Function at 0x1002b22a
Capabilities:
Create process on windows
Get geographical location
Get memory capacity
Parse pe header
Query environment variable
Terminate process

Disassembly:
mov eax, 0x1007c5a1
call fcn.1007afa0
mov eax, 0x14b4
call fcn.10077860
push ebx
push esi
push edi
push 2
xor eax, eax
mov byte [ebp - 0x61], dl
pop esi
mov dword [ebp - 0x18], eax
push 8
mov dword [ebp - 0x60], ecx
pop ebx
cmp dword [ebp - 0x18], esi
jge 0x1002b26b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2ac], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002b257
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b28a
push 0x1f7e
push eax
push eax
push eax
push 0xdaa
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
push 0x14
mov dword [ebp - 0x2ac], 0xfffffffd
pop edi
jmp 0x1002b2bc
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b2b6
push eax
push 0xa1e
push 0x1209
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
inc dword [ebp - 0x2ac]
cmp dword [ebp - 0x2ac], edi
jne 0x1002b299
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002b2e0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x250], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002b2cc
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b2ff
push 0x1f7e
push eax
push eax
push eax
push 0xdaa
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov dword [ebp - 0x250], 0xfffffffd
jmp 0x1002b32e
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b328
push eax
push 0xa1e
push 0x1209
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
inc dword [ebp - 0x250]
cmp dword [ebp - 0x250], edi
jne 0x1002b30b
push 3
pop ecx
mov dword [ebp - 0x3c], 0xac204e2
mov dword [ebp - 0x18], eax
push 0xffffffffffffffff
pop ebx
cmp dword [ebp - 0x18], ecx
jge 0x1002b35f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1394], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002b34b
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x3c], eax
jmp 0x1002b381
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b37e
call edi
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor eax, eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff9
jne 0x1002b36a
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x3c], eax
jl 0x1002b3ac
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b3a7
push 0x184a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x1002b38f
mov dword [ebp - 0x28], 0x5c96dd1e
mov dword [ebp - 0x18], 0xf2f4a8b1
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002b3e6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x658], 0xe149cff2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002b3ce
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002b3fc
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1304], 0x17b38e51
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002b3eb
mov eax, dword [ebp - 0x28]
mov ecx, 0xa729
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
sub ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x4c]
jne 0x1002b41c
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
sub edx, 0x5900
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x4c], eax
je 0x1002b460
mov edx, ebx
cmp dword [ebp - 0x18], eax
jne 0x1002b462
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x1002b47b
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002b47d
mov eax, ebx
movdqa xmm0, xmmword [0x10008040]
lea ecx, [ebp - 0x125c]
mov dword [ebp - 0x658], eax
lea eax, [ebp - 0x10cc]
push eax
lea eax, [ebp - 0x10dc]
push eax
movdqu xmmword [ebp - 0x10dc], xmm0
call fcn.10015934
lea ecx, [ebp - 0x15f]
mov esi, eax
call fcn.100091b3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x318]
push dword [esi]
call fcn.100158fa
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0x184c506d
push 3
mov dword [ebp - 0x34], eax
pop ecx
cmp dword [ebp - 0x34], ecx
jg 0x1002b5f9
or edx, 0xffffffff
mov dword [ebp - 0x2c], 0x6b950ba1
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x1002b5ed
mov dword [ebp - 0x18], eax
jmp 0x1002b514
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xda0], 0x63a74adf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002b503
push ebx
lea ecx, [ebp - 0x318]
call fcn.10015925
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x795ed7c6
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
je 0x1002b551
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x318]
call fcn.10015925
cmp dword [eax], 0
jne 0x1002b551
xor eax, eax
mov esi, eax
jmp 0x1002b553
mov esi, ebx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x318]
call fcn.10015925
mov ecx, dword [ebp - 0x2c]
xor ebx, ebx
sub esi, ecx
lea ecx, [ebp - 0x318]
imul esi, dword [ebp - 0x2c]
push dword [ebp - 0x34]
cmp esi, dword [eax]
setg bl
call fcn.10015925
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0xd9c], ecx
push dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x318]
call fcn.10015925
xor ecx, ecx
cmp dword [ebp - 0x24], 0xf219a6f
sete cl
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x318]
setle bl
xor eax, eax
push eax
call fcn.10015925
push dword [ebp - 0x34]
lea ecx, [ebp - 0x318]
sub ebx, dword [eax]
call fcn.10015925
xor ecx, ecx
push 0
cmp dword [eax], ebx
pop eax
setne cl
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x2c]
push 1
pop ebx
jns 0x1002b4fe
push 3
pop ecx
or edx, 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x1002b4e8
or eax, 0xffffffff
lea ecx, [ebp - 0x318]
mov dword [ebp - 4], eax
call fcn.10015920
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x1002b62e
push 8
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x370], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002b61a
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b64d
push 0x1f7e
push eax
push eax
push eax
push 0xdaa
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov dword [ebp - 0x370], 0xfffffffd
jmp 0x1002b67c
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b676
push eax
push 0xa1e
push 0x1209
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
inc dword [ebp - 0x370]
cmp dword [ebp - 0x370], 0x14
jne 0x1002b659
mov dword [ebp - 0x38], 5
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x8f8]
mov dword [ebp - 0x38], 0xbd97a888
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x7f2fb5a5
mov dword [ebp - 0x38], 0xd035c573
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfffffffd
push esi
call fcn.100158b8
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002b6ec
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd5c], 0xfffffff9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002b6d4
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002b712
push 8
pop ebx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x8f8]
call fcn.10015925
mov dword [eax], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002b6f7
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x8f8]
call fcn.10015925
lea ecx, [ebp - 0x8f8]
dec dword [eax]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10015920
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x14], 0xfffffff0
jmp 0x1002b819
push esi
lea ecx, [ebp - 0x4e4]
call fcn.100158b8
or eax, 0xffffffff
mov dword [ebp - 4], esi
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002b786
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4e4]
call fcn.10015925
mov dword [eax], 0xe1d9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002b768
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002b7fa
mov dword [ebp - 0x2c], 0x887cf2e5
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x1002b7f7
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x4e4]
push dword [ebp - 0x2c]
call fcn.10015925
cmp dword [ebp - 0x14], ebx
jne 0x1002b7b3
mov eax, dword [ebp - 0x3c]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4e4]
call fcn.10015925
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x4e4]
push dword [ebp - 0x2c]
call fcn.10015925
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x4e4]
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x2c]
call fcn.10015925
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x2c]
jns 0x1002b79a
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jle 0x1002b78b
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x3c], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10015920
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jg 0x1002b749
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x28], eax
jmp 0x1002b8a9
push ebx
lea ecx, [ebp - 0xd10]
call fcn.100158b8
push 3
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002b865
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd10]
call fcn.10015925
mov dword [eax], 0xf9e6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002b847
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002b895
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b890
push 0x1674
push 0x65
push 0x45b
push 0x1dd7
push eax
call dword [sym.imp.USER32.dll_SetRect]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002b86d
or eax, 0xffffffff
lea ecx, [ebp - 0xd10]
mov dword [ebp - 4], eax
call fcn.10015920
inc dword [ebp - 0x28]
push 5
pop eax
cmp dword [ebp - 0x28], eax
jl 0x1002b82b
mov dword [ebp - 0x2c], 0xfffffffe
mov eax, 0x53e58bfc
mov dword [ebp - 0xca0], eax
mov dword [ebp - 0xc9c], eax
mov dword [ebp - 0xc98], eax
mov dword [ebp - 0xc94], eax
mov dword [ebp - 0x38], 0x37c1d6b3
mov dword [ebp - 0x1c], 0x29c8ddac
mov dword [ebp - 0x2c], 0xffffffee
jmp 0x1002b921
mov dword [ebp - 0x30], 0xc4ab
xor edx, edx
mov dword [ebp - 0x24], 0xdcad2086
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0xc9c], ecx
inc dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], 0xfffffff4
je 0x1002b8f0
push 3
pop ecx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x1002b956
or edx, 0xffffffff
mov dword [ebp - 0x38], 0xf9d44c03
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x38], 0xa4ccfd6
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], edx
inc dword [ebp - 0x1c]
dec dword [ebp - 0x2c]
jns 0x1002b937
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0xef20fe6e
mov dword [ebp - 0x18], eax
jmp 0x1002b976
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x580], 0xbeccce1e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002b965
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x580], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002b9b0
push eax
push 0x202f
push eax
push 0x20ed
push 0x13d
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x34], 0x7862fd41
mov dword [ebp - 0x28], 0xbefcdf1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002b9de
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb80], 0xcfda6c2e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002b9c6
xor eax, eax
push 0xfffffffffffffffb
pop edx
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0xffffffe3
jg 0x1002bae0
jmp 0x1002b9f2
xor eax, eax
mov dword [ebp - 0x2c], 0x70ade21
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x11
jg 0x1002ba7b
jmp 0x1002ba09
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x30], 0xe018
mov dword [ebp - 0x24], 0x6be856df
cmp dword [ebp - 0x1c], eax
jne 0x1002ba31
mov dword [ebp - 0x30], 0x714ad38
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x1002ba33
mov edx, ebx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jge 0x1002ba46
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002ba48
mov esi, ebx
jmp 0x1002ba4a
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
sete cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, esi
neg edx
sbb edx, edx
add edx, 7
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x11
jle 0x1002ba07
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0x7bf7
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
sub ecx, eax
mov dword [ebp - 0xb7c], ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
setle dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x2c], edx
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe3
jle 0x1002b9f0
push 2
pop esi
push 3
pop ecx
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xb7c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002bb0e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x32c], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002baf6
xor eax, eax
mov dword [ebp - 0x3c], 0xac204e2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002bb34
or edx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x143c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002bb20
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002bb50
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002bb4d
call edi
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor eax, eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff9
jne 0x1002bb39
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x3c], eax
jl 0x1002bb7b
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002bb76
push 0x184a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x1002bb5e
movdqa xmm0, xmmword [0x10008040]
lea eax, [ebp - 0xfec]
push eax
lea eax, [ebp - 0xffc]
push eax
lea ecx, [ebp - 0x126c]
movdqu xmmword [ebp - 0xffc], xmm0
call fcn.10015934
lea ecx, [ebp - 0x157]
mov esi, eax
call fcn.100091b3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x2c4]
push dword [esi]
call fcn.100158fa
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x34], 0x184c506d
push 3
mov dword [ebp - 0x34], eax
pop esi
cmp dword [ebp - 0x34], esi
jg 0x1002bcf5
or ecx, 0xffffffff
mov dword [ebp - 0x2c], 0x6b950ba1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x1002bce9
mov dword [ebp - 0x18], eax
jmp 0x1002bc10
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdb4], 0x63a74adf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002bbff
push ebx
lea ecx, [ebp - 0x2c4]
call fcn.10015925
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x795ed7c6
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
je 0x1002bc4d
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c4]
call fcn.10015925
cmp dword [eax], 0
jne 0x1002bc4d
xor eax, eax
mov esi, eax
jmp 0x1002bc4f
mov esi, ebx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c4]
call fcn.10015925
mov ecx, dword [ebp - 0x2c]
xor ebx, ebx
sub esi, ecx
lea ecx, [ebp - 0x2c4]
imul esi, dword [ebp - 0x2c]
push dword [ebp - 0x34]
cmp esi, dword [eax]
setg bl
call fcn.10015925
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0xdb0], ecx
push dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x2c4]
call fcn.10015925
xor ecx, ecx
cmp dword [ebp - 0x24], 0xf219a6f
sete cl
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x2c4]
setle bl
xor eax, eax
push eax
call fcn.10015925
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2c4]
sub ebx, dword [eax]
call fcn.10015925
xor ecx, ecx
push 0
cmp dword [eax], ebx
pop eax
setne cl
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x2c]
push 1
pop ebx
jns 0x1002bbfa
push 3
pop esi
or ecx, 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x1002bbe4
or eax, 0xffffffff
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 4], eax
call fcn.10015920
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x3c], 0xac204e2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002bd31
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1454], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002bd1d
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002bd4d
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002bd4a
call edi
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor eax, eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff9
jne 0x1002bd36
push 2
pop esi
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x3c], eax
jl 0x1002bd7b
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002bd76
push 0x184a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x1002bd5e
cmp byte [ebp - 0xd], 0
je 0x1002be3d
mov dword [ebp - 0x2c], 0xfffffffe
mov ecx, 0x53e58bfc
mov dword [ebp - 0xbc0], ecx
mov dword [ebp - 0xbbc], ecx
mov dword [ebp - 0xbb8], ecx
mov dword [ebp - 0xbb4], ecx
mov dword [ebp - 0x38], 0x37c1d6b3
mov dword [ebp - 0x1c], 0x29c8ddac
mov dword [ebp - 0x2c], 0xffffffee
jmp 0x1002bdf4
mov dword [ebp - 0x30], 0xc4ab
xor edx, edx
mov dword [ebp - 0x24], 0xdcad2086
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
push 0
setle cl
mov dword [ebp - 0xbbc], ecx
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], 0xfffffff4
je 0x1002bdc0
push 3
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
jl 0x1002be29
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0xf9d44c03
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], 0xa4ccfd6
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x1c]
dec dword [ebp - 0x2c]
jns 0x1002be0a
push 0x1f7e
push eax
push eax
push eax
push 0xdaa
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x28], 0x5c96dd1e
xor eax, eax
mov dword [ebp - 0x18], 0xf2f4a8b1
or ecx, 0xffffffff
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002be79
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x5f4], 0xe149cff2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002be61
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002be8f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x127c], 0x17b38e51
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002be7e
mov eax, dword [ebp - 0x28]
mov ecx, 0xa729
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
sub ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x4c]
jne 0x1002beaf
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
sub edx, 0x5900
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x4c], eax
je 0x1002bef3
mov edx, ebx
cmp dword [ebp - 0x18], eax
jne 0x1002bef5
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x1002bf0e
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002bf10
mov eax, ebx
mov edi, dword [sym.imp.USER32.dll_EndMenu]
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x32c], 0xfffffffd
jmp 0x1002c477
push 8
pop eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x910]
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
push ebx
call fcn.100158b8
push 5
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1204]
movdqa xmm0, xmmword [0x10007fc0]
lea eax, [ebp - 0x106c]
push eax
lea eax, [ebp - 0x107c]
mov dword [ebp - 0x28], 0xf0e4f200
mov dword [ebp - 0x30], 0x9baaa4f6
push eax
movdqu xmmword [ebp - 0x107c], xmm0
call fcn.10015934
lea ecx, [ebp - 0x155]
mov esi, eax
call fcn.100091b3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xfa0]
push dword [esi]
call fcn.100158fa
mov byte [ebp - 4], 6
push 9
mov dword [ebp - 0x30], 0x88307b36
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002bfd3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x910]
call fcn.10015925
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002bfb9
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002bfdb
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x3ccd
mov eax, 0x9da97273
setg cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
sete dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setle cl
xor ebx, ebx
cmp ecx, 0x22d8
lea ecx, [ebp - 0x910]
setg bl
xor eax, eax
push eax
call fcn.10015925
mov dword [eax], ebx
xor eax, eax
inc eax
cmp eax, ebx
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xfa0]
mov esi, dword [ebp - 0x30]
neg esi
sbb esi, esi
xor ebx, ebx
inc ebx
neg esi
push ebx
call fcn.10015925
mov ecx, dword [ebp - 0x20]
xor edx, edx
neg ecx
cmp ecx, esi
setle dl
xor ecx, ecx
or esi, 0xffffffff
cmp edx, esi
push 3
setle cl
mov dword [eax], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
pop esi
cmp dword [ebp - 0x28], eax
jl 0x1002c117
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c0d8
call edi
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x1002c10d
mov dword [ebp - 0x20], eax
jmp 0x1002c105
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c102
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1002c0e2
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jle 0x1002c0dd
dec dword [ebp - 0x28]
jns 0x1002c0cb
lea ecx, [ebp - 0xfa0]
call fcn.10015920
or eax, 0xffffffff
lea ecx, [ebp - 0x910]
mov dword [ebp - 4], eax
call fcn.10015920
push 9
pop eax
mov dword [ebp - 0x38], 0x5720e83c
lea ecx, [ebp - 0xb74]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
push ebx
call fcn.100158b8
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c180
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb74]
call fcn.10015925
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c166
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c192
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor eax, eax
push eax
lea ecx, [ebp - 0xb74]
call fcn.10015925
lea ecx, [ebp - 0xb74]
dec dword [eax]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10015920
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x4c], 0x53bc
mov dword [ebp - 0x1c], 0x7b5bf2d3
mov dword [ebp - 0x28], 0x9b76eea5
mov dword [ebp - 0x30], 0xb6ea
mov dword [ebp - 0x24], 0x273d5943
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c1f9
push 8
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xac], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c1e7
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x1c]
jge 0x1002c217
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002c22b
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x1002c22d
mov ecx, ebx
mov eax, dword [ebp - 0x24]
xor edx, edx
add eax, ecx
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
imul ecx, ecx, 0x7673
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x30]
jg 0x1002c286
mov edx, ebx
cmp dword [ebp - 0xac], eax
jne 0x1002c288
mov edx, eax
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xac]
push 0xfffffffffffffff7
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0xfffffffb
pop ecx
setne al
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x28], eax
cmp byte [ebp - 0xd], 0
je 0x1002c471
movdqa xmm0, xmmword [0x10007fa0]
lea ecx, [ebp - 0x120c]
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x54], 0xfffffffd
mov dword [ebp - 0x24], 0x9d568d52
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x44], 0xf7bf48c4
mov dword [ebp - 0x18], 7
push eax
movdqu xmmword [ebp - 0x101c], xmm0
call fcn.10015934
lea ecx, [ebp - 0x15d]
mov esi, eax
call fcn.100091b3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xecc]
push dword [esi]
call fcn.100158fa
push 8
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x30], 0x2a04f777
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002c36f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x134], 0xe4562513
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002c357
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002c392
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd28], 0xfffffff7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002c37a
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x1002c3b1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xdc8], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002c39d
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002c3b9
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd20]
xor eax, eax
cmp dword [ebp - 0xdc4], eax
je 0x1002c3e2
mov ecx, ebx
cmp dword [ebp - 0x134], eax
jne 0x1002c3e4
mov ecx, eax
mov dword [ebp - 0x134], ecx
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x30]
cmp eax, ecx
je 0x1002c3f8
mov esi, ebx
jmp 0x1002c3fc
xor eax, eax
mov esi, eax
push edx
lea ecx, [ebp - 0xecc]
call fcn.10015925
push 3
mov eax, dword [eax]
imul eax, esi
pop esi
mov dword [ebp - 0xd24], eax
mov dword [ebp - 0x18], 0x1a
jmp 0x1002c447
mov dword [ebp - 0x24], 0xcb0be945
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x134]
cmp ecx, eax
setle dl
neg edx
cmp edx, 0xd029b4cc
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002c41f
or eax, 0xffffffff
lea ecx, [ebp - 0xecc]
mov dword [ebp - 4], eax
call fcn.10015920
xor eax, eax
push eax
push 0xa1e
push 0x1209
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
inc dword [ebp - 0x32c]
cmp dword [ebp - 0x32c], 0x14
jne 0x1002bf2b
push 5
pop eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x928]
or eax, 0xffffffff
mov ebx, 0xbd97a888
mov dword [ebp - 0x38], eax
mov esi, 0x7f2fb5a5
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xd035c573
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfffffffd
push 2
call fcn.100158b8
push 9
pop eax
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [ebp - 0x38], eax
inc ecx
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x1002c4f1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd6c], 0xfffffff9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002c4d9
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002c519
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x928]
call fcn.10015925
push 8
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002c4fa
xor ecx, ecx
inc ecx
push ecx
lea ecx, [ebp - 0x928]
call fcn.10015925
lea ecx, [ebp - 0x928]
dec dword [eax]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10015920
push 5
pop eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xacc]
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xd035c573
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfffffffd
push 2
call fcn.100158b8
push 9
mov dword [ebp - 4], 0xa
xor esi, esi
pop eax
mov dword [ebp - 0x38], eax
inc esi
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002c59f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd7c], 0xfffffff9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002c587
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002c5c7
push 8
pop esi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xacc]
call fcn.10015925
mov dword [eax], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002c5ab
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0xacc]
call fcn.10015925
or ebx, 0xffffffff
lea ecx, [ebp - 0xacc]
dec dword [eax]
mov dword [ebp - 4], ebx
call fcn.10015920
mov dword [ebp - 0x30], ebx
xor edx, edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x54], 0xe6a3735b
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
sub ecx, 0x2d68d631
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0xe60f
sete al
cmp dword [ebp - 0x30], eax
je 0x1002c625
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x24], ebx
jmp 0x1002c62c
mov dword [ebp - 0x54], 0xf65e790e
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidth32A]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c657
push eax
push 0xd59
push 0x167d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x54], 0xe6a3735b
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
sub ecx, 0x2d68d631
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0xe60f
sete al
cmp dword [ebp - 0x30], eax
je 0x1002c69d
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x24], 0xffffffff
jmp 0x1002c6a4
mov dword [ebp - 0x54], 0xf65e790e
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c6c9
push eax
push 0xd59
push 0x167d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov dword [ebp - 0x14], 0x60477862
lea ecx, [ebp - 0x368]
push 2
call fcn.100158b8
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002c70e
push dword [ebp - 0x18]
lea ecx, [ebp - 0x368]
call fcn.10015925
mov dword [eax], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c6ef
xor eax, eax
mov dword [ebp - 0x14], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x14], ecx
jne 0x1002c7b2
movdqa xmm0, xmmword [0x10008010]
lea eax, [ebp - 0x10ac]
push eax
lea eax, [ebp - 0x10bc]
mov dword [ebp - 0x24], 0xfff8
mov dword [ebp - 0x30], 0x5c62e089
lea ecx, [ebp - 0x12c4]
push eax
movdqu xmmword [ebp - 0x10bc], xmm0
call fcn.10015934
lea ecx, [ebp - 0x161]
mov esi, eax
call fcn.100091b3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd40]
push dword [esi]
call fcn.100158fa
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xd40]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
call fcn.10015925
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 4], 0xb
mov dword [eax], ecx
lea ecx, [ebp - 0xd40]
call fcn.10015920
dec dword [ebp - 0x14]
or ecx, 0xffffffff
cmp dword [ebp - 0x14], ecx
je 0x1002c71d
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1002c8e4
mov dword [ebp - 0x3c], 0x49f6d4a0
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jg 0x1002c8db
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x940]
push 4
call fcn.100158b8
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x18], eax
jmp 0x1002c80d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x940]
call fcn.10015925
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c7f6
push dword [ebp - 0x14]
lea ecx, [ebp - 0x368]
call fcn.10015925
push dword [ebp - 0x14]
lea ecx, [ebp - 0x368]
mov esi, eax
call fcn.10015925
mov ecx, dword [eax]
mov dword [esi], ecx
xor esi, esi
mov dword [ebp - 0x30], ecx
inc esi
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp esi, eax
sbb eax, eax
neg eax
cmp eax, esi
jb 0x1002c8a0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x368]
call fcn.10015925
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x368]
call fcn.10015925
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x368]
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x3c]
call fcn.10015925
mov eax, dword [eax]
dec eax
je 0x1002c88d
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002c88d
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x368]
call fcn.10015925
cmp dword [eax], 0
jne 0x1002c8a4
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0x940]
call fcn.10015925
lea ecx, [ebp - 0x940]
mov dword [eax], esi
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 0xb
call fcn.10015920
inc dword [ebp - 0x3c]
xor esi, esi
inc esi
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x3c], esi
jle 0x1002c7db
xor eax, eax
or ecx, ecx
dec dword [ebp - 0x14]
jns 0x1002c7be
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x368]
call fcn.10015920
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x54], 0xe6a3735b
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
sub ecx, 0x2d68d631
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0xe60f
sete al
cmp dword [ebp - 0x30], eax
je 0x1002c938
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x24], 0xffffffff
jmp 0x1002c93f
mov dword [ebp - 0x54], 0xf65e790e
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c966
push eax
push 0xd59
push 0x167d
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push 3
xor ebx, ebx
lea ecx, [ebp - 0xf54]
pop eax
inc ebx
mov dword [ebp - 0x34], ebx
push eax
call fcn.100158b8
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x1c], ebx
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002c9b5
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf54]
call fcn.10015925
mov dword [eax], 0x13d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c994
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x34], 0x1a
jmp 0x1002caac
mov dword [ebp - 0x28], 0x772304b2
mov dword [ebp - 0xc40], ecx
mov dword [ebp - 0xc3c], ecx
mov dword [ebp - 0xc38], ecx
mov dword [ebp - 0xc34], ecx
mov dword [ebp - 0x24], 0xc44d4e2b
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x1002ca86
push 8
pop ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x1002ca79
mov dword [ebp - 0x4c], 0xea66e58d
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4c], 2
cmp dword [ebp - 0x4c], eax
jl 0x1002ca46
mov dword [ebp - 0x18], 0xe135e1f6
mov dword [ebp - 0x18], eax
jmp 0x1002ca3b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ca38
push eax
push eax
call dword [sym.imp.GDI32.dll_RectInRegion]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002ca25
dec dword [ebp - 0x4c]
jns 0x1002ca19
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x4c], 0xc3f4f880
sbb eax, eax
inc eax
mov dword [ebp - 0xc38], eax
jne 0x1002ca64
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 2
push 0
pop eax
jle 0x1002ca03
push 8
pop ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1002c9f7
cmp dword [ebp - 0x1c], eax
je 0x1002ca94
mov dword [ebp - 0x1c], 0xd91f06e8
jmp 0x1002caa9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002caa9
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1b
mov ecx, 0xf1e5c8a5
jge 0x1002c9c1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cad4
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
or eax, 0xffffffff
lea ecx, [ebp - 0xf54]
mov dword [ebp - 4], eax
call fcn.10015920
mov dword [ebp - 0x14], 0xd4e06482
mov dword [ebp - 0x1c], 0xd1cb6a7f
mov dword [ebp - 0x30], 0xcccaea0a
mov dword [ebp - 0x14], 0xffffffef
cmp dword [ebp - 0x14], 0x11
je 0x1002cb3e
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cb35
push eax
call esi
push eax
push 0xd06
push 0x11cc
push 0x2276
push 0xc82
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x11
jne 0x1002cb09
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002cb48
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
imul eax, dword [ebp - 0x14], 0x12df
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x30]
mov edx, 0xf9a02370
setle cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0x64bd
test eax, eax
je 0x1002cba6
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002cba8
mov edx, ebx
jmp 0x1002cbaa
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
push 8
setge cl
xor ebx, ebx
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], 0x3a00d0e7
mov dword [ebp - 0x1c], 0x6e33a79c
mov dword [ebp - 0x18], 0x475761ac
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x24], 0x53674f9a
mov dword [ebp - 0x28], 0x25c5395f
mov dword [ebp - 0x1c], 0x974db9be
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add eax, 0x647c2c9e
cmp eax, 0x72ba29f5
setge cl
or eax, 0xffffffff
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
inc ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov ecx, dword [ebp - 0x18]
setle dl
xor eax, eax
cmp edx, 0x1808adc7
setl al
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
pop ecx
setg dl
xor eax, eax
cmp edx, 0x12af
setge al
sub eax, dword [ebp - 0x28]
add eax, ecx
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x4a8]
sub eax, dword [ebp - 0x28]
neg eax
push 5
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], 0x79536444
push 2
call fcn.100158b8
mov dword [ebp - 4], 0xf
push 9
pop eax
mov dword [ebp - 0x28], eax
mov eax, 0xfc1f7b40
mov dword [ebp - 0x30], 0x60915bb0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0xbd8], eax
mov dword [ebp - 0xbd4], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1002cd21
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xea4], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1002cd08
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002cd36
push dword [ebp - 0x2c]
call fcn.10015925
push 0xfffffffffffffff7
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
lea ecx, [ebp - 0x4a8]
jl 0x1002cd26
mov eax, dword [ebp - 0xe98]
xor ebx, ebx
mov dword [ebp - 0x18], eax
push ebx
call fcn.10015925
mov eax, dword [ebp - 0x28]
push 0xfffffffffffffff7
pop ecx
sub eax, ecx
neg eax
push ebx
sbb eax, eax
xor ecx, ecx
inc eax
or edx, 0xffffffff
cmp eax, edx
mov eax, dword [ebp - 0x18]
setne cl
sub eax, ecx
lea ecx, [ebp - 0x4a8]
imul eax, eax, 6
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xe98]
call fcn.10015925
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x4a8]
push ebx
call fcn.10015925
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x4a8]
mov eax, dword [ebp - 0x1c]
push ebx
call fcn.10015925
push 8
pop ecx
cmp dword [ebp - 0x28], ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x4a8]
mov eax, dword [ebp - 0xe98]
setge dl
or ebx, 0xffffffff
imul eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 4], ebx
call fcn.10015920
push 5
mov dword [ebp - 0x38], ebx
xor ebx, ebx
pop eax
mov dword [ebp - 0x2c], 0xae5a60d0
inc ebx
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], eax
push 8
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
push 3
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002ce28
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x146c], 2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002ce17
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xb245
cmp eax, dword [ebp - 0x30]
jge 0x1002ce62
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
setge cl
xor edx, edx
sub ecx, 6
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x40], eax
jmp 0x1002cec2
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cebf
push 0x11cb
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jle 0x1002ce9e
movdqa xmm0, xmmword [0x10007f90]
lea ecx, [ebp - 0x12d4]
mov dword [ebp - 0x38], 0xbd97a888
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0x64a6847d
push 0xfffffffffffffffc
mov dword [ebp - 0x34], 0xddac0faa
mov dword [ebp - 0x38], eax
pop eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x102c]
push eax
lea eax, [ebp - 0x103c]
push eax
movdqu xmmword [ebp - 0x103c], xmm0
call fcn.10015934
lea ecx, [ebp - 0x156]
mov esi, eax
call fcn.100091b3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1140]
push dword [esi]
call fcn.100158fa
push 8
pop eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x28], eax
jmp 0x1002d0f8