Function at 0x1002e5f5
Capabilities:
Accept command line arguments
Allocate thread local storage
Create pipe
Get keyboard layout
Get thread local storage value
Log keystrokes via polling
Parse pe header
Terminate process

Disassembly:
mov eax, 0x1008b21b
call fcn.10089ac8
mov eax, 0x13e4
call fcn.10085800
push ebx
push esi
push edi
mov edi, 0xdb22124f
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0x20], edi
mov esi, 0xf86f25db
mov dword [ebp - 0x1c], esi
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], 0x7cdd5376
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x10], eax
jmp 0x1002e644
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2d0], 0xb56411d7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002e633
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
cmp eax, edx
setl bl
xor ecx, ecx
sub ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x2d0], ecx
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x2cc], eax
jne 0x1002e6b0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2d0]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2d0]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setl bl
xor ecx, ecx
cmp ebx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], 0x7cdd5376
mov dword [ebp - 0x10], eax
jmp 0x1002e73e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x300], 0xb56411d7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002e72d
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
cmp eax, edx
setl bl
xor ecx, ecx
sub ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x300], ecx
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x2fc], eax
jne 0x1002e7aa
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x300]
mov eax, dword [ebp - 0x300]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x300]
mov eax, dword [ebp - 0x300]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x300]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x300]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setl bl
xor ecx, ecx
cmp ebx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x300], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], 0x7cdd5376
mov dword [ebp - 0x10], eax
jmp 0x1002e838
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2b8], 0xb56411d7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002e827
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
cmp eax, edx
setl bl
xor ecx, ecx
sub ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x2b8], ecx
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x2b4], eax
jne 0x1002e8a4
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2b8]
mov eax, dword [ebp - 0x2b8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2b8]
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2b8]
dec ecx
neg ecx
push 7
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2b8]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setl bl
xor ecx, ecx
cmp ebx, eax
pop eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x2b8], ecx
inc ebx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x578]
mov dword [ebp - 0x1c], eax
or eax, 0xffffffff
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x10], eax
push ebx
call fcn.10016d5e
push 2
xor eax, eax
lea ecx, [ebp - 0x994]
pop esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], 0xa8f1edd1
push esi
call fcn.10016d5e
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002e976
or edi, 0xffffffff
push dword [ebp - 0x28]
lea ecx, [ebp - 0x578]
call fcn.10016dfc
mov dword [eax], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002e957
xor eax, eax
mov edi, 0xdb22124f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002e99e
or edi, 0xffffffff
push dword [ebp - 0x28]
lea ecx, [ebp - 0x994]
call fcn.10016dfc
mov dword [eax], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002e981
mov edi, 0xdb22124f
xor ecx, ecx
mov dword [ebp - 0x1c], 0x732aa61f
mov eax, dword [ebp - 0x24]
mov edx, 0xfffa
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0xbc99
setg al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10]
cmp ecx, 0xdb856137
jne 0x1002e9ed
xor eax, eax
lea ecx, [ebp - 0x578]
push eax
call fcn.10016dfc
xor eax, eax
lea ecx, [ebp - 0x578]
push eax
call fcn.10016dfc
push 5
pop ecx
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x578]
setne bl
xor eax, eax
push eax
call fcn.10016dfc
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x578]
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.10016dfc
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x994]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
xor eax, eax
push eax
call fcn.10016dfc
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x24], eax
inc ebx
jmp 0x1002ea7f
mov dword [ebp - 0x1c], eax
jmp 0x1002ea77
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002ea74
push 0x66f
push eax
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002ea5c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1002ea57
lea ecx, [ebp - 0x994]
call fcn.10016de0
or eax, 0xffffffff
lea ecx, [ebp - 0x578]
mov dword [ebp - 4], eax
call fcn.10016de0
push ebx
lea ecx, [ebp - 0x37c]
call fcn.10016d5e
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002eade
push dword [ebp - 0x28]
lea ecx, [ebp - 0x37c]
call fcn.10016dfc
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002eac3
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002eafe
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x204], 0xdedb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002eae6
xor eax, eax
push eax
lea ecx, [ebp - 0x37c]
call fcn.10016dfc
xor eax, eax
lea ecx, [ebp - 0x37c]
push eax
call fcn.10016dfc
xor eax, eax
lea ecx, [ebp - 0x37c]
push eax
call fcn.10016dfc
cmp dword [eax], 0
je 0x1002eb39
xor eax, eax
cmp dword [ebp - 0x204], eax
je 0x1002eb3b
mov esi, ebx
jmp 0x1002eb3d
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x37c]
call fcn.10016dfc
mov ecx, dword [ebp - 0x204]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x37c]
setg bl
xor eax, eax
push eax
call fcn.10016dfc
xor edx, edx
cmp dword [eax], ebx
setge dl
xor ecx, ecx
cmp esi, 0xfecafe8
setne cl
xor eax, eax
cmp edx, ecx
setne al
cmp eax, dword [ebp - 0x204]
je 0x1002eb9f
xor eax, eax
lea ecx, [ebp - 0x37c]
push eax
call fcn.10016dfc
cmp dword [eax], 0
jne 0x1002eb9f
xor ebx, ebx
xor eax, eax
inc ebx
jmp 0x1002eba4
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x37c]
mov eax, dword [ebp - 0x48]
or esi, 0xffffffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], esi
call fcn.10016de0
mov dword [ebp - 0x30], edi
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
jmp 0x1002ec0c
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002ec03
push 0x2636
push 0x1dc3
push 0x230f
push 0x2599
push 0x68f
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], 0xfffffff1
jle 0x1002ebd1
mov dword [ebp - 0x18], 0xf86f25db
lea ecx, [ebp - 0x988]
push 3
mov dword [ebp - 0x24], 0x5540d7f8
mov dword [ebp - 0x48], esi
pop esi
mov dword [ebp - 0x48], 0x8039d6b9
push esi
call fcn.10016d5e
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x38], 0xbec5
mov dword [ebp - 0x40], 0x3c86
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002ec6c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x110], 0x73ff82f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002ec54
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002ec92
push dword [ebp - 0x28]
lea ecx, [ebp - 0x988]
call fcn.10016dfc
mov dword [eax], 0x1ec2184e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002ec74
xor eax, eax
mov dword [ebp - 0x24], esi
jmp 0x1002ecb4
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002ecb1
push eax
push 0x211e
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff8
jle 0x1002ec97
mov eax, dword [ebp - 0x110]
xor eax, eax
cmp dword [ebp - 0x110], eax
je 0x1002ecd8
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jle 0x1002ecd6
mov eax, ebx
jmp 0x1002ecd8
xor eax, eax
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, 0xffff
lea ecx, [ebp - 0x988]
setle dl
sub edx, eax
mov eax, dword [ebp - 0x110]
neg edx
push ebx
sbb edx, edx
inc edx
imul eax, edx
mov dword [ebp - 0x48], eax
mov esi, dword [ebp - 0x48]
call fcn.10016dfc
xor ecx, ecx
test esi, esi
sete cl
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x110]
cmp ecx, eax
mov eax, dword [ebp - 0x110]
setge dl
sub eax, edx
je 0x1002ed43
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002ed45
mov eax, ebx
jmp 0x1002ed45
xor eax, eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x988]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016de0
mov dword [ebp - 0x54], 0x4cd4
lea ecx, [ebp - 0xdc0]
mov dword [ebp - 0x50], 0x13a473eb
xor eax, eax
mov dword [ebp - 0x54], 8
push 2
mov dword [ebp - 0x54], 0xfffffffc
pop esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], 6
mov dword [ebp - 0x48], esi
push esi
call fcn.10016d5e
push 3
lea ecx, [ebp - 0xe80]
mov dword [ebp - 4], 4
call fcn.10016d5e
push 5
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x54], 0xfffffff6
mov dword [ebp - 0x34], 0xae8b0121
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002ede3
push dword [ebp - 0x20]
lea ecx, [ebp - 0xdc0]
call fcn.10016dfc
mov dword [eax], 0x9ce4562
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002edc5
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002ee0b
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe80]
call fcn.10016dfc
mov dword [eax], 0x5e82
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002edec
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002ee2b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x11e8], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002ee13
xor eax, eax
inc dword [ebp - 0x48]
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x50], eax
jl 0x1002ee64
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002ee5c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe3c], 0xb61b583d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002ee44
xor eax, eax
inc dword [ebp - 0x34]
dec dword [ebp - 0x50]
jns 0x1002ee36
lea ecx, [ebp - 0xe80]
call fcn.10016de0
or eax, 0xffffffff
lea ecx, [ebp - 0xdc0]
mov dword [ebp - 4], eax
call fcn.10016de0
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 0xffff
mov dword [ebp - 0x50], 3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002eeb5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3b4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002ee9c
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002eec6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
mov dword [ebp - 0x3ac], 0xfffffff1
cmp dword [ebp - 0x3ac], 0x18
jle 0x1002f03a
push 7
pop eax
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0xbf8]
mov dword [ebp - 0x48], 0x8ddac0fa
push 3
call fcn.10016d5e
push 6
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1300]
movdqa xmm0, xmmword [0x100085c0]
lea eax, [ebp - 0x10d8]
push eax
lea eax, [ebp - 0x10e8]
push eax
movdqu xmmword [ebp - 0x10e8], xmm0
call fcn.10016e0b
lea ecx, [ebp - 0x24b]
mov esi, eax
call fcn.10009623
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xef4]
push dword [esi]
call fcn.10016dba
push 7
pop eax
mov byte [ebp - 4], al
or esi, 0xffffffff
xor eax, eax
push 2
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002ef6e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x618], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002ef5a
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002ef86
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbf8]
call fcn.10016dfc
mov dword [eax], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002ef73
mov eax, dword [ebp - 0x618]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
cmp eax, 0xccfd
mov eax, dword [ebp - 0x50]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x618]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x618], 0x85c9e53
jg 0x1002efdc
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x3b0], eax
je 0x1002efde
mov ecx, ebx
mov esi, dword [ebp - 0x3ac]
xor eax, eax
add esi, 0xfffffff7
add esi, ecx
lea ecx, [ebp - 0xbf8]
push eax
call fcn.10016dfc
push 3
lea ecx, [ebp - 0xef4]
mov dword [eax], esi
call fcn.10016dfc
lea ecx, [ebp - 0xef4]
mov dword [eax], esi
call fcn.10016de0
or eax, 0xffffffff
lea ecx, [ebp - 0xbf8]
mov dword [ebp - 4], eax
call fcn.10016de0
inc dword [ebp - 0x3ac]
cmp dword [ebp - 0x3ac], 0x18
jg 0x1002eedd
push 2
pop esi
mov dword [ebp - 0x38], 0x7cdd5376
xor eax, eax
mov dword [ebp - 0x28], 0x83c7730f
mov dword [ebp - 0x20], 0x487223b1
mov dword [ebp - 0x24], 0x153413f0
mov dword [ebp - 0x2c], 0x6cad8e65
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002f07c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x60], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f067
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002f2c6
mov dword [ebp - 0x1c], 0xc2c9ebf4
lea ecx, [ebp - 0x414]
push 4
call fcn.10016d5e
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x48], 0x6736
mov dword [ebp - 0x10], eax
jmp 0x1002f0c8
push dword [ebp - 0x10]
lea ecx, [ebp - 0x414]
call fcn.10016dfc
mov dword [eax], 0x4c20f746
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002f0b1
mov eax, dword [ebp - 0x1c]
mov edx, 0xfffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
push 3
mov ecx, dword [ebp + eax*4 - 0x60]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x60]
add eax, 0x79cd
cmp edx, eax
sbb eax, eax
xor ebx, ebx
neg eax
cmp ecx, eax
lea ecx, [ebp - 0x414]
setle bl
call fcn.10016dfc
mov ecx, dword [ebp - 0x60]
imul ecx, ebx
xor ebx, ebx
push 0xfffffffffffffffa
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
pop ecx
mov eax, dword [ebp + eax*4 - 0x60]
sub ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, 0xe503
setne bl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x60]
cmp ebx, eax
mov eax, dword [ebp - 0x28]
setne dl
mov ecx, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x20]
sub ecx, edx
xor edx, edx
cmp ecx, eax
setne dl
sub edx, 0x8953
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x60], 0xffed005a
jle 0x1002f1ce
mov eax, 0xfffb
lea ecx, [ebp - 0x414]
xor ebx, ebx
mov dword [ebp - 0x48], eax
inc ebx
push 3
mov dword [ebp - 0x38], ebx
call fcn.10016dfc
cmp dword [eax], 0
jne 0x1002f1c4
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x414]
mov eax, dword [ebp - 0x48]
push 3
call fcn.10016dfc
mov ecx, dword [ebp - 0x60]
xor ebx, ebx
push 3
cmp dword [eax], ecx
lea ecx, [ebp - 0x414]
setl bl
call fcn.10016dfc
mov ecx, dword [ebp - 0x48]
xor edx, edx
cmp ebx, ecx
sete dl
sub edx, dword [ebp - 0x2c]
imul edx, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
xor eax, eax
jmp 0x1002f1c6
mov eax, ebx
mov dword [ebp - 0x38], eax
jmp 0x1002f2a7
xor eax, eax
mov dword [ebp - 0x38], 0x584502e4
mov dword [ebp - 0x20], eax
jmp 0x1002f245
mov dword [ebp - 0x24], eax
jmp 0x1002f23d
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x1002f23a
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002f235
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f21a
push 0x26eb
push 0xf0c
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f230
push 0x2508
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x1002f1f5
dec dword [ebp - 0x1c]
jns 0x1002f1ed
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002f1e1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1002f1dc
cmp dword [ebp - 0x38], 0xfff9
jbe 0x1002f291
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x414]
push esi
mov eax, dword [ebp + eax*4 - 0x60]
call fcn.10016dfc
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
cmp eax, esi
setne cl
sub ecx, 0xd487c759
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x60], eax
jne 0x1002f291
mov edx, eax
jmp 0x1002f296
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x60]
cmp eax, edx
sete cl
mov dword [ebp - 0x60], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x414]
mov dword [ebp - 4], eax
call fcn.10016de0
dec dword [ebp - 0x28]
jns 0x1002f088
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
jmp 0x1002f31e
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x60], 0
jne 0x1002f2de
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x1002f2e0
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x60]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setg cl
cmp ecx, dword [ebp + eax*4 - 0x60]
jl 0x1002f300
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x60], eax
je 0x1002f302
mov edx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x20]
sub ecx, edx
mov dword [ebp + eax*4 - 0x60], ecx
mov dword [ebp - 0x28], 0x4b5bc68
inc dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jle 0x1002f2cb
mov dword [ebp - 0x1c], 0x5b9b55bb
lea ecx, [ebp - 0x488]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x34], ebx
push esi
call fcn.10016d5e
push 9
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x48], 0xe72e
mov dword [ebp - 0x2c], 0xf0ab
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002f389
push dword [ebp - 0x10]
lea ecx, [ebp - 0x488]
call fcn.10016dfc
mov dword [eax], 0x3f3ac9d7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f36b
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], 0x14
jg 0x1002f563
mov esi, 0x71c3
jmp 0x1002f39f
xor eax, eax
mov dword [ebp - 0x24], 0x9b2b
mov dword [ebp - 0x50], 0xffff
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xcf4], esi
mov dword [ebp - 0xcf0], esi
mov dword [ebp - 0xcec], esi
push 2
mov dword [ebp - 0xce8], esi
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x1002f3e1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002f3d0
push ebx
lea ecx, [ebp - 0x488]
call fcn.10016dfc
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, ebx
setle cl
xor ebx, ebx
imul ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c4]
dec ecx
cmp ecx, eax
lea ecx, [ebp - 0x488]
setge bl
xor eax, eax
push eax
neg ebx
call fcn.10016dfc
imul ecx, ebx, 0x32d
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setg dl
sub edx, 0x5f9b
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
cmp ecx, dword [ebp - 0x1c4]
je 0x1002f450
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
xor ebx, ebx
mov eax, dword [ebp - 0x1c4]
inc ebx
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002f479
push ebx
lea ecx, [ebp - 0x488]
call fcn.10016dfc
cmp dword [eax], 0
jne 0x1002f480
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x1002f482
mov edx, ebx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c4]
sete cl
xor edx, edx
cmp ecx, 0xb2a1
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
test ecx, ecx
js 0x1002f4ae
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1c4]
inc dword [ebp - 0x50]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x1c4], ecx
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x28]
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xb64e3176
jbe 0x1002f4f8
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x50], eax
je 0x1002f4fa
mov ecx, ebx
mov eax, 0x1c3a
sub eax, ecx
je 0x1002f51a
xor eax, eax
lea ecx, [ebp - 0x488]
push eax
call fcn.10016dfc
cmp dword [eax], 0
je 0x1002f51a
mov eax, ebx
jmp 0x1002f51c
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xcec]
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
je 0x1002f550
cmp dword [ebp - 0x1c4], eax
je 0x1002f550
mov eax, ebx
mov dword [ebp - 0x50], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x14
jle 0x1002f39d
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x488]
mov dword [ebp - 4], eax
call fcn.10016de0
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop edi
cmp dword [ebp - 0x10], edi
jge 0x1002f599
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2e8], 0xb56411d7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002f581
xor eax, eax
mov dword [ebp - 0x28], 0x2c70bb74
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002f5cd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x120], 0x8206
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f5b5
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002f68d
push esi
lea ecx, [ebp - 0x9a0]
call fcn.10016d5e
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002f60c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9a0]
call fcn.10016dfc
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f5f2
xor eax, eax
mov esi, dword [ebp - 0x34]
lea ecx, [ebp - 0x9a0]
push eax
call fcn.10016dfc
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x120]
cmp eax, edx
mov eax, dword [ebp - 0x28]
setl cl
imul ecx, dword [ebp + eax*4 - 0x120]
test ecx, ecx
jne 0x1002f66f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x120]
xor eax, eax
lea ecx, [ebp - 0x9a0]
mov dword [ebp - 0x44], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016de0
inc dword [ebp - 0x28]
xor eax, eax
push 2
pop esi
cmp dword [ebp - 0x28], eax
jle 0x1002f5d5
mov eax, dword [ebp - 0x44]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setg dl
xor ebx, ebx
cmp eax, edx
push 6
setl bl
xor ecx, ecx
sub ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ebx, eax
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
pop eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x2e8], ecx
inc ebx
mov dword [ebp - 0x54], 0xc7a00f47
lea ecx, [ebp - 0xb38]
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x44], 0x8f6c74aa
mov dword [ebp - 0x54], 0x76b87d0f
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x38], 0x7b5bf2d3
mov dword [ebp - 0x54], 0xc4d1454b
mov dword [ebp - 0x34], 0x4a6f4440
mov dword [ebp - 0x48], 0xfffffff7
push ebx
call fcn.10016d5e
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002f764
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe40], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002f750
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002f786
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb38]
call fcn.10016dfc
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002f76c
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f798
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
xor eax, eax
push eax
lea ecx, [ebp - 0xb38]
call fcn.10016dfc
xor ecx, ecx
inc dword [eax]
mov dword [ebp - 0x48], 0xab3c
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
cmp eax, 0x7128
setne cl
or esi, 0xffffffff
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xb38]
mov dword [ebp - 4], esi
call fcn.10016de0
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x2e4], eax
jne 0x1002f7e7
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2e8]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2e8]
dec ecx
neg ecx
push edi
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2e8]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setl bl
xor ecx, ecx
cmp ebx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x2e8], ecx
inc ebx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x9b8]
mov dword [ebp - 0x28], 0x8a1f9496
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], 0xa05d
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x40], 0x6084edc0
mov dword [ebp - 0x40], 0xf7c2f5a2
call fcn.10016d5e
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x10], eax
jmp 0x1002f8a3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9b8]
call fcn.10016dfc
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002f890
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x28]
jge 0x1002f8c6
cmp dword [ebp - 0x28], eax
je 0x1002f8c6
mov eax, ebx
mov dword [ebp - 0x34], eax
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
push 2
setne dl
sub edx, dword [ebp - 0x44]
neg edx
pop esi
sbb edx, edx
inc edx
mov dword [ebp - 0x34], edx
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
push esi
setge dl
lea ecx, [ebp - 0x9b8]
mov dword [ebp - 0x40], edx
call fcn.10016dfc
lea ecx, [ebp - 0x9b8]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016de0
mov dword [ebp - 0x28], 0x8a1f9496
lea ecx, [ebp - 0xcb8]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], 0xa05d
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x40], 0x6084edc0
mov dword [ebp - 0x40], 0xf7c2f5a2
push edi
call fcn.10016d5e
xor eax, eax
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x10], eax
jmp 0x1002f98d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xcb8]
call fcn.10016dfc
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002f977
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x28]
jge 0x1002f9b0
cmp dword [ebp - 0x28], eax
je 0x1002f9b0
mov eax, ebx
mov dword [ebp - 0x34], eax
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
push esi
setne dl
sub edx, dword [ebp - 0x44]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x34], edx
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
lea ecx, [ebp - 0xcb8]
setge dl
mov dword [ebp - 0x40], edx
call fcn.10016dfc
lea ecx, [ebp - 0xcb8]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016de0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002fa3f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x137c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002fa2b
xor eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fa55
push eax
push eax
push eax
call edi
xor eax, eax
mov ebx, dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [ebp - 0x10], esi
mov esi, dword [sym.imp.USER32.dll_ShowOwnedPopups]
cmp dword [ebp - 0x10], eax
jl 0x1002fac6
xor edi, edi
inc edi
mov dword [ebp - 0x50], 0x86cce57b
mov dword [ebp - 0x50], 2
cmp dword [ebp - 0x50], eax
jl 0x1002fa99
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fa94
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
dec dword [ebp - 0x50]
jns 0x1002fa7f
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fabb
push eax
push 0x1f36
push 0x1f78
push 0xc74
push 0x1e27
call ebx
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1002fa6c
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x28], 0x8a1f9496
lea ecx, [ebp - 0x9d0]
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xa05d
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x40], 0x6084edc0
mov dword [ebp - 0x40], 0xf7c2f5a2
push 3
call fcn.10016d5e
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002fb30
or edi, 0xffffffff
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9d0]
call fcn.10016dfc
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002fb11
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x28]
jge 0x1002fb4d
cmp dword [ebp - 0x28], eax
je 0x1002fb4d
inc eax
mov dword [ebp - 0x34], eax
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
push 2
setne dl
sub edx, dword [ebp - 0x44]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x34], edx
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
pop eax
setge dl
lea ecx, [ebp - 0x9d0]
mov dword [ebp - 0x40], edx
push eax
call fcn.10016dfc
lea ecx, [ebp - 0x9d0]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016de0
push 5
mov dword [ebp - 0x20], 0xac64a684
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x20], 0x1b
cmp dword [ebp - 0x20], 0xfffffff5
jge 0x1002fd1e
xor eax, eax
mov dword [ebp - 0x34], eax
push 7
pop ecx
mov dword [ebp - 0x6c8], ecx
mov dword [ebp - 0x6c4], ecx
mov dword [ebp - 0x6c0], ecx
mov dword [ebp - 0x6bc], ecx
xor ecx, ecx
mov dword [ebp - 0x34], 0x4ed25e42
inc ecx
mov dword [ebp - 0x38], 0xd31fc531
mov dword [ebp - 0x10], eax
jmp 0x1002fc26
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x84], 0x4f9dbc9b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002fc15
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x84], eax
jne 0x1002fc3a
mov ecx, eax
mov eax, dword [ebp - 0x84]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x84]
cmp ecx, eax
sete dl
xor eax, eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], eax
je 0x1002fc5c
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x6bc]
mov eax, dword [ebp - 0x6bc]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
add eax, 0x9080
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x50], eax
je 0x1002fcaf
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x1002fcaf
xor edi, edi
mov ecx, eax
inc edi
jmp 0x1002fcb4
xor edi, edi
inc edi
mov ecx, edi
mov eax, dword [ebp - 0x6bc]
add eax, ecx
cmp eax, dword [ebp - 0x20]
jge 0x1002fcca
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x1002fccc
mov edx, edi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x20]
jge 0x1002fce7
mov edx, edi
cmp dword [ebp - 0x6c0], eax
jne 0x1002fce9
mov edx, eax
mov eax, dword [ebp - 0x84]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x84]
jge 0x1002fd04
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff5
jl 0x1002fbdf
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x20], 0xd
cmp dword [ebp - 0x20], 0x14
jge 0x1002fd54
xor edi, edi
inc edi
mov dword [ebp - 0x38], 0x9d693ce8
mov dword [ebp - 0x40], 0x278539ae
mov dword [ebp - 0x50], edi
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x14
jl 0x1002fd2e
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002fd7b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13ac], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002fd62
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fd8b
push eax
push eax
push eax
call edi
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x1002fdf2
xor edi, edi
inc edi
mov dword [ebp - 0x50], 0x86cce57b
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], eax
jl 0x1002fdc2
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fdbd
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
dec dword [ebp - 0x50]
jns 0x1002fda8
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fde4
push eax
push 0x1f36
push 0x1f78
push 0xc74
push 0x1e27
call ebx
xor eax, eax
dec dword [ebp - 0x10]
push 2
pop ecx
jns 0x1002fd99
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
mov dword [ebp - 0x38], 0x85299dad
inc eax
lea ecx, [ebp - 0xb50]
push eax
call fcn.10016d5e
xor eax, eax
mov dword [ebp - 4], 0xf
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002fe43
xor edi, edi
inc edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb50]
call fcn.10016dfc
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002fe1f
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
push eax
lea ecx, [ebp - 0xb50]
call fcn.10016dfc
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002fe65
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
or eax, 0xffffffff
lea ecx, [ebp - 0xb50]
mov dword [ebp - 4], eax
call fcn.10016de0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002fe9d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13a0], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002fe84
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fead
push eax
push eax
push eax
call edi
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x1002ff14
xor edi, edi
inc edi
mov dword [ebp - 0x50], 0x86cce57b
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], eax
jl 0x1002fee4
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fedf
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
dec dword [ebp - 0x50]
jns 0x1002feca
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002ff06
push eax
push 0x1f36
push 0x1f78
push 0xc74
push 0x1e27
call ebx
xor eax, eax
dec dword [ebp - 0x10]
push 2
pop ecx
jns 0x1002febb
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff1
jg 0x1002ff65
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002ff56
push 0x2636
push 0x1dc3
push 0x230f
push 0x2599
push 0x68f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff1
push 0
pop eax
jle 0x1002ff20
push 5
mov dword [ebp - 0x20], 0xac64a684
xor ebx, ebx
pop ecx
mov dword [ebp - 0x50], ecx
inc ebx
mov dword [ebp - 0x20], 0x1b
cmp dword [ebp - 0x20], 0xfffffff5
jge 0x100300b8
jmp 0x1002ff8a
xor eax, eax
mov dword [ebp - 0x34], eax
push 7
pop ecx
mov dword [ebp - 0x6dc], ecx
mov dword [ebp - 0x6d8], ecx
mov dword [ebp - 0x6d4], ecx
mov dword [ebp - 0x6d0], ecx
mov dword [ebp - 0x34], 0x4ed25e42
mov dword [ebp - 0x38], 0xd31fc531
mov dword [ebp - 0x10], eax
jmp 0x1002ffcc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x88], 0x4f9dbc9b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002ffbb
mov eax, dword [ebp - 0x20]
mov ecx, ebx
xor eax, eax
cmp dword [ebp - 0x88], eax
jne 0x1002ffe2
mov ecx, eax
mov eax, dword [ebp - 0x88]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x88]
cmp ecx, eax
sete dl
xor eax, eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], eax
je 0x10030004
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x6d0]
mov eax, dword [ebp - 0x6d0]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
add eax, 0x9080
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x50], eax
je 0x10030052
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x50], eax
je 0x10030054
mov ecx, ebx
mov eax, dword [ebp - 0x6d0]
add eax, ecx
cmp eax, dword [ebp - 0x20]
jge 0x1003006a
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x1003006c
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x20]
jge 0x10030087
mov edx, ebx
cmp dword [ebp - 0x6d4], eax
jne 0x10030089
mov edx, eax
mov eax, dword [ebp - 0x88]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x88]
jge 0x100300a4
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff5
jl 0x1002ff88
mov dword [ebp - 0x20], 0xd
jmp 0x100300db
mov dword [ebp - 0x38], 0x9d693ce8
mov dword [ebp - 0x40], 0x278539ae
mov dword [ebp - 0x50], ebx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x14
jl 0x100300c1
push 2
pop esi
push esi
lea ecx, [ebp - 0x174]
call fcn.10016d5e
push esi
lea ecx, [ebp - 0x9e8]
mov dword [ebp - 4], 0x10
call fcn.10016d5e
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1003012f
push dword [ebp - 0x20]
lea ecx, [ebp - 0x174]
call fcn.10016dfc
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10030111
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1003014f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x640], 0xbd90
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10030137
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10030175
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9e8]
call fcn.10016dfc
mov dword [eax], 0x56237581
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10030157
xor eax, eax
push eax
lea ecx, [ebp - 0x174]
call fcn.10016dfc
lea ecx, [ebp - 0x174]
mov dword [eax], 0xffffffec
xor eax, eax
push eax
call fcn.10016dfc
cmp dword [eax], 0xffffffef
je 0x10030304
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100301c5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1268], 0x8451d77f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100301ac
xor eax, eax
push eax
lea ecx, [ebp - 0x174]
call fcn.10016dfc
cmp dword [eax], 0
je 0x100302c8
xor eax, eax
lea ecx, [ebp - 0x174]
push eax
call fcn.10016dfc
push ebx
lea ecx, [ebp - 0x174]
call fcn.10016dfc
xor eax, eax
lea ecx, [ebp - 0x174]
push eax
call fcn.10016dfc
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x174]
xor eax, eax
push eax
call fcn.10016dfc
cmp dword [eax], 0
je 0x1003022f
xor eax, eax
lea ecx, [ebp - 0x174]
push eax
call fcn.10016dfc
cmp dword [eax], 0
je 0x1003022f
mov esi, ebx
jmp 0x10030233
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x174]
call fcn.10016dfc
xor ebx, ebx
lea ecx, [ebp - 0x174]
mov eax, dword [eax]
imul eax, esi
cmp eax, 0x65251c60
setge bl
xor eax, eax
mov dword [ebp - 0x1264], ebx
push eax
call fcn.10016dfc
xor ecx, ecx
test ebx, ebx
sete cl
xor ebx, ebx
imul ecx, dword [ebp - 0x1c]
cmp ecx, 0x1c36
lea ecx, [ebp - 0x174]
setg bl
sub ebx, dword [eax]
neg ebx
sbb ebx, ebx
xor eax, eax
push eax
inc ebx
call fcn.10016dfc
mov ecx, dword [ebp - 0x1c]
mov edx, eax
mov eax, dword [ebp - 0x1c]
sub ebx, ecx
push 0
pop ecx
sets cl
sub eax, ecx
sub eax, dword [edx]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x640], eax
dec eax
cmp eax, 0x5bb5
setge cl
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
xor eax, eax
inc ebx
cmp dword [ebp - 0x1c], eax
je 0x100302ca
mov esi, ebx
jmp 0x100302cc
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x9e8]
call fcn.10016dfc
lea ecx, [ebp - 0x174]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.10016dfc
lea ecx, [ebp - 0x174]
inc dword [eax]
xor eax, eax
push eax
call fcn.10016dfc
cmp dword [eax], 0xffffffef
jne 0x1003019e
push 2
pop esi
lea ecx, [ebp - 0x9e8]
call fcn.10016de0
or eax, 0xffffffff
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], eax
call fcn.10016de0
xor eax, eax
mov dword [ebp - 0x54], 0x6482
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003033a
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030351
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 0x18], 0x8a1f9496
lea ecx, [ebp - 0xdd8]
push ebx
call fcn.10016d5e
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x10], 0x18885c6f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003039a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdd8]
call fcn.10016dfc
mov dword [eax], 0x198a8f93
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003037c
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100303b2
cmp byte [ebp - 0x39], 0
je 0x100303af
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
mov byte [ebp - 0x39], al
jle 0x1003039f
cmp byte [ebp - 0x39], 0
je 0x100303c6
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
or eax, 0xffffffff
lea ecx, [ebp - 0xdd8]
mov dword [ebp - 4], eax
call fcn.10016de0
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0xc10]
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], 0xf76ec751
mov dword [ebp - 0x40], 0xa7b7e80d
push esi
call fcn.10016d5e
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003042e
push 5
pop edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc10]
call fcn.10016dfc
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003040e
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003043d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
jne 0x1003045e
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jle 0x1003045e
xor eax, eax
mov ecx, eax
jmp 0x10030460
mov ecx, ebx
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp eax, dword [ebp - 0x1c]
jne 0x10030476
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x40], eax
je 0x10030478
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
push ebx
setl cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xc10]
call fcn.10016dfc
mov ecx, dword [ebp - 0x40]
add ecx, 0x331c
mov dword [eax], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0xc10]
mov dword [ebp - 4], eax
call fcn.10016de0
mov dword [ebp - 0x44], 0xa05d
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x10], eax
jmp 0x100304dd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8ec], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100304cc
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100304fd
cmp dword [ebp - 0x28], eax
je 0x100304fd
mov eax, ebx
mov ecx, dword [ebp - 0x28]
xor ebx, ebx
imul ecx, eax
mov edx, 0x70669599
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg bl
xor ecx, ecx
sub edx, ebx
cmp eax, edx
setl cl
cmp ecx, 4
ja 0x10030526
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x8ec]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x1c]
je 0x10030559
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10030559
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x1003055e
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x7976
setle al
xor ecx, ecx
cmp eax, 0xd9ae
mov eax, 0xfffa
setg cl
cmp ecx, eax
ja 0x1003059f
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100305bc
push 0x11a8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x100305bc
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100305b7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x8ec], 0xd7ba
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x100305a6
mov dword [ebp - 0x34], 8
lea ecx, [ebp - 0xb68]
mov dword [ebp - 0x24], 0xeac8b13e
push esi
call fcn.10016d5e
push esi
lea ecx, [ebp - 0xa00]
mov dword [ebp - 4], 0x14
call fcn.10016d5e
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1003060f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x10c], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100305f7
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10030635
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb68]
call fcn.10016dfc
mov dword [eax], 0x36d0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10030617
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1003065e
or edi, 0xffffffff
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa00]
call fcn.10016dfc
mov dword [eax], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10030640
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
dec dword [ebp - 0x108]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x108]
sub eax, dword [ebp - 0x108]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x24], eax
jge 0x100306f8
xor eax, eax
mov dword [ebp - 0x40], 0x3e76e5b1
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xb68]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.10016dfc
mov edx, dword [ebp - 0x38]
xor ebx, ebx
mov ecx, dword [ebp - 0x24]
cmp edx, ecx
mov ecx, dword [ebp - 0x108]
setl bl
or edx, 0xffffffff
cmp edx, ecx
sbb ecx, ecx
inc ecx
sub ebx, ecx
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, dword [eax]
mov eax, dword [ebp - 0x40]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp eax, ebx
setge cl
xor ebx, ebx
xor eax, eax
inc ebx
cmp ecx, ebx
setle al
mov dword [ebp - 0x24], eax
jmp 0x10030776
mov dword [ebp - 0x24], ebx
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x10030776
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1003075f
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xa00]
mov eax, dword [ebp - 0x28]
push ebx
mov eax, dword [ebp + eax*4 - 0x10c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x10c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x10c]
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x28]
sub esi, 0xfffffffd
neg esi
sbb esi, esi
inc esi
call fcn.10016dfc
push 0
mov dword [eax], esi
mov dword [ebp - 0x38], esi
dec dword [ebp - 0x28]
pop eax
jns 0x10030711
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030771
push eax
call dword [sym.imp.GDI32.dll_GetObjectType]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10030702
lea ecx, [ebp - 0xa00]
call fcn.10016de0
or eax, 0xffffffff
lea ecx, [ebp - 0xb68]
mov dword [ebp - 4], eax
call fcn.10016de0
mov dword [ebp - 0x40], 0x6084edc0
xor eax, eax
mov dword [ebp - 0x24], 0xb9b55bb2
mov dword [ebp - 0x24], eax
jmp 0x100307ee
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], 0xbd6c3f0b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xf
je 0x100307eb
mov dword [ebp - 0x10], eax
jmp 0x100307d0
cmp dword [ebp - 0x10], 3
jl 0x100307bf
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff8
jne 0x100307a7
mov dword [ebp - 0x40], 0xf7c2f5a2
mov dword [ebp - 0x54], 0x8753e1e0
push 3
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x10030825