Function at 0x1002f8d7
Capabilities:
Check os version
Create process on windows
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get file system object information
Get graphical window text
Get keyboard layout
Log keystrokes via polling
Parse pe header
Read .ini file
Suspend thread

Disassembly:
mov eax, 0x10073dc6
call fcn.10072640
mov eax, 0x14dc
call fcn.1006eb90
push ebx
push esi
push edi
push 2
pop ebx
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x934]
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x18], 0xfffffffa
push ebx
mov byte [ebp - 0x6d], dl
call fcn.10016dd3
xor eax, eax
mov dword [ebp - 4], eax
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002f939
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2d8], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f921
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002f95c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x934]
call fcn.10016e40
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f941
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002f97f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6e8], 0x9f4aec70
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f967
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], eax
jmp 0x1002f9bc
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002f9b9
push 0x20af
push eax
push eax
push 0x26a3
push 0xa2b
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1002f990
cmp dword [ebp - 0x1c], eax
je 0x1002fa04
mov dword [ebp - 0x1c], 0xd0c1
cmp dword [ebp - 0x1c], eax
jne 0x1002f9f8
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002f9e9
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x2d4]
mov eax, dword [ebp - 0x2cc]
mov ecx, 0x2afa4368
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub ecx, eax
sub ecx, dword [ebp - 0x2d4]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
or edx, 0xffffffff
cmp ecx, edx
lea ecx, [ebp - 0x934]
setne al
mov dword [ebp - 0x18], eax
xor eax, eax
mov esi, dword [ebp - 0x2cc]
push eax
call fcn.10016e40
mov dword [eax], esi
test esi, esi
jne 0x1002fa64
mov eax, dword [ebp - 0x1c]
xor eax, eax
lea ecx, [ebp - 0x934]
push eax
call fcn.10016e40
mov eax, dword [ebp - 0x2d8]
lea ecx, [ebp - 0x934]
xor eax, eax
mov dword [ebp - 0x6e8], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016e3b
push 2
pop eax
mov dword [ebp - 0x1c], 5
lea ecx, [ebp - 0x94c]
mov dword [ebp - 0x18], 0xfffffffa
push eax
call fcn.10016dd3
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 4], esi
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002fad9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2f0], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002fac1
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002fb00
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x94c]
call fcn.10016e40
push 2
and dword [eax], 0
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x1002fae2
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002fb20
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x728], 0x9f4aec70
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002fb08
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002fb51
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002fb4e
push 0x20af
push eax
push eax
push 0x26a3
push 0xa2b
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1002fb25
cmp dword [ebp - 0x1c], eax
je 0x1002fb99
mov dword [ebp - 0x1c], 0xd0c1
cmp dword [ebp - 0x1c], eax
jne 0x1002fb8d
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002fb7e
mov eax, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2f0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2f0]
mov eax, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x2e4]
mov ecx, 0x2afa4368
mov eax, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub ecx, eax
sub ecx, dword [ebp - 0x2ec]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
or ebx, 0xffffffff
cmp ecx, ebx
lea ecx, [ebp - 0x94c]
setne al
mov dword [ebp - 0x18], eax
xor eax, eax
mov esi, dword [ebp - 0x2e4]
push eax
call fcn.10016e40
mov dword [eax], esi
test esi, esi
jne 0x1002fbf9
mov eax, dword [ebp - 0x1c]
xor eax, eax
lea ecx, [ebp - 0x94c]
push eax
call fcn.10016e40
mov eax, dword [ebp - 0x2f0]
lea ecx, [ebp - 0x94c]
xor eax, eax
mov dword [ebp - 0x728], eax
mov dword [ebp - 4], ebx
call fcn.10016e3b
mov dword [ebp - 0x38], 0xa1f94964
push 4
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x2c], 0x3b6f9b69
cmp dword [ebp - 0x38], eax
je 0x1002fc6e
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0xfffffffa
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x20]
jne 0x1002fc5e
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002fc6c
xor esi, esi
inc esi
mov eax, esi
jmp 0x1002fc71
xor eax, eax
xor esi, esi
inc esi
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002fc91
push 0x12e6
push eax
call edi
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002fcb1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x124], 0xfc558bac
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002fc99
xor eax, eax
mov edx, esi
cmp dword [ebp - 0x124], eax
jne 0x1002fcbd
mov edx, eax
mov eax, dword [ebp - 0x124]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
setg cl
xor eax, eax
cmp edx, ecx
setge al
mov dword [ebp - 0x124], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002fcf4
push eax
push 0x185c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 2
pop eax
mov dword [ebp - 0x1c], 5
lea ecx, [ebp - 0x964]
mov dword [ebp - 0x18], 0xfffffffa
push eax
call fcn.10016dd3
push 2
pop ecx
xor eax, eax
mov dword [ebp - 4], ecx
push 4
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x1002fd3c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x308], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002fd24
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002fd62
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x964]
call fcn.10016e40
push 2
and dword [eax], 0
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x1002fd44
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002fd82
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x650], 0x9f4aec70
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002fd6a
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002fdb7
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002fdb4
push 0x20af
push eax
push eax
push 0x26a3
push 0xa2b
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1002fd87
cmp dword [ebp - 0x1c], eax
je 0x1002fdff
mov dword [ebp - 0x1c], 0xd0c1
cmp dword [ebp - 0x1c], eax
jne 0x1002fdf3
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002fde4
mov eax, dword [ebp - 0x300]
mov eax, dword [ebp - 0x300]
mov eax, dword [ebp - 0x308]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x308]
mov eax, dword [ebp - 0x304]
mov eax, dword [ebp - 0x2fc]
mov ecx, 0x2afa4368
mov eax, dword [ebp - 0x300]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x300]
mov eax, dword [ebp - 0x304]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub ecx, eax
sub ecx, dword [ebp - 0x304]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
or edx, 0xffffffff
cmp ecx, edx
lea ecx, [ebp - 0x964]
setne al
mov dword [ebp - 0x18], eax
xor eax, eax
mov esi, dword [ebp - 0x2fc]
push eax
call fcn.10016e40
mov dword [eax], esi
test esi, esi
jne 0x1002fe5f
mov eax, dword [ebp - 0x1c]
xor eax, eax
lea ecx, [ebp - 0x964]
push eax
call fcn.10016e40
mov eax, dword [ebp - 0x308]
lea ecx, [ebp - 0x964]
xor eax, eax
mov dword [ebp - 0x650], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016e3b
xor esi, esi
xor edx, edx
inc esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
setl dl
xor eax, eax
cmp edx, 0x8029
push 8
setg al
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0xe4e91208
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf09a2b44
pop ecx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jl 0x1002ff49
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002ff04
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
xor eax, eax
mov dword [ebp - 0x38], 0xa1f94964
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x2c], 0x3b6f9b69
cmp dword [ebp - 0x38], eax
je 0x1002ff7b
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0xfffffffa
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x20]
jne 0x1002ff3e
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002ff79
mov eax, esi
jmp 0x1002ff7b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffffc
jne 0x1002ff02
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x1c], ecx
jmp 0x1002ff6e
mov dword [ebp - 0x38], esi
inc dword [ebp - 0x38]
cmp dword [ebp - 0x20], eax
jne 0x1002ff74
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
je 0x1002ff60
dec dword [ebp - 0x10]
jmp 0x1002ff4e
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002ff93
push 0x12e6
push eax
call edi
push eax
call ebx
push 3
pop edi
push edi
lea ecx, [ebp - 0xab8]
call fcn.10016dd3
mov dword [ebp - 4], edi
xor ebx, ebx
mov dword [ebp - 0x30], 0xfffffff7
inc ebx
mov dword [ebp - 0x34], 0xfffffff9
xor eax, eax
mov dword [ebp - 0x34], 0x22e974a5
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x20], 0xab46
mov dword [ebp - 0x2c], 0xfc37f20b
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10030006
push dword [ebp - 0x24]
lea ecx, [ebp - 0xab8]
call fcn.10016e40
mov dword [eax], 0xc204
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002ffe5
push 0xfffffffffffffffb
xor eax, eax
pop ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10030026
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x76c], 6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003000e
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], eax
jl 0x10030076
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003004f
push 0x1455
push 0x18d2
call dword [sym.imp.USER32.dll_SetCaretPos]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10030069
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10030066
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10030054
dec dword [ebp - 0x30]
push 0xfffffffffffffffb
pop ecx
jns 0x10030031
cmp dword [ebp - 0x30], 0xdb5a
jne 0x1003009c
or eax, 0xffffffff
cmp dword [ebp - 0x76c], eax
sbb eax, eax
inc eax
cmp eax, 0xcc33bab7
sbb eax, eax
neg eax
cmp eax, ebx
ja 0x1003009c
mov ecx, ebx
jmp 0x100300a0
xor eax, eax
mov ecx, eax
inc dword [ebp - 0x20]
xor eax, eax
cmp ecx, 0xfffffffa
sete al
xor ecx, ecx
imul eax, dword [ebp - 0x20]
sub eax, 0xb221
imul eax, eax, 0x9f36
cmp eax, 0xfb38
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x38]
jge 0x100300d2
mov esi, eax
cmp dword [ebp - 0x20], eax
je 0x100300d4
mov esi, ebx
push eax
lea ecx, [ebp - 0xab8]
call fcn.10016e40
xor ecx, ecx
cmp esi, dword [eax]
setge cl
or esi, 0xffffffff
imul eax, ecx, 0x700d
lea ecx, [ebp - 0xab8]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], esi
call fcn.10016e3b
push edi
lea ecx, [ebp - 0x20c]
call fcn.10016dd3
push 4
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], 0x865e1bfe
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0x905687c4
mov dword [ebp - 0x1c], 0xd6b8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1003015c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x20c]
call fcn.10016e40
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003013f
push 4
xor eax, eax
pop ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x10030178
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7bc], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10030164
xor eax, eax
mov dword [ebp - 0x20], 0x4aa41a80
cmp dword [ebp - 0x20], eax
jle 0x1003019d
push eax
lea ecx, [ebp - 0x20c]
call fcn.10016e40
cmp dword [eax], 0
je 0x1003019b
mov esi, ebx
xor eax, eax
jmp 0x1003019f
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x20c]
call fcn.10016e40
lea ecx, [ebp - 0x20c]
mov eax, dword [eax]
mov dword [ebp - 0x7b0], eax
xor eax, eax
push eax
call fcn.10016e40
mov ecx, dword [ebp - 0x10]
xor edx, edx
sub esi, ecx
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
setl dl
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x20c]
mov eax, dword [ebp - 0x10]
sub eax, 5
mov dword [ebp - 0x2c], eax
xor eax, eax
push eax
call fcn.10016e40
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax]
xor eax, eax
cmp ecx, 0x4f2a6ca0
mov ecx, 0xfff9
setg al
cmp ecx, eax
lea ecx, [ebp - 0x20c]
sbb edi, edi
xor eax, eax
neg edi
imul edi, dword [ebp - 0x7b0]
push eax
call fcn.10016e40
lea ecx, [ebp - 0x20c]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, edi
call fcn.10016e40
push 2
xor ebx, ebx
lea ecx, [ebp - 0x20c]
pop edi
cmp dword [eax], esi
push edi
setle bl
call fcn.10016e40
xor ecx, ecx
push edi
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x20c]
call fcn.10016e40
mov edx, dword [ebp - 0x38]
xor ecx, ecx
push 3
pop esi
cmp edx, dword [eax]
setle cl
cmp ecx, esi
jg 0x10030281
mov eax, dword [ebp - 0x20]
xor ebx, ebx
xor ecx, ecx
inc ebx
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, edi
setg cl
neg ecx
je 0x100302f6
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x18], eax
jmp 0x100302ba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2b0], 0xf87662b0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100302a9
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2ac]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003045c
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x20], 0xb74473ca
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1003045c
jmp 0x1003031c
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff7
or edx, 0xffffffff
mov dword [ebp - 0x48], edx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10030345
push eax
push eax
push 0x394
push 0xb25
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7bc], ecx
or eax, 0xffffffff
cmp dword [ebp - 0x20], eax
jge 0x1003040a
push ebx
lea ecx, [ebp - 0x103c]
call fcn.10016dd3
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10030390
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1f0], 0xbe3e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030378
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100303b6
push dword [ebp - 0x24]
lea ecx, [ebp - 0x103c]
call fcn.10016e40
mov dword [eax], 0xee1efb40
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030398
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100303d5
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0x1f0]
jne 0x100303cc
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov ecx, eax
jmp 0x100303d7
mov ecx, ebx
xor eax, eax
cmp ecx, ebx
push 4
sete al
lea ecx, [ebp - 0x103c]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x20], 0xdf555a6f
inc dword [ebp - 0x48]
pop eax
mov byte [ebp - 4], al
call fcn.10016e3b
jmp 0x10030450
mov dword [ebp - 0x20], 6
mov ecx, 0x234d
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x7bc]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + eax*4 - 0x7bc]
mov eax, dword [ebp - 0x20]
sub ecx, eax
xor eax, eax
add edx, ecx
je 0x1003044d
cmp dword [ebp - 0x2c], eax
je 0x1003044d
cmp dword [ebp - 0x1c], eax
je 0x1003044d
mov eax, ebx
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1003031a
or eax, 0xffffffff
lea ecx, [ebp - 0x20c]
mov dword [ebp - 4], eax
call fcn.10016e3b
push esi
lea ecx, [ebp - 0x470]
call fcn.10016dd3
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100304b2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x470]
call fcn.10016e40
mov dword [eax], 0xa049
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10030494
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x100304d1
or edx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xbc], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x100304bd
xor eax, eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], edi
jg 0x1003064c
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], eax
jl 0x10030553
mov dword [ebp - 0x20], 0x34eea2a3
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10030524
push 0x1792
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x1003054e
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10030546
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov dword [ebp - 0x28], ebx
dec dword [ebp - 0x20]
jns 0x1003052c
dec dword [ebp - 0x10]
jns 0x100304f9
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10030584
push 0x20af
push eax
push eax
push 0x26a3
push 0xa2b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], eax
jl 0x10030637
or eax, 0xffffffff
lea ecx, [ebp - 0x470]
mov dword [ebp - 0x38], eax
push dword [ebp - 0xbc]
call fcn.10016e40
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x470]
call fcn.10016e40
cmp dword [eax], 0
je 0x10030609
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x470]
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp - 0x10]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.10016e40
cmp esi, dword [eax]
jge 0x100305ef
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x470]
call fcn.10016e40
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0x470]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0xbc]
call fcn.10016e40
mov dword [ebp - 0x38], 0xc65
xor edx, edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setge dl
add edx, 0x32adaa23
mov dword [ebp - 0x38], edx
dec dword [ebp - 0x28]
jns 0x10030590
xor eax, eax
inc dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], edi
jle 0x100304e3
push 3
pop esi
or eax, 0xffffffff
mov dword [ebp - 0xbc], ebx
lea ecx, [ebp - 0x470]
mov dword [ebp - 4], eax
call fcn.10016e3b
mov dword [ebp - 0x30], 0xfdf99ff6
xor eax, eax
mov dword [ebp - 0x34], 0x5bf25cbd
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x34], 0xe673292c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100306a1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x145c], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10030689
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffffc
je 0x1003070d
mov dword [ebp - 0x34], 0x6444
lea ecx, [ebp - 0xe64]
mov dword [ebp - 0x34], 0xeb7161ab
push ebx
call fcn.10016dd3
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x38], 0xd91e66c6
mov dword [ebp - 0x18], eax
jmp 0x100306e9
push dword [ebp - 0x18]
call fcn.10016e40
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xe64]
cmp dword [ebp - 0x18], ebx
jl 0x100306d9
inc dword [ebp - 0x38]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016e3b
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffc
jne 0x100306aa
xor eax, eax
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x50], 0xfffffffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003073b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x128], 0xfc558bac
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030723
xor eax, eax
mov edx, ebx
cmp dword [ebp - 0x128], eax
jne 0x10030747
mov edx, eax
mov eax, dword [ebp - 0x128]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
setg cl
xor eax, eax
cmp edx, ecx
setge al
mov dword [ebp - 0x128], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1003077e
push eax
push 0x185c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edi
lea ecx, [ebp - 0x928]
call fcn.10016dd3
push 8
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x97c]
or eax, 0xffffffff
mov dword [ebp - 0x10], eax
push ebx
call fcn.10016dd3
push 9
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100307ca
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xfe4], 0xfffd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100307b2
xor eax, eax
mov dword [ebp - 0x24], eax
or esi, 0xffffffff
cmp dword [ebp - 0x24], ebx
jge 0x100307ef
push dword [ebp - 0x24]
lea ecx, [ebp - 0x97c]
call fcn.10016e40
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100307d5
xor eax, eax
push 9
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jg 0x100308bf
mov dword [ebp - 0x1c], 0xc4530722
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10030826
push eax
lea ecx, [ebp - 0x97c]
call fcn.10016e40
push 0
mov dword [eax], esi
dec dword [ebp - 0x1c]
pop eax
jns 0x10030810
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x100308ad
mov dword [ebp - 0x28], 0x5b2906c9
mov dword [ebp - 0x38], 0xc42ff18c
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], eax
jl 0x100308a8
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
setge dl
sub esi, edx
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xfe4]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ebx, ebx
cmp edx, esi
setle bl
add ebx, dword [ebp + eax*4 - 0xfe4]
mov eax, dword [ebp - 0x1c]
neg ebx
sbb ebx, ebx
xor ecx, ecx
neg ebx
cmp ebx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x97c]
push eax
call fcn.10016e40
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
dec dword [ebp - 0x28]
jns 0x10030844
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1003082e
inc dword [ebp - 0x10]
push 0xffffffffffffffff
pop esi
cmp dword [ebp - 0x10], edi
jle 0x10030801
xor ebx, ebx
inc ebx
push 8
pop eax
lea ecx, [ebp - 0x97c]
mov byte [ebp - 4], al
call fcn.10016e3b
movdqa xmm0, xmmword [0x100078f0]
lea ecx, [ebp - 0x12f4]
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1060]
push eax
lea eax, [ebp - 0x1070]
mov dword [ebp - 0x2c], 0xd2e819d3
push eax
movdqu xmmword [ebp - 0x1070], xmm0
call fcn.10016e52
lea ecx, [ebp - 0x19e]
mov esi, eax
call fcn.10016e4f
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x5c4]
push dword [esi]
call fcn.10016e15
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x38], 0x5c935cb5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10030952
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x994], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10030939
xor eax, eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 0xffffffe7
je 0x10030ad9
jmp 0x10030963
xor eax, eax
mov dword [ebp - 0x48], 0x6985
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003098a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x64], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030975
xor eax, eax
mov dword [ebp - 0x64], edi
cmp dword [ebp - 0x64], eax
jl 0x10030a7e
mov dword [ebp - 0x38], 0x2294
xor edx, edx
mov dword [ebp - 0x20], 0x99bf0bb9
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x994]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x64]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x64]
setle cl
xor ebx, ebx
imul ecx, ecx, 6
cmp ecx, eax
lea ecx, [ebp - 0x5c4]
setge bl
xor eax, eax
push eax
call fcn.10016e40
push edi
mov dword [eax], ebx
xor eax, eax
cmp ebx, 7
setne al
xor edx, edx
cmp eax, 0xe468a07c
mov eax, dword [ebp - 0x64]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x5c4]
call fcn.10016e40
mov ecx, dword [ebp - 0x64]
xor edx, edx
push 4
sub ecx, dword [eax]
mov eax, dword [ebp - 0x64]
imul ecx, ecx, 3
mov eax, dword [ebp + eax*4 - 0x994]
cmp eax, ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x64]
sete dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x64]
setl dl
mov eax, dword [ebp + eax*4 - 0x994]
sub edx, eax
pop eax
cmp edx, eax
jle 0x10030a57
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10030a57
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x10030a5c
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0x64]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x64]
jns 0x10030996
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x5c4]
xor eax, eax
push eax
call fcn.10016e40
xor eax, eax
cmp dword [ebp - 0x990], eax
je 0x10030a9e
mov eax, dword [ebp - 0x64]
xor eax, eax
push eax
lea ecx, [ebp - 0x5c4]
call fcn.10016e40
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x5c4]
mov esi, dword [ebp - 0x2c]
sub esi, eax
xor eax, eax
push eax
call fcn.10016e40
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp esi, ecx
setle dl
mov dword [eax], edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe7
jne 0x10030961
push 8
pop eax
lea ecx, [ebp - 0x5c4]
mov byte [ebp - 4], al
call fcn.10016e3b
mov dword [ebp - 0x10], 0x5d6c05ba
xor eax, eax
mov dword [ebp - 0x38], 0xad7494df
mov dword [ebp - 0x38], 0x20f620a3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10030b21
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x674], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10030b09
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x16
je 0x10030cc9
push ebx
lea ecx, [ebp - 0x778]
call fcn.10016dd3
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0x56810853
mov dword [ebp - 0x38], 0x747c914a
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10030b77
push dword [ebp - 0x24]
lea ecx, [ebp - 0x778]
call fcn.10016e40
mov dword [eax], 0xe0b4074d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030b59
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10030b99
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9ac], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10030b80
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x10030ca9
mov dword [ebp - 0x20], 0x1912530a
lea ecx, [ebp - 0x778]
mov dword [ebp - 0x48], 5
push dword [ebp - 0x28]
call fcn.10016e40
lea ecx, [ebp - 0x778]
mov eax, dword [eax]
mov dword [ebp - 0x9a4], eax
xor eax, eax
push eax
call fcn.10016e40
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov esi, dword [eax]
mov eax, dword [ebp - 0x10]
shl esi, 2
cmp ecx, eax
lea ecx, [ebp - 0x778]
setl dl
sub edx, esi
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x28]
call fcn.10016e40
xor edx, edx
mov eax, dword [eax]
cmp eax, dword [ebp - 0x9a4]
sete dl
cmp dword [ebp - 0x2c], 0xffff
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
setge cl
lea eax, [ecx + 0x105e1e3b]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x670]
mov eax, dword [ebp - 0x670]
sub edx, 6
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setg dl
xor ebx, ebx
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x9a4]
cmp edx, eax
mov ecx, dword [ebp - 0x9ac]
mov eax, dword [ebp - 0x10]
setge bl
imul ecx, ebx
imul eax, ecx
test eax, eax
je 0x10030c98
xor eax, eax
cmp dword [ebp - 0x670], eax
je 0x10030c9a
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x10030c9d
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x28]
jns 0x10030ba5
push 8
pop eax
lea ecx, [ebp - 0x778]
mov byte [ebp - 4], al
call fcn.10016e3b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x16
jne 0x10030b2e
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x10030ce2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x320], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030cd1
push 9
pop eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x69c]
mov dword [ebp - 0x48], 0x1d91e66
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x34], 0x2a3cc92e
mov dword [ebp - 0x34], 0xd82c32b9
push 3
call fcn.10016dd3
mov byte [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x34], 0x8d6e8597
mov dword [ebp - 0x2c], 0xc1994476
mov dword [ebp - 0x34], 0xc77a5c6a
mov dword [ebp - 0x18], eax
jmp 0x10030d49
push dword [ebp - 0x18]
call fcn.10016e40
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
lea ecx, [ebp - 0x69c]
jl 0x10030d3c
push edi
call fcn.10016e40
mov ecx, dword [ebp - 0x2c]
mov eax, dword [eax]
inc dword [ebp - 0x2c]
cmp ecx, eax
jle 0x10030d6d
mov edi, ebx
xor eax, eax
jmp 0x10030d71
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x20], eax
jne 0x10030d7d
mov esi, eax
cmp dword [ebp - 0x48], eax
je 0x10030d7f
mov esi, ebx
push ebx
lea ecx, [ebp - 0x69c]
call fcn.10016e40
xor ebx, ebx
lea ecx, [ebp - 0x69c]
cmp esi, dword [eax]
setle bl
xor eax, eax
push eax
call fcn.10016e40
mov edx, dword [ebp - 0x48]
xor ecx, ecx
push 8
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x48]
sete cl
imul edx, ecx
xor ecx, ecx
imul edx, edi
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, 0x990b
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp eax, edx
pop eax
setg cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x69c]
mov byte [ebp - 4], al
call fcn.10016e3b
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ebx
cmp dword [ebp - 0x1c], ebx
jge 0x10030e20
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x928]
call fcn.10016e40
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030e05
xor eax, eax
mov dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10030e4a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3cc], 0xfffffffd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030e32
xor eax, eax
xor edi, edi
mov dword [ebp - 0x24], eax
inc edi
jmp 0x10030e63
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x714], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10030e52
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
je 0x10030e82
mov dword [ebp - 0x38], 0x53bc6e5c
dec dword [ebp - 0x38]
jmp 0x10030f1f
mov dword [ebp - 0x28], 0xd7d393e7
xor eax, eax
mov dword [ebp - 0x38], 0x75ff4442
mov dword [ebp - 0x1c], eax
jmp 0x10030f15
mov dword [ebp - 0x10], 0x6c74aa0d
mov dword [ebp - 0x10], 0xfffffff8
cmp dword [ebp - 0x10], 0xffffffe8
jl 0x10030eee
mov dword [ebp - 0x20], 0xa7b445ac
mov dword [ebp - 0x2c], eax
or eax, 0xffffffff
mov dword [ebp - 0x3c8], edi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe8
push 0
pop eax
jge 0x10030eab
mov dword [ebp - 0x28], eax
jmp 0x10030f0d
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10030f0a
push 0xb2b
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x10030ef3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x2b
jl 0x10030e97
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10030f2c
mov eax, dword [ebp - 0x3c8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c8]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x3c8]
mov eax, dword [ebp - 0x714]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x5534
setg al
mov dword [ebp - 0x3c8], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030f7d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x684], 0x9f4aec70
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030f6c
push edi
lea ecx, [ebp - 0x440]
call fcn.10016dd3
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x1c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10030fc3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x440]
call fcn.10016e40
mov dword [eax], 0x9f9b3198
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10030fa5
xor eax, eax
mov dword [ebp - 0x1c], eax
mov esi, 0xc4b03e38
cmp dword [ebp - 0x1c], eax
jl 0x10031214
jmp 0x10030fd8
xor eax, eax
mov dword [ebp - 0x20], 0xeb8e136d
mov dword [ebp - 0x18], 0xbbd4aa41
push 4
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0xb53abf6a
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1003100f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x428], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10030ffb
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10031031
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe7c], 0x4bb8686b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10031018
xor eax, eax
mov dword [ebp - 0x420], eax
jmp 0x10031119
mov dword [ebp - 0x2c], 0xe0d6158f
lea ecx, [ebp - 0x440]
push dword [ebp - 0x1c]
call fcn.10016e40
mov eax, dword [ebp - 0x424]
lea ecx, [ebp - 0x440]
push dword [ebp - 0x420]
call fcn.10016e40
mov ecx, dword [ebp - 0x1c]
cmp esi, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0x54a20a29
setg dl
imul edx, dword [ebp - 0x1c]
mov eax, dword [eax]
sub eax, edx
je 0x1003108d
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1003108f
mov eax, edi
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100310a8
mov dword [ebp - 0x38], 0x311c3fc0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
jmp 0x100310b8
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x100310ba
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1003110c
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x440]
push dword [ebp - 0x1c]
call fcn.10016e40
push dword [ebp - 0x1c]
xor ebx, ebx
lea ecx, [ebp - 0x440]
cmp dword [eax], 0xffffaf16
sete bl
call fcn.10016e40
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x48]
setg cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0x2a19820b
setne cl
cmp ecx, dword [ebp - 0x41c]
jle 0x1003110c
xor eax, eax
jmp 0x1003110e
mov eax, edi
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x420]
xor eax, eax
cmp dword [ebp - 0x420], eax
jle 0x1003103c
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x420]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x10031208
mov dword [ebp - 0x20], 0x7656
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10031161
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0xe78], eax
jne 0x10031163
mov esi, eax
jmp 0x10031165
xor eax, eax
mov esi, edi
add esi, 7
lea ecx, [ebp - 0x440]
push eax
mov dword [ebp - 0x41c], esi
call fcn.10016e40
xor ecx, ecx
cmp esi, dword [eax]
setg cl
neg ecx
jne 0x1003118c
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1003118e
mov eax, edi
mov ecx, 0xc1abdda6
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edi
mov eax, dword [ebp - 0xe74]
setg cl
xor edx, edx
cmp ecx, edi
mov ecx, dword [ebp - 0x20]
setg dl
add eax, edx
imul ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, edi
setge al
cmp eax, dword [ebp - 0x2c]
jg 0x100311ee
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10031203
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x100311fa
push 0xa03
push 0xcd4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x100311fa
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfffffff8
dec dword [ebp - 0x18]
jns 0x1003113f
mov esi, 0xc4b03e38
dec dword [ebp - 0x1c]
jns 0x10030fd6
push 2
pop ebx
push 8
pop eax
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], al
call fcn.10016e3b
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jg 0x1003158e
push 9
pop eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x724]
mov dword [ebp - 0x48], 0x1d91e66
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x34], 0x2a3cc92e
mov dword [ebp - 0x34], 0xd82c32b9
push esi
call fcn.10016dd3
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x34], 0x8d6e8597
mov dword [ebp - 0x2c], 0xc1994476
mov dword [ebp - 0x34], 0xc77a5c6a
mov dword [ebp - 0x18], eax
jmp 0x10031297
push dword [ebp - 0x18]
call fcn.10016e40
mov dword [eax], edi
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x724]
cmp dword [ebp - 0x18], esi
jl 0x1003128a
push ebx
call fcn.10016e40
mov ecx, dword [ebp - 0x2c]
mov eax, dword [eax]
inc dword [ebp - 0x2c]
cmp ecx, eax
jle 0x100312b8
xor eax, eax
jmp 0x100312bc
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x20], eax
jne 0x100312cd
cmp dword [ebp - 0x48], eax
jne 0x100312cd
mov esi, eax
xor eax, eax
inc eax
jmp 0x100312d2
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0x724]
call fcn.10016e40
xor ebx, ebx
lea ecx, [ebp - 0x724]
cmp esi, dword [eax]
setle bl
xor eax, eax
push eax
call fcn.10016e40
mov edx, dword [ebp - 0x48]
xor ecx, ecx
push 8
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x48]
sete cl
imul edx, ecx
xor ecx, ecx
imul edx, edi
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, 0x990b
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp eax, edx
pop eax
setg cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x724]
mov byte [ebp - 4], al
call fcn.10016e3b
push 6
pop edi
push 2
mov dword [ebp - 0x10], edi
xor eax, eax
pop ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], 0x4af12a83
push 3
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x10031383
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9c4], 0xd7f825e7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003136b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x10031474
push 4
pop ebx
push ebx
lea ecx, [ebp - 0xd94]
call fcn.10016dd3
or eax, 0xffffffff
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100313bf
push dword [ebp - 0x18]
call fcn.10016e40
push 9
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xd94]
cmp dword [ebp - 0x18], ebx
jl 0x100313af
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x9c4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x9c4]
test eax, eax
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0x28], eax
setne bl
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x9bc]
imul esi, eax
xor eax, eax
push eax
call fcn.10016e40
push 3
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
sub eax, 0xfffffffa
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp esi, eax
pop esi
setge cl
neg ebx
sub ecx, ebx
neg ecx
push 2
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], esi
pop ebx
cmp dword [ebp - 0x28], eax
jl 0x10031455
mov dword [ebp - 0x38], 0x86992f1e
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x10031450
mov dword [ebp - 0x34], 0xbec5ec62
inc dword [ebp - 0x38]
dec dword [ebp - 0x18]
jns 0x10031441
dec dword [ebp - 0x28]
jns 0x10031432
push 8
pop eax
lea ecx, [ebp - 0xd94]
mov byte [ebp - 4], al
call fcn.10016e3b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1003138f
xor eax, eax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x30], 0x1f7e2799
mov dword [ebp - 0x38], 0xb5f0b10
mov dword [ebp - 0x30], edi
xor edi, edi
inc edi
cmp dword [ebp - 0x30], 0xfffffffd
jge 0x100314f3
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x38], edi
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100314ad
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100314d3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], 0x6881
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x38], eax
je 0x1003159a
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1003159c
mov edx, edi
mov ecx, dword [ebp - 0x18]
neg ecx
push 0
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setge al
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffd
pop eax
jl 0x10031491
cmp byte [ebp - 0x11], 0
je 0x10031580
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1003151f
push 9
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1228], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003150b
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003153e
push eax
push eax
push 0x26e9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1003155a
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x1228], 0
jne 0x10031558
dec dword [ebp - 0x18]
jns 0x10031546
xor eax, eax
push 0x20af
push eax
push eax
push 0x26a3
push 0xa2b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10031236
xor eax, eax
mov dword [ebp - 0x28], 0x57a7c203
mov dword [ebp - 0x18], eax
jmp 0x100315b4
xor eax, eax
mov edx, eax
jmp 0x100314d5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9dc], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100315a3
mov eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1003160f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100315e9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6b4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100315d1
xor eax, eax
mov dword [ebp - 0x6ac], 4
jmp 0x10031603
cmp dword [ebp - 0x9d8], eax
jne 0x1003160c
dec dword [ebp - 0x6ac]
cmp dword [ebp - 0x6ac], 0xfffffff9
jne 0x100315f5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
jg 0x100315c9
cmp dword [ebp - 0x1c], eax
je 0x10031657
mov dword [ebp - 0x1c], 0xd0c1
cmp dword [ebp - 0x1c], eax
jne 0x1003164b
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1003163c
mov eax, dword [ebp - 0x318]
mov eax, dword [ebp - 0x318]
mov eax, dword [ebp - 0x320]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x320]
mov eax, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x314]
mov ecx, 0x2afa4368
mov eax, dword [ebp - 0x318]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x318]
mov eax, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sub ecx, eax
sub ecx, dword [ebp - 0x31c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
or ebx, 0xffffffff
cmp ecx, ebx
lea ecx, [ebp - 0x928]
setne al
mov dword [ebp - 0x50], eax
xor eax, eax
mov esi, dword [ebp - 0x314]
push eax
call fcn.10016e40
mov dword [eax], esi
test esi, esi
jne 0x100316b7
mov eax, dword [ebp - 0x1c]
xor eax, eax
lea ecx, [ebp - 0x928]
push eax
call fcn.10016e40
mov eax, dword [ebp - 0x320]
lea ecx, [ebp - 0x928]
xor eax, eax
mov dword [ebp - 0x684], eax
mov dword [ebp - 4], ebx
call fcn.10016e3b
mov dword [ebp - 0x1c], edi
xor edx, edx
mov dword [ebp - 0x10], edi
mov ebx, 0x8029
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
setl dl
xor eax, eax
cmp edx, ebx
setg al
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0xe4e91208
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf09a2b44
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jl 0x10031754
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10031788
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x10031788
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10031782
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x1c], 8
jmp 0x10031779
mov dword [ebp - 0x38], edi
inc dword [ebp - 0x38]
cmp dword [ebp - 0x20], eax
jne 0x1003177f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
je 0x1003176b
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffc
je 0x1003175b
mov dword [ebp - 0x38], 0xbeaa
lea ecx, [ebp - 0xaac]
push edi
call fcn.10016dd3
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x34], 0xf69f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100317d1
push dword [ebp - 0x18]
lea ecx, [ebp - 0xaac]
call fcn.10016e40
mov dword [eax], 0xb457102d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100317b3
xor eax, eax
push eax
lea ecx, [ebp - 0xaac]
call fcn.10016e40
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100317f2
call dword [sym.imp.KERNEL32.dll_GetVersion]
or eax, 0xffffffff
lea ecx, [ebp - 0xaac]
mov dword [ebp - 4], eax
call fcn.10016e3b
push 4
pop eax
mov dword [ebp - 0x38], 0xa1f94964
mov dword [ebp - 0x20], eax
xor eax, eax
push 3
pop esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x3b6f9b69
cmp dword [ebp - 0x38], eax
je 0x1003184a
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0xfffffffa
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x20]
jne 0x1003183d
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10031848
mov eax, edi
jmp 0x1003184a
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003186c
push 0x12e6
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
mov ecx, 0x822c
or edx, 0xffffffff
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0xa04], ecx
mov dword [ebp - 0xa00], ecx
mov dword [ebp - 0x9fc], ecx
mov dword [ebp - 0x9f8], ecx
mov dword [ebp - 0x30], 0xb
jmp 0x100318cf
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x34], 0x693e932
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x34], 0xa98815cb
mov dword [ebp - 0x18], eax
jmp 0x100318c7
inc dword [ebp - 0x9f8]
jne 0x100318cc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jge 0x100318bc
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jl 0x1003189f
push esi
lea ecx, [ebp - 0xc2c]
call fcn.10016dd3
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x34], 0x22e974a5
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x20], 0xab46
mov dword [ebp - 0x2c], 0xfc37f20b
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10031945
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc2c]
call fcn.10016e40
mov dword [eax], 0xc204
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10031924
push 0xfffffffffffffffb
xor eax, eax
pop ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10031965
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x74c], 6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003194d
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], eax
jl 0x100319b5
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003198e
push 0x1455
push 0x18d2
call dword [sym.imp.USER32.dll_SetCaretPos]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100319a8
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100319a5
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10031993
dec dword [ebp - 0x30]
push 0xfffffffffffffffb
pop ecx
jns 0x10031970
cmp dword [ebp - 0x30], 0xdb5a
jne 0x100319db
or eax, 0xffffffff
cmp dword [ebp - 0x74c], eax
sbb eax, eax
inc eax
cmp eax, 0xcc33bab7
sbb eax, eax
neg eax
cmp eax, edi
ja 0x100319db
mov ecx, edi
jmp 0x100319df
xor eax, eax
mov ecx, eax
inc dword [ebp - 0x20]
xor eax, eax
cmp ecx, 0xfffffffa
sete al
xor ecx, ecx
imul eax, dword [ebp - 0x20]
sub eax, 0xb221
imul eax, eax, 0x9f36
cmp eax, 0xfb38
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x38]
jge 0x10031a11
mov esi, eax
cmp dword [ebp - 0x20], eax
je 0x10031a13
mov esi, edi
push eax
lea ecx, [ebp - 0xc2c]
call fcn.10016e40
xor ecx, ecx
cmp esi, dword [eax]
setge cl
imul eax, ecx, 0x700d
lea ecx, [ebp - 0xc2c]
mov dword [ebp - 0x2c], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016e3b
push 2
pop esi
push esi
lea ecx, [ebp - 0x1024]
call fcn.10016dd3
xor eax, eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10031a81
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1024]
call fcn.10016e40
mov dword [eax], 0x55bb2c21
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10031a63
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10031afb
mov dword [ebp - 0x18], 0x5260417b
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x10031af2
cmp dword [ebp - 0x30], edi
jle 0x10031a86
or eax, 0xffffffff
lea ecx, [ebp - 0x1024]
mov dword [ebp - 4], eax
call fcn.10016e3b
mov dword [ebp - 0x1c], edi
xor edx, edx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
setl dl
xor eax, eax
cmp edx, ebx
setg al
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0xe4e91208
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf09a2b44
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jl 0x10031b7f