Function at 0x1002d6e5
Capabilities:
Contain obfuscated stackstrings
Delete registry value
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008d459
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x69c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002d734
mov eax, dword [ebp + 8]
mov dword [ebp - 0x348], eax
push 0x47ad
push dword [ebp - 0x348]
push 0x4b4c
push 1
call fcn.100301c7
add esp, 0x10
jmp 0x100301b8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x440], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
movzx eax, byte [eax]
test eax, eax
je 0x10030195
mov dword [ebp - 0x228], 0x846
mov dword [ebp - 0x434], 0x10009cf0
cmp dword [ebp - 0x228], 0xa9e
jle 0x1002d869
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreatePen]
and dword [ebp - 0x17c], 0
jmp 0x1002d7aa
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x5aaa
jge 0x1002d869
and dword [ebp - 0x158], 0
jmp 0x1002d7d0
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x5c8f
jge 0x1002d864
and dword [ebp - 0x110], 0
jmp 0x1002d7f6
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x638d
jge 0x1002d85f
mov eax, dword [ebp - 0x17c]
sub eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0x110]
cdq
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x310], edx
push dword [ebp - 0x310]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x698]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e4]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x698]
call fcn.1002281d
jmp 0x1002d7e9
jmp 0x1002d7c3
jmp 0x1002d79d
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x228], 0x63c
jge 0x1002d88d
push dword [ebp - 0x434]
call fcn.10077843
pop ecx
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x18], 0x1dfe
mov dword [ebp - 0x2a4], 0x2119
mov dword [ebp - 0x2d4], 0x10009d50
cmp dword [ebp - 0x2a4], 0x2307
jle 0x1002d99e
and dword [ebp - 0xa0], 0
jmp 0x1002d8da
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x854
jge 0x1002d99e
and dword [ebp - 0x98], 0
jmp 0x1002d900
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x484b
jge 0x1002d999
and dword [ebp - 0x148], 0
jmp 0x1002d926
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x17d0
jge 0x1002d994
mov eax, dword [ebp - 0x98]
cdq
idiv dword [ebp - 0x148]
mov eax, dword [ebp - 0xa0]
mov ecx, edx
sar eax, cl
cdq
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x31c], edx
push dword [ebp - 0x31c]
push dword [ebp - 0x320]
lea ecx, [ebp - 0x620]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x308], eax
mov ecx, dword [ebp - 0x308]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x620]
call fcn.1002281d
jmp 0x1002d919
jmp 0x1002d8f3
jmp 0x1002d8cd
push 4
lea ecx, [ebp - 0x2b4]
call fcn.10022b61
and dword [ebp - 4], 0
cmp dword [ebp - 0x2a4], 0x1ff7
jge 0x1002d9c7
push dword [ebp - 0x2d4]
call fcn.10077843
pop ecx
push 4
lea ecx, [ebp - 0x44c]
call fcn.10022b61
mov byte [ebp - 4], 1
lea eax, [ebp - 0x3b4]
push eax
push 1
push 1
lea eax, [ebp - 0x2b4]
push eax
call fcn.10026ed6
add esp, 0x10
mov dword [ebp - 0x264], 0x5854
mov dword [ebp - 0x2dc], 0x10009d88
cmp dword [ebp - 0x264], 0x5baa
jle 0x1002dabe
and dword [ebp - 0x118], 0
jmp 0x1002da2c
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x6cca
jge 0x1002dab6
and dword [ebp - 0xa8], 0
jmp 0x1002da4e
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x5ea8
jge 0x1002dab1
mov eax, dword [ebp - 0x118]
or eax, dword [ebp - 0xa8]
cdq
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], edx
push dword [ebp - 0x328]
push dword [ebp - 0x32c]
lea ecx, [ebp - 0x668]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x41c]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x668]
call fcn.1002281d
jmp 0x1002da41
jmp 0x1002da1f
push 0
call dword [sym.imp.USER32.dll_SetCapture]
cmp dword [ebp - 0x264], 0x559c
jge 0x1002dad6
push dword [ebp - 0x2dc]
call fcn.10077843
pop ecx
push 0x5d3e
push 0x4374
push 1
lea eax, [ebp - 0x3b4]
push eax
push 0x20b3
lea eax, [ebp - 0x44c]
push eax
push 0
call fcn.100302ad
add esp, 0x1c
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jl 0x1002db13
mov dword [ebp - 0x288], 1
jmp 0x1002db1a
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 0xffffffff
je 0x1002db2f
mov dword [ebp - 0x19c], 1
jmp 0x1002db36
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x19c]
cmp eax, dword [ebp - 0x18]
jg 0x1002db51
mov dword [ebp - 0x184], 1
jmp 0x1002db58
and dword [ebp - 0x184], 0
push 3
lea ecx, [ebp - 0x2b4]
call fcn.10022bff
mov ecx, dword [ebp - 0x184]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x184]
jl 0x1002db84
mov dword [ebp - 0x224], 1
jmp 0x1002db8b
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x224], eax
jne 0x1002dba2
mov dword [ebp - 0x1a4], 1
jmp 0x1002dba9
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1a4]
jne 0x1002dbd8
mov eax, 0x4198
test eax, eax
jne 0x1002dbd8
push 3
lea ecx, [ebp - 0x2b4]
call fcn.10022bff
cmp dword [eax], 0
jne 0x1002dbd8
and dword [ebp - 0x2a0], 0
jmp 0x1002dbe2
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0x18], eax
jg 0x1002dbfd
mov dword [ebp - 0x1ac], 1
jmp 0x1002dc04
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1ac], eax
jne 0x1002dc2d
push 1
lea ecx, [ebp - 0x2b4]
call fcn.10022bff
cmp dword [eax], 0
je 0x1002dc2d
mov dword [ebp - 0x22c], 1
jmp 0x1002dc34
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 0xb382e580
jae 0x1002dc5b
push 3
lea ecx, [ebp - 0x2b4]
call fcn.10022bff
cmp dword [eax], 0
jne 0x1002dc5b
and dword [ebp - 0x1b4], 0
jmp 0x1002dc65
mov dword [ebp - 0x1b4], 1
mov esi, dword [ebp - 0x18]
add esi, dword [ebp - 0x1b4]
push 3
lea ecx, [ebp - 0x44c]
call fcn.10022bff
mov dword [eax], esi
lea eax, [ebp - 0x44c]
push eax
push 0
lea eax, [ebp - 0x2b4]
push eax
push 0x3792
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.1002c104
add esp, 0x18
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44c]
call fcn.10022be3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b4]
call fcn.10022be3
mov dword [ebp - 0x26c], 0x6d59
mov dword [ebp - 0x2e4], 0x10009da8
cmp dword [ebp - 0x26c], 0x70fe
jle 0x1002ddc0
and dword [ebp - 0xb8], 0
jmp 0x1002dcf8
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xdec
jge 0x1002ddc0
and dword [ebp - 0x120], 0
jmp 0x1002dd1e
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x3ac9
jge 0x1002ddbb
and dword [ebp - 0x170], 0
jmp 0x1002dd44
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x5e32
jge 0x1002ddb6
and dword [ebp - 0xb0], 0
jmp 0x1002dd66
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x4466
jge 0x1002ddb4
mov eax, dword [ebp - 0x170]
cdq
idiv dword [ebp - 0xb0]
add edx, dword [ebp - 0x120]
mov eax, dword [ebp - 0xb8]
mov ecx, edx
sar eax, cl
cdq
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x334], edx
push dword [ebp - 0x334]
push dword [ebp - 0x338]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1002dd59
jmp 0x1002dd37
jmp 0x1002dd11
jmp 0x1002dceb
cmp dword [ebp - 0x26c], 0x6b0e
jge 0x1002dddc
mov edx, dword [ebp - 0x2e4]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0xc0], 0x61be360d
mov dword [ebp - 0x150], 1
mov dword [ebp - 0x28], 0
jmp 0x1002de07
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002de1d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x518], 0xffffffff
jmp 0x1002de00
mov dword [ebp - 0x28], 0
jmp 0x1002de2d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002de43
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x500], 0x216709e1
jmp 0x1002de26
mov eax, dword [ebp - 0x20]
sub eax, 0xc285
neg eax
jne 0x1002df64
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1bc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp + eax - 0x518], ecx
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
je 0x1002de99
mov eax, 0xffff
test eax, eax
je 0x1002de99
mov dword [ebp - 0x234], 1
jmp 0x1002dea0
and dword [ebp - 0x234], 0
cmp dword [ebp - 0x234], 0x80eb
jg 0x1002deb8
mov dword [ebp - 0x1c4], 1
jmp 0x1002debf
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c4], eax
jge 0x1002ded6
mov dword [ebp - 0x28c], 1
jmp 0x1002dedd
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28c]
jl 0x1002def4
mov dword [ebp - 0x1cc], 1
jmp 0x1002defb
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1cc], eax
jl 0x1002df12
mov dword [ebp - 0x23c], 1
jmp 0x1002df19
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x23c]
neg eax
cmp eax, 0x398963ec
jne 0x1002df43
cmp dword [ebp - 0xc0], 0
jne 0x1002df43
cmp dword [ebp - 0x150], 0
jne 0x1002df43
and dword [ebp - 0x1d4], 0
jmp 0x1002df4d
mov dword [ebp - 0x1d4], 1
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x150]
jne 0x1002df64
and dword [ebp - 0x43c], 0
jmp 0x1002df6e
mov dword [ebp - 0x43c], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x548], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x518], 0
jne 0x1002df92
mov dword [ebp - 0x274], 1
jmp 0x1002df99
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x20]
je 0x1002dfb4
mov dword [ebp - 0x1dc], 1
jmp 0x1002dfbb
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1dc], eax
je 0x1002dfd2
mov dword [ebp - 0x244], 1
jmp 0x1002dfd9
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
je 0x1002e003
cmp dword [ebp - 0xc0], 0
je 0x1002e003
mov dword [ebp - 0x1e4], 1
jmp 0x1002e00a
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1e4], eax
jg 0x1002e021
mov dword [ebp - 0x2a8], 1
jmp 0x1002e028
and dword [ebp - 0x2a8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2a8]
mov dword [ebp + eax - 0x500], ecx
mov eax, dword [0x10093c28]
and eax, 1
jne 0x1002e072
mov eax, dword [0x10093c28]
or eax, 1
mov dword [0x10093c28], eax
mov dword [ebp - 4], 2
mov ecx, 0x10098078
call fcn.10022e90
push 0x1008e215
call fcn.10077819
pop ecx
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x260]
lea ecx, [ebp - 0x480]
call fcn.1002295c
mov dword [ebp - 4], 3
lea eax, [ebp - 0x51c]
push eax
lea ecx, [ebp - 0x480]
call fcn.10023403
push dword [eax]
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x480]
call fcn.10023417
push dword [eax]
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x480]
call fcn.10023403
push dword [eax]
mov edx, 0x1002662b
lea ecx, [ebp - 0x554]
call fcn.1004b89e
add esp, 0xc
push 0x2fb7
push 0
push 0x3c3f
push 0x232d
push 0x2be9
push 1
push 0x662a
push 1
push 0x58a7
call fcn.1004aec6
add esp, 0x24
mov dword [ebp - 0x1ec], 0x449c
mov dword [ebp - 0x3c0], 0x10009e00
cmp dword [ebp - 0x1ec], 0x4638
jle 0x1002e1fe
and dword [ebp - 0x128], 0
jmp 0x1002e13f
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x3f25
jge 0x1002e1fe
and dword [ebp - 0xc8], 0
jmp 0x1002e165
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x3a21
jge 0x1002e1f9
and dword [ebp - 0x168], 0
jmp 0x1002e18b
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x2c78
jge 0x1002e1f4
mov eax, dword [ebp - 0x128]
and eax, dword [ebp - 0xc8]
xor eax, dword [ebp - 0x168]
cdq
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x340], edx
push dword [ebp - 0x340]
push dword [ebp - 0x344]
lea ecx, [ebp - 0x680]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x2ec]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x680]
call fcn.1002281d
jmp 0x1002e17e
jmp 0x1002e158
jmp 0x1002e132
lea ecx, [ebp - 0x480]
call fcn.100265b6
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x1ec], 0x40c8
jge 0x1002e227
push dword [ebp - 0x3c0]
call fcn.10077843
pop ecx
movzx eax, byte [0x10098011]
test eax, eax
je 0x1002e633
mov ecx, 0x10098078
call fcn.1004b57b
movzx eax, al
test eax, eax
jne 0x1002e633
push 0x7b6
push 0x37e
push 0x1add
push 0x7d35
push 0x5906
push 0x7bd9
push 0x4547
push 0x1c68
push 0x55ed
push 0x4ea9
push 1
push 0x1391
push 0
push 0
call fcn.100484e2
add esp, 0x38
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x1fc]
push eax
mov ecx, 0x10098078
call fcn.10022cea
mov dword [ebp - 0x27c], 0x452c
mov dword [ebp - 0x30c], 0x10009e50
cmp dword [ebp - 0x27c], 0x47b6
jle 0x1002e37d
and dword [ebp - 0xd0], 0
jmp 0x1002e2e2
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xe53
jge 0x1002e373
and dword [ebp - 0x130], 0
jmp 0x1002e308
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x49f9
jge 0x1002e36e
mov eax, dword [ebp - 0xd0]
cdq
idiv dword [ebp - 0x130]
mov eax, edx
cdq
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x34c], edx
push dword [ebp - 0x34c]
push dword [ebp - 0x350]
lea ecx, [ebp - 0x5f0]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x2f4], eax
mov ecx, dword [ebp - 0x2f4]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x5f0]
call fcn.1002281d
jmp 0x1002e2fb
jmp 0x1002e2d5
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 3
lea ecx, [ebp - 0x458]
call fcn.10022b61
mov byte [ebp - 4], 4
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x304], 0xf0f
mov dword [ebp - 0x40c], 0xfffffffb
mov dword [ebp - 0x24c], 0x6a59
mov dword [ebp - 0x2fc], 0x10009ea4
cmp dword [ebp - 0x24c], 0x6cfd
jle 0x1002e4d6
and dword [ebp - 0xec], 0
jmp 0x1002e3e3
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x246c
jge 0x1002e4d6
and dword [ebp - 0xe0], 0
jmp 0x1002e409
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x52ab
jge 0x1002e4d1
and dword [ebp - 0xd8], 0
jmp 0x1002e42f
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x4347
jge 0x1002e4cc
and dword [ebp - 0xe8], 0
jmp 0x1002e455
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x525b
jge 0x1002e4c7
mov ecx, dword [ebp - 0xd8]
imul ecx, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe0]
sar eax, cl
xor eax, dword [ebp - 0xec]
cdq
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x358], edx
push dword [ebp - 0x358]
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x650]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x424], eax
mov ecx, dword [ebp - 0x424]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x650]
call fcn.1002281d
jmp 0x1002e448
jmp 0x1002e422
jmp 0x1002e3fc
jmp 0x1002e3d6
push 0x3e24
push 0x3cd6
push 1
lea eax, [ebp - 0x53c]
push eax
push 1
lea eax, [ebp - 0x458]
push eax
call fcn.10027628
add esp, 0x18
cmp dword [ebp - 0x24c], 0x673c
jge 0x1002e512
push dword [ebp - 0x2fc]
call fcn.10077843
pop ecx
mov dword [ebp - 0x3c], 2
jmp 0x1002e522
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1002e5be
mov dword [ebp - 0x1f4], 0x5b3b9da4
mov dword [ebp - 0x3cc], 0xbd2ab60e
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x3cc]
push eax
push 0
push 0x2604
push 0x7cc7
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x1f4]
push eax
push 0x7789
call fcn.10030388
add esp, 0x24
push 0x47f9
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x3c]
push eax
push 1
lea eax, [ebp - 0x458]
push eax
push 0x3600
push 0x5895
push 1
lea eax, [ebp - 0x40c]
push eax
push 1
push 0x6f17
push 0x2178
call fcn.10029735
add esp, 0x30
jmp 0x1002e51b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x458]
call fcn.10022be3
cmp dword [ebp - 0x27c], 0x44d1
jge 0x1002e5e5
push dword [ebp - 0x30c]
call fcn.10077843
pop ecx
lea eax, [ebp - 0x564]
push eax
mov ecx, 0x10098078
call fcn.10022cdc
push eax
lea ecx, [ebp - 0x1fc]
call fcn.10022f47
movzx eax, al
test eax, eax
je 0x1002e633
lea ecx, [ebp - 0x1fc]
call fcn.1004b584
mov ecx, dword [ebp - 0x278]
mov eax, dword [eax + 4]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x480]
call fcn.100229f4
jmp 0x100301b8
and dword [ebp - 0x38], 0
mov dword [ebp - 0x1c], 0x1dfe
push 4
lea ecx, [ebp - 0x298]
call fcn.10022b61
mov byte [ebp - 4], 5
push 4
lea ecx, [ebp - 0x3f4]
call fcn.10022b61
mov byte [ebp - 4], 6
push 1
lea eax, [ebp - 0x3d8]
push eax
push 1
push 0x2691
lea eax, [ebp - 0x298]
push eax
push 1
push 0x73f9
call fcn.10029a06
add esp, 0x1c
lea eax, [ebp - 0x3f4]
push eax
push 0x76cb
lea eax, [ebp - 0x3d8]
push eax
push 0
call fcn.100301c7
add esp, 0x10
push 0x78ea
lea eax, [ebp - 0x3f4]
push eax
push 0x76b7
lea eax, [ebp - 0x1c]
push eax
push 1
lea eax, [ebp - 0x298]
push eax
push 0
call fcn.1002bac7
add esp, 0x1c
mov dword [ebp - 0x1c], 0
jmp 0x1002e6db
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1002e8be
mov dword [ebp - 0x4d4], 0xe5156be8
mov dword [ebp - 0x4d0], 0xe5156be8
mov dword [ebp - 0x4cc], 0xe5156be8
mov dword [ebp - 0x4c8], 0xe5156be8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3f4]
call fcn.10022bff
cmp dword [eax], 1
jle 0x1002e72c
mov dword [ebp - 0x214], 1
jmp 0x1002e733
and dword [ebp - 0x214], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x298]
call fcn.10022bff
mov eax, dword [eax]
sub eax, 0x83ad
cmp eax, 1
jl 0x1002e759
mov dword [ebp - 0x254], 1
jmp 0x1002e760
and dword [ebp - 0x254], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x298]
call fcn.10022bff
mov ecx, dword [ebp - 0x254]
cmp ecx, dword [eax]
jg 0x1002e784
mov dword [ebp - 0x204], 1
jmp 0x1002e78b
and dword [ebp - 0x204], 0
push 1
lea ecx, [ebp - 0x3f4]
call fcn.10022bff
mov ecx, dword [ebp - 0x204]
cmp ecx, dword [eax]
je 0x1002e7ae
mov dword [ebp - 0x29c], 1
jmp 0x1002e7b5
and dword [ebp - 0x29c], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x298]
call fcn.10022bff
mov esi, dword [ebp - 0x29c]
imul esi, dword [eax]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x298]
call fcn.10022bff
cmp esi, dword [eax]
jne 0x1002e7ea
mov dword [ebp - 0x20c], 1
jmp 0x1002e7f1
and dword [ebp - 0x20c], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x298]
call fcn.10022bff
mov ecx, dword [ebp - 0x20c]
cmp ecx, dword [eax]
jl 0x1002e815
mov dword [ebp - 0x25c], 1
jmp 0x1002e81c
and dword [ebp - 0x25c], 0
imul eax, dword [ebp - 0x25c], 0xa1ba
test eax, eax
je 0x1002e83b
or eax, 0xffffffff
je 0x1002e83b
mov dword [ebp - 0x284], 1
jmp 0x1002e842
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x284]
jl 0x1002e85c
mov dword [ebp - 0x21c], 1
jmp 0x1002e863
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 0x840cc74b
jb 0x1002e87b
mov dword [ebp - 0x194], 1
jmp 0x1002e882
and dword [ebp - 0x194], 0
imul eax, dword [ebp - 0x194], 0xfffe
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4d4], eax
push 0x5198
push 1
push 0x22e9
push 0x5268
push 1
push 0x758e
call fcn.1002c104
add esp, 0x18
jmp 0x1002e6d4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3f4]
call fcn.10022be3
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x298]
call fcn.10022be3
lea eax, [ebp - 0x480]
push eax
call fcn.10026d72
pop ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x1002fec6
mov dword [ebp - 0x318], 0x571177e8
mov dword [ebp - 0x544], 2
mov dword [ebp - 0x55c], 0xfffffff8
mov dword [ebp - 0x50c], 0x7c694a6
mov dword [ebp - 0x540], 3
mov dword [ebp - 0x324], 0xfffffffb
push 1
lea ecx, [ebp - 0x528]
call fcn.10022b61
mov byte [ebp - 4], 7
mov dword [ebp - 0x410], 0xd6c3
push 0x6435
push 0x357d
push 0x2fc9
push 0x25de
push 1
push 0xd10
lea eax, [ebp - 0x4f4]
push eax
push 0
push 0
lea eax, [ebp - 0x528]
push eax
call fcn.1002b964
add esp, 0x28
lea eax, [ebp - 0x318]
push eax
push 1
push 0x16b0
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x324]
push eax
push 0x6b5a
push 1
call fcn.1002c700
add esp, 0x1c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x528]
call fcn.10022be3
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x44], 0x3b2b74c3
mov dword [ebp - 0x40], 0xc1a1fd29
mov dword [ebp - 0x494], 0xde04
mov dword [ebp - 0x490], 0xde04
mov dword [ebp - 0x48c], 0xde04
mov dword [ebp - 0x488], 0xde04
lea ecx, [ebp - 0x17d]
call fcn.10022c0e
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x494]
push eax
lea ecx, [ebp - 0x578]
call fcn.10022c11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x538]
call fcn.10022bbd
mov byte [ebp - 4], 8
mov dword [ebp - 0x4f8], 0xd67f3e8e
cmp dword [ebp - 0x2c], 0xffffffff
je 0x1002ea4e
mov dword [ebp - 0x198], 1
jmp 0x1002ea55
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x2c]
sub eax, 0x751c
imul eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jl 0x1002ea8d
mov dword [ebp - 0x3e0], 1
jmp 0x1002ea94
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x44], 0
je 0x1002eb23
mov dword [ebp - 0x418], 8
mov dword [ebp - 0x3e8], 0x39956a21
mov dword [ebp - 0x33c], 0x5fe57b6a
mov dword [ebp - 0x330], 0xfffffff8
lea eax, [ebp - 0x330]
push eax
push 0x7e6d
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x33c]
push eax
push 0x7634
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x2786
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x40]
push eax
push 1
push 0x68d5
push 1
push 0
call fcn.100484e2
add esp, 0x38
jmp 0x1002ecc0
mov dword [ebp - 0x354], 0xd407
mov dword [ebp - 0x3f8], 8
mov dword [ebp - 0x40], 0
jmp 0x1002eb47
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jge 0x1002ecc0
mov dword [ebp - 0x2c8], 0xfffffffe
mov dword [ebp - 0x1a0], 0xb99
mov dword [ebp - 0x420], 0x10009ec0
cmp dword [ebp - 0x1a0], 0xebf
jle 0x1002ec58
and dword [ebp - 0xf0], 0
jmp 0x1002eb95
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x2002
jge 0x1002ec58
and dword [ebp - 0x8c], 0
jmp 0x1002ebbb
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x3d2f
jge 0x1002ec53
and dword [ebp - 0xf4], 0
jmp 0x1002ebe1
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x209b
jge 0x1002ec4e
and dword [ebp - 0x138], 0
jmp 0x1002ec03
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x5af
jge 0x1002ec4c
mov eax, dword [ebp - 0x8c]
and eax, dword [ebp - 0xf4]
xor eax, dword [ebp - 0xf0]
or eax, dword [ebp - 0x138]
cdq
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x364], edx
push dword [ebp - 0x364]
push dword [ebp - 0x368]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1002ebf6
jmp 0x1002ebd4
jmp 0x1002ebae
jmp 0x1002eb88
cmp dword [ebp - 0x2c8], 0
je 0x1002ec63
jmp 0x1002ecc0
cmp dword [ebp - 0x1a0], 0x906
jge 0x1002ec7f
mov edx, dword [ebp - 0x420]
mov ecx, 0x10092b78
call fcn.10025597
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x538]
push eax
push 1
push 0x5d79
lea eax, [ebp - 0x2c]
push eax
push 0x4a91
push 0
lea eax, [ebp - 0x40]
push eax
push 0x5e9f
call fcn.1002b233
add esp, 0x2c
jmp 0x1002eb40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x538]
call fcn.10022be3
cmp dword [0x10098004], 0
jne 0x1002fea8
push 1
lea ecx, [ebp - 0x4c4]
call fcn.10022b61
mov byte [ebp - 4], 9
mov dword [ebp - 0x550], 0x19c5
push 0x3458
push 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x4c4]
push eax
push 0
call fcn.10047212
add esp, 0x14
mov dword [ebp - 0x4c], 0
jmp 0x1002ed23
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x1002ed39
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x468], 0xfffffffe
jmp 0x1002ed1c
mov byte [ebp - 0x2d], 0
push 0x1abe
push 1
push 0x6b16
push 0
push 0x2761
push 1
push 0x3edf
push 0x6684
push 0x61ef
lea eax, [ebp - 0x2d]
push eax
push 0x4c87
call fcn.10046ece
add esp, 0x2c
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x468], 0
jmp 0x1002ed9d
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x468]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x468], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x468], 1
jge 0x1002edcb
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x468]
lea ecx, [ebp - 0x4c4]
call fcn.10022bff
mov dword [eax], 0x3df6
jmp 0x1002ed84
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4c4]
call fcn.10022be3
mov dword [ebp - 0x1a8], 0xb9a
mov dword [ebp - 0x428], 0x10009f14
cmp dword [ebp - 0x1a8], 0xce8
jle 0x1002eed3
and dword [ebp - 0xf8], 0
jmp 0x1002ee14
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x64f0
jge 0x1002eed3
and dword [ebp - 0x178], 0
jmp 0x1002ee3a
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x7be7
jge 0x1002eece
and dword [ebp - 0x100], 0
jmp 0x1002ee60
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x6dbc
jge 0x1002eec9
mov eax, dword [ebp - 0xf8]
sub eax, dword [ebp - 0x178]
xor eax, dword [ebp - 0x100]
cdq
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x370], edx
push dword [ebp - 0x370]
push dword [ebp - 0x374]
lea ecx, [ebp - 0x5a8]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp - 0x360]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x5a8]
call fcn.1002281d
jmp 0x1002ee53
jmp 0x1002ee2d
jmp 0x1002ee07
cmp dword [ebp - 0x1a8], 0x9ea
jge 0x1002eeeb
push dword [ebp - 0x428]
call fcn.10077843
pop ecx
mov dword [ebp - 0x1b0], 0x14f4
mov dword [ebp - 0x430], 0x10009f48
cmp dword [ebp - 0x1b0], 0x15fb
jle 0x1002efcf
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
and dword [ebp - 0x140], 0
jmp 0x1002ef31
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x133a
jge 0x1002efc5
and dword [ebp - 0x108], 0
jmp 0x1002ef57
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x1c96
jge 0x1002efc0
and dword [ebp - 0x160], 0
jmp 0x1002ef79
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xf49
jge 0x1002efbe
mov eax, dword [ebp - 0x140]
sub eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x160]
shl eax, cl
cdq
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], edx
push dword [ebp - 0x37c]
push dword [ebp - 0x380]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1002ef6c
jmp 0x1002ef4a
jmp 0x1002ef24
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 2
lea ecx, [ebp - 0x4a0]
call fcn.10022b61
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x94], 0xffffffff
mov dword [ebp - 0x378], 0x2573
mov dword [ebp - 0x90], 0
jmp 0x1002f00d
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1002f02f
push dword [ebp - 0x90]
lea ecx, [ebp - 0x4a0]
call fcn.10022bff
mov dword [eax], 0xa8c6
jmp 0x1002f000
push 0
push 0x1c88
push 0x1bfb
push 0x7712
call fcn.10049642
add esp, 0x10
mov dword [ebp - 0x94], 0
jmp 0x1002f061
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jg 0x1002f0c3
mov dword [ebp - 0x36c], 0xa137b189
mov dword [ebp - 0x408], 4
push 0x267c
push 0x4abc
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x408]
push eax
push 1
lea eax, [ebp - 0x378]
push eax
push 0x3492
push 1
push 0x2169
push 1
push 0xeab
call fcn.1002a9b7
add esp, 0x30
jmp 0x1002f054
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4a0]
call fcn.10022be3
cmp dword [ebp - 0x1b0], 0x12be
jge 0x1002f0ee
mov edx, dword [ebp - 0x430]
mov ecx, 0x10092b78
call fcn.10025597
mov byte [ebp - 0x88], 1
mov byte [ebp - 0x87], 0x28
mov byte [ebp - 0x86], 0xb
mov byte [ebp - 0x85], 9
mov byte [ebp - 0x84], 2
mov byte [ebp - 0x83], 0xb6
mov byte [ebp - 0x82], 0xc
mov byte [ebp - 0x81], 0
mov byte [ebp - 0x80], 0x27
mov byte [ebp - 0x7f], 9
mov byte [ebp - 0x7e], 0x2f
mov byte [ebp - 0x7d], 4
mov byte [ebp - 0x7c], 1
mov byte [ebp - 0x7b], 8
mov byte [ebp - 0x7a], 0x4b
mov byte [ebp - 0x79], 3
mov byte [ebp - 0x78], 0x40
mov byte [ebp - 0x77], 6
mov byte [ebp - 0x76], 0x5d
mov byte [ebp - 0x75], 2
mov byte [ebp - 0x74], 0x41
mov byte [ebp - 0x73], 5
mov byte [ebp - 0x72], 0x1e
mov byte [ebp - 0x71], 7
mov byte [ebp - 0x70], 0x5e
mov byte [ebp - 0x6f], 0xa
mov byte [ebp - 0x6e], 0x5e
push 0x2ccc
push 1
push 0x402d
push 0x54c0
push 0
call fcn.10047212
add esp, 0x14
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x88]
or eax, 0x4d
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x88]
and ecx, 0x4d
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x88]
mov word [ebp + ecx*2 - 0x4f0], ax
mov dword [ebp - 0x14], 2
and dword [ebp - 0xbc], 0
jmp 0x1002f1df
mov eax, dword [ebp - 0x14]
inc eax
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1b
jae 0x1002f3db
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x88]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x14], eax
jne 0x1002f229
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x88]
inc eax
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x88]
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x14], eax
jmp 0x1002f1d7
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x87]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0xbc]
movzx ecx, byte [ebp + ecx - 0x8a]
movzx ecx, word [ebp + ecx*2 - 0x4f0]
or eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x87]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0xbc]
movzx edx, byte [ebp + edx - 0x8a]
movzx edx, word [ebp + edx*2 - 0x4f0]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x88]
mov word [ebp + ecx*2 - 0x4f0], ax
mov dword [ebp - 0x1b8], 0x1494
mov dword [ebp - 0x384], 0x10009fa0
cmp dword [ebp - 0x1b8], 0x156c
jle 0x1002f398
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlUnwind]
and dword [ebp - 0x9c], 0
jmp 0x1002f2d2
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x211b
jge 0x1002f398
and dword [ebp - 0xa4], 0
jmp 0x1002f2f8
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x5626
jge 0x1002f393
and dword [ebp - 0xac], 0
jmp 0x1002f31e
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x3d49
jge 0x1002f38e
and dword [ebp - 0xb4], 0
jmp 0x1002f340
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x43c5
jge 0x1002f38c
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xac]
imul ecx, dword [ebp - 0xb4]
sub eax, ecx
cdq
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x388], edx
push dword [ebp - 0x388]
push dword [ebp - 0x38c]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1002f333
jmp 0x1002f311
jmp 0x1002f2eb
jmp 0x1002f2c5
push 0
push 1
push 0x67c
push 0x7bf6
lea eax, [ebp - 0xbc]
push eax
push 0x76d5
call fcn.1002d0d7
add esp, 0x18
cmp dword [ebp - 0x1b8], 0x122e
jge 0x1002f3d6
mov edx, dword [ebp - 0x384]
mov ecx, 0x10092b78
call fcn.10025597
jmp 0x1002f1d7
mov dword [ebp - 0x230], 0x5e11
mov dword [ebp - 0x390], 0x10009ff4
cmp dword [ebp - 0x230], 0x6120
jle 0x1002f515
and dword [ebp - 0xd4], 0
jmp 0x1002f415
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x4f0e
jge 0x1002f507
and dword [ebp - 0xc4], 0
jmp 0x1002f43b
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x5be6
jge 0x1002f502
and dword [ebp - 0xcc], 0
jmp 0x1002f461
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x3b2a
jge 0x1002f4fd
and dword [ebp - 0xdc], 0
jmp 0x1002f487
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x632a
jge 0x1002f4f8
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xcc]
sar eax, cl
xor eax, dword [ebp - 0xd4]
xor eax, dword [ebp - 0xdc]
cdq
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x394], edx
push dword [ebp - 0x394]
push dword [ebp - 0x398]
lea ecx, [ebp - 0x5c0]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0x438]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x5c0]
call fcn.1002281d
jmp 0x1002f47a
jmp 0x1002f454
jmp 0x1002f42e
jmp 0x1002f408
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [ebp - 0x24], 0x654fddd3
mov dword [ebp - 0x18c], 0xfffffffc
mov dword [ebp - 0x1e0], 0xfffffff6
mov dword [ebp - 0x208], 0
push 2
lea ecx, [ebp - 0x4b8]
call fcn.10022b61
mov byte [ebp - 4], 0xb
push 1
lea ecx, [ebp - 0x4ac]
call fcn.10022b61
mov byte [ebp - 4], 0xc
push 1
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x34]
push eax
push 1
call fcn.10027f41
add esp, 0x10
mov dword [ebp - 0x34], 0
jmp 0x1002f583
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1002f599
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x508], 8
jmp 0x1002f57c
push 0x380
push 0x1783
push 0x41c9
lea eax, [ebp - 0x4ac]
push eax
push 0x6cab
lea eax, [ebp - 0x34]
push eax
push 1
push 0x6a41
push 1
push 0x1bf1
push 0x2a18
call fcn.100281e2
add esp, 0x2c
push 0xc71
push 0x4b13
push 1
push 0x52b6
push 0x1105
push 0x62ca
push 1
call fcn.1002cce6
add esp, 0x1c
cmp dword [ebp - 0x24], 0
jne 0x1002f674
cmp dword [ebp - 0x24], 0xfffffff9
jg 0x1002f610
mov dword [ebp - 0x1c0], 1
jmp 0x1002f617
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c0]
add eax, dword [ebp - 0x24]
je 0x1002f638
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1002f638
mov dword [ebp - 0x1c8], 1
jmp 0x1002f63f
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c8]
jg 0x1002f656
mov dword [ebp - 0x1d0], 1
jmp 0x1002f65d
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x1d0], eax
jg 0x1002f674
and dword [ebp - 0x1d8], 0
jmp 0x1002f67e
mov dword [ebp - 0x1d8], 1
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
imul eax, dword [ebp - 0x18c]
cmp eax, dword [ebp - 0x24]
jg 0x1002f6a8
mov dword [ebp - 0x1e8], 1
jmp 0x1002f6af
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
neg eax
je 0x1002f6cb
cmp dword [ebp - 0x24], 0
je 0x1002f6cb
mov dword [ebp - 0x1f0], 1
jmp 0x1002f6d2
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1f0], eax
je 0x1002f6e9
mov dword [ebp - 0x1f8], 1
jmp 0x1002f6f0
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x18c]
cmp eax, dword [ebp - 0x1f8]
jne 0x1002f70a
mov dword [ebp - 0x200], 1
jmp 0x1002f711
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x279e56e
je 0x1002f735
mov dword [ebp - 0x210], 1
jmp 0x1002f73c
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0xb26d5d64
jne 0x1002f754
mov dword [ebp - 0x188], 1
jmp 0x1002f75b
and dword [ebp - 0x188], 0
push 1
lea ecx, [ebp - 0x4b8]
call fcn.10022bff
mov ecx, dword [ebp - 0x188]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x188]
jge 0x1002f787
mov dword [ebp - 0x218], 1
jmp 0x1002f78e
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x218]
sub eax, 0x1c0a9c5a
mov dword [ebp - 0x220], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x220]
mov dword [ebp + eax - 0x508], ecx
cmp dword [ebp - 0x220], 0
je 0x1002f7d0
mov eax, 0x8129
test eax, eax
je 0x1002f7d0
mov dword [ebp - 0x190], 1
jmp 0x1002f7d7
and dword [ebp - 0x190], 0
push 0
lea ecx, [ebp - 0x4ac]
call fcn.10022bff
mov ecx, dword [ebp - 0x190]
mov dword [eax], ecx
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4ac]
call fcn.10022be3
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4b8]
call fcn.10022be3
cmp dword [ebp - 0x230], 0x5a9d
jge 0x1002f822
push dword [ebp - 0x390]
call fcn.10077843
pop ecx
mov dword [ebp - 0x238], 0x7cf9
mov dword [ebp - 0x414], 0x1000a010
cmp dword [ebp - 0x238], 0x7e95
jle 0x1002f8c9
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
and dword [ebp - 0xe4], 0
jmp 0x1002f868
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x99a
jge 0x1002f8c9
and dword [ebp - 0xfc], 0
jmp 0x1002f88a
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xdfa
jge 0x1002f8c7
mov eax, dword [ebp - 0xe4]
or eax, dword [ebp - 0xfc]
cdq
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x3a0], edx
push dword [ebp - 0x3a0]
push dword [ebp - 0x3a4]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1002f87d
jmp 0x1002f85b
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x4f0], cx
cmp dword [ebp - 0x238], 0x7cbd
jge 0x1002f8f5
mov edx, dword [ebp - 0x414]
mov ecx, 0x10092b78
call fcn.10025597
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0x5d8]
call fcn.1004b4ca
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x42c], eax
mov byte [ebp - 4], 0xd
push dword [ebp - 0x42c]
call fcn.10026d72
pop ecx
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5d8]
call fcn.100229f4
mov dword [ebp - 0x240], 0x2da1
mov dword [ebp - 0x2d0], 0x1000a058
cmp dword [ebp - 0x240], 0x2e1e
jle 0x1002fa08
and dword [ebp - 0x104], 0
jmp 0x1002f978
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x363d
jge 0x1002fa08
and dword [ebp - 0x10c], 0
jmp 0x1002f99e
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x22b
jge 0x1002fa03
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x10c]
shl eax, cl
cdq
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], edx
push dword [ebp - 0x3ac]
push dword [ebp - 0x3b0]
lea ecx, [ebp - 0x608]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x2cc], eax
mov ecx, dword [ebp - 0x2cc]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x608]
call fcn.1002281d
jmp 0x1002f991
jmp 0x1002f96b
cmp dword [ebp - 0x240], 0x2a9a
jge 0x1002fa20
push dword [ebp - 0x2d0]
call fcn.10077843
pop ecx
mov dword [ebp - 0x2d8], 0xa32b1cec
mov dword [ebp - 0x114], 0
jmp 0x1002fa43
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 4
jge 0x1002fa5f
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x6a8], 0x9841
jmp 0x1002fa36
push 1
push 1
push 0x652d
lea eax, [ebp - 0x2d8]
push eax
push 0x21b8
push 0x202b
call fcn.1002d0d7
add esp, 0x18
and dword [ebp - 0x11c], 0
jmp 0x1002fa97
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xd
jae 0x1002fab2
xor eax, eax
mov ecx, dword [ebp - 0x11c]
mov word [ebp + ecx*2 - 0x4f0], ax
jmp 0x1002fa8a
mov dword [ebp - 0x258], 0x205c
mov dword [ebp - 0x2e8], 0x1000a0b8
cmp dword [ebp - 0x258], 0x22a6
jle 0x1002fb4c
and dword [ebp - 0x124], 0
jmp 0x1002fae8
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xda1
jge 0x1002fb4c
and dword [ebp - 0x12c], 0
jmp 0x1002fb0a
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x16e9
jge 0x1002fb4a
mov eax, dword [ebp - 0x124]
cdq
idiv dword [ebp - 0x12c]
mov eax, edx
cdq
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3b8], edx
push dword [ebp - 0x3b8]
push dword [ebp - 0x3bc]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1002fafd
jmp 0x1002fadb
cmp dword [ebp - 0x250], 0
je 0x1002fe8c
mov byte [ebp - 0x6c], 4
mov byte [ebp - 0x6b], 0x7b
mov byte [ebp - 0x6a], 3
mov byte [ebp - 0x69], 0x28
mov byte [ebp - 0x68], 0xa
mov byte [ebp - 0x67], 0x1d
mov byte [ebp - 0x66], 0xb
mov byte [ebp - 0x65], 0x2e
mov byte [ebp - 0x64], 2
mov byte [ebp - 0x63], 0x36
mov byte [ebp - 0x62], 4
mov byte [ebp - 0x61], 0xcd
mov byte [ebp - 0x60], 0xd7
mov byte [ebp - 0x5f], 0xdc
mov byte [ebp - 0x5e], 0x78
mov byte [ebp - 0x5d], 9
mov byte [ebp - 0x5c], 0x13
mov byte [ebp - 0x5b], 6
mov byte [ebp - 0x5a], 0x10
mov byte [ebp - 0x59], 7
mov byte [ebp - 0x58], 0x10
mov byte [ebp - 0x57], 8
mov byte [ebp - 0x56], 0x13
mov byte [ebp - 0x55], 5
mov byte [ebp - 0x54], 8
mov byte [ebp - 0x53], 0
mov byte [ebp - 0x52], 0x25
mov byte [ebp - 0x51], 1
mov byte [ebp - 0x50], 0x23
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x6c]
or eax, 0x37
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x6c]
and ecx, 0x37
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x6c]
mov byte [ebp + ecx - 0x2c4], al
mov dword [ebp - 0x10], 2
and dword [ebp - 0x48], 0
jmp 0x1002fc12
mov eax, dword [ebp - 0x10]
inc eax
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1d
jae 0x1002fce3
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x6c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x10], eax
jne 0x1002fc50
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x6c]
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x6c]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x10], eax
jmp 0x1002fc0a
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x6b]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x48]
movzx ecx, byte [ebp + ecx - 0x6e]
movsx ecx, byte [ebp + ecx - 0x2c4]
add eax, ecx
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x6b]
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x48]
movzx edx, byte [ebp + edx - 0x6e]
movsx edx, byte [ebp + edx - 0x2c4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x6b]
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x48]
movzx edx, byte [ebp + edx - 0x6e]
movsx edx, byte [ebp + edx - 0x2c4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x6c]
mov byte [ebp + ecx - 0x2c4], al
push 0x5090
lea eax, [ebp - 0x48]
push eax
push 0x6bc
push 1
push 0xdc6
push 1
push 0x4d87
call fcn.1002864d
add esp, 0x1c
jmp 0x1002fc0a
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x2c4], 0
mov dword [ebp - 0x248], 0x4c43
mov dword [ebp - 0x2e0], 0x1000a118
cmp dword [ebp - 0x248], 0x4d04
jle 0x1002fdfe
and dword [ebp - 0x14c], 0
jmp 0x1002fd2b
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x2e5c
jge 0x1002fdf0
and dword [ebp - 0x134], 0
jmp 0x1002fd51
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x5f40
jge 0x1002fdeb
and dword [ebp - 0x13c], 0
jmp 0x1002fd77
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x2159
jge 0x1002fde6
and dword [ebp - 0x144], 0
jmp 0x1002fd99
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0x23b0
jge 0x1002fde4
mov ecx, dword [ebp - 0x134]
sub ecx, dword [ebp - 0x13c]
sub ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x14c]
sar eax, cl
cdq
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3c4], edx
push dword [ebp - 0x3c4]
push dword [ebp - 0x3c8]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1002fd8c
jmp 0x1002fd6a
jmp 0x1002fd44
jmp 0x1002fd1e
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x590]
call fcn.1004b4ef
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x248], 0x4a13
jge 0x1002fe30
mov edx, dword [ebp - 0x2e0]
mov ecx, 0x10092b78
call fcn.10025597
and dword [ebp - 0x154], 0
jmp 0x1002fe46
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xd
jae 0x1002fe5f
mov eax, dword [ebp - 0x154]
mov byte [ebp + eax - 0x2c4], 0
jmp 0x1002fe39
push 0
push 0
lea eax, [ebp - 0x590]
push eax
push dword [ebp - 0x250]
call fcn.1003627d
add esp, 0x10
mov dword [0x10098004], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x590]
call fcn.10022ace
cmp dword [ebp - 0x258], 0x1d67
jge 0x1002fea8
mov edx, dword [ebp - 0x2e8]
mov ecx, 0x10092b78
call fcn.10025597
cmp dword [0x10098004], 0
je 0x1002fec6
mov ecx, dword [ebp - 0x260]
call fcn.10022a53
push eax
call dword [0x10098004]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x1002ff2e
movzx eax, byte [0x10098011]
test eax, eax
je 0x1002fee8
mov ecx, 0x10098078
call fcn.1004b57b
movzx eax, al
test eax, eax
jne 0x1002ff2e
lea eax, [ebp - 0x268]
push eax
push 0x4b21
push 0x10098078
push 1
lea eax, [ebp - 0x38]
push eax
push 0x2086
push 1
push 0x27a4
call fcn.10028af5
add esp, 0x20
push 0x4781
push 0
push 0x10098011
push 0x1ea
push 1
call fcn.1004975c
add esp, 0x14
push 2
lea ecx, [ebp - 0x404]
call fcn.10022b61
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x404]
push eax
push 0x1920
push 0xbff
lea eax, [ebp - 0x558]
push eax
push 1
push 0x5f68
push 0x789
push 1
push 0
push 0x6012
call fcn.1002b964
add esp, 0x28
push 1
push 1
call fcn.1002d571
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x404]
call fcn.10022bff
mov dword [eax], 0xfffffff2
jmp 0x1002ffb8
push 0
lea ecx, [ebp - 0x404]
call fcn.10022bff
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x270]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x270]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x404]
call fcn.10022bff
cmp dword [eax], 1
jne 0x10030009
mov dword [ebp - 0x2f0], 0
push 0xd79
push 0x25e7
push 0x1b3e
push 0x1ef
push 1
lea eax, [ebp - 0x2f0]
push eax
push 0x572a
push 1
push 1
push 0x37c8
call fcn.1002b964
add esp, 0x28
jmp 0x1002ff94
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x404]
call fcn.10022be3
mov dword [ebp - 0x280], 0x76e3
mov dword [ebp - 0x300], 0x1000a170
cmp dword [ebp - 0x280], 0x7a98
jle 0x10030150
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowRgn]
and dword [ebp - 0x15c], 0
jmp 0x1003005e
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x33c
jge 0x10030150
and dword [ebp - 0x164], 0
jmp 0x10030084
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x14e1
jge 0x1003014b
and dword [ebp - 0x16c], 0
jmp 0x100300aa
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x1d26
jge 0x10030146
and dword [ebp - 0x174], 0
jmp 0x100300d0
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x6de4
jge 0x10030141
mov eax, dword [ebp - 0x15c]
add eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x16c]
add ecx, dword [ebp - 0x174]
sar eax, cl
cdq
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x3d0], edx
push dword [ebp - 0x3d0]
push dword [ebp - 0x3d4]
lea ecx, [ebp - 0x638]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x2f8], eax
mov ecx, dword [ebp - 0x2f8]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x638]
call fcn.1002281d
jmp 0x100300c3
jmp 0x1003009d
jmp 0x10030077
jmp 0x10030051
mov eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
cmp dword [ebp - 0x280], 0x7344
jge 0x10030173
push dword [ebp - 0x300]
call fcn.10077843
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x480]
call fcn.100229f4
jmp 0x100301b8
mov byte [ebp - 0x2e], 0
push 0x36c6
push 0x2807
push 0
lea eax, [ebp - 0x2e]
push eax
push 0
push 0x7287
call fcn.10027929
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret