setle bl
xor eax, eax
add ebx, dword [esi]
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x244]
push 2
sete dl
xor ebx, ebx
cmp edx, dword [eax]
setg bl
call fcn.10014055
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x24]
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
cmp edx, eax
setg bl
sub ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
neg ebx
sbb ebx, ebx
inc ebx
xor ecx, ecx
cmp ebx, eax
setge cl
dec ecx
mov dword [ebp - 0x24], ecx
je 0x1002e9ef
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002e9c6
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x1c], eax
or ebx, 0xffffffff
cmp dword [ebp - 0x1c], 3
jge 0x1002ea2e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x244]
call fcn.10014055
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002e9d2
xor eax, eax
jmp 0x1002ea2e
mov dword [ebp - 0x34], 0xf3c8
xor eax, eax
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], eax
jl 0x1002ea22
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ea1d
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x1002ea04
xor eax, eax
mov dword [ebp - 0x34], 0xd14a140c
or ebx, 0xffffffff
mov dword [ebp - 0x14], eax
jmp 0x1002ea55
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ea52
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffea
jg 0x1002ea33
lea ecx, [ebp - 0x244]
mov dword [ebp - 4], ebx
call fcn.10014050
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov dword [ebp - 0x44], 0xbaf43b7c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002ea98
push 0xf33
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002eabe
push eax
push 0x10e5
push 0x1a90
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x20], 0xa14c5530
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x54], 0xbde8aff6
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x18], eax
jmp 0x1002eb04
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x100], 0x89fff12f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002eaf3
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, 0x9ba8
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
add ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
neg ebx
cmp ebx, eax
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, 0xd77cccae
setg dl
cmp eax, edx
sbb eax, eax
neg eax
add eax, dword [ebp - 0x1c]
jne 0x1002eb87
cmp dword [ebp - 0x100], eax
jne 0x1002eb87
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x1002eb8c
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x20]
je 0x1002eba6
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002eba8
mov eax, ebx
jmp 0x1002eba8
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
jne 0x1002ebb6
cmp dword [ebp - 0x24], eax
je 0x1002ebb8
mov eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002ebc8
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x24]
jg 0x1002ebf6
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002ec04
mov edx, eax
cmp dword [ebp - 0x40], eax
je 0x1002ec06
mov edx, ebx
mov eax, dword [ebp - 0x100]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
imul eax, ecx
test eax, eax
je 0x1002ec28
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x1002ec2a
mov eax, ebx
jmp 0x1002ec2a
xor eax, eax
xor ecx, ecx
cmp eax, 0xfffffffe
sete cl
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xf390
test eax, eax
jne 0x1002ec5d
cmp dword [ebp - 0x100], eax
je 0x1002ec5f
mov eax, ebx
mov dword [ebp - 0x100], eax
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x18], eax
jmp 0x1002ecaa
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ec91
push 0xdc4
push 0x6e8
call esi
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002eca7
push ebx
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x17
jle 0x1002ec73
push ebx
lea ecx, [ebp - 0x150]
call fcn.10013fe8
mov dword [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x2c], 0xc7c6f1fd
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x3c], 0xd639b6af
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002ecfc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x488], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002ece3
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002ed22
push dword [ebp - 0x14]
lea ecx, [ebp - 0x150]
call fcn.10014055
mov dword [eax], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002ed04
xor eax, eax
push eax
lea ecx, [ebp - 0x150]
call fcn.10014055
lea ecx, [ebp - 0x150]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10014055
cmp dword [eax], 2
jg 0x1002f023
or edi, 0xffffffff
movdqa xmm0, xmmword [0x10006680]
lea eax, [ebp - 0x11c8]
push eax
lea eax, [ebp - 0x11d8]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xfffffff6
lea ecx, [ebp - 0x1664]
push eax
movdqu xmmword [ebp - 0x11d8], xmm0
call fcn.10014064
lea ecx, [ebp - 0x296]
mov esi, eax
call fcn.10006c7f
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x10b0]
push dword [esi]
call fcn.1001402a
xor eax, eax
mov byte [ebp - 4], 0x22
push 2
mov dword [ebp - 0x28], eax
pop ecx
jmp 0x1002efde
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x1002efdb
mov edx, 0x79c4185a
mov dword [ebp - 0x2b4], edx
mov dword [ebp - 0x2b0], edx
mov dword [ebp - 0x2ac], edx
mov dword [ebp - 0x2a8], edx
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], ecx
jg 0x1002ee49
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jle 0x1002edad
lea ecx, [ebp - 0x10b0]
mov byte [ebp - 4], 0x21
call fcn.10014050
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10014055
lea ecx, [ebp - 0x150]
inc dword [eax]
xor eax, eax
push eax
call fcn.10014055
cmp dword [eax], 2
jle 0x1002ed4b
mov edi, dword [sym.imp.USER32.dll_TranslateMDISysAccel]
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10014055
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x150]
xor eax, eax
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10014055
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x480]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
cmp ecx, dword [ebp - 0x3c]
jle 0x1002f094
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10014055
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10014055
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, 0x72f548f9
lea ecx, [ebp - 0x150]
setge dl
or esi, 0xffffffff
add edx, dword [eax]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], esi
call fcn.10014050
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x18], eax
jmp 0x1002f113
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f0f6
cmp dword [ebp - 0x18], 0x17
jle 0x1002f0d4
mov dword [ebp - 0x44], 0xbaf43b7c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f145