Function at 0x1002c9ad
Capabilities:
Accept command line arguments
Allocate thread local storage
Clear file content
Compare security identifiers
Delete registry key
Delete registry value
Get common file path
Get geographical location
Get thread local storage value
Parse pe header
Query environment variable

Disassembly:
mov eax, 0x1007d1f4
call fcn.1007b848
mov eax, 0x165c
call fcn.10078000
mov dword [ebp - 0x3c], 0x5252cb13
push ebx
mov dword [ebp - 0x28], 0x5165352f
xor ebx, ebx
mov dword [ebp - 0x4c], 0x6a205b29
inc ebx
mov dword [ebp - 0x18], 0xb17b
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
xor eax, eax
push esi
push edi
mov byte [ebp - 0x69], dl
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x4c], eax
je 0x1002c9fc
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, dword [ebp - 0x3c]
je 0x1002cbb6
lea eax, [ebp - 0x126c]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x127c]
push eax
lea ecx, [ebp - 0x14d0]
movdqu xmmword [ebp - 0x127c], xmm0
call fcn.10015060
lea ecx, [ebp - 0x231]
mov esi, eax
call fcn.10008b73
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x434]
push dword [esi]
call fcn.10015026
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], eax
jmp 0x1002caa8
mov dword [ebp - 0x28], eax
jmp 0x1002ca9f
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002ca80
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002ca96
mov dword [ebp - 0x34], 0xf62c4df8
mov dword [ebp - 0x34], 0xfffffff6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xb
jl 0x1002ca85
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x34
jg 0x1002ca71
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x33
je 0x1002ca6c
push 3
pop edx
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], eax
jl 0x1002cba5
mov edi, 0xf93be41b
push 4
lea ecx, [ebp - 0x9f0]
call fcn.10014fc7
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], eax
jmp 0x1002caf0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9f0]
call fcn.10015051
mov dword [eax], 0x6eae1177
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002cad9
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x434]
call fcn.10015051
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002cb1b
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x434]
push 2
call fcn.10015051
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x434]
call fcn.10015051
mov ecx, dword [ebp - 0x18]
cmp edi, ecx
sbb ecx, ecx
neg ecx
imul ecx, ecx, 0xbb30
add ecx, dword [eax]
jne 0x1002cb45
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x3c], eax
je 0x1002cb47
mov esi, ebx
push ebx
lea ecx, [ebp - 0x434]
call fcn.10015051
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x434]
sub esi, dword [eax]
call fcn.10015051
push 3
lea ecx, [ebp - 0x434]
mov dword [eax], esi
pop eax
push eax
call fcn.10015051
push ebx
lea ecx, [ebp - 0x9f0]
mov esi, eax
call fcn.10015051
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
lea ecx, [ebp - 0x9f0]
mov byte [ebp - 4], al
call fcn.1001504c
dec dword [ebp - 0x3c]
jns 0x1002cac2
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.1001504c
jmp 0x1002cbc0
mov dword [ebp - 0x4c], 0xd734895c
inc dword [ebp - 0x4c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002cbd3
push eax
call ebx
mov dword [ebp - 0x3c], 0x5252cb13
xor esi, esi
mov dword [ebp - 0x28], 0x5165352f
inc esi
mov dword [ebp - 0x4c], 0x6a205b29
mov dword [ebp - 0x18], 0xb17b
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002cc05
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
je 0x1002cdc5
lea eax, [ebp - 0x116c]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x117c]
push eax
lea ecx, [ebp - 0x1588]
movdqu xmmword [ebp - 0x117c], xmm0
call fcn.10015060
lea ecx, [ebp - 0x1d5]
mov esi, eax
call fcn.10008b73
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x3bc]
push dword [esi]
call fcn.10015026
xor eax, eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x18], eax
jmp 0x1002ccaf
mov dword [ebp - 0x28], eax
jmp 0x1002cca6
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002cc87
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002cc9d
mov dword [ebp - 0x34], 0xf62c4df8
mov dword [ebp - 0x34], 0xfffffff6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xb
jl 0x1002cc8c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x34
jg 0x1002cc78
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x33
je 0x1002cc73
push 3
pop ecx
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x1002cdb1
xor edi, edi
inc edi
push 4
lea ecx, [ebp - 0xaec]
call fcn.10014fc7
push 3
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002ccf8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xaec]
call fcn.10015051
mov dword [eax], 0x6eae1177
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002cce1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x3bc]
call fcn.10015051
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002cd23
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x3bc]
push 2
call fcn.10015051
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x3bc]
call fcn.10015051
mov ecx, dword [ebp - 0x18]
mov edx, 0xf93be41b
cmp edx, ecx
sbb ecx, ecx
neg ecx
imul ecx, ecx, 0xbb30
add ecx, dword [eax]
jne 0x1002cd52
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x3c], eax
je 0x1002cd54
mov esi, edi
push edi
lea ecx, [ebp - 0x3bc]
call fcn.10015051
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x3bc]
sub esi, dword [eax]
call fcn.10015051
push 3
lea ecx, [ebp - 0x3bc]
mov dword [eax], esi
pop eax
push eax
call fcn.10015051
push edi
lea ecx, [ebp - 0xaec]
mov esi, eax
call fcn.10015051
mov ecx, dword [esi]
mov byte [ebp - 4], 2
mov dword [eax], ecx
lea ecx, [ebp - 0xaec]
call fcn.1001504c
dec dword [ebp - 0x3c]
jns 0x1002ccc7
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3bc]
call fcn.1001504c
xor esi, esi
inc esi
jmp 0x1002cdcf
mov dword [ebp - 0x4c], 0xd734895c
inc dword [ebp - 0x4c]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002cdde
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x3c], 0x5252cb13
mov dword [ebp - 0x10], 0xffffffff
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002ce0f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13f8], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002cdf7
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x1002ce65
mov dword [ebp - 0x20], 0xfe77dd68
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jl 0x1002ce5d
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002ce58
push eax
push 0xf4a
push 0x2673
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002ce2e
dec dword [ebp - 0x10]
jns 0x1002ce1b
push 3
pop ecx
mov dword [ebp - 0x13f0], 0xf3d4210e
mov dword [ebp - 0x28], 0x5165352f
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], 0xcdead9ba
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], 0x389a9b8
mov dword [ebp - 0x18], 0x2c39d5b6
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x34], 0xdf8a
cmp dword [ebp - 0x20], eax
jne 0x1002ceb5
cmp dword [ebp - 0x2c], eax
jne 0x1002ceb5
mov esi, eax
mov dword [ebp - 0x10], 9
xor edx, edx
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
inc ecx
jne 0x1002cee1
cmp dword [ebp - 0x20], eax
je 0x1002cee9
cmp dword [ebp - 0x10], eax
je 0x1002cee9
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xd80]
mov dword [ebp - 0x4c], esi
xor esi, esi
mov eax, dword [ebp - 0x4c]
inc esi
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x4c], 0x6a205b29
mov dword [ebp - 0x10], 0x10c93b4e
mov dword [ebp - 0x40], 0xfffffff7
push esi
call fcn.10014fc7
push 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002cf62
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd80]
call fcn.10015051
mov dword [eax], 0x17f75960
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cf44
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002cf70
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x4c]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x1002cf67
dec dword [ebp - 0x30]
lea ecx, [ebp - 0xd80]
or dword [ebp - 4], 0xffffffff
call fcn.1001504c
mov dword [ebp - 0x18], 0xb17b
lea ecx, [ebp - 0xf84]
push esi
call fcn.10014fc7
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002cfcd
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf84]
call fcn.10015051
mov dword [eax], 0xea7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cfaf
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002cff4
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002cff1
push eax
push eax
push 0x59d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002cfd2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf84]
call fcn.1001504c
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002d01b
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
je 0x1002d4f3
mov dword [ebp - 0x10], 0x61928c17
mov dword [ebp - 0x24], 0xc3099cf
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], 0xdfe9f486
mov dword [ebp - 0x40], 0xcb314b81
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], 0xffffffe2
jg 0x1002d26d
push 6
xor eax, eax
pop edi
mov dword [ebp - 0x1c], 0x66bc657e
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002d0a6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1428], 0xb6084edc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002d08e
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002d198
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe2
jge 0x1002d25a
movdqa xmm0, xmmword [0x10007b50]
lea eax, [ebp - 0x136c]
push eax
lea eax, [ebp - 0x137c]
push eax
lea ecx, [ebp - 0x1550]
movdqu xmmword [ebp - 0x137c], xmm0
call fcn.10015060
lea ecx, [ebp - 0x211]
mov esi, eax
call fcn.10008b73
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x52c]
push dword [esi]
call fcn.10015026
xor eax, eax
mov dword [ebp - 4], edi
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002d117
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
push 2
lea ecx, [ebp - 0x52c]
call fcn.10015051
mov dword [eax], 0xffffffed
jmp 0x1002d165
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002d144
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 2
lea ecx, [ebp - 0x52c]
call fcn.10015051
cmp dword [eax], 0
jne 0x1002d177
push 2
lea ecx, [ebp - 0x52c]
call fcn.10015051
inc dword [eax]
push 2
lea ecx, [ebp - 0x52c]
call fcn.10015051
cmp dword [eax], 0xb
je 0x1002d12c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x52c]
call fcn.1001504c
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe2
jl 0x1002d0bc
jmp 0x1002d258
mov dword [ebp - 0x20], 0xf7c2f5a2
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], 0xffffffe4
cmp dword [ebp - 0x24], 0xffffffe6
jne 0x1002d233
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002d1d5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x924], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002d1bc
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002d1e0
mov eax, dword [ebp - 0x920]
dec dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x920]
cmp eax, ecx
setg dl
imul eax, edx, 0xfffff30b
test eax, eax
jne 0x1002d203
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
neg eax
sub ecx, eax
neg ecx
push 0
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
neg ecx
cmp ecx, 0xffffffff
setl al
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe6
pop eax
je 0x1002d1b3
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x17
je 0x1002d25a
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setge dl
mov dword [ebp - 0x1420], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jne 0x1002d23c
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
jle 0x1002d07c
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0x118c]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x119c]
push eax
lea ecx, [ebp - 0x1580]
movdqu xmmword [ebp - 0x119c], xmm0
call fcn.10015060
lea ecx, [ebp - 0x1d7]
mov esi, eax
call fcn.10008b73
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x458]
push dword [esi]
call fcn.10015026
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x18], eax
jmp 0x1002d2f9
mov dword [ebp - 0x28], eax
jmp 0x1002d2f0
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002d2d1
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002d2e7
mov dword [ebp - 0x34], 0xf62c4df8
mov dword [ebp - 0x34], 0xfffffff6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xb
jl 0x1002d2d6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x34
jg 0x1002d2c2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x33
je 0x1002d2bd
mov dword [ebp - 0x10], 0x62d5e48d
lea ecx, [ebp - 0x1068]
xor esi, esi
mov eax, 0x5b40194d
inc esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x34], 0xbac04ee7
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
push 3
mov dword [ebp - 0x74], eax
pop eax
push eax
call fcn.10014fc7
mov byte [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x4c], 0x42f3
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002d36c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1068]
call fcn.10015051
push 3
pop ecx
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d34b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x18
jg 0x1002d3ce
jmp 0x1002d37a
push 3
pop ecx
push ecx
mov dword [ebp - 0x40], 0x867b8f5f
lea ecx, [ebp - 0xd98]
call fcn.10014fc7
push 9
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002d3ab
push dword [ebp - 0x1c]
call fcn.10015051
mov dword [eax], 0x5fac1226
inc dword [ebp - 0x1c]
push 3
pop eax
lea ecx, [ebp - 0xd98]
cmp dword [ebp - 0x1c], eax
jl 0x1002d39a
inc dword [ebp - 0x4c]
mov byte [ebp - 4], 8
call fcn.1001504c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x18
jle 0x1002d377
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x1068]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 7
call fcn.1001504c
push 3
pop eax
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
jl 0x1002d4e2
push 4
lea ecx, [ebp - 0x9b4]
call fcn.10014fc7
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x10], eax
jmp 0x1002d423
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9b4]
call fcn.10015051
mov dword [eax], 0x6eae1177
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002d40c
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x458]
call fcn.10015051
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002d44e
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x458]
push 2
call fcn.10015051
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x458]
call fcn.10015051
mov ecx, dword [ebp - 0x18]
mov edx, 0xf93be41b
cmp edx, ecx
sbb ecx, ecx
neg ecx
imul ecx, ecx, 0xbb30
add ecx, dword [eax]
jne 0x1002d47d
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002d47d
mov esi, eax
xor edi, edi
lea ecx, [ebp - 0x458]
inc edi
push edi
call fcn.10015051
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x458]
sub esi, dword [eax]
call fcn.10015051
push 3
lea ecx, [ebp - 0x458]
mov dword [eax], esi
pop eax
push eax
call fcn.10015051
push edi
lea ecx, [ebp - 0x9b4]
mov esi, eax
call fcn.10015051
mov ecx, dword [esi]
mov byte [ebp - 4], 7
mov dword [eax], ecx
lea ecx, [ebp - 0x9b4]
call fcn.1001504c
dec dword [ebp - 0x3c]
push edi
pop esi
jns 0x1002d3f4
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x458]
call fcn.1001504c
jmp 0x1002d4fd
mov dword [ebp - 0x4c], 0xd734895c
inc dword [ebp - 0x4c]
push esi
lea ecx, [ebp - 0x568]
call fcn.10014fc7
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002d52e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10e8], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d51a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002d554
push dword [ebp - 0x18]
lea ecx, [ebp - 0x568]
call fcn.10015051
mov dword [eax], 0xa32b1cec
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d536
xor eax, eax
push eax
lea ecx, [ebp - 0x568]
call fcn.10015051
xor ecx, ecx
push ecx
mov dword [eax], ecx
jmp 0x1002d5b2
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002d588
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002d5a1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
push eax
lea ecx, [ebp - 0x568]
call fcn.10015051
dec dword [eax]
xor eax, eax
push eax
lea ecx, [ebp - 0x568]
call fcn.10015051
cmp dword [eax], 0
jge 0x1002d567
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x568]
call fcn.1001504c
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002d5e0
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff9
mov dword [ebp - 0x34], 0xbacd7953
pop ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0xfffffffb
jl 0x1002d630
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002d625
push eax
push 0x1b85
push 0x490
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffb
jge 0x1002d5f6
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ebx
cmp dword [ebp - 0x10], ebx
jge 0x1002d653
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x508], 0xad313dd3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d63b
xor eax, eax
mov dword [ebp - 0x504], 0x1b
jmp 0x1002d69e
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], 0xb
jmp 0x1002d692
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002d687
push 0xfed
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
cmp dword [ebp - 0x504], eax
jne 0x1002d698
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff1
jl 0x1002d66f
dec dword [ebp - 0x504]
cmp dword [ebp - 0x504], 0xffffffe9
je 0x1002d65f
mov dword [ebp - 0x3c], 0x5252cb13
lea ecx, [ebp - 0x1b8]
push ebx
call fcn.10014fc7
push 2
pop ebx
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0xdb0]
mov dword [ebp - 0x24], 0xf57a7c2
push ebx
call fcn.10014fc7
xor eax, eax
mov byte [ebp - 4], 0xd
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002d709
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1b8]
call fcn.10015051
push 3
mov dword [eax], 0x77862fd4
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1002d6e8
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002d734
push 6
pop edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdb0]
call fcn.10015051
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002d714
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002d855
mov edi, 0xffff
mov dword [ebp - 0x10], eax
jmp 0x1002d75b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x734], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d74a
push esi
lea ecx, [ebp - 0x1b8]
call fcn.10015051
xor ebx, ebx
lea ecx, [ebp - 0x1b8]
mov dword [eax], esi
mov dword [ebp - 0x734], ebx
push dword [ebp - 0x24]
call fcn.10015051
cmp dword [eax], ebx
jne 0x1002d78b
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1b8]
call fcn.10015051
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1b8]
call fcn.10015051
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
push 3
imul ecx, dword [eax]
pop eax
push dword [ebp - 0x24]
cmp ecx, eax
lea ecx, [ebp - 0x1b8]
setge bl
call fcn.10015051
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1b8]
mov esi, dword [eax]
imul esi, ebx
call fcn.10015051
xor ebx, ebx
lea ecx, [ebp - 0x1b8]
push 2
cmp dword [eax], esi
setne bl
call fcn.10015051
xor ecx, ecx
push 2
cmp ebx, dword [eax]
pop ebx
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x1b8]
push ebx
call fcn.10015051
mov ecx, dword [ebp - 0x24]
xor edx, edx
add ecx, dword [ebp - 0x34]
mov esi, 0x67f5ed9a
push dword [ebp - 0x24]
cmp ecx, 0xfffffff6
setg dl
xor ecx, ecx
cmp edx, 0xfffffff7
setle cl
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1b8]
setg dl
xor eax, eax
cmp edx, edi
setne al
sub esi, eax
call fcn.10015051
push 0
mov dword [eax], esi
dec dword [ebp - 0x24]
pop eax
push 1
pop esi
jns 0x1002d745
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002d86a
push 0x11b2
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
lea ecx, [ebp - 0xdb0]
call fcn.1001504c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b8]
call fcn.1001504c
mov dword [ebp - 0x1c], 0x5165352f
xor eax, eax
mov dword [ebp - 0x10], 0xffffffff
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002d8b7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1440], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d89f
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x1002d905
mov dword [ebp - 0x20], 0xfe77dd68
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002d8fd
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002d8f8
push eax
push 0xf4a
push 0x2673
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002d8ce
dec dword [ebp - 0x10]
jns 0x1002d8bf
push 3
pop ecx
mov dword [ebp - 0x1438], 0xf3d4210e
xor ebx, ebx
mov dword [ebp - 0x4c], 0x6a205b29
inc ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], 0xcdead9ba
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], 0x389a9b8
mov dword [ebp - 0x18], 0x2c39d5b6
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x34], 0xdf8a
cmp dword [ebp - 0x20], eax
jne 0x1002d958
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x1002d95a
mov esi, ebx
push 9
pop eax
mov dword [ebp - 0x10], eax
xor edx, edx
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
inc ecx
jne 0x1002d985
cmp dword [ebp - 0x20], eax
je 0x1002d98c
cmp dword [ebp - 0x10], eax
je 0x1002d98c
mov eax, ebx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xf9c]
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x44], 0xb17b
mov dword [ebp - 0x10], 0x10c93b4e
mov dword [ebp - 0x40], 0xfffffff7
push ebx
call fcn.10014fc7
push 4
mov dword [ebp - 4], 0xe
xor eax, eax
pop esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002da06
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf9c]
call fcn.10015051
mov dword [eax], 0x17f75960
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d9e8
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002da14
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x4c]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x1002da0b
dec dword [ebp - 0x30]
lea ecx, [ebp - 0xf9c]
or dword [ebp - 4], 0xffffffff
call fcn.1001504c
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0xdc8]
push ebx
call fcn.10014fc7
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002da6d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdc8]
call fcn.10015051
mov dword [eax], 0xea7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002da4f
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002da94
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002da91
push eax
push eax
push 0x59d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002da72
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc8]
call fcn.1001504c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002dab8
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
je 0x1002f1cb
mov dword [ebp - 0x10], 0x61928c17
mov dword [ebp - 0x24], 0xc3099cf
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], 0xdfe9f486
mov dword [ebp - 0x40], 0xcb314b81
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0xffffffe2
jg 0x1002dd05
xor eax, eax
mov dword [ebp - 0x1c], 0x66bc657e
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002db40
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1458], 0xb6084edc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002db28
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002dc36
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe2
jge 0x1002dcf8
movdqa xmm0, xmmword [0x10007b50]
lea eax, [ebp - 0x128c]
push eax
lea eax, [ebp - 0x129c]
push eax
lea ecx, [ebp - 0x1590]
movdqu xmmword [ebp - 0x129c], xmm0
call fcn.10015060
lea ecx, [ebp - 0x251]
mov esi, eax
call fcn.10008b73
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x5c8]
push dword [esi]
call fcn.10015026
xor eax, eax
mov dword [ebp - 4], 0x10
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002dbb5
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
push 2
lea ecx, [ebp - 0x5c8]
call fcn.10015051
mov dword [eax], 0xffffffed
jmp 0x1002dc03
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002dbe2
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 2
lea ecx, [ebp - 0x5c8]
call fcn.10015051
cmp dword [eax], 0
jne 0x1002dc15
push 2
lea ecx, [ebp - 0x5c8]
call fcn.10015051
inc dword [eax]
push 2
lea ecx, [ebp - 0x5c8]
call fcn.10015051
cmp dword [eax], 0xb
je 0x1002dbca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c8]
call fcn.1001504c
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe2
jl 0x1002db56
jmp 0x1002dcf6
mov dword [ebp - 0x20], 0xf7c2f5a2
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], 0xffffffe4
cmp dword [ebp - 0x24], 0xffffffe6
jne 0x1002dcd1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002dc73
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x934], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002dc5a
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002dc7e
mov eax, dword [ebp - 0x930]
dec dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x930]
cmp eax, ecx
setg dl
imul eax, edx, 0xfffff30b
test eax, eax
jne 0x1002dca1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
neg eax
sub ecx, eax
neg ecx
push 0
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
neg ecx
cmp ecx, 0xffffffff
setl al
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe6
pop eax
je 0x1002dc51
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x17
je 0x1002dcf8
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setge dl
mov dword [ebp - 0x1450], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jne 0x1002dcda
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
jle 0x1002db16
lea eax, [ebp - 0x11ac]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x11bc]
push eax
lea ecx, [ebp - 0x15a0]
movdqu xmmword [ebp - 0x11bc], xmm0
call fcn.10015060
lea ecx, [ebp - 0x1d9]
mov esi, eax
call fcn.10008b73
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x44c]
push dword [esi]
call fcn.10015026
mov dword [ebp - 4], 0x11
lea ecx, [ebp - 0xde0]
mov dword [ebp - 0x10], 0x62d5e48d
mov eax, 0x5b40194d
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], 0xbac04ee7
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
push 3
mov dword [ebp - 0x74], eax
pop eax
push eax
call fcn.10014fc7
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x4c], 0x42f3
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002ddb8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xde0]
call fcn.10015051
push 3
pop ecx
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002dd97
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x18
jg 0x1002de18
jmp 0x1002ddc6
push 3
pop ecx
push ecx
mov dword [ebp - 0x40], 0x867b8f5f
lea ecx, [ebp - 0x10e4]
call fcn.10014fc7
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x1c], eax
jmp 0x1002ddf5
push dword [ebp - 0x1c]
call fcn.10015051
mov dword [eax], 0x5fac1226
inc dword [ebp - 0x1c]
push 3
pop eax
lea ecx, [ebp - 0x10e4]
cmp dword [ebp - 0x1c], eax
jl 0x1002dde4
inc dword [ebp - 0x4c]
mov byte [ebp - 4], 0x12
call fcn.1001504c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x18
jle 0x1002ddc3
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0xde0]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x11
call fcn.1001504c
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x33
jne 0x1002eaed
push 6
pop esi
push 3
pop eax
push eax
lea ecx, [ebp - 0xdf8]
call fcn.10014fc7
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xfb4]
mov dword [ebp - 0x40], 0x8256a9ef
mov dword [ebp - 0x40], esi
push 4
call fcn.10014fc7
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x40], 0x1f1eb32a
mov dword [ebp - 0x4c], 0x70ab227d
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002dea9
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdf8]
call fcn.10015051
push 3
mov dword [eax], 0xd1e1e87d
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1002de88
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002debf
push dword [ebp - 0x18]
call fcn.10015051
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
lea ecx, [ebp - 0xfb4]
jl 0x1002deae
inc dword [ebp - 0x4c]
call fcn.1001504c
lea ecx, [ebp - 0xdf8]
mov byte [ebp - 4], 0x11
call fcn.1001504c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x34
jle 0x1002eae0
jmp 0x1002def5
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x38], 0xdf851f08
mov dword [ebp - 0x34], 0xdd93f870
mov dword [ebp - 0x3c], 0xfffffffe
cmp dword [ebp - 0x3c], 0xfffffff2
jne 0x1002e120
mov dword [ebp - 0x24], 0xfff8
mov dword [ebp - 0x18], 0x58900fdb
mov dword [ebp - 0x28], 0xd9248e6b
mov dword [ebp - 0x10], 0xdeb94592
mov dword [ebp - 0x10], eax
jmp 0x1002df4d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x290], 0xb6fb96f3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002df3c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3c], eax
je 0x1002dfab
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002df91
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x113c], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002df78
xor eax, eax
cmp dword [ebp - 0x1138], eax
jne 0x1002e11e
mov eax, dword [ebp - 0x1138]
mov dword [ebp - 0x18], eax
jmp 0x1002e02d
mov dword [ebp - 0x2c], 8
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0x3cea2ff3
setge cl
xor edx, edx
mov dword [ebp - 0x28c], ecx
mov eax, dword [ebp - 0x2c]
sub ecx, eax
cmp ecx, 0x2ae45661
setne dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
dec eax
add eax, edx
jne 0x1002dff9
cmp dword [ebp - 0x24], eax
je 0x1002dffb
mov eax, ebx
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0x4e54
setne cl
cmp ecx, 0x75e3aa9c
jne 0x1002e01a
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002e01c
mov eax, ebx
imul eax, eax, 0xfffd
xor ecx, ecx
cmp eax, 0xfffffffb
setl cl
mov dword [ebp - 0x38], ecx
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002e105
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x10], eax
jmp 0x1002e0f9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x1002e0f6
mov dword [ebp - 0x24], eax
jmp 0x1002e083
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jg 0x1002e080
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x290]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x290], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x1002e062
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1002e05a
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
push 0
mov ecx, dword [ebp + eax*4 - 0x290]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 7
setne al
sub eax, 0xfffffffb
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
sets cl
mov edx, dword [ebp + eax*4 - 0x290]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp edx, ecx
setl al
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x28]
pop eax
cmp dword [ebp - 0x28], ebx
jle 0x1002e055
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1002e049
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1002e037
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff2
push 0
pop eax
je 0x1002df1b
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002e171
cmp dword [ebp - 0x3c], eax
je 0x1002e15c
mov ecx, ebx
cmp dword [ebp - 0x38], eax
jne 0x1002e133
mov ecx, eax
xor eax, eax
cmp ecx, 8
sete al
cmp esi, eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax, 0x4064
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setge dl
cmp edx, dword [ebp - 0x3c]
jg 0x1002e15c
xor ecx, ecx
mov eax, ecx
jmp 0x1002e160
mov eax, ebx
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push 9
pop edx
add eax, edx
jne 0x1002e174
mov eax, ecx
jmp 0x1002e176
push 9
pop edx
mov eax, ebx
movdqa xmm0, xmmword [0x10007b00]
xor ecx, ecx
test eax, eax
sets cl
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x14f8]
setg al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x130c]
push eax
lea eax, [ebp - 0x131c]
push eax
movdqu xmmword [ebp - 0x131c], xmm0
call fcn.10015060
lea ecx, [ebp - 0x221]
mov esi, eax
call fcn.10008b73
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x3d4]
push dword [esi]
call fcn.10015026
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x4c], 0x278c
mov dword [ebp - 0x34], 0x21dd2eb2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002e20f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x69c], 0xff18ee85
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002e1f7
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x1002e2fe
mov dword [ebp - 0x2c], 0x30467731
lea ecx, [ebp - 0x3d4]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x4c]
push dword [ebp - 0x18]
call fcn.10015051
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d4]
call fcn.10015051
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
push dword [ebp - 0x18]
cmp ecx, 0x5f4e
lea ecx, [ebp - 0x3d4]
setne bl
add ebx, 0x4f60a6ac
sub ebx, dword [eax]
neg ebx
sbb ebx, ebx
inc ebx
call fcn.10015051
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x3d4]
push dword [ebp - 0x18]
call fcn.10015051
push dword [ebp - 0x18]
xor ebx, ebx
lea ecx, [ebp - 0x3d4]
cmp dword [eax], ebx
sete bl
sub ebx, 0x64087a91
call fcn.10015051
lea ecx, [ebp - 0x3d4]
mov eax, dword [eax]
imul eax, ebx
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x18]
call fcn.10015051
mov ecx, dword [ebp - 0x2c]
xor edx, edx
push 3
cmp dword [eax], ecx
pop ecx
setge dl
mov dword [ebp - 0x69c], edx
lea eax, [edx + 4]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002e2ed
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x1002e2e4
dec dword [ebp - 0x18]
jns 0x1002e21e
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x3d4]
mov byte [ebp - 4], 0x11
call fcn.1001504c
xor eax, eax
lea ecx, [ebp - 0x1e8]
push 3
mov byte [ebp - 0x11], al
pop eax
push eax
call fcn.10014fc7
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1078]
mov dword [ebp - 0x24], 0xf57a7c2
push 2
call fcn.10014fc7
xor eax, eax
mov byte [ebp - 4], 0x18
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002e36b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1e8]
call fcn.10015051
push 3
mov dword [eax], 0x77862fd4
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1002e34a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002e398
push 6
pop edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1078]
call fcn.10015051
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002e377
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], eax
jl 0x1002e4bb
mov edi, 0xffff
mov dword [ebp - 0x10], eax
jmp 0x1002e3c3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6cc], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002e3b2
push ebx
lea ecx, [ebp - 0x1e8]
call fcn.10015051
lea ecx, [ebp - 0x1e8]
mov dword [eax], ebx
xor ebx, ebx
mov dword [ebp - 0x6cc], ebx
push dword [ebp - 0x24]
call fcn.10015051
cmp dword [eax], ebx
jne 0x1002e3f3
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1e8]
call fcn.10015051
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1e8]
call fcn.10015051
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
push 3
imul ecx, dword [eax]
pop eax
push dword [ebp - 0x24]
cmp ecx, eax
lea ecx, [ebp - 0x1e8]
setge bl
call fcn.10015051
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1e8]
mov esi, dword [eax]
imul esi, ebx
call fcn.10015051
xor ebx, ebx
lea ecx, [ebp - 0x1e8]
push 2
cmp dword [eax], esi
setne bl
call fcn.10015051
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x1e8]
call fcn.10015051
mov ecx, dword [ebp - 0x24]
xor edx, edx
add ecx, dword [ebp - 0x34]
mov esi, 0x67f5ed9a
push dword [ebp - 0x24]
cmp ecx, 0xfffffff6
setg dl
xor ecx, ecx
cmp edx, 0xfffffff7
setle cl
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1e8]
setg dl
xor eax, eax
cmp edx, edi
setne al
sub esi, eax
call fcn.10015051
push 0
mov dword [eax], esi
dec dword [ebp - 0x24]
pop eax
push 1
pop ebx
jns 0x1002e3ad
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002e4d0
push 0x11b2
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
lea ecx, [ebp - 0x1078]
call fcn.1001504c
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 0x11
call fcn.1001504c
cmp byte [ebp - 0x11], 0
je 0x1002e60e
movdqa xmm0, xmmword [0x10007bb0]
lea eax, [ebp - 0x11cc]
push eax
lea eax, [ebp - 0x11dc]
push eax
lea ecx, [ebp - 0x15f0]
movdqu xmmword [ebp - 0x11dc], xmm0
call fcn.10015060
lea ecx, [ebp - 0x19d]
mov esi, eax
call fcn.10008b73
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1470]
push dword [esi]
call fcn.10015026
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], eax
inc ebx
cmp dword [ebp - 0x10], ebx
jge 0x1002e560
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbc], 0x184c506d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002e548
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0xbc], ecx
cmp dword [ebp - 0xbc], eax
jl 0x1002e5fb
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x1002e5ef
mov dword [ebp - 0x10], 0xa5fef9d7
mov dword [ebp - 0x10], eax
jmp 0x1002e5e5
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e5e2
push eax
push 0x1705
push 0xf77
push 0x185c
push 0x13d3
push 0x1b09
push 0x15d4
push 0x177b
push 0x98f
push 0x1949
push 0x325
push 0x24ff
push 0x1b5
push 0x2206
call dword [sym.imp.GDI32.dll_CreateFontA]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x1002e58c
dec dword [ebp - 0x20]
jns 0x1002e580
dec dword [ebp - 0xbc]
jns 0x1002e575
lea ecx, [ebp - 0x1470]
call fcn.1001504c
xor eax, eax
push eax
push eax
call edi
jmp 0x1002e611
xor ebx, ebx
inc ebx
mov eax, 0xffff
xor edx, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 0x15d7249a
mov dword [ebp - 0x10], 0x65256810
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp eax, 0x844a
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x2c]
je 0x1002e64f
mov edx, ebx
cmp dword [ebp - 0x20], eax
jne 0x1002e651
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, 0x3248
setl al
imul eax, eax, 5
test eax, eax
jne 0x1002e672
cmp dword [ebp - 0x20], eax
je 0x1002e674
mov eax, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 7
cmp dword [ebp - 0x10], 0x13
jl 0x1002e6a1
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e698
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x13
jge 0x1002e686
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xb
jge 0x1002ead0
push 3
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0x770]
pop eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x4c], 0xfffffff8
push eax
call fcn.10014fc7
push 6
mov byte [ebp - 4], 0x19
xor eax, eax
pop edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], 0x95b676bd
mov dword [ebp - 0x10], eax
push 3
pop eax
cmp dword [ebp - 0x10], eax
jge 0x1002e712
push dword [ebp - 0x10]
lea ecx, [ebp - 0x770]
call fcn.10015051
push 3
mov dword [eax], 0xa98815cb
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], eax
jl 0x1002e6f0
push 6
pop edx
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
cmp eax, 0xd4aa
jle 0x1002e725
mov esi, ebx
xor eax, eax
jmp 0x1002e729
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x4c], eax
jne 0x1002e731
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edx
mov edi, 0xffff
mov eax, dword [ebp - 0x30]
setne cl
xor edx, edx
cmp ecx, 0x1bfedaac
push 2
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setge bl
xor ecx, ecx
sub ebx, edi
cmp ebx, eax
setne cl
xor ebx, ebx
cmp ecx, 0x69d1fe9
lea ecx, [ebp - 0x770]
setle bl
call fcn.10015051
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x34]
cmp ebx, eax
mov eax, 0xe0d6158f
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, edi
setg dl
add edx, dword [ebp - 0x2c]
imul edx, esi
sub eax, edx
je 0x1002e840
push 2
lea ecx, [ebp - 0x770]
call fcn.10015051
cmp dword [eax], 0
je 0x1002e840
mov dword [ebp - 0x2c], 0x57718da9
xor ecx, ecx
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x4c], 0xafe497d6
mov eax, dword [ebp - 0x2c]
cmp eax, 0x53bd
push 2
setg cl
xor ebx, ebx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
lea ecx, [ebp - 0x770]
setl bl
call fcn.10015051
push 9
mov ecx, 0x47f0b4bd
mov dword [eax], ebx
pop eax
cmp eax, ebx
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x28]
je 0x1002e833
cmp dword [ebp - 0x18], eax
je 0x1002e833
xor edi, edi
lea eax, [edi + 1]
cmp eax, 0x97b69e0d
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x1002e873
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002e86d
mov dword [ebp - 0x4c], 0xc2df
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e867
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
dec dword [ebp - 0x4c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jg 0x1002e847
lea ecx, [ebp - 0x770]
mov byte [ebp - 4], 0x11
call fcn.1001504c
push 3
pop ebx
mov dword [ebp - 0x34], 0xf62c4df8
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x24], 0x99d9
push ebx
call fcn.10014fc7
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xb94]
mov dword [ebp - 0x4c], 0x6c5533f2
mov dword [ebp - 0x4c], 0x93f04518
mov dword [ebp - 0x2c], 0x53649d95
mov dword [ebp - 0x4c], 0xf98093af
mov dword [ebp - 0x4c], 0x98791b16
push 2
call fcn.10014fc7
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x4c], 0x1a16747b
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1002e90d
push dword [ebp - 0x38]
lea ecx, [ebp - 0x31c]
call fcn.10015051
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002e8ef
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1002e92d
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe10], 0xffffffff
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002e915
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1002e955
push dword [ebp - 0x38]
lea ecx, [ebp - 0xb94]
call fcn.10015051
mov dword [eax], 0x554c62b4
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jl 0x1002e936
xor eax, eax
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x24], eax
je 0x1002ea7a
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x1002e972
mov ecx, ebx
xor eax, eax
cmp ecx, 0x3ecd
setg al
xor ecx, ecx
cmp eax, 0x1fa6
setl cl
sub ecx, 5
cmp ecx, dword [ebp - 0x24]
jl 0x1002e996
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002e998
mov eax, ebx
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x31c]
push ebx
imul esi, eax
call fcn.10015051
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
cmp esi, eax
setne cl
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0x2b3395cc
setl cl
cmp ecx, 0x5799333c
je 0x1002e9e0
mov eax, dword [ebp - 0x2c]
push ebx
lea ecx, [ebp - 0x31c]
call fcn.10015051
mov eax, dword [eax]
mov dword [ebp - 0xe10], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xc84a4e7
cmp dword [ebp - 0x4c], eax
je 0x1002ea0e
push ebx
lea ecx, [ebp - 0x31c]
call fcn.10015051
push 2
lea ecx, [ebp - 0x31c]
call fcn.10015051
imul eax, dword [eax], 6
test eax, eax
je 0x1002ea2e
push ebx
lea ecx, [ebp - 0x31c]
call fcn.10015051
push ebx
lea ecx, [ebp - 0x31c]
call fcn.10015051
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp ecx, 0xb779c63c
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xb94]
push eax
call fcn.10015051
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe0c]
lea ecx, [ebp - 0x31c]
push ebx
call fcn.10015051
xor ecx, ecx
cmp dword [eax], ecx
setne cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xb94]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
call fcn.1001504c
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 0x11
call fcn.1001504c
mov dword [ebp - 0x34], 0xfffffff6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xb
jl 0x1002e6b0
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x34
push 6
pop esi
jg 0x1002def3
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x33
je 0x1002de3f
push 3
pop eax
mov dword [ebp - 0x24], 0x99d9
lea ecx, [ebp - 0x2d4]
push eax
call fcn.10014fc7
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x9cc]
mov dword [ebp - 0x4c], 0x6c5533f2
mov dword [ebp - 0x4c], 0x93f04518
mov dword [ebp - 0x2c], 0x53649d95
mov dword [ebp - 0x4c], 0xf98093af
mov dword [ebp - 0x4c], 0x98791b16
push 2
call fcn.10014fc7
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x4c], 0x1a16747b
mov dword [ebp - 0x34], 0xfffffffa
push 3
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x1002eb77
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2d4]
call fcn.10015051
push 3
pop ecx
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1002eb56
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x1002eb97
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xfc8], 0xffffffff
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1002eb7f
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1002ebbf
push dword [ebp - 0x38]
lea ecx, [ebp - 0x9cc]
call fcn.10015051
mov dword [eax], 0x554c62b4
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jl 0x1002eba0
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002ece1
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x1002ebd9
mov ecx, ebx
xor eax, eax
cmp ecx, 0x3ecd
setg al
xor ecx, ecx
cmp eax, 0x1fa6
setl cl
sub ecx, 5
cmp ecx, dword [ebp - 0x24]
jl 0x1002ebfd
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002ebff
mov eax, ebx
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x2d4]
push ebx
imul esi, eax
call fcn.10015051
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
cmp esi, eax
setne cl
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0x2b3395cc
setl cl
cmp ecx, 0x5799333c
je 0x1002ec47
mov eax, dword [ebp - 0x2c]
push ebx
lea ecx, [ebp - 0x2d4]
call fcn.10015051
mov eax, dword [eax]
mov dword [ebp - 0xfc8], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xc84a4e7
cmp dword [ebp - 0x4c], eax
je 0x1002ec75
push ebx
lea ecx, [ebp - 0x2d4]
call fcn.10015051
push 2
lea ecx, [ebp - 0x2d4]
call fcn.10015051
imul eax, dword [eax], 6
test eax, eax
je 0x1002ec95
push ebx
lea ecx, [ebp - 0x2d4]
call fcn.10015051
push ebx
lea ecx, [ebp - 0x2d4]
call fcn.10015051
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp ecx, 0xb779c63c
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x9cc]
push eax
call fcn.10015051
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xfc4]
lea ecx, [ebp - 0x2d4]
push ebx
call fcn.10015051
xor ecx, ecx
cmp dword [eax], ecx
setne cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x9cc]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
call fcn.1001504c
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 0x11
call fcn.1001504c
push 3
pop eax
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
jl 0x1002f1b4
push 4
pop edi
push edi
lea ecx, [ebp - 0x9e4]
call fcn.10014fc7
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002ed6c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x96c], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002ed53
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ed8c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x368], 0xfa5f9c71
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ed74
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jne 0x1002ee00
mov dword [ebp - 0x2c], 0x5b7cefa9
xor ebx, ebx
mov dword [ebp - 0x20], 0xdcefbde2
mov dword [ebp - 0x4c], 0xfe737448
mov eax, dword [ebp - 0x368]
mov eax, dword [ebp - 0x96c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x368]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x96c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge bl
xor edx, edx
imul ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x10]
je 0x1002ed94
xor ebx, ebx
inc ebx
push 2
lea ecx, [ebp - 0xb04]
call fcn.10014fc7
mov byte [ebp - 4], 0x1f
push 3
pop eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0xd609
mov dword [ebp - 0x10], eax
jmp 0x1002ee39
push dword [ebp - 0x10]
call fcn.10015051
mov dword [eax], 0x2afe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
lea ecx, [ebp - 0xb04]
jl 0x1002ee28
push ebx
call fcn.10015051
mov dword [eax], 8
cmp dword [ebp - 0x4c], ebx
jge 0x1002ee69
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002ee97
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1002ee97
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002ee91
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002ee8e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x35
jne 0x1002ee76
lea ecx, [ebp - 0xb04]
mov byte [ebp - 4], 0x1e
call fcn.1001504c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002eece
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9e4]
call fcn.10015051
mov dword [eax], 0x6eae1177
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002eeb0
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002eef1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x730], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002eed9
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002ef03
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
xor eax, eax
mov dword [ebp - 0x72c], eax
jmp 0x1002ef30
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002ef2a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor eax, eax
inc dword [ebp - 0x72c]
cmp dword [ebp - 0x72c], ebx
jl 0x1002ef0b
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x44c]
call fcn.10015051
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002ef5d
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x44c]
push 2
call fcn.10015051
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x44c]
call fcn.10015051
mov ecx, dword [ebp - 0x44]
mov edx, 0xf93be41b
cmp edx, ecx
sbb ecx, ecx
neg ecx
imul ecx, ecx, 0xbb30
add ecx, dword [eax]
jne 0x1002ef8c
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x3c], eax
je 0x1002ef8e
mov esi, ebx
push ebx
lea ecx, [ebp - 0x44c]
call fcn.10015051
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x44c]
sub esi, dword [eax]
call fcn.10015051
push 3
lea ecx, [ebp - 0x7b4]
mov dword [eax], esi
mov dword [ebp - 0x34], ebx
pop eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x4c], 0xfffffff8
push eax
call fcn.10014fc7
push 6
mov byte [ebp - 4], 0x20
xor eax, eax
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], 0x95b676bd
mov dword [ebp - 0x10], eax
push 3
pop eax
cmp dword [ebp - 0x10], eax
jge 0x1002f00e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7b4]
call fcn.10015051
push 3
mov dword [eax], 0xa98815cb
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], eax
jl 0x1002efec
push 6
pop edx
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
cmp eax, 0xd4aa
jle 0x1002f021
mov esi, ebx
xor eax, eax
jmp 0x1002f025
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x4c], eax
jne 0x1002f02d
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x30]
push 2
setne cl
xor edx, edx
cmp ecx, 0x1bfedaac
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, 0xffff
setge bl
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
setne cl
xor ebx, ebx
cmp ecx, 0x69d1fe9
lea ecx, [ebp - 0x7b4]
setle bl
call fcn.10015051
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x34]
cmp ebx, eax
mov eax, 0xe0d6158f
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, 0xffff
setg dl
add edx, dword [ebp - 0x2c]
imul edx, esi
sub eax, edx
je 0x1002f137
push 2
lea ecx, [ebp - 0x7b4]
call fcn.10015051
cmp dword [eax], 0
je 0x1002f137
mov dword [ebp - 0x2c], 0x57718da9
xor ecx, ecx
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x4c], 0xafe497d6
mov eax, dword [ebp - 0x2c]
cmp eax, 0x53bd
push 2
setg cl
xor ebx, ebx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
lea ecx, [ebp - 0x7b4]
setl bl
call fcn.10015051
push 9
mov ecx, 0x47f0b4bd
mov dword [eax], ebx
pop eax
cmp eax, ebx
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x2c]
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x1c]
je 0x1002f12a
cmp dword [ebp - 0x18], eax
je 0x1002f12a
inc eax
cmp eax, 0x97b69e0d
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f169
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002f164
mov dword [ebp - 0x4c], 0xc2df
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f15e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
dec dword [ebp - 0x4c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jg 0x1002f13e
lea ecx, [ebp - 0x7b4]
mov byte [ebp - 4], 0x1e
call fcn.1001504c
push 3
pop eax
push eax
lea ecx, [ebp - 0x44c]
call fcn.10015051
xor ebx, ebx
lea ecx, [ebp - 0x9e4]
inc ebx
mov esi, eax
push ebx
call fcn.10015051
mov ecx, dword [esi]
mov byte [ebp - 4], 0x11
mov dword [eax], ecx
lea ecx, [ebp - 0x9e4]
call fcn.1001504c
dec dword [ebp - 0x3c]
jns 0x1002ed31
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44c]
call fcn.1001504c
push 4
pop esi
jmp 0x1002f31c
xor eax, eax
mov dword [ebp - 0x40], 0xbaf43b7c
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f1f0
push 0x85d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f207
push 0x23d3
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
mov dword [ebp - 0x4c], 0xd734895c
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x44], 8
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002f23b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x163c], 0x498
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002f223
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe5
jl 0x1002f319
jmp 0x1002f24c
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002f26f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd04], 0xc3f0bc50
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f257
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002f285
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfbc], 0x95da2282
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f274
mov eax, dword [ebp - 0x10]
mov ecx, 0xcd16652d
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0xfbc], eax
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x1002f307
mov dword [ebp - 0x28], 0xfe7528ac
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1002f304
mov dword [ebp - 0x1c], 0xf88d9675
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1002f2ff
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f2ea
push 0xd46
push 0x119d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [ebp - 0x28]
push 0
mov eax, dword [ebp + eax*4 - 0xd04]
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], ebx
jle 0x1002f2c3
dec dword [ebp - 0x28]
jns 0x1002f2b4
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jle 0x1002f2a5
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jge 0x1002f24a
inc dword [ebp - 0x4c]
push ebx
lea ecx, [ebp - 0x520]
call fcn.10014fc7
xor eax, eax
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f34d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1050], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f339
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f373
push dword [ebp - 0x18]
lea ecx, [ebp - 0x520]
call fcn.10015051
mov dword [eax], 0xa32b1cec
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f355
xor eax, eax
push eax
lea ecx, [ebp - 0x520]
call fcn.10015051
xor ebx, ebx
mov dword [eax], ebx
jmp 0x1002f3cf
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f3a6
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f3bf
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
push eax
lea ecx, [ebp - 0x520]
call fcn.10015051
dec dword [eax]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x520]
call fcn.10015051
cmp dword [eax], ebx
jge 0x1002f385
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x520]
call fcn.1001504c
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x10c4]
call fcn.10014fc7
push 6
pop edi
mov dword [ebp - 4], 0x22
lea ecx, [ebp - 0xe28]
mov dword [ebp - 0x40], 0x8256a9ef
mov dword [ebp - 0x40], edi
push esi
call fcn.10014fc7
mov byte [ebp - 4], 0x23
xor eax, eax
mov dword [ebp - 0x40], 0x1f1eb32a
mov dword [ebp - 0x4c], 0x70ab227d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f457
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10c4]
call fcn.10015051
mov dword [eax], 0xd1e1e87d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f439
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002f46d
push dword [ebp - 0x18]
call fcn.10015051
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xe28]
cmp dword [ebp - 0x18], esi
jl 0x1002f45c
inc dword [ebp - 0x4c]
call fcn.1001504c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10c4]
call fcn.1001504c
xor eax, eax
mov byte [ebp - 0x45], al
mov dword [ebp - 0x24], 0x17571177
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x24], eax
jmp 0x1002f696
push esi
lea ecx, [ebp - 0x740]
call fcn.10014fc7
xor eax, eax
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f4e6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x634], 0x6e3245f1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f4ce
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f50c
push dword [ebp - 0x18]
lea ecx, [ebp - 0x740]
call fcn.10015051
mov dword [eax], 0xf9e923e6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f4ee
xor eax, eax
mov dword [ebp - 0x634], eax
jmp 0x1002f5d3
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f53b
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002f5c4
mov dword [ebp - 0x1c], 0x4d63a88e
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002f5c1
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f596
push 0x19da
push 0xc46
push 0x157e
push 0x25c0
push 0x2047
push 0x128f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002f5bc
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f5b7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002f59e
dec dword [ebp - 0x1c]
jns 0x1002f552
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1002f543
dec dword [ebp - 0x634]
cmp dword [ebp - 0x634], 0xffffffe4
jge 0x1002f517
cmp dword [ebp - 0x62c], eax
je 0x1002f607
push eax
lea ecx, [ebp - 0x740]
call fcn.10015051
mov ecx, dword [ebp - 0x628]
cmp dword [eax], ecx
jle 0x1002f605
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x1002f60c
xor eax, eax
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xaa3e
jge 0x1002f627
mov ecx, ebx
cmp dword [ebp - 0x24], eax
jne 0x1002f629
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x634]
push 3
setne dl
xor ecx, ecx
cmp edx, eax
pop ebx
setle cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x740]
push ebx
call fcn.10015051
push ebx
lea ecx, [ebp - 0x740]
mov esi, eax
call fcn.10015051
mov ecx, dword [esi]
imul ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
imul eax, ecx
mov ecx, 0xe468a07c
cmp ecx, eax
lea ecx, [ebp - 0x740]
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
or dword [ebp - 4], 0xffffffff
call fcn.1001504c
dec dword [ebp - 0x24]
push 4
pop esi
cmp dword [ebp - 0x24], 0xffffffe6
jl 0x1002f4b1
cmp byte [ebp - 0x45], 0
je 0x1002f878
push ebx
lea ecx, [ebp - 0x1f8]
call fcn.10014fc7
push 2
pop ebx
mov dword [ebp - 4], 0x25
lea ecx, [ebp - 0xe40]
mov dword [ebp - 0x24], 0xf57a7c2
push ebx
call fcn.10014fc7
xor eax, eax
mov byte [ebp - 4], 0x26
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002f705
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1f8]
call fcn.10015051
push 3
mov dword [eax], 0x77862fd4
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1002f6e4
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f727
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe40]
call fcn.10015051
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f70d
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002f840
xor ebx, ebx
mov dword [ebp - 0x10], eax
inc ebx
jmp 0x1002f74c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x648], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f73b
push ebx
lea ecx, [ebp - 0x1f8]
call fcn.10015051
lea ecx, [ebp - 0x1f8]
mov dword [eax], ebx
xor ebx, ebx
mov dword [ebp - 0x648], ebx
push dword [ebp - 0x24]
call fcn.10015051
cmp dword [eax], ebx
jne 0x1002f77c
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1f8]
call fcn.10015051
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1f8]
call fcn.10015051
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
push 3
imul ecx, dword [eax]
pop eax
push dword [ebp - 0x24]
cmp ecx, eax
lea ecx, [ebp - 0x1f8]
setge bl
call fcn.10015051
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1f8]
mov esi, dword [eax]
imul esi, ebx
call fcn.10015051
xor ebx, ebx
lea ecx, [ebp - 0x1f8]
push 2
cmp dword [eax], esi
setne bl
call fcn.10015051
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x1f8]
call fcn.10015051
mov ecx, dword [ebp - 0x24]
xor edx, edx
add ecx, dword [ebp - 0x34]
mov esi, 0x67f5ed9a
push dword [ebp - 0x24]
cmp ecx, 0xfffffff6
setg dl
xor ecx, ecx
cmp edx, 0xfffffff7
setle cl
xor edx, edx
cmp ecx, dword [eax]
mov ecx, 0xffff
setg dl
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x1f8]
setne al
sub esi, eax
call fcn.10015051
push 0
mov dword [eax], esi
dec dword [ebp - 0x24]
pop eax
jns 0x1002f733
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f855
push 0x11b2
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
lea ecx, [ebp - 0xe40]
call fcn.1001504c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f8]
call fcn.1001504c
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 2
lea ecx, [ebp - 0x800]
call fcn.10014fc7
xor esi, esi
mov dword [ebp - 4], 0x27
inc esi
mov edi, 0x43250e6d
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002f8c4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x800]
call fcn.10015051
mov dword [eax], 0xa684
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002f8a5
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_LoadCursorA]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f8d9
push eax
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002f90b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x800]
call fcn.10015051
push dword [ebp - 0x10]
lea ecx, [ebp - 0x800]
mov esi, eax
call fcn.10015051
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x10]
jns 0x1002f8e1
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x800]
call fcn.1001504c
xor eax, eax
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x34], 0xbacd7953
mov dword [ebp - 0x10], eax
jmp 0x1002f960
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f95d
push eax
push 0x1b85
push 0x490
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffb
jge 0x1002f92e
push 2
lea ecx, [ebp - 0x89c]
call fcn.10014fc7
mov dword [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002f9aa
push dword [ebp - 0x10]
lea ecx, [ebp - 0x89c]
call fcn.10015051
mov dword [eax], 0xa684
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002f98b
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f9b9
push eax
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002f9eb
push dword [ebp - 0x10]
lea ecx, [ebp - 0x89c]
call fcn.10015051
push dword [ebp - 0x10]
lea ecx, [ebp - 0x89c]
mov esi, eax
call fcn.10015051
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x10]
jns 0x1002f9c1
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x89c]
call fcn.1001504c
xor eax, eax
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x34], 0xbacd7953
mov dword [ebp - 0x10], eax
jmp 0x1002fa40
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002fa3d
push eax
push 0x1b85
push 0x490
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffb
jge 0x1002fa0e
mov dword [ebp - 0x10], 0x62d5e48d
lea ecx, [ebp - 0xe58]
mov dword [ebp - 0x40], esi
mov eax, 0x5b40194d
mov dword [ebp - 0x34], 0xbac04ee7
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
push 3
mov dword [ebp - 0x74], eax
pop eax
push eax
call fcn.10014fc7
mov dword [ebp - 4], 0x29
xor eax, eax
mov dword [ebp - 0x4c], 0x42f3
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002fab3
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe58]
call fcn.10015051
push 3
pop ecx
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002fa92
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x18
jg 0x1002fb13
jmp 0x1002fac1
push 3
pop ecx
push ecx
mov dword [ebp - 0x40], 0x867b8f5f
lea ecx, [ebp - 0xfe0]
call fcn.10014fc7
xor eax, eax
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x1c], eax
jmp 0x1002faf0
push dword [ebp - 0x1c]
call fcn.10015051
mov dword [eax], 0x5fac1226
inc dword [ebp - 0x1c]
push 3
pop eax
lea ecx, [ebp - 0xfe0]
cmp dword [ebp - 0x1c], eax
jl 0x1002fadf
inc dword [ebp - 0x4c]
mov byte [ebp - 4], 0x29
call fcn.1001504c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x18
jle 0x1002fabe
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0xe58]
mov dword [ebp - 0x10], eax
or dword [ebp - 4], 0xffffffff
call fcn.1001504c
push 2
lea ecx, [ebp - 0x8b4]
call fcn.10014fc7
mov dword [ebp - 4], 0x2b
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002fb6c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8b4]
call fcn.10015051
mov dword [eax], 0xa684
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002fb4d
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fb7b
push eax
push eax
call ebx
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x1002fbad
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8b4]
call fcn.10015051
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8b4]
mov esi, eax
call fcn.10015051
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x10]
jns 0x1002fb86
or edi, 0xffffffff
lea ecx, [ebp - 0x8b4]
mov dword [ebp - 4], edi
call fcn.1001504c
push 3
pop eax
push eax
lea ecx, [ebp - 0x160]
call fcn.10014fc7
mov dword [ebp - 4], 0x2c
lea ecx, [ebp - 0x9fc]
xor eax, eax
mov dword [ebp - 0x38], eax
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x614], eax
mov dword [ebp - 0x610], eax
mov dword [ebp - 0x60c], eax
mov dword [ebp - 0x608], eax
push 3
pop eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], 0xa55b90cb
push eax
call fcn.10014fc7
xor eax, eax
mov byte [ebp - 4], 0x2d
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002fc42
push dword [ebp - 0x18]
lea ecx, [ebp - 0x160]
call fcn.10015051
push 3
mov dword [eax], 0x7f825e7a
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1002fc1e
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002fc67
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9fc]
call fcn.10015051
push 3
mov dword [eax], ebx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1002fc4a
xor eax, eax
mov dword [ebp - 0x38], 2
cmp dword [ebp - 0x38], eax
jl 0x1002fed1
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x4c], 0xbe776e9f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002fca3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc90], 0x94d03572
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002fc8a
xor eax, eax
push eax
lea ecx, [ebp - 0x160]
call fcn.10015051
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x160]
setne bl
xor eax, eax
inc eax
mov dword [ebp - 0xc90], ebx
push eax
call fcn.10015051
push dword [ebp - 0x38]
xor ecx, ecx
cmp ebx, 0x18d3
sete cl
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x160]
setle bl
call fcn.10015051
push dword [ebp - 0x38]
lea ecx, [ebp - 0x160]
mov esi, dword [eax]
imul esi, ebx
call fcn.10015051
xor ecx, ecx
cmp esi, dword [eax]
sete cl
xor eax, eax
cmp ecx, 0xc2d6
lea ecx, [ebp - 0x160]
setne al
mov dword [ebp - 0x44], eax
push dword [ebp - 0x38]
call fcn.10015051
mov edx, dword [ebp - 0x44]
mov esi, eax
mov ecx, dword [ebp - 0x38]
xor eax, eax
cmp ecx, edx
setle al
sub eax, 0xfffa
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xa6c84902
mov eax, dword [esi]
setne cl
sub eax, ecx
cmp eax, dword [ebp - 0x60c]
jle 0x1002fe94
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], 0xb39
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x1002feb8
mov dword [ebp - 0x1c], 0xc8a52b4b
mov dword [ebp - 0x1c], eax
jmp 0x1002fd97
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fd94
push 0x1b44
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1002fd7c
cmp dword [ebp - 0x1c], eax
jne 0x1002fe2d
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x160]
push dword [ebp - 0x38]
call fcn.10015051
mov edx, dword [ebp - 0x2c]
mov edi, eax
imul edx, dword [ebp - 0x2c]
xor eax, eax
mov ecx, dword [ebp - 0xc90]
cmp edx, ecx
setge al
sub eax, 7
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0x69a0
mov eax, dword [ebp - 0x4c]
push dword [ebp - 0x38]
cmp ecx, eax
lea ecx, [ebp - 0x160]
setge dl
imul esi, edx, 5
add esi, dword [edi]
call fcn.10015051
mov ecx, dword [ebp - 0x4c]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
imul edx, edx, 0xe487
cmp edx, ecx
setg bl
xor ecx, ecx
add ebx, dword [eax]
mov eax, dword [ebp - 0x60c]
cmp ebx, eax
sete cl
add ecx, 0x1d1bedd5
jne 0x1002fe2d
xor eax, eax
jmp 0x1002fe30
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x160]
push dword [ebp - 0x38]
call fcn.10015051
mov edx, dword [ebp - 0x34]
mov esi, eax
mov ecx, dword [ebp - 0x30]
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0x44]
push dword [ebp - 0x44]
setg al
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0x160]
setne bl
sub ebx, dword [esi]
call fcn.10015051
xor edx, edx
lea ecx, [ebx - 0xa672]
push 0
mov dword [eax], ebx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
pop eax
setne dl
mov dword [ebp - 0x24], edx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jle 0x1002fd70
or edi, 0xffffffff
jmp 0x1002feb8
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002feaa
mov dword [ebp - 0x34], 0xd727ab81
cmp dword [ebp - 0x34], eax
jne 0x1002feb0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x11
jl 0x1002fe9b
cmp dword [ebp - 0xc90], eax
jne 0x1002fec2
mov dword [ebp - 0xc90], 0xfac86e89
dec dword [ebp - 0x38]
push 0
pop eax
jns 0x1002fc77
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], eax
jmp 0x1002ff8f
push 2
lea ecx, [ebp - 0xc0c]
call fcn.10014fc7
mov byte [ebp - 4], 0x2e
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], eax
jmp 0x1002ff0a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc0c]
call fcn.10015051
push 3
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002fef4
mov eax, dword [ebp - 0x24]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0x614], ebx
je 0x1002ff5d
push ebx
lea ecx, [ebp - 0x9fc]
call fcn.10015051
mov esi, dword [ebp - 0x60c]
lea ecx, [ebp - 0xc0c]
push ebx
mov dword [eax], 0xfffffffd
call fcn.10015051
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x614]
lea eax, [esi - 0x5ae2b100]
cmp ecx, eax
jg 0x1002ff5d
inc ebx
mov esi, ebx
jmp 0x1002ff64
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push 2
lea ecx, [ebp - 0x160]
call fcn.10015051
lea ecx, [ebp - 0xc0c]
mov eax, dword [eax]
add eax, 0xdd966924
add eax, esi
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 0x2d
call fcn.1001504c
inc dword [ebp - 0x24]
push 3
pop eax
cmp dword [ebp - 0x24], eax
jle 0x1002fed9
lea ecx, [ebp - 0x9fc]
call fcn.1001504c
lea ecx, [ebp - 0x160]
mov dword [ebp - 4], edi
call fcn.1001504c
mov dword [ebp - 0x4c], 0xa2c7c8a6
lea ecx, [ebp - 0x8cc]
mov dword [ebp - 0x2c], 0xfffffffb
push ebx
call fcn.10014fc7
mov dword [ebp - 4], 0x2f
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002fffc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf44], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002ffe7
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10030012
push dword [ebp - 0x18]
call fcn.10015051
mov dword [eax], 0x865925ef
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x8cc]
cmp dword [ebp - 0x18], ebx
jl 0x10030001
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.10015051
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1003004b
push eax
lea ecx, [ebp - 0x8cc]
call fcn.10015051
cmp dword [eax], 0
jne 0x1003004b
xor eax, eax
mov edx, eax
jmp 0x1003004d
mov edx, ebx
mov dword [ebp - 0xf40], edi
xor ecx, ecx
mov dword [ebp - 0x4c], edi
mov eax, dword [ebp - 0x4c]
cmp eax, edx
setge cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x8cc]
mov dword [ebp - 4], edi
call fcn.1001504c
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x61928c17
mov dword [ebp - 0x24], 0xc3099cf
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], 0xdfe9f486
mov dword [ebp - 0x40], 0xcb314b81
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x1c], ebx
jmp 0x10030286
mov dword [ebp - 0x10], 0x66bc657e
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x100300d5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1488], 0xb6084edc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100300bd
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100301ca
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe2
jge 0x10030283
mov dword [ebp - 0x20], 0xf7c2f5a2
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], 0xffffffe4
cmp dword [ebp - 0x24], 0xffffffe6
jne 0x1003025c
cmp dword [ebp - 0x1c], 0xffffffe2
jle 0x100300ab
push 4
pop esi
mov dword [ebp - 0x34], 0xbacd7953
lea ecx, [ebp - 0x1088]
mov dword [ebp - 0x28], 0xe0648261
mov dword [ebp - 0x1c], 0x1aa12afd
push esi
call fcn.10014fc7
xor eax, eax
mov dword [ebp - 4], 0x31
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100302df
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1088]
call fcn.10015051
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100302c5
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100302fb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x105c], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100302e7
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffef
jge 0x100303bd