Function at 0x1002c4bc
Capabilities:
Accept command line arguments
Allocate thread local storage
Clear file content
Connect pipe
Create pipe
Get geographical location
Get memory capacity
Get thread local storage value
Log keystrokes via polling
Query environment variable
Query or enumerate registry value
Set environment variable
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x1008283d
call fcn.100821d0
mov eax, 0x11d0
call fcn.1007e5b0
push ebx
push esi
push edi
push 5
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop edi
mov byte [ebp - 0x85], dl
mov dword [ebp - 0x70], ecx
cmp dword [ebp - 0x18], edi
jge 0x1002c507
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x115c], 0x313d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002c4ef
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_ScrollWindowEx]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x1002c547
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002c542
push 0xe72
push eax
push eax
push eax
push eax
push 0x238f
push 0xd3f
call esi
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002c51f
push 5
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002c56d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11ac], 0x313d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002c555
xor eax, eax
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x1002c5a1
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002c59c
push 0xe72
push eax
push eax
push eax
push eax
push 0x238f
push 0xd3f
call esi
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002c579
mov dword [ebp - 0x18], 0x8d4081c2
xor ecx, ecx
mov dword [ebp - 0x3c], 0x5e1abe8f
inc ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002c5ce
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x358], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002c5ba
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002c613
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x1002c60e
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x358]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x358], ecx
mov eax, dword [ebp - 0x18]
add eax, ecx
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002c60c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002c5e1
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002c5d6
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push 2
mov dword [ebp - 0x1c], eax
xor eax, eax
pop ecx
push 9
pop edx
cmp dword [ebp - 0x1c], eax
jne 0x1002c783
mov dword [ebp - 0x1c], eax
jmp 0x1002c656
cmp byte [ebp - 0x25], 0
je 0x1002c653
push eax
push 0x23f1
push eax
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x13
mov byte [ebp - 0x25], al
jl 0x1002c638
cmp byte [ebp - 0x25], 0
je 0x1002c67c
push eax
call esi
push eax
call edi
push eax
xor eax, eax
push eax
push 0x15bc
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
xor eax, eax
or edi, 0xffffffff
push 5
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002c6a7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x118c], 0x313d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c68e
xor eax, eax
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x1002c6db
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002c6d6
push 0xe72
push eax
push eax
push eax
push eax
push 0x238f
push 0xd3f
call esi
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002c6b3
mov dword [ebp - 0x54], 0xc05baf43
mov dword [ebp - 0x54], 0xfffffff7
mov dword [ebp - 0x54], 0x7eede0b4
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], 0x5a9c4c8d
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002c724
push eax
push eax
call edi
xor eax, eax
dec dword [ebp - 0x6c]
push 5
pop ecx
mov dword [ebp - 0x20], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x30], 0x357257ea
mov dword [ebp - 0x6c], 0x6903
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov dword [ebp - 0x18], eax
inc ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002c76b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xac], 0x40d7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002c753
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x1002c8ef
mov dword [ebp - 0x3c], 0x919c
mov dword [ebp - 0x18], eax
jmp 0x1002c7cd
or edi, 0xffffffff
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x18], eax
jmp 0x1002c79b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc98], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002c78e
mov eax, dword [ebp - 0xc98]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1c], eax
xor eax, eax
jmp 0x1002c67f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc68], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c7bc
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xac]
test eax, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xac]
cmp edx, eax
setg cl
cmp ecx, 0xfffffffc
mov dword [ebp - 0xc64], ecx
mov eax, dword [ebp - 0x14]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1002c8dd
mov dword [ebp - 0x40], eax
push 3
mov dword [ebp - 0x48], 0xfcb44481
pop ecx
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], eax
jl 0x1002c8bb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002c871
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x704], 0x84902314
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c858
xor eax, eax
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x6fc], ecx
jg 0x1002c8b6
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xc60]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xc68]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x6fc]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], 0x6f9a4d91
inc dword [ebp - 0x6fc]
cmp dword [ebp - 0x6fc], ecx
jle 0x1002c87f
xor eax, eax
dec dword [ebp - 0x40]
jns 0x1002c84f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac], ecx
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1002c83a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
push 0
pop eax
jle 0x1002c777
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1002c91f
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
neg eax
je 0x1002c904
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x3c], 0xfeac8e4c
dec dword [ebp - 0x30]
jns 0x1002c8f7
xor eax, eax
mov dword [ebp - 0x1c], 0xe0648261
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002c946
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb84], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002c92e
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002c961
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002c95e
push eax
push eax
call dword [sym.imp.USER32.dll_CopyRect]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jl 0x1002c94b
mov dword [ebp - 0x1c], eax
jmp 0x1002ca53
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jl 0x1002ca50
mov dword [ebp - 0x20], 0x5f5b1b6f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002c9ab
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x688], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002c992
xor eax, eax
mov dword [ebp - 0x684], eax
jmp 0x1002ca12
mov dword [ebp - 0x2c], 0xdf3d37a5
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002ca0c
mov dword [ebp - 0x18], 0xc2e7ccc8
mov dword [ebp - 0x18], eax
jmp 0x1002ca02
mov dword [ebp - 0x20], 0x8e9646b8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002c9ff
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002c9fa
push eax
push 0x2166
push 0xb04
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002c9dd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x1002c9ce
dec dword [ebp - 0x2c]
jns 0x1002c9c2
inc dword [ebp - 0x684]
cmp dword [ebp - 0x684], eax
jle 0x1002c9b3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002ca47
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002ca42
push eax
push eax
push 0x1371
push 0x513
call esi
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002ca22
dec dword [ebp - 0x40]
jns 0x1002c982
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002c96f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002ca7e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11cc], 0x313d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002ca65
xor eax, eax
xor edx, edx
mov dword [ebp - 0x6c], 0xfff8
inc edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002cab1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4d0], 0xfff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002ca99
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jg 0x1002cb88
mov dword [ebp - 0x1c], 0x6df37d45
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x1002cb79
mov dword [ebp - 0xa4], 0xfffffff6
mov dword [ebp - 0x20], 0xeafb5d1c
mov dword [ebp - 0x18], eax
jmp 0x1002cafa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x578], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002caed
mov dword [ebp - 0x24], 0x2524
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xa4], eax
xor eax, eax
cmp dword [ebp - 0xa4], eax
jne 0x1002cb1e
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002cb29
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002cb3e
mov eax, edx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push 0
mov ecx, dword [ebp + eax*4 - 0x4d0]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4d0], ecx
lea eax, [ecx + 0xaa12]
mov dword [ebp - 0x578], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], edx
jle 0x1002cad7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002cabd
push 2
pop ecx
mov dword [ebp - 0x24], eax
jmp 0x1002cbc5
mov dword [ebp - 0x14], eax
jmp 0x1002cbbc
mov dword [ebp - 0x34], 0x4e1054d8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jge 0x1002cbb9
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x4d0], 0x2c78
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x1002cba1
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe8
jle 0x1002cb92
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe2
je 0x1002cb8d
mov dword [ebp - 0x20], 3
mov dword [ebp - 0xa4], 0x949f4ffc
cmp dword [ebp - 0x20], eax
jl 0x1002d005
or edi, 0xffffffff
jmp 0x1002cbed
push 2
pop ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002cc1e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1b8], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002cc06
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002cc3e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf0], 0xc45cdbe8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002cc26
xor eax, eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], edx
jg 0x1002ceaa
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x594], ecx
mov dword [ebp - 0x590], ecx
mov dword [ebp - 0x58c], ecx
mov dword [ebp - 0x588], ecx
mov dword [ebp - 0x1c], 0xfaa0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002cc97
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x200], 0x10b999fb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002cc7e
xor eax, eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], edx
jg 0x1002cde9
mov dword [ebp - 0x3c], 0x23f1
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002ccd8
push 5
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa98], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002ccc3
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002cce8
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [ebp - 0xa98]
xor ecx, ecx
mov eax, dword [ebp - 0x1fc]
mov eax, dword [ebp - 0xa90]
test eax, eax
mov eax, dword [ebp - 0xf0]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1fc]
setl dl
imul eax, edx
cmp dword [ebp - 0x3c], eax
jl 0x1002cd2d
xor eax, eax
cmp dword [ebp - 0xa98], eax
jne 0x1002cd2d
xor esi, esi
mov edx, eax
inc esi
jmp 0x1002cd32
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0xa98]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1b8]
setne cl
xor edx, edx
cmp ecx, 8
setne dl
imul eax, edx
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002cd64
mov edx, esi
cmp dword [ebp - 0x1fc], eax
jne 0x1002cd66
mov edx, eax
mov esi, dword [ebp - 0x1fc]
xor ecx, ecx
mov dword [ebp - 0x594], esi
mov eax, dword [ebp - 0xec]
cmp edx, eax
mov eax, dword [ebp - 0xec]
setle cl
xor edx, edx
add ecx, 0x74db503b
cmp ecx, eax
setl dl
xor eax, eax
cmp esi, edx
jl 0x1002cda7
cmp dword [ebp - 0xf0], eax
je 0x1002cda7
xor edx, edx
inc edx
mov eax, edx
jmp 0x1002cdaa
xor edx, edx
inc edx
imul eax, eax, 0xd482
cmp eax, dword [ebp - 0x1b8]
jl 0x1002cdc6
xor eax, eax
cmp dword [ebp - 0x1b8], eax
je 0x1002cdc8
mov ecx, edx
jmp 0x1002cdca
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, edi
push 0
sete al
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x1fc]
pop eax
cmp dword [ebp - 0x1fc], edx
jle 0x1002cca9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x1002ce92
mov dword [ebp - 0x4c], 0xb3176a17
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x594]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], edx
xor edx, edx
mov ecx, dword [ebp - 0x594]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setg dl
mov dword [ebp - 0x4c], edx
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x4c]
inc eax
cmp eax, ecx
setle dl
xor ecx, ecx
cmp edx, 0x8509
setle cl
xor edx, edx
sub ecx, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0xf0]
add ecx, 0xfffffffd
cmp eax, ecx
mov eax, dword [ebp - 0x1b4]
setle dl
sub edx, eax
mov eax, dword [ebp - 0x594]
dec eax
add eax, edx
neg eax
sbb eax, eax
xor edx, edx
neg eax
inc edx
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002cdf5
xor eax, eax
inc dword [ebp - 0xec]
cmp dword [ebp - 0xec], edx
jle 0x1002cc50
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xf0], eax
push 0
pop eax
sete al
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x18], 0x8d4081c2
mov dword [ebp - 0x3c], 0x5e1abe8f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002ceeb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x378], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002ced7
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002cf30
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x1002cf2b
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x378]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x378], ecx
mov eax, dword [ebp - 0x18]
add eax, ecx
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002cf29
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002cefe
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002cef3
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002cff3
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002cf9e
mov dword [ebp - 0x1c], eax
jmp 0x1002cf74
cmp byte [ebp - 0x25], 0
je 0x1002cf71
push eax
push 0x23f1
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x13
mov byte [ebp - 0x25], al
jl 0x1002cf52
cmp byte [ebp - 0x25], 0
je 0x1002cfd8
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
xor eax, eax
push eax
push 0x15bc
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
jmp 0x1002cfd6
mov dword [ebp - 0x4c], edi
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002cfc1
push 9
pop edx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbc0], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002cfaf
mov eax, dword [ebp - 0xbc0]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
xor eax, eax
push 0xe72
push eax
push eax
push eax
push eax
push 0x238f
push 0xd3f
call esi
push eax
call ebx
xor edx, edx
inc edx
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1002cbea
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, 0xffff
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x3c], 0x664087a9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe5
push 2
pop ebx
je 0x1002d178
xor edi, edi
mov dword [ebp - 0x18], eax
jmp 0x1002d049
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x954], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002d03c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002d162
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d0c1
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x905
push 0x1d7c
push 0x1e18
push 0x25a1
push 0x3b4
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1eed
push 0x1549
push 0xb46
push 0x1e1d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
push 2
xor eax, eax
pop ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x1002d154
push 5
pop eax
mov dword [ebp - 0x3c], 0xad7d
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 0xc131
jne 0x1002d0ea
mov eax, dword [ebp - 0x954]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x954]
cmp edx, eax
setne cl
xor eax, eax
cmp dword [ebp - 0x3c], ecx
jge 0x1002d11d
lea edx, [edi + 1]
cmp dword [ebp - 0x24], eax
jne 0x1002d11f
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x954]
cmp eax, edx
setne cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002d146
push eax
call esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1002d0cd
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002d063
mov ecx, 0xffff
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
push 0
pop eax
jne 0x1002d037
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 0x54], 0xc05baf43
or ecx, 0xffffffff
mov dword [ebp - 0x54], 0xfffffff7
mov dword [ebp - 0x54], 0x7eede0b4
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], 0x5a9c4c8d
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d1c1
push eax
push eax
call edi
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x4c]
mov dword [ebp - 0x5a8], ecx
mov dword [ebp - 0x5a4], ecx
mov dword [ebp - 0x5a0], ecx
mov dword [ebp - 0x59c], ecx
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x4c], 0xa9bca7b5
mov dword [ebp - 0x2c], 0x639e
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], eax
jmp 0x1002d20a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8d8], 0xc8d3c891
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002d1f9
inc dword [ebp - 0x40]
xor ebx, ebx
mov eax, dword [ebp - 0x8d8]
xor edx, edx
push 5
lea ecx, [ebx + 1]
sub ecx, eax
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
pop eax
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp dword [ebp - 0x40], ecx
jle 0x1002d25f
mov dword [ebp - 0x4c], 0xfffffffd
dec dword [ebp - 0x4c]
jmp 0x1002d32f
mov dword [ebp - 0x38], 0xfffffffb
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffc
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002d292
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7f0], 0xb9cc5119
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002d27a
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002d2b1
push 9
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10a0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002d29e
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002d2f9
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x5a0]
cmp eax, ecx
setg dl
xor ecx, ecx
imul eax, edx, 0xea6c
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x8d4], edx
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setne cl
mov dword [ebp - 0x7ec], ecx
mov eax, dword [ebp - 0x7ec]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x5a0]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002d313
mov edx, eax
cmp dword [ebp - 0x4c], eax
je 0x1002d316
lea edx, [ebx + 1]
mov dword [ebp - 0x59c], edx
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1098], ecx
mov dword [ebp - 0x54], 0xc05baf43
xor eax, eax
mov dword [ebp - 0x54], 0xfffffff7
or ecx, 0xffffffff
mov dword [ebp - 0x54], 0x7eede0b4
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], 0x5a9c4c8d
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002d376
push eax
push eax
call edi
xor eax, eax
dec dword [ebp - 0x4c]
xor edx, edx
mov dword [ebp - 0x24], 0x638ecf54
inc edx
mov dword [ebp - 0x18], edx
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002d3a9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x238], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002d391
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], bl
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
je 0x1002d3e0
push 0x68c
push 0xdd5
push 0xc81
push 0x48d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jg 0x1002d521
push 2
pop esi
mov dword [ebp - 0x34], 0x30722263
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x238], 0
jne 0x1002d519
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x1002d50d
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x1002d501
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jg 0x1002d4c6
cmp dword [ebp - 0x14], eax
jne 0x1002d4a5
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x238]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x238]
sub ecx, eax
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x238]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp edx, eax
setge cl
cmp ecx, esi
sbb eax, eax
xor edx, edx
neg eax
inc edx
cmp eax, edx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x238]
jl 0x1002d49c
mov eax, dword [ebp - 0x34]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x1002d4a7
mov ecx, edx
mov eax, dword [ebp - 0x14]
push 0
mov eax, dword [ebp + eax*4 - 0x238]
imul eax, ecx
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], edx
jle 0x1002d43d
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x1002d4f5
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d4ed
push eax
push 0x61e
push 0x13b3
call ebx
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002d4ce
xor edx, edx
inc edx
dec dword [ebp - 0x20]
jns 0x1002d427
or ecx, 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x1002d418
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x1002d3ef
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x3c], 0x664087a9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe5
je 0x1002d688
xor edi, edi
mov dword [ebp - 0x18], eax
jmp 0x1002d55b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9d8], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002d54a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
push 2
pop eax
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jl 0x1002d66f
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d5cd
push 0x905
push 0x1d7c
push 0x1e18
push 0x25a1
push 0x3b4
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1eed
push 0x1549
push 0xb46
push 0x1e1d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jg 0x1002d666
push 5
pop eax
mov dword [ebp - 0x3c], 0xad7d
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 0xc131
jne 0x1002d5f9
mov eax, dword [ebp - 0x9d8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x9d8]
cmp edx, eax
setne cl
xor eax, eax
cmp dword [ebp - 0x3c], ecx
jge 0x1002d62c
lea edx, [edi + 1]
cmp dword [ebp - 0x24], eax
jne 0x1002d62e
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x9d8]
cmp eax, edx
setne cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002d655
push eax
call esi
inc dword [ebp - 0x24]
push 2
pop eax
cmp dword [ebp - 0x24], eax
jle 0x1002d5dc
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002d578
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
push 0
pop eax
jne 0x1002d545
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
xor edx, edx
inc edx
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x14], 0xd64ea33a
mov dword [ebp - 0x34], edx
push 2
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x5c], 0xd30cd947
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1002d6c8
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x12c], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1002d6af
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002d6da
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x5dc], edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1002d6cd
inc dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 0x40e11a79
setl cl
xor edx, edx
sub ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x5d4]
mov eax, dword [ebp - 0x12c]
cmp ecx, eax
mov eax, dword [ebp - 0x12c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
sub eax, ecx
sub eax, dword [ebp - 0x12c]
cmp eax, 0xfffffffb
mov eax, dword [ebp - 0x5d4]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x34]
jle 0x1002d744
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x5dc]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x5dc], eax
imul eax, eax, 0x7cbb
cmp eax, 0xffff
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x12c]
sub ecx, eax
mov eax, 0xde21e525
je 0x1002d846
mov dword [ebp - 0x5c8], eax
or ecx, 0xffffffff
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5bc], eax
push 9
mov dword [ebp - 0x3c], 0xefaa
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0xffffffe4
jl 0x1002d9b1
xor edi, edi
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002d7db
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbd8], 0x9b8ae051
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002d7ca
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x8a3d3555
je 0x1002d7f9
mov eax, dword [ebp - 0xbd8]
mov eax, dword [ebp - 0x5bc]
mov eax, dword [ebp - 0xbd8]
xor eax, eax
cmp dword [ebp - 0x5c0], eax
jne 0x1002d814
cmp dword [ebp - 0x34], eax
je 0x1002d817
lea eax, [edi + 1]
imul eax, eax, 0xd319
cmp eax, dword [ebp - 0x5bc]
jl 0x1002d82c
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002d82f
lea eax, [edi + 1]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe4
jge 0x1002d7c3
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x1002d9b1
xor eax, eax
or ecx, 0xffffffff
inc eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], 0x8409d7ff
push 2
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x1002d87e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x888], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002d866
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jg 0x1002d9a2
xor esi, esi
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x12c]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x12c]
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x12c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
cmp ecx, dword [ebp + eax*4 - 0x12c]
jl 0x1002d8ed
xor eax, eax
cmp dword [ebp - 0x5dc], eax
je 0x1002d8ef
lea eax, [esi + 1]
jmp 0x1002d8ef
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x5dc]
mov eax, dword [ebp - 0x5dc]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
push 2
mov ecx, dword [ebp + eax*4 - 0x12c]
mov eax, dword [ebp - 0x12c]
sub eax, 0xffff
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x12c]
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x888], ecx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x12c]
setle dl
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x5c]
setle cl
cmp ecx, 0xfffc
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
pop edx
sete cl
add ecx, edx
jne 0x1002d984
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x12c], esi
jne 0x1002d984
xor eax, eax
jmp 0x1002d987
lea eax, [esi + 1]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002d88c
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x5f0], ecx
xor eax, eax
mov dword [ebp - 0x5ec], ecx
mov dword [ebp - 0x5e8], ecx
mov dword [ebp - 0x5e4], ecx
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x4c], 0xa9bca7b5
mov dword [ebp - 0x2c], 0x639e
push 2
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002d9fc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x800], 0xc8d3c891
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002d9eb
inc dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x800]
inc ecx
sub ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
push 5
setl dl
xor ecx, ecx
pop eax
cmp edx, eax
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp dword [ebp - 0x40], ecx
jle 0x1002da4f
mov dword [ebp - 0x4c], 0xfffffffd
dec dword [ebp - 0x4c]
jmp 0x1002db23
mov dword [ebp - 0x38], 0xfffffffb
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffc
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002da82
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x938], 0xb9cc5119
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002da6a
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002daa1
push 9
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfe0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002da8e
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002dae9
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x5e8]
cmp eax, ecx
setg dl
xor ecx, ecx
imul eax, edx, 0xea6c
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x7fc], edx
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setne cl
mov dword [ebp - 0x934], ecx
mov eax, dword [ebp - 0x934]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x5e8]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002db05
cmp dword [ebp - 0x4c], eax
jne 0x1002db05
mov edx, eax
jmp 0x1002db0a
xor eax, eax
lea edx, [eax + 1]
mov dword [ebp - 0x5e4], edx
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0xfd8], ecx
mov dword [ebp - 0x1c], 0xfffffff9
xor eax, eax
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x3c], 0x664087a9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe5
je 0x1002dc89
xor edi, edi
mov dword [ebp - 0x18], eax
jmp 0x1002db5f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x96c], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002db4e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
push 2
pop eax
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jl 0x1002dc73
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002dbd1
push 0x905
push 0x1d7c
push 0x1e18
push 0x25a1
push 0x3b4
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1eed
push 0x1549
push 0xb46
push 0x1e1d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jg 0x1002dc6a
push 5
pop eax
mov dword [ebp - 0x3c], 0xad7d
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 0xc131
jne 0x1002dbfd
mov eax, dword [ebp - 0x96c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x96c]
cmp edx, eax
setne cl
xor eax, eax
cmp dword [ebp - 0x3c], ecx
jge 0x1002dc30
lea edx, [edi + 1]
cmp dword [ebp - 0x24], eax
jne 0x1002dc32
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x96c]
cmp eax, edx
setne cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002dc59
push eax
call esi
inc dword [ebp - 0x24]
push 2
pop eax
cmp dword [ebp - 0x24], eax
jle 0x1002dbe0
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002db7c
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
push 0
pop eax
jne 0x1002db49
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
xor edx, edx
mov dword [ebp - 0x24], 0x638ecf54
inc edx
mov dword [ebp - 0x18], edx
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002dcb9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x278], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002dca1
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002dceb
push 0x68c
push 0xdd5
push 0xc81
push 0x48d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jg 0x1002de2c
push 2
pop edi
mov dword [ebp - 0x34], 0x30722263
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x278], 0
jne 0x1002de24
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x1002de18
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x1002de0c
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jg 0x1002ddd1
cmp dword [ebp - 0x14], eax
jne 0x1002ddb0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x278]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x278]
sub ecx, eax
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x278]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp edx, eax
setge cl
cmp ecx, edi
sbb eax, eax
xor edx, edx
neg eax
inc edx
cmp eax, edx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x278]
jl 0x1002dda7
mov eax, dword [ebp - 0x34]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x1002ddb2
mov ecx, edx
mov eax, dword [ebp - 0x14]
push 0
mov eax, dword [ebp + eax*4 - 0x278]
imul eax, ecx
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], edx
jle 0x1002dd48
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x1002de00
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002ddf8
push eax
push 0x61e
push 0x13b3
call ebx
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002ddd9
xor edx, edx
inc edx
dec dword [ebp - 0x20]
jns 0x1002dd32
or ecx, 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x1002dd23
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x1002dcfa
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov dword [ebp - 0x24], 0x638ecf54
mov dword [ebp - 0x18], edx
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002de59
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x268], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002de41
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002de8b
push 0x68c
push 0xdd5
push 0xc81
push 0x48d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jg 0x1002dfcc
push 2
pop esi
mov dword [ebp - 0x34], 0x30722263
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x268], 0
jne 0x1002dfc4
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x1002dfb8
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x1002dfac
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jg 0x1002df71
cmp dword [ebp - 0x14], eax
jne 0x1002df50
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x268]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x268]
sub ecx, eax
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x268]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp edx, eax
setge cl
cmp ecx, esi
sbb eax, eax
xor edx, edx
neg eax
inc edx
cmp eax, edx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x268]
jl 0x1002df47
mov eax, dword [ebp - 0x34]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x1002df52
mov ecx, edx
mov eax, dword [ebp - 0x14]
push 0
mov eax, dword [ebp + eax*4 - 0x268]
imul eax, ecx
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], edx
jle 0x1002dee8
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x1002dfa0
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002df98
push eax
push 0x61e
push 0x13b3
call ebx
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002df79
xor edx, edx
inc edx
dec dword [ebp - 0x20]
jns 0x1002ded2
or ecx, 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x1002dec3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x1002de9a
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x3c], 0x664087a9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe5
je 0x1002e130
xor edi, edi
mov dword [ebp - 0x18], eax
jmp 0x1002e006
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9cc], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002dff5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
push 2
pop eax
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jl 0x1002e11a
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e078
push 0x905
push 0x1d7c
push 0x1e18
push 0x25a1
push 0x3b4
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1eed
push 0x1549
push 0xb46
push 0x1e1d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jg 0x1002e111
push 5
pop eax
mov dword [ebp - 0x3c], 0xad7d
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 0xc131
jne 0x1002e0a4
mov eax, dword [ebp - 0x9cc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x9cc]
cmp edx, eax
setne cl
xor eax, eax
cmp dword [ebp - 0x3c], ecx
jge 0x1002e0d7
lea edx, [edi + 1]
cmp dword [ebp - 0x24], eax
jne 0x1002e0d9
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x9cc]
cmp eax, edx
setne cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002e100
push eax
call esi
inc dword [ebp - 0x24]
push 2
pop eax
cmp dword [ebp - 0x24], eax
jle 0x1002e087
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002e023
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
push 0
pop eax
jne 0x1002dff0
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 0x3c], 0xaa9ac70c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002e159
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1050], 0xf73838a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002e140
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e16e
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov eax, dword [ebp - 0x104c]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x54], 0xc05baf43
mov dword [ebp - 0x54], 0xc6a5
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002e1aa
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
xor eax, eax
push eax
push 0x15bc
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e1d0
push eax
push eax
push eax
push 0xa59
push 0x56
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
mov dword [ebp - 0x54], 0xfffffff7
mov dword [ebp - 0x18], 0x62d5e48d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002e200
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xec0], 0x69f30c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002e1e7
xor eax, eax
xor edx, edx
mov dword [ebp - 0x18], eax
inc edx
cmp dword [ebp - 0x18], 0xfffffffc
je 0x1002e23f
mov dword [ebp - 0x4c], eax
xor ecx, ecx
mov dword [ebp - 0x3c], 0xb2391cb4
mov eax, dword [ebp - 0x4c]
cmp eax, 0xf737
setge cl
cmp ecx, edx
jb 0x1002e22d
mov eax, dword [ebp - 0xebc]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffc
push 0
pop eax
jne 0x1002e20c
mov dword [ebp - 0x54], 0x7eede0b4
mov dword [ebp - 0x30], 0x1f7e2799
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002e277
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d4], 0xf0b101aa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002e25f
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe6
je 0x1002e40e
push 9
pop esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x9ac196a1
cmp dword [ebp - 0x18], eax
jne 0x1002e402
mov dword [ebp - 0x14], 0xb7ce
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x30]
test eax, eax
je 0x1002e2ed
mov dword [ebp - 0x14], 0xffffffe5
cmp dword [ebp - 0x14], edx
je 0x1002e2e2
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e2da
push eax
push 0x1b79
push 0x1cc7
push eax
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
xor edx, edx
xor eax, eax
inc edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jne 0x1002e2ba
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
jmp 0x1002e3f2
mov dword [ebp - 0x24], 7
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002e332
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e32d
push 0x8ce
push 0x159b
push edx
push eax
push 0x1020
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor edx, edx
xor eax, eax
inc edx
dec dword [ebp - 0x14]
jns 0x1002e308
cmp dword [ebp - 0x24], eax
jne 0x1002e394
cmp dword [ebp - 0x30], eax
jne 0x1002e394
mov eax, dword [ebp - 0x30]
neg eax
je 0x1002e34e
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002e350
mov ecx, edx
jmp 0x1002e352
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
imul eax, ecx
sub eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x3c], eax
jne 0x1002e36a
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002e36c
mov eax, edx
cmp eax, dword [ebp - 0x14]
jl 0x1002e374
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1d4]
xor edx, edx
mov eax, dword [ebp - 0x30]
add ecx, eax
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setge dl
neg edx
cmp edx, 0xfffffffa
jae 0x1002e394
xor eax, eax
jmp 0x1002e399
xor edi, edi
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 2
setl cl
xor edx, edx
add ecx, dword [ebp - 0x1d4]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, 0xa457
jge 0x1002e3d9
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
mov dword [ebp - 0x24], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
inc edx
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe6
push 0
pop eax
jne 0x1002e287
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x24], 0x1928c176
mov dword [ebp - 0x3c], 8
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002e442
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd24], 0x7e3b6f9b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002e42a
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e45a
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 2
xor eax, eax
pop ecx
xor ebx, ebx
mov dword [ebp - 0x24], eax
inc ebx
cmp dword [ebp - 0x24], ecx
jg 0x1002e4ff
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002e490
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x17c], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e478
xor eax, eax
cmp dword [ebp - 0x17c], eax
je 0x1002e49a
mov eax, ebx
mov ecx, dword [ebp - 0x24]
imul ecx, eax
push 2
sub ecx, 0x89051546
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x13ec752f
setne al
xor ecx, ecx
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0x17c]
test eax, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x17c]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x24]
pop ecx
push 0
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], ecx
jle 0x1002e469
mov dword [ebp - 0x54], 0x5a9c4c8d
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], 0xa47c9d5f
push 5
mov dword [ebp - 0x54], 8
pop edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002e53f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc7c], 0xe48d327c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002e526
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002e55f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbcc], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002e547
xor eax, eax
push 3
pop edx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x1002e613
mov dword [ebp - 0x3c], 0x2fdc
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x54], 0x980db95
mov dword [ebp - 0x54], 0xfffffffd
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x54], 0x9adb8213
mov dword [ebp - 0x54], 0x41ce3cb5
mov dword [ebp - 0x54], 0x8b166c19
mov dword [ebp - 0x54], 0x691f6f49
mov dword [ebp - 0x5c], 0x9a7032f1
mov dword [ebp - 0x18], eax
jmp 0x1002e5c6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1134], 0x3dd972c4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002e5b5
mov eax, dword [ebp - 0x24]
push 0
mov eax, dword [ebp + eax*4 - 0xc7c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xc7c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xc7c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xbcc], eax
inc dword [ebp - 0x5c]
dec dword [ebp - 0x24]
pop eax
jns 0x1002e56e
inc dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x14], 0x7571177e
mov dword [ebp - 0x4c], 0xd21b1857
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002e650
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9e8], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002e637
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x14
je 0x1002e76d
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x4c], 0x7b9c5c93
mov dword [ebp - 0x48], 0x83019c36
mov dword [ebp - 0x18], eax
jmp 0x1002e68b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcb0], 0x169ff9e6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002e67a
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x40]
jle 0x1002e6b5
cmp dword [ebp - 0x14], eax
je 0x1002e6b5
mov eax, ebx
imul eax, eax, 0xf9be
test eax, eax
je 0x1002e6ca
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002e6cc
mov edx, ebx
jmp 0x1002e6ce
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
sub ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
cmp ecx, 0xfffe
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x9e0]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setge dl
cmp edx, dword [ebp - 0x9e8]
je 0x1002e724
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002e726
mov eax, ebx
mov dword [ebp - 0x4c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
push 0
setg cl
mov dword [ebp - 0xcac], ecx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9e4]
mov eax, dword [ebp - 0x9e0]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
pop eax
push 2
pop ecx
jne 0x1002e65d
push 3
pop edx
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x7c], 0xffffffff
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002e7c1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1000], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002e7a8
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002e7dd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbe0], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002e7c9
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x1002e875
mov dword [ebp - 0x40], 0x8fb770a7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002e810
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x50c], 0x3b15a8df
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e7f8
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e826
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 3
xor eax, eax
pop edx
cmp dword [ebp - 0x34], eax
jne 0x1002e837
mov eax, dword [ebp - 0xff8]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xbe0]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50c], ebx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
sub eax, 4
neg eax
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x34]
pop eax
cmp dword [ebp - 0x34], edx
jle 0x1002e7e9
push 2
pop ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002e89f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x344], 0x9841b3c6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002e887
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jg 0x1002e9dc
push 2
pop edi
mov dword [ebp - 0x3c], 0xfd061a65
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x18], eax
jmp 0x1002e8d2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x188], 0xd5a519d8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e8c1
mov dword [ebp - 0x18], 6
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x344], ecx
je 0x1002e931
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x344], ecx
je 0x1002e931
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x344]
mov eax, dword [ebp - 0x340]
cmp eax, ecx
setge dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x188], eax
test eax, eax
je 0x1002e925
mov eax, dword [ebp - 0x188]
xor eax, eax
cmp dword [ebp - 0x188], eax
jne 0x1002e938
jmp 0x1002e933
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002e93a
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x344]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x33c]
sete dl
xor ebx, ebx
cmp edx, 0x1516
setle bl
xor ecx, ecx
cmp eax, ebx
setne cl
add ecx, 0x290ce96f
jne 0x1002e984
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002e984
cmp dword [ebp - 0x4c], eax
jne 0x1002e984
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x1002e989
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x188]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
push 0
setg dl
xor ecx, ecx
mov esi, dword [ebp + eax*4 - 0x344]
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov eax, dword [ebp - 0x344]
setne cl
xor edx, edx
cmp esi, ecx
setne dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1002e8ae
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x25], al
mov ecx, 0x680a2560
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x4c], 0x45
mov dword [ebp - 0x38], 0x76c56d2
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ea2a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x150], 0x5568
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ea12
xor eax, eax
mov ecx, 0xfff7
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x150], eax
je 0x1002eb48
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x3c], 0x3cd4fe93
cmp dword [ebp - 0x34], eax
je 0x1002ead8
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, ebx
mov eax, dword [ebp - 0x150]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x150]
setg cl
sub eax, ecx
jne 0x1002ea92
cmp dword [ebp - 0x4c], eax
jne 0x1002ea92
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x1002ea94
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x34]
add ecx, 3
je 0x1002ead6
mov ecx, ebx
jmp 0x1002eada
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x5659cde3
push 2
setg al
pop ecx
cmp eax, ecx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x150]
jne 0x1002eafe
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x1002eb00
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
sub edx, 0x1fffa
cmp edx, eax
mov eax, dword [ebp - 0x150]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x228d029b
setne al
jmp 0x1002eb55
mov dword [ebp - 0x3c], 0xb407cb0b
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x5c]
cmp byte [ebp - 0x25], 0
je 0x1002eb67
xor eax, eax
push eax
push eax
call edi
mov dword [ebp - 0x44], 0xa2768935
or eax, 0xffffffff
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x10f7a73d
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x50], 3
push 7
pop edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x38], 0xfa9a1804
mov dword [ebp - 0x48], 0x77c83be7
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002ebc4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc90], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002ebb0
xor eax, eax
inc dword [ebp - 0x20]
jne 0x1002ebf5
cmp dword [ebp - 0x44], eax
jne 0x1002ebe6
mov eax, dword [ebp - 0xc8c]
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0xc8c]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xc8c], 0x229656d2
push 9
pop eax
mov dword [ebp - 0x4c], eax
xor eax, eax
dec dword [ebp - 0x60]
mov dword [ebp - 0x30], 0x1f7e2799
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ec3a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a8], 0xf0b101aa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ec22
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe6
je 0x1002edc1
push 9
pop esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x9ac196a1
cmp dword [ebp - 0x18], eax
jne 0x1002edb8
mov dword [ebp - 0x14], 0xb7ce
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x30]
test eax, eax
je 0x1002ecad
mov dword [ebp - 0x14], 0xffffffe5
cmp dword [ebp - 0x14], ebx
je 0x1002eca2
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002ec9a
push eax
push 0x1b79
push 0x1cc7
push eax
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jne 0x1002ec7d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
jmp 0x1002eda5
mov dword [ebp - 0x24], edx
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002eceb
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002ece6
push 0x8ce
push 0x159b
push ebx
push eax
push 0x1020
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002ecc4
cmp dword [ebp - 0x24], eax
jne 0x1002ed4d
cmp dword [ebp - 0x30], eax
jne 0x1002ed4d
mov eax, dword [ebp - 0x30]
neg eax
je 0x1002ed07
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002ed09
mov ecx, ebx
jmp 0x1002ed0b
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
imul eax, ecx
sub eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x3c], eax
jne 0x1002ed23
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002ed25
mov eax, ebx
cmp eax, dword [ebp - 0x14]
jl 0x1002ed2d
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1a8]
xor edx, edx
mov eax, dword [ebp - 0x30]
add ecx, eax
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setge dl
neg edx
cmp edx, 0xfffffffa
jae 0x1002ed4d
xor eax, eax
jmp 0x1002ed4f
mov eax, ebx
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 2
setl cl
xor edx, edx
add ecx, dword [ebp - 0x1a8]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, 0xa457
jge 0x1002ed8f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe6
push 0
pop eax
push 7
pop edx
jne 0x1002ec4a
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
push 4
pop ecx
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x14], 0xd64ea33a
mov dword [ebp - 0x34], ebx
push 2
pop edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x5c], 0xd30cd947
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1002ee01
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x120], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1002ede8
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002ee13
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x618], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x1002ee06
inc dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 0x40e11a79
setl cl
xor edx, edx
sub ecx, dword [ebp - 0x120]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x610]
mov eax, dword [ebp - 0x120]
cmp ecx, eax
mov eax, dword [ebp - 0x120]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
sub eax, ecx
sub eax, dword [ebp - 0x120]
cmp eax, 0xfffffffb
mov eax, dword [ebp - 0x610]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x34]
jle 0x1002ee7c
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x618]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x618], eax
imul eax, eax, 0x7cbb
cmp eax, 0xffff
sbb eax, eax
or ecx, 0xffffffff
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x120]
sub eax, dword [ebp - 0x40]
je 0x1002ef6a
mov eax, 0xde21e525
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x600], eax
mov dword [ebp - 0x5fc], eax
mov dword [ebp - 0x5f8], eax
push 9
mov dword [ebp - 0x3c], 0xefaa
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x24], ecx
jmp 0x1002ef5f
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002ef07
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbec], 0x9b8ae051
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002eef6
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x8a3d3555
je 0x1002ef25
mov eax, dword [ebp - 0xbec]
mov eax, dword [ebp - 0x5f8]
mov eax, dword [ebp - 0xbec]
xor eax, eax
cmp dword [ebp - 0x5fc], eax
jne 0x1002ef40
cmp dword [ebp - 0x34], eax
je 0x1002ef42
mov eax, ebx
imul eax, eax, 0xd319
cmp eax, dword [ebp - 0x5f8]
jl 0x1002ef57
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002ef59
mov eax, ebx
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe4
jge 0x1002eeef
jmp 0x1002f0be
mov dword [ebp - 0x20], ebx
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], 0x8409d7ff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002ef98
push 9
pop edx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x810], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002ef84
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jg 0x1002f0af
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x120]
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
cmp ecx, dword [ebp + eax*4 - 0x120]
jl 0x1002f004
xor eax, eax
cmp dword [ebp - 0x618], eax
je 0x1002f006
mov eax, ebx
jmp 0x1002f006
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x618]
mov eax, dword [ebp - 0x618]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x120]
sub eax, 0xffff
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x120]
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x810], ecx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x120]
setle dl
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x5c]
setle cl
cmp ecx, 0xfffc
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
add ecx, edi
jne 0x1002f098
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x120], ecx
jne 0x1002f098
xor eax, eax
jmp 0x1002f09a
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1002efa4
or ecx, 0xffffffff
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x62c], ecx
xor eax, eax
mov dword [ebp - 0x628], ecx
mov dword [ebp - 0x624], ecx
mov dword [ebp - 0x620], ecx
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x4c], 0xa9bca7b5
mov dword [ebp - 0x2c], 0x639e
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], eax
jmp 0x1002f106
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x898], 0xc8d3c891
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002f0f5
inc dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x898]
mov ecx, ebx
sub ecx, eax
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
push 5
setl dl
xor ecx, ecx
pop eax
cmp edx, eax
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp dword [ebp - 0x40], ecx
jle 0x1002f158
mov dword [ebp - 0x4c], 0xfffffffd
dec dword [ebp - 0x4c]
jmp 0x1002f224
mov dword [ebp - 0x38], 0xfffffffb
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002f188
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x820], 0xb9cc5119
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002f170
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002f1a7
push 9
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf50], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002f194
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002f1ef
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x624]
cmp eax, ecx
setg dl
xor ecx, ecx
imul eax, edx, 0xea6c
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x894], edx
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setne cl
mov dword [ebp - 0x81c], ecx
mov eax, dword [ebp - 0x81c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x624]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002f209
mov edx, eax
cmp dword [ebp - 0x4c], eax
je 0x1002f20b
mov edx, ebx
mov dword [ebp - 0x620], edx
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0xf48], ecx
mov dword [ebp - 0x24], 0x638ecf54
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002f250
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x240], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002f238
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002f289
push 0x68c
push 0xdd5
push 0xc81
push 0x48d
call edi
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
xor eax, eax
jmp 0x1002f28f
mov ebx, dword [sym.imp.USER32.dll_GetDC]
xor edx, edx
mov dword [ebp - 0x24], eax
inc edx
cmp dword [ebp - 0x24], edx
jg 0x1002f3d3
push 2
pop esi
mov dword [ebp - 0x34], 0x30722263
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x240], 0
jne 0x1002f3cb
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x1002f3bf
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x1002f3b3
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jg 0x1002f378
cmp dword [ebp - 0x14], eax
jne 0x1002f357
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x240]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x240]
sub ecx, eax
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x240]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp edx, eax
setge cl
cmp ecx, esi
sbb eax, eax
xor edx, edx
neg eax
inc edx
cmp eax, edx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x240]
jl 0x1002f34e
mov ecx, edx
mov eax, dword [ebp - 0x14]
push 0
mov eax, dword [ebp + eax*4 - 0x240]
imul eax, ecx
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], edx
jle 0x1002f2ef
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x1002f3a7
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002f39f
dec dword [ebp - 0x20]
jns 0x1002f2d9
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x1002f2ca
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x1002f2a1
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov dword [ebp - 0x50], 0xc2e0cf57
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002f3f6
push 0x1caf
push 0x1af
push eax
call dword [sym.imp.USER32.dll_InflateRect]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002f40c
push 0x11cb
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
xor edx, edx
mov dword [ebp - 0x24], 0x638ecf54
inc edx
mov dword [ebp - 0x18], edx
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002f43c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x250], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f424
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002f46a
push 0x68c
push 0xdd5
push 0xc81
push 0x48d
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jg 0x1002f5ab
push 2
pop esi
mov dword [ebp - 0x34], 0x30722263
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x250], 0
jne 0x1002f5a3
mov dword [ebp - 0x1c], 0xe0648261
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002f5d2