Function at 0x100281de
Capabilities:
Delete registry value
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10089206
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x584
push esi
mov dword [ebp - 0x24], 0xf4a8
mov dword [ebp - 0x398], 0xe2fde2bb
mov dword [ebp - 0x394], 0xe2fde2bb
mov dword [ebp - 0x390], 0xe2fde2bb
mov dword [ebp - 0x38c], 0xe2fde2bb
lea ecx, [ebp - 0xcd]
call fcn.1000bd13
push eax
lea eax, [ebp - 0x388]
push eax
lea eax, [ebp - 0x398]
push eax
lea ecx, [ebp - 0x580]
call fcn.10019d71
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x118]
call fcn.10019d37
and dword [ebp - 4], 0
push 3
lea ecx, [ebp - 0x324]
call fcn.10019cd8
mov byte [ebp - 4], 1
mov dword [ebp - 0x304], 0xc114ff6a
mov dword [ebp - 0x88], 0
jmp 0x10028299
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x100282bb
push dword [ebp - 0x88]
lea ecx, [ebp - 0x324]
call fcn.10019d62
mov dword [eax], 1
jmp 0x1002828c
imul eax, dword [ebp - 0x24], 0xfffa
test eax, eax
je 0x10028490
mov dword [ebp - 0x54], 0xe96b
mov dword [ebp - 0x2fc], 0xfffffffa
push 0
lea ecx, [ebp - 0x118]
call fcn.10019d62
mov dword [eax], 0xef72d4ea
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x54], 0
jne 0x1002830f
mov eax, 0x1e2d
test eax, eax
jne 0x1002830f
and dword [ebp - 0x300], 0
jmp 0x10028319
mov dword [ebp - 0x300], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x508], eax
mov esi, dword [ebp - 0x24]
push 0
lea ecx, [ebp - 0x118]
call fcn.10019d62
cmp esi, dword [eax]
jl 0x10028342
mov dword [ebp - 0x1b4], 1
jmp 0x10028349
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x1b4], eax
je 0x10028360
mov dword [ebp - 0x294], 1
jmp 0x10028367
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50c], eax
push 0
lea ecx, [ebp - 0x118]
call fcn.10019d62
mov esi, dword [ebp - 0x54]
push 3
lea ecx, [ebp - 0x118]
call fcn.10019d62
cmp esi, dword [eax]
jle 0x100283b2
mov dword [ebp - 0x2a0], 1
jmp 0x100283b9
and dword [ebp - 0x2a0], 0
cmp dword [ebp - 0x2a0], 0x1dda8db8
jg 0x100283d1
mov dword [ebp - 0x29c], 1
jmp 0x100283d8
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x29c], eax
je 0x100283ef
mov dword [ebp - 0x28c], 1
jmp 0x100283f6
and dword [ebp - 0x28c], 0
push 3
lea ecx, [ebp - 0x118]
call fcn.10019d62
mov ecx, dword [ebp - 0x28c]
cmp ecx, dword [eax]
jle 0x10028419
mov dword [ebp - 0x128], 1
jmp 0x10028420
and dword [ebp - 0x128], 0
cmp dword [ebp - 0x128], 1
jne 0x10028435
mov dword [ebp - 0x1e8], 1
jmp 0x1002843c
and dword [ebp - 0x1e8], 0
cmp dword [ebp - 0x1e8], 0
je 0x10028451
mov dword [ebp - 0x130], 1
jmp 0x10028458
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x130], eax
jl 0x1002846f
mov dword [ebp - 0x248], 1
jmp 0x10028476
and dword [ebp - 0x248], 0
push 0
lea ecx, [ebp - 0x118]
call fcn.10019d62
mov ecx, dword [ebp - 0x248]
mov dword [eax], ecx
jmp 0x100285e3
mov dword [ebp - 0x1f0], 8
push 2
lea ecx, [ebp - 0x354]
call fcn.10019cd8
mov byte [ebp - 4], 2
mov dword [ebp - 0x138], 0x140a9711
mov dword [ebp - 0xb4], 0
jmp 0x100284ce
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x100284f0
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x354]
call fcn.10019d62
mov dword [eax], 0xf2a6add3
jmp 0x100284c1
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x414], eax
push 0
lea ecx, [ebp - 0x354]
call fcn.10019d62
mov eax, dword [eax]
mov dword [ebp - 0x138], eax
imul esi, dword [ebp - 0x138], 0xa8da
push 0
lea ecx, [ebp - 0x324]
call fcn.10019d62
mov eax, dword [eax]
sub eax, esi
je 0x10028560
push 0
lea ecx, [ebp - 0x354]
call fcn.10019d62
push 2
lea ecx, [ebp - 0x118]
call fcn.10019d62
cmp dword [ebp - 0x1f0], 0xcc9e520c
ja 0x10028560
mov dword [ebp - 0x140], 1
jmp 0x10028567
and dword [ebp - 0x140], 0
push 2
lea ecx, [ebp - 0x118]
call fcn.10019d62
mov ecx, dword [ebp - 0x140]
add ecx, dword [eax]
je 0x1002858b
push 0
lea ecx, [ebp - 0x324]
call fcn.10019d62
push 0
lea ecx, [ebp - 0x324]
call fcn.10019d62
cmp dword [eax], 0
jne 0x100285a9
mov dword [ebp - 0x278], 1
jmp 0x100285b0
and dword [ebp - 0x278], 0
push 1
lea ecx, [ebp - 0x118]
call fcn.10019d62
mov esi, dword [ebp - 0x278]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x118]
call fcn.10019d62
mov dword [eax], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x354]
call fcn.10019d5d
mov dword [ebp - 0x24], 0x1a
jmp 0x100285f3
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xb
jl 0x10028621
cmp dword [ebp - 0x304], 0
je 0x10028604
jmp 0x10028621
mov byte [ebp - 0x43], 0
movzx eax, byte [ebp - 0x43]
test eax, eax
je 0x1002861f
push 0x544
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x100285ec
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x324]
call fcn.10019d5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.10019d5d
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10028fca
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 0xac], 7
mov dword [ebp - 0x41c], 5
mov dword [ebp - 0x424], 3
mov dword [ebp - 0x314], 0xfffffff7
mov dword [ebp - 0x30c], 0x72159124
mov dword [ebp - 0x3c0], 0xea41449c
mov dword [ebp - 0x3bc], 0xea41449c
mov dword [ebp - 0x3b8], 0xea41449c
mov dword [ebp - 0x3b4], 0xea41449c
lea ecx, [ebp - 0x105]
call fcn.1000bd13
push eax
lea eax, [ebp - 0x3b0]
push eax
lea eax, [ebp - 0x3c0]
push eax
lea ecx, [ebp - 0x568]
call fcn.10019d71
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x560]
call fcn.10019d37
mov dword [ebp - 0x42c], 0x3cc25429
mov dword [ebp - 0x434], 0x493876a4
mov dword [ebp - 0x43c], 1
mov dword [ebp - 0x68], 0x8a99
mov dword [ebp - 0xf4], 0x2b8f
mov dword [ebp - 0x94], 0
jmp 0x1002872b
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x10028747
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x544], 0
jmp 0x1002871e
mov byte [ebp - 0x42], 0
movzx eax, byte [ebp - 0x42]
test eax, eax
je 0x10028759
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x544]
cmp dword [ebp - 0xf4], eax
jl 0x1002883b
mov dword [ebp - 0x150], 0x3491
mov dword [ebp - 0x148], 0xffffffff
mov dword [ebp - 0x68], 0
jmp 0x100287a2
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jg 0x100287dd
mov dword [ebp - 0xac], 0
jmp 0x100287c1
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jg 0x100287db
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x544], 0
je 0x100287d9
jmp 0x100287db
jmp 0x100287b4
jmp 0x1002879b
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xffffffff
jae 0x100287fe
mov dword [ebp - 0x1f8], 1
jmp 0x10028805
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x150]
imul eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x150], eax
jg 0x10028826
mov dword [ebp - 0x250], 1
jmp 0x1002882d
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x314], eax
jmp 0x10028893
mov byte [ebp - 0x44], 0
movzx eax, byte [ebp - 0x44]
test eax, eax
je 0x10028893
push 0x12d6
push 0x1482
push 0x148a
push 0x2273
push 0x8d0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x82a
push 0x17a0
push 0x60
push 0x1a95
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
lea ecx, [ebp - 0x560]
call fcn.10019d5d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x28], 0xe87df2f4
mov dword [ebp - 0x208], 0xffff
mov dword [ebp - 0x2f4], 0xe360de57
mov dword [ebp - 0x2dc], 0x5537c57f
cmp dword [ebp - 0x28], 0
jne 0x100289fe
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jg 0x100288fc
mov dword [ebp - 0x158], 1
jmp 0x10028903
and dword [ebp - 0x158], 0
imul eax, dword [ebp - 0x158], 0xe763
cmp eax, 1
je 0x1002891e
mov dword [ebp - 0x200], 1
jmp 0x10028925
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x200], eax
jne 0x1002893c
mov dword [ebp - 0x160], 1
jmp 0x10028943
and dword [ebp - 0x160], 0
cmp dword [ebp - 0x160], 0xffff
jbe 0x1002895b
mov dword [ebp - 0x290], 1
jmp 0x10028962
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x290]
sub eax, dword [ebp - 0x28]
je 0x10028982
cmp dword [ebp - 0x208], 0
je 0x10028982
mov dword [ebp - 0x168], 1
jmp 0x10028989
and dword [ebp - 0x168], 0
cmp dword [ebp - 0x168], 0x81d2
jge 0x100289a1
mov dword [ebp - 0x170], 1
jmp 0x100289a8
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x170], eax
jg 0x100289c2
mov dword [ebp - 0x258], 1
jmp 0x100289c9
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x2f4]
cmp dword [ebp - 0x258], eax
jg 0x100289e3
mov dword [ebp - 0x178], 1
jmp 0x100289ea
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x178]
jne 0x100289fe
and dword [ebp - 0x210], 0
jmp 0x10028a08
mov dword [ebp - 0x210], 1
cmp dword [ebp - 0x210], 0xffff
jb 0x10028a20
mov dword [ebp - 0x180], 1
jmp 0x10028a27
and dword [ebp - 0x180], 0
cmp dword [ebp - 0x180], 0
jne 0x10028a3c
mov dword [ebp - 0x280], 1
jmp 0x10028a43
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x280]
mov dword [ebp - 0x2dc], eax
mov byte [ebp - 0x50], 0
movzx eax, byte [ebp - 0x50]
test eax, eax
je 0x10028a6d
push 0x1c22
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x454], 3
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x464], 1
push 1
lea ecx, [ebp - 0x3cc]
call fcn.10019cd8
mov dword [ebp - 4], 3
mov dword [ebp - 0x9c], 0
jmp 0x10028ad5
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x10028af4
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x3cc]
call fcn.10019d62
and dword [eax], 0
jmp 0x10028ac8
mov dword [ebp - 0xbc], 0
jmp 0x10028b0d
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xfffffff7
jl 0x10028c2f
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0x514], 0x289a695
mov dword [ebp - 0x51c], 0x50b5f0b1
push 1
lea ecx, [ebp - 0x474]
call fcn.10019cd8
mov byte [ebp - 4], 4
mov dword [ebp - 0xa4], 0
jmp 0x10028b62
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x10028b84
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x474]
call fcn.10019d62
mov dword [eax], 0x4b64b5c6
jmp 0x10028b55
mov eax, 0x2c9cc141
test eax, eax
je 0x10028ba2
cmp dword [ebp - 0xe4], 0
je 0x10028ba2
mov dword [ebp - 0x188], 1
jmp 0x10028ba9
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x188]
jle 0x10028bc3
mov dword [ebp - 0x218], 1
jmp 0x10028bca
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x218]
jle 0x10028be4
mov dword [ebp - 0x190], 1
jmp 0x10028beb
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x2b0], eax
push 0
lea ecx, [ebp - 0x3cc]
call fcn.10019d62
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x260]
mov dword [ecx], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x474]
call fcn.10019d5d
jmp 0x10028b00
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3cc]
call fcn.10019d5d
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x308], 0xfffffff6
mov dword [ebp - 0x10], 0
jmp 0x10028c75
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff2
jg 0x10028f8c
push 3
lea ecx, [ebp - 0xcc]
call fcn.10019cd8
mov dword [ebp - 4], 5
mov dword [ebp - 0x84], 0
jmp 0x10028cac
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x10028cce
push dword [ebp - 0x84]
lea ecx, [ebp - 0xcc]
call fcn.10019d62
mov dword [eax], 1
jmp 0x10028c9f
push 2
lea ecx, [ebp - 0xcc]
call fcn.10019d62
mov ecx, dword [ebp - 0x10]
cmp dword [eax], ecx
jne 0x10028cee
mov dword [ebp - 0x228], 1
jmp 0x10028cf5
and dword [ebp - 0x228], 0
push 2
lea ecx, [ebp - 0xcc]
call fcn.10019d62
mov eax, dword [eax]
sub eax, dword [ebp - 0x10]
je 0x10028d1e
mov eax, 0x40c18ab9
test eax, eax
je 0x10028d1e
mov dword [ebp - 0x198], 1
jmp 0x10028d25
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x198], eax
jg 0x10028d3d
xor eax, eax
jne 0x10028d3d
and dword [ebp - 0x220], 0
jmp 0x10028d47
mov dword [ebp - 0x220], 1
cmp dword [ebp - 0x220], 0x364d64ea
jge 0x10028d5f
mov dword [ebp - 0x1a0], 1
jmp 0x10028d66
and dword [ebp - 0x1a0], 0
push 1
lea ecx, [ebp - 0xcc]
call fcn.10019d62
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1a0]
jg 0x10028d89
mov dword [ebp - 0x298], 1
jmp 0x10028d90
and dword [ebp - 0x298], 0
push 2
lea ecx, [ebp - 0xcc]
call fcn.10019d62
mov ecx, dword [ebp - 0x298]
sub ecx, dword [eax]
cmp ecx, 0x2da3c3d
jl 0x10028dbf
cmp dword [ebp - 0x10], 0
je 0x10028dbf
mov dword [ebp - 0x1a8], 1
jmp 0x10028dc6
and dword [ebp - 0x1a8], 0
push 2
lea ecx, [ebp - 0xcc]
call fcn.10019d62
mov ecx, dword [ebp - 0x1a8]
cmp ecx, dword [eax]
jg 0x10028de9
mov dword [ebp - 0x328], 1
jmp 0x10028df0
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
jne 0x10028e0d
mov dword [ebp - 0x1b0], 1
jmp 0x10028e14
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x1b0]
je 0x10028e2e
mov dword [ebp - 0x268], 1
jmp 0x10028e35
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x268], eax
jl 0x10028e82
cmp dword [ebp - 0x10], 0
je 0x10028e5a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.10019d5d
jmp 0x10028f8c
push 2
lea ecx, [ebp - 0xcc]
call fcn.10019d62
cmp dword [eax], 0
je 0x10028e80
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.10019d5d
jmp 0x10028f8c
jmp 0x10028eaf
mov dword [ebp - 0x1b8], 4
mov byte [ebp - 0x46], 0
movzx eax, byte [ebp - 0x46]
test eax, eax
je 0x10028ea2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x10]
sub eax, 0x7e17
cmp dword [ebp - 0x10], eax
je 0x10028ec8
mov dword [ebp - 0x2d0], 1
jmp 0x10028ecf
and dword [ebp - 0x2d0], 0
cmp dword [ebp - 0x10], 0
jge 0x10028ee1
mov dword [ebp - 0x230], 1
jmp 0x10028ee8
and dword [ebp - 0x230], 0
push 2
lea ecx, [ebp - 0xcc]
call fcn.10019d62
mov ecx, dword [ebp - 0x230]
cmp ecx, dword [eax]
jg 0x10028f0b
mov dword [ebp - 0x1c0], 1
jmp 0x10028f12
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1c0]
jl 0x10028f29
mov dword [ebp - 0x288], 1
jmp 0x10028f30
and dword [ebp - 0x288], 0
push 2
lea ecx, [ebp - 0xcc]
call fcn.10019d62
mov ecx, dword [ebp - 0x288]
cmp ecx, dword [eax]
jge 0x10028f56
cmp dword [ebp - 0x10], 0
jne 0x10028f56
and dword [ebp - 0x1c8], 0
jmp 0x10028f60
mov dword [ebp - 0x1c8], 1
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x308], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.10019d5d
jmp 0x10028c6e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x64]
mov dword [eax], 0
jmp 0x10028fa8
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x64]
mov dword [ecx], eax
mov eax, dword [ebp - 0x64]
cmp dword [eax], 1
jge 0x10028fc5
mov eax, dword [ebp - 0x64]
push dword [eax]
mov ecx, dword [ebp - 0x2d8]
call fcn.10019d62
and dword [eax], 0
jmp 0x10028f9d
jmp 0x1002a48c
push 4
lea ecx, [ebp - 0x104]
call fcn.10019cd8
mov dword [ebp - 4], 6
mov dword [ebp - 0x1c], 0xfebaeef2
push 4
lea ecx, [ebp - 0x3e4]
call fcn.10019cd8
mov byte [ebp - 4], 7
push 3
lea ecx, [ebp - 0x484]
call fcn.10019cd8
mov byte [ebp - 4], 8
mov dword [ebp - 0x14], 0
jmp 0x10029017
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10029033
push dword [ebp - 0x14]
lea ecx, [ebp - 0x104]
call fcn.10019d62
mov dword [eax], 3
jmp 0x10029010
mov dword [ebp - 0x14], 0
jmp 0x10029043
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10029059
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x240], 0x31e468a0
jmp 0x1002903c
mov dword [ebp - 0x14], 0
jmp 0x10029069
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10029085
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3e4]
call fcn.10019d62
mov dword [eax], 3
jmp 0x10029062
mov dword [ebp - 0x14], 0
jmp 0x10029095
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100290ae
push dword [ebp - 0x14]
lea ecx, [ebp - 0x484]
call fcn.10019d62
and dword [eax], 0
jmp 0x1002908e
mov dword [ebp - 0x1c], 3
jmp 0x100290be
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10029276
mov dword [ebp - 0x270], 0xf9beab1d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10019d62
cmp dword [eax], 0
je 0x100290ea
jmp 0x10029276
mov esi, dword [ebp - 0x1c]
shl esi, 3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10019d62
cmp esi, dword [eax]
jg 0x1002910e
mov dword [ebp - 0x10c], 1
jmp 0x10029115
and dword [ebp - 0x10c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10c]
mov dword [ebp + eax - 0x240], ecx
cmp dword [ebp - 0x10c], 0
jne 0x1002914d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10019d62
cmp dword [eax], 0
jne 0x1002914d
and dword [ebp - 0x1d0], 0
jmp 0x10029157
mov dword [ebp - 0x1d0], 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10019d62
mov ecx, dword [ebp - 0x1d0]
sub ecx, dword [eax]
mov dword [ebp - 0x270], ecx
mov esi, dword [ebp - 0x270]
push 1
lea ecx, [ebp - 0x104]
call fcn.10019d62
cmp esi, dword [eax]
jge 0x10029196
mov dword [ebp - 0x1d8], 1
jmp 0x1002919d
and dword [ebp - 0x1d8], 0
mov esi, dword [ebp - 0x1c]
add esi, dword [ebp - 0x1d8]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10019d62
cmp esi, dword [eax]
jge 0x100291d4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x240], 0
je 0x100291d4
mov dword [ebp - 0x1e0], 1
jmp 0x100291db
and dword [ebp - 0x1e0], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10019d62
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1e0]
jge 0x100291ff
mov dword [ebp - 0x120], 1
jmp 0x10029206
and dword [ebp - 0x120], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10019d62
mov ecx, dword [ebp - 0x120]
cmp ecx, dword [eax]
je 0x1002922a
mov dword [ebp - 0x124], 1
jmp 0x10029231
and dword [ebp - 0x124], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10019d62
mov eax, dword [eax]
cmp eax, dword [ebp - 0x124]
jge 0x10029255
mov dword [ebp - 0x12c], 1
jmp 0x1002925c
and dword [ebp - 0x12c], 0
push 0
lea ecx, [ebp - 0x3e4]
call fcn.10019d62
mov ecx, dword [ebp - 0x12c]
mov dword [eax], ecx
jmp 0x100290b7
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x484]
call fcn.10019d5d
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3e4]
call fcn.10019d5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x104]
call fcn.10019d5d
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2cc], eax
mov dword [ebp - 0x34], 0
jmp 0x100292bc
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x100292d2
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x348], 0xfffffffb
jmp 0x100292b5
mov dword [ebp - 0x34], 0
jmp 0x100292e2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x100292f8
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x370], 1
jmp 0x100292db
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x370], 0
jmp 0x10029326
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x370]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x370], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x370], 0
jl 0x10029351
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x370]
cmp dword [ebp + eax*4 - 0x348], 0
je 0x1002934f
jmp 0x10029351
jmp 0x1002930b
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x10029365
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x5c], 0xfffffffa
mov dword [ebp - 0x154], 0xfb5d1cb6
mov dword [ebp - 0x5c], 0
jmp 0x1002938f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xe
jle 0x10029766
push 2
lea ecx, [ebp - 0x2ac]
call fcn.10019cd8
mov dword [ebp - 4], 9
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3ac], 0xc5530c4e
mov dword [ebp - 0x3a8], 0xc5530c4e
mov dword [ebp - 0x3a4], 0xc5530c4e
mov dword [ebp - 0x3a0], 0xc5530c4e
lea ecx, [ebp - 0xf5]
call fcn.1000bd13
push eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x3ac]
push eax
lea ecx, [ebp - 0x570]
call fcn.10019d71
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x360]
call fcn.10019d37
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xec], 0xffff
mov dword [ebp - 0x310], 0xffffffff
mov dword [ebp - 0x2c], 0
jmp 0x10029439
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10029452
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2ac]
call fcn.10019d62
and dword [eax], 0
jmp 0x10029432
mov dword [ebp - 0x2c], 0
jmp 0x10029462
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10029478
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x490], 0
jmp 0x1002945b
mov dword [ebp - 0x38], 0
jmp 0x10029488
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jg 0x10029743
mov dword [ebp - 0x184], 0xb4709ba8
mov dword [ebp - 0x384], 0xbf390f3b
mov dword [ebp - 0x380], 0xbf390f3b
mov dword [ebp - 0x37c], 0xbf390f3b
mov dword [ebp - 0x378], 0xbf390f3b
lea ecx, [ebp - 0xd9]
call fcn.1000bd13
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x384]
push eax
lea ecx, [ebp - 0x578]
call fcn.10019d71
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4a0]
call fcn.10019d37
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0xec], eax
jle 0x10029524
mov dword [ebp - 0x134], 1
jmp 0x1002952b
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x134], eax
jg 0x10029542
mov dword [ebp - 0x13c], 1
jmp 0x10029549
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x13c], eax
jne 0x10029560
mov dword [ebp - 0x144], 1
jmp 0x10029567
and dword [ebp - 0x144], 0
push 0
lea ecx, [ebp - 0x360]
call fcn.10019d62
mov esi, dword [ebp - 0x144]
add esi, dword [eax]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2ac]
call fcn.10019d62
cmp esi, dword [eax]
jl 0x1002959a
mov dword [ebp - 0x2e0], 1
jmp 0x100295a1
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x528], eax
push 3
lea ecx, [ebp - 0x360]
call fcn.10019d62
mov dword [ebp - 0x14c], eax
push 3
lea ecx, [ebp - 0x360]
call fcn.10019d62
mov ecx, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x154]
imul ecx, dword [eax]
add ecx, 0xffff
mov dword [ebp - 0x15c], ecx
push 2
lea ecx, [ebp - 0x4a0]
call fcn.10019d62
mov ecx, dword [ebp - 0x15c]
mov dword [eax], ecx
cmp dword [ebp - 0x15c], 0xf4d4e20
jge 0x1002961f
mov dword [ebp - 0x164], 1
jmp 0x10029626
and dword [ebp - 0x164], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2ac]
call fcn.10019d62
imul eax, dword [eax], 0
cmp eax, dword [ebp - 0x164]
jge 0x1002964b
mov dword [ebp - 0x16c], 1
jmp 0x10029652
and dword [ebp - 0x16c], 0
imul eax, dword [ebp - 0x16c], 0xffffffff
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x490]
jne 0x10029674
mov dword [ebp - 0x174], 1
jmp 0x1002967b
and dword [ebp - 0x174], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2ac]
call fcn.10019d62
mov eax, dword [eax]
cmp eax, dword [ebp - 0x174]
jl 0x1002969f
mov dword [ebp - 0x17c], 1
jmp 0x100296a6
and dword [ebp - 0x17c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x490]
cmp dword [ebp - 0x17c], eax
je 0x100296cd
cmp dword [ebp - 0x184], 0
jne 0x100296cd
and dword [ebp - 0x18c], 0
jmp 0x100296d7
mov dword [ebp - 0x18c], 1
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2ac]
call fcn.10019d62
mov ecx, dword [ebp - 0x18c]
cmp ecx, dword [eax]
je 0x100296fb
mov dword [ebp - 0x194], 1
jmp 0x10029702
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x194]
sub eax, 0xc0a1033
imul eax, eax, 0x6658
mov dword [ebp - 0x310], eax
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x1002972f
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x4a0]
call fcn.10019d5d
jmp 0x10029481
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x360]
call fcn.10019d5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2ac]
call fcn.10019d5d
jmp 0x10029388
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x1002977c
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x6c], 0xfff9
mov dword [ebp - 0x2f0], 1
mov dword [ebp - 0x40], 0xffffffe8
jmp 0x100297bb
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xa
jle 0x1002991e
mov dword [ebp - 0x30], 0x6d03
cmp dword [ebp - 0x40], 0
je 0x100297e4
cmp dword [ebp - 0x30], 0
je 0x100297e4
mov dword [ebp - 0x2e8], 1
jmp 0x100297eb
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x10029815
mov dword [ebp - 0x19c], 1
jmp 0x1002981c
and dword [ebp - 0x19c], 0
imul eax, dword [ebp - 0x19c], 0xc7eb
cmp eax, 0x589d3895
jg 0x10029833
cmp dword [ebp - 0x30], 0
jne 0x10029842
cmp dword [ebp - 0x20], 0
jne 0x10029842
and dword [ebp - 0x1a4], 0
jmp 0x1002984c
mov dword [ebp - 0x1a4], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1a4], eax
jg 0x10029863
mov dword [ebp - 0x1ac], 1
jmp 0x1002986a
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1ac], eax
jle 0x10029881
mov dword [ebp - 0x11c], 1
jmp 0x10029888
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x11c], eax
jne 0x1002989f
mov dword [ebp - 0x1bc], 1
jmp 0x100298a6
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1bc], eax
jle 0x100298bd
mov dword [ebp - 0x1c4], 1
jmp 0x100298c4
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x1c4]
cmp eax, 1
jbe 0x100298de
mov dword [ebp - 0x1cc], 1
jmp 0x100298e5
and dword [ebp - 0x1cc], 0
cmp dword [ebp - 0x1cc], 0
jne 0x10029903
cmp dword [ebp - 0x40], 0
jne 0x10029903
cmp dword [ebp - 0x20], 0
jne 0x10029903
and dword [ebp - 0x1d4], 0
jmp 0x1002990d
mov dword [ebp - 0x1d4], 1
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x6c], eax
jmp 0x100297b4
mov dword [ebp - 0x20], 0xf
jmp 0x1002992e
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 7
je 0x10029ac6
push 3
lea ecx, [ebp - 0x334]
call fcn.10019cd8
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x90], 0
jmp 0x10029965
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x10029984
push dword [ebp - 0x90]
lea ecx, [ebp - 0x334]
call fcn.10019d62
and dword [eax], 0
jmp 0x10029958
mov dword [ebp - 0x6c], 0
jmp 0x10029994
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x23
jne 0x10029ab2
mov dword [ebp - 0x1e4], 0xe188a746
mov dword [ebp - 0x3c], 2
jmp 0x100299b8
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10029aad
mov dword [ebp - 0x318], 0xafeddd8d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x20], eax
jne 0x100299e9
mov dword [ebp - 0x1dc], 1
jmp 0x100299f0
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x1dc], eax
jl 0x10029a0a
mov dword [ebp - 0x1ec], 1
jmp 0x10029a11
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1e4]
cmp eax, dword [ebp - 0x1ec]
jle 0x10029a2b
mov dword [ebp - 0x338], 1
jmp 0x10029a32
and dword [ebp - 0x338], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x334]
call fcn.10019d62
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x334]
call fcn.10019d62
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x334]
call fcn.10019d62
cmp dword [eax], 0x9f0
je 0x10029a70
mov dword [ebp - 0x1f4], 1
jmp 0x10029a77
and dword [ebp - 0x1f4], 0
cmp dword [ebp - 0x1f4], 0
je 0x10029a95
cmp dword [ebp - 0x2f0], 0
je 0x10029a95
mov dword [ebp - 0x1fc], 1
jmp 0x10029a9c
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x318], eax
jmp 0x100299b1
jmp 0x1002998d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.10019d5d
jmp 0x10029927
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xa0], 0xf6af1124
mov dword [ebp - 0x4b4], 0xfddd3f46
push 1
lea ecx, [ebp - 0x4c0]
call fcn.10019cd8
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x98], 0
jmp 0x10029b10
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x10029b32
push dword [ebp - 0x98]
lea ecx, [ebp - 0x4c0]
call fcn.10019d62
mov dword [eax], 1
jmp 0x10029b03
mov dword [ebp - 0xa0], 0
jmp 0x10029b4b
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xfffffff6
je 0x10029cbc
mov dword [ebp - 0x420], 0xfffffff7
mov dword [ebp - 0x510], 0xfffffff6
mov dword [ebp - 0x428], 0x4800fa7
mov dword [ebp - 0x4c4], 1
mov dword [ebp - 0x430], 1
mov dword [ebp - 0x410], 0x3773672
mov dword [ebp - 0x438], 0x1a4e6659
mov dword [ebp - 0x4d4], 0x5b6478c3
mov dword [ebp - 0x440], 0xfffffffe
mov dword [ebp - 0x518], 0xffffffff
push 4
lea ecx, [ebp - 0x4b0]
call fcn.10019cd8
mov byte [ebp - 4], 0xe
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10019cd8
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x18], 0
jmp 0x10029bee
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10029c0a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4b0]
call fcn.10019d62
mov dword [eax], 0x68cd546
jmp 0x10029be7
mov dword [ebp - 0x18], 0
jmp 0x10029c1a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10029c36
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d8]
call fcn.10019d62
mov dword [eax], 0x47cd
jmp 0x10029c13
mov dword [ebp - 0x18], 0
jmp 0x10029c46
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10029c5c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x554], 0x92e6c0b3
jmp 0x10029c3f
push 1
lea ecx, [ebp - 0x3d8]
call fcn.10019d62
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x204]
mov dword [ecx], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x554]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x554], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x3d8]
call fcn.10019d5d
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x4b0]
call fcn.10019d5d
jmp 0x10029b3e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c0]
call fcn.10019d5d
mov dword [ebp - 0xa8], 0xffffffff
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10019cd8
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x78], 0
jmp 0x10029cf9
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x10029d15
push dword [ebp - 0x78]
lea ecx, [ebp - 0x4d0]
call fcn.10019d62
mov dword [eax], 0x9b2cfb63
jmp 0x10029cf2
mov dword [ebp - 0xa8], 0
jmp 0x10029d2e
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffe8
jg 0x10029d73
mov dword [ebp - 0x7c], 0x10b999fb
mov dword [ebp - 0x7c], 0
jmp 0x10029d4e
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x10029d71
mov byte [ebp - 0x47], 0
movzx eax, byte [ebp - 0x47]
test eax, eax
je 0x10029d6f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
jmp 0x10029d47
jmp 0x10029d21
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d0]
call fcn.10019d5d
mov dword [ebp - 0x58], 0x5baf43b
mov dword [ebp - 0x2f8], 0xfffffff6
mov dword [ebp - 0x80], 0
jmp 0x10029da3
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x10029db9
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x590], 0
jmp 0x10029d9c
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x58], 0
jmp 0x10029dd0
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x10029de2
mov dword [ebp - 0x2f8], 1
jmp 0x10029dc9
push 3
lea ecx, [ebp - 0x344]
call fcn.10019cd8
mov dword [ebp - 4], 0x11
push 2
lea ecx, [ebp - 0x3f0]
call fcn.10019cd8
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x74], 0
jmp 0x10029e17
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x10029e30
push dword [ebp - 0x74]
lea ecx, [ebp - 0x344]
call fcn.10019d62
or dword [eax], 0xffffffff
jmp 0x10029e10
lea eax, [ebp - 0x74]
push eax
push 0x566a
lea eax, [ebp - 0x3f0]
push eax
push 0
call fcn.1002a766
add esp, 0x10
push 0
lea ecx, [ebp - 0x344]
call fcn.10019d62
mov dword [eax], 0x1a
jmp 0x10029e83
push 0
lea ecx, [ebp - 0x344]
call fcn.10019d62
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x20c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x344]
call fcn.10019d62
cmp dword [eax], 0xfffffff9
jne 0x10029ed3
mov dword [ebp - 0x2b8], 0x9ea
mov dword [ebp - 0x2bc], 0x1738ab65
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x4e], 0
push 0x6504
push 0x3e14
lea eax, [ebp - 0x4e]
push eax
push 0
call fcn.1002ac4e
add esp, 0x10
jmp 0x10029e5f
push 0
lea ecx, [ebp - 0x3f0]
call fcn.10019d62
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x214]
mov dword [ecx], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x3f0]
call fcn.10019d5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344]
call fcn.10019d5d
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x448], 3
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 0x450], 1
push 1
lea ecx, [ebp - 0x3fc]
call fcn.10019cd8
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xb0], 0
jmp 0x10029f74
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x10029f93
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x3fc]
call fcn.10019d62
and dword [eax], 0
jmp 0x10029f67
mov dword [ebp - 0xb8], 0
jmp 0x10029fac
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xfffffff7
jl 0x1002a0ce
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0x530], 0x289a695
mov dword [ebp - 0x458], 0x50b5f0b1
push 1
lea ecx, [ebp - 0x4e0]
call fcn.10019cd8
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xc0], 0
jmp 0x1002a001
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x1002a023
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x4e0]
call fcn.10019d62
mov dword [eax], 0x4b64b5c6
jmp 0x10029ff4
mov eax, 0x2c9cc141
test eax, eax
je 0x1002a041
cmp dword [ebp - 0xd4], 0
je 0x1002a041
mov dword [ebp - 0x21c], 1
jmp 0x1002a048
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x21c]
jle 0x1002a062
mov dword [ebp - 0x224], 1
jmp 0x1002a069
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x224]
jle 0x1002a083
mov dword [ebp - 0x22c], 1
jmp 0x1002a08a
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x2c4], eax
push 0
lea ecx, [ebp - 0x3fc]
call fcn.10019d62
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x234]
mov dword [ecx], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x4e0]
call fcn.10019d5d
jmp 0x10029f9f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3fc]
call fcn.10019d5d
mov eax, dword [ebp - 0x2cc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jle 0x1002a48c
mov dword [ebp - 0x70], 1
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0x264], 3
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x40c], 0x9efededc
mov dword [ebp - 0x408], 0x9efededc
mov dword [ebp - 0x404], 0x9efededc
mov dword [ebp - 0x400], 0x9efededc
mov dword [ebp - 0x2e4], 0x688cdf2a
mov dword [ebp - 0x8c], 0
jmp 0x1002a173
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1002a18c
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x4c], 0xa42b4837
jmp 0x1002a166
cmp dword [ebp - 0x70], 6
je 0x1002a2a4
cmp dword [ebp - 0x70], 0
je 0x1002a23b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
cmp dword [ebp - 0x70], eax
jge 0x1002a1bb
mov dword [ebp - 0x23c], 1
jmp 0x1002a1c2
and dword [ebp - 0x23c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
cmp dword [ebp - 0x23c], eax
jl 0x1002a1f1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 0
jne 0x1002a1f1
push 3
pop eax
test eax, eax
jne 0x1002a1f1
and dword [ebp - 0x244], 0
jmp 0x1002a1fb
mov dword [ebp - 0x244], 1
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x244], eax
jne 0x1002a212
mov dword [ebp - 0x24c], 1
jmp 0x1002a219
and dword [ebp - 0x24c], 0
cmp dword [ebp - 0x24c], 0
jne 0x1002a22f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 0
je 0x1002a23b
mov dword [ebp - 0x254], 1
jmp 0x1002a242
and dword [ebp - 0x254], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
cmp dword [ebp - 0x254], eax
je 0x1002a260
mov dword [ebp - 0x25c], 1
jmp 0x1002a267
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0x25c]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
imul eax, dword [ebp - 0x2d4]
mov ecx, dword [ebp - 0xd8]
dec ecx
mov dword [ebp - 0xd8], ecx
test eax, eax
je 0x1002a2a4
mov dword [ebp - 0xe0], 1
jmp 0x1002a2ab
and dword [ebp - 0xe0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe0]
mov dword [ebp + eax - 0x4c], ecx
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0xe0]
cmp eax, 0xfff0698
jge 0x1002a2d8
mov dword [ebp - 0x26c], 1
jmp 0x1002a2df
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x2b4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
mov dword [ebp - 0x274], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x274]
mov dword [ebp + eax - 0x40c], ecx
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x2e4], eax
push 4
push 0x1000
push dword [ebp - 0xe8]
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0x2ec]
add ecx, dword [eax + 0xc]
push ecx
push 0x54e5
push 0x5751
call fcn.100277aa
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0xf0]
mov dword [ecx], eax
mov dword [ebp - 0x4f4], 0xfffffffb
mov dword [ebp - 0x460], 0xe1e87df2
mov dword [ebp - 0x520], 1
mov dword [ebp - 0x468], 0
push 1
lea ecx, [ebp - 0x500]
call fcn.10019cd8
mov dword [ebp - 4], 0x15
push 3
lea ecx, [ebp - 0x4f0]
call fcn.10019cd8
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x27c], 0x57f39cee
mov dword [ebp - 0x504], 0x4af7
mov dword [ebp - 0x60], 0
jmp 0x1002a3c3
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1002a3d9
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x478], 0xfffffff6
jmp 0x1002a3bc
push 0x77b7
lea eax, [ebp - 0x60]
push eax
push 0
push 0x108d
lea eax, [ebp - 0x500]
push eax
call fcn.10031c2f
add esp, 0x14
push 0x8a3
push 0x2f26
lea eax, [ebp - 0x60]
push eax
push 0x7a47
lea eax, [ebp - 0x4f0]
push eax
push 0x5e6a
push 0x4431
push 0
call fcn.1002a8ff
add esp, 0x20
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x1002a438
call dword [sym.imp.USER32.dll_DestroyCaret]
mov eax, dword [ebp - 0x27c]
dec eax
mov dword [ebp - 0x27c], eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x4f0]
call fcn.10019d5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x500]
call fcn.10019d5d
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx]
mov dword [eax + 8], ecx
push dword [ebp - 0xe8]
push 0
mov eax, dword [ebp - 0xf0]
push dword [eax]
call fcn.10027877
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret