Function at 0x1002cff2
Capabilities:
Accept command line arguments
Check os version
Create pipe
Create process on windows
Create thread
Delete directory
Delete file
Enumerate files on windows
Enumerate gui resources
Get common file path
Get thread local storage value
Identify system language via api
Parse pe header
Query environment variable
Query or enumerate registry key
Resume thread
Set environment variable
Start service
Terminate process

Disassembly:
mov eax, 0x10085ff7
call fcn.10084668
mov eax, 0x185c
call fcn.10080e20
push ebx
push esi
push edi
push 3
pop ebx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0xb2c]
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x34], 0xb22489af
push ebx
mov byte [ebp - 0x69], dl
call fcn.10015766
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0x77405739
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d058
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x228], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d040
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002d074
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb2c]
call fcn.100157d3
mov dword [eax], 0xe0b5dae8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d05d
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0x1f90ef30
mov edi, dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edx, 0x8d3c891c
setne cl
mov dword [ebp - 0x70], edx
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
add eax, dword [ebp - 0x30]
inc ecx
cmp edx, eax
mov edx, 0xf758fc5
sbb eax, eax
or esi, 0xffffffff
inc eax
imul ecx, eax
mov eax, 0xcb06a9be
mov dword [ebp - 0x224], ecx
test ecx, ecx
je 0x1002d112
xor ebx, ebx
inc ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x228]
mov eax, dword [ebp - 0x220]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x224]
mov eax, dword [ebp - 0x34]
sub eax, 7
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], 0xfff7
dec dword [ebp - 0x54]
jmp 0x1002d28d
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x558], eax
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x54], 0x82d77871
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x34]
test eax, eax
jne 0x1002d141
mov eax, dword [ebp - 0x228]
mov eax, dword [ebp - 0x554]
mov eax, dword [ebp - 0x558]
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x55c]
mov eax, 0x6d7d0454
dec ecx
neg ecx
push 1
sbb ecx, ecx
inc ecx
pop ebx
sub eax, ecx
je 0x1002d191
xor eax, eax
mov dword [ebp - 0x40], 0xa52e
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x1002d183
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x558], eax
jmp 0x1002d27a
push 3
pop esi
xor eax, eax
lea ecx, [ebp - 0x7d8]
mov dword [ebp - 0x44], eax
push esi
call fcn.10015766
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d1d3
or ebx, 0xffffffff
push dword [ebp - 0x20]
lea ecx, [ebp - 0x7d8]
call fcn.100157d3
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d1b8
xor ebx, ebx
inc ebx
push 2
lea ecx, [ebp - 0x7d8]
call fcn.100157d3
cmp dword [eax], 0
jne 0x1002d1e8
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp eax, ebx
mov eax, 0xffff
setge cl
cmp ecx, eax
je 0x1002d207
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x558], eax
je 0x1002d209
mov esi, ebx
push 2
lea ecx, [ebp - 0xb2c]
call fcn.100157d3
mov dword [eax], esi
test esi, esi
je 0x1002d21f
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x7d8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x558]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x224]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x220]
mov eax, dword [ebp - 0x224]
mov eax, dword [ebp - 0x4c]
push 2
call fcn.100157d3
push 2
lea ecx, [ebp - 0x7d8]
mov esi, eax
call fcn.100157d3
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x7d8]
call fcn.100157ce
or esi, 0xffffffff
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x1002d28d
push eax
push ebx
push 0xd50
call edi
lea ecx, [ebp - 0xb2c]
mov dword [ebp - 4], esi
call fcn.100157ce
mov dword [ebp - 0x20], 0x13b91020
xor eax, eax
mov dword [ebp - 0x20], 0xee76f502
mov dword [ebp - 0x20], eax
push 9
pop ecx
cmp dword [ebp - 0x20], ebx
jge 0x1002d2ca
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf24], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002d2b6
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1002d2e3
push 0x2182
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1002d317
xor ebx, ebx
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002d2fc
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002d30c
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1002d2ed
xor ebx, ebx
inc ebx
push 3
pop eax
push eax
lea ecx, [ebp - 0xd0c]
call fcn.10015766
push 2
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x730]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x54], 0xffff
push eax
call fcn.10015766
push 3
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0xa30]
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x44], 0x7bd55fd0
push eax
call fcn.10015766
xor eax, eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002d390
push dword [ebp - 0x10]
lea ecx, [ebp - 0x730]
call fcn.100157d3
mov dword [eax], 0xafbd13d8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002d371
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x1002d3b6
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa30]
call fcn.100157d3
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d39b
xor eax, eax
mov dword [ebp - 0x30], 0x905c
cmp dword [ebp - 0x30], eax
je 0x1002d44d
cmp dword [ebp - 0x54], eax
jne 0x1002d41a
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x730]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.100157d3
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x730]
push ebx
call fcn.100157d3
mov ecx, dword [ebp - 0x40]
add ecx, dword [eax]
or eax, 0xffffffff
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x54]
jle 0x1002d40f
xor eax, eax
lea ecx, [ebp - 0x730]
push eax
call fcn.100157d3
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
lea ecx, [ebp - 0xa30]
call fcn.100157d3
xor ebx, ebx
lea ecx, [ebp - 0xa30]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.100157d3
mov dword [eax], ebx
test ebx, ebx
je 0x1002d448
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1002d44d
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0xa30]
call fcn.100157ce
lea ecx, [ebp - 0x730]
mov byte [ebp - 4], 2
call fcn.100157ce
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d492
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd0c]
call fcn.100157d3
mov dword [eax], 0x751c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d474
xor eax, eax
mov dword [ebp - 0x20], 0xf
jmp 0x1002d4b8
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xd0c]
push eax
call fcn.100157d3
push 0
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], ebx
jge 0x1002d49b
or eax, 0xffffffff
lea ecx, [ebp - 0xd0c]
mov dword [ebp - 4], eax
call fcn.100157ce
mov dword [ebp - 0x20], 0x13b91020
lea ecx, [ebp - 0xb44]
push esi
call fcn.10015766
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d510
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb44]
call fcn.100157d3
mov dword [eax], 0x751c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d4f2
xor eax, eax
mov dword [ebp - 0x20], 0xf
jmp 0x1002d536
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xb44]
push eax
call fcn.100157d3
push 0
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], ebx
jge 0x1002d519
or eax, 0xffffffff
lea ecx, [ebp - 0xb44]
mov dword [ebp - 4], eax
call fcn.100157ce
mov dword [ebp - 0x20], 0x13b91020
lea ecx, [ebp - 0xda8]
push esi
call fcn.10015766
xor eax, eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d58e
push dword [ebp - 0x20]
lea ecx, [ebp - 0xda8]
call fcn.100157d3
mov dword [eax], 0x751c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d570
xor eax, eax
mov dword [ebp - 0x20], 0xf
jmp 0x1002d5b4
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xda8]
push eax
call fcn.100157d3
push 0
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], ebx
jge 0x1002d597
or eax, 0xffffffff
lea ecx, [ebp - 0xda8]
mov dword [ebp - 4], eax
call fcn.100157ce
mov dword [ebp - 0x10], 0x3ae35568
mov esi, 0x7c2076a
mov dword [ebp - 0x4c], 0xc02a3062
mov dword [ebp - 0x3c], 0x4ed09eb
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x10], 6
cmp dword [ebp - 0x10], 0x13
jne 0x1002d6b8
xor ebx, ebx
mov dword [ebp - 0x4fc], esi
mov dword [ebp - 0x4f8], esi
mov dword [ebp - 0x4f4], esi
mov dword [ebp - 0x4f0], esi
mov dword [ebp - 0x20], ebx
jmp 0x1002d62c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1238], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002d61b
mov eax, dword [ebp - 0x4fc]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4fc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4f4]
mov eax, dword [ebp - 0x1234]
mov dword [ebp - 0x1234], eax
lea ecx, [eax - 7]
mov eax, dword [ebp - 0x4fc]
cmp ecx, eax
mov eax, dword [ebp - 0x4fc]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4fc]
setne cl
xor edx, edx
imul eax, ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x13
je 0x1002d5fe
xor ebx, ebx
inc ebx
xor eax, eax
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], 0x4f84b811
mov dword [ebp - 0x4c], 0xaa39ed08
mov dword [ebp - 0x34], 0x3859
push ebx
call fcn.10015766
push 9
mov dword [ebp - 4], 7
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002d713
push dword [ebp - 0x20]
lea ecx, [ebp - 0x440]
call fcn.100157d3
mov dword [eax], 0x4fda7ef5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002d6f5
xor eax, eax
inc dword [ebp - 0x3c]
je 0x1002d727
mov dword [ebp - 0x54], 0x509978f3
dec dword [ebp - 0x54]
jmp 0x1002d804
mov dword [ebp - 0x14], 0xef99
lea ecx, [ebp - 0x440]
push eax
mov dword [ebp - 0x28], 0xb8b0d58e
call fcn.100157d3
inc dword [eax]
jne 0x1002d7ea
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.100157d3
mov edx, dword [ebp - 0x4c]
xor ecx, ecx
cmp dword [eax], 6
mov eax, dword [ebp - 0x3c]
setle cl
add edx, ecx
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x3c], eax
jl 0x1002d7a2
xor eax, eax
lea ecx, [ebp - 0x440]
push eax
call fcn.100157d3
cmp dword [eax], 0
je 0x1002d7a2
mov ecx, ebx
jmp 0x1002d7a6
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x34]
imul eax, ecx
dec eax
dec eax
jne 0x1002d7c1
cmp dword [ebp - 0x28], eax
jne 0x1002d7c1
push eax
lea ecx, [ebp - 0x440]
call fcn.100157d3
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x440]
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.100157d3
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, dword [ebp - 0x28]
sub edx, ecx
sub edx, 2
add eax, edx
jne 0x1002d7ea
mov edx, eax
jmp 0x1002d7ec
mov edx, ebx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, 0xf4fe10ef
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x40], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], eax
call fcn.100157ce
push ebx
lea ecx, [ebp - 0x2f4]
call fcn.10015766
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x20], 0x3e58bfc4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002d85a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1408], 0xc64a6847
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002d841
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d880
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2f4]
call fcn.100157d3
mov dword [eax], 0xfb871c7b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d862
xor eax, eax
push eax
lea ecx, [ebp - 0x2f4]
call fcn.100157d3
lea ecx, [ebp - 0x2f4]
mov dword [eax], 3
xor eax, eax
push eax
call fcn.100157d3
cmp dword [eax], 0
jl 0x1002d941
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x2f4]
call fcn.100157d3
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1408], ebx
je 0x1002d8e9
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002d905
push ebx
push 0x16cb
push 0x1e59
push ebx
push 0x6f6
push 0x18b3
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x1002d905
push 7
pop ecx
push 3
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], ebx
pop eax
jmp 0x1002d900
mov dword [ebp - 0x54], ecx
inc dword [ebp - 0x54]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1002d8f7
push ebx
lea ecx, [ebp - 0x2f4]
call fcn.100157d3
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1408], ebx
jne 0x1002d93e
push ebx
lea ecx, [ebp - 0x2f4]
call fcn.100157d3
push ebx
lea ecx, [ebp - 0x2f4]
dec dword [eax]
call fcn.100157d3
cmp dword [eax], ebx
jge 0x1002d8ab
xor ebx, ebx
inc ebx
mov dword [ebp - 0x20], 0x18
cmp dword [ebp - 0x20], 0xfffffff3
jge 0x1002d96c
xor ebx, ebx
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002d960
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff3
jl 0x1002d950
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x2f4]
mov dword [ebp - 4], eax
call fcn.100157ce
push 3
pop eax
mov dword [ebp - 0x34], 0x13b91020
lea ecx, [ebp - 0xb5c]
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x34], 0xb22489af
push eax
call fcn.10015766
push 9
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x77405739
push 3
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1002d9d3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x270], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002d9bb
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002d9f2
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb5c]
call fcn.100157d3
push 3
pop edx
mov dword [eax], 0xe0b5dae8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002d9d8
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0x1f90ef30
setne cl
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
add eax, dword [ebp - 0x30]
inc ecx
cmp dword [ebp - 0x70], eax
sbb eax, eax
inc eax
imul ecx, eax
mov dword [ebp - 0x26c], ecx
test ecx, ecx
je 0x1002da78
mov dword [ebp - 0x34], ebx
mov eax, 0xf758fc5
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x270]
mov eax, dword [ebp - 0x268]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x34]
sub eax, 7
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], 0xfff7
dec dword [ebp - 0x54]
jmp 0x1002dbf8
mov eax, 0xcb06a9be
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x538], eax
mov dword [ebp - 0x534], eax
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x54], 0x82d77871
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x34]
test eax, eax
jne 0x1002daac
mov eax, dword [ebp - 0x270]
mov eax, dword [ebp - 0x534]
mov eax, dword [ebp - 0x538]
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x53c]
mov eax, 0x6d7d0454
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x1002daf9
xor eax, eax
mov dword [ebp - 0x40], 0xa52e
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x1002daeb
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x538], eax
jmp 0x1002dbe5
xor eax, eax
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x44], eax
push edx
call fcn.10015766
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x4c], ebx
push 3
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x1002db3c
or ebx, 0xffffffff
push dword [ebp - 0x20]
lea ecx, [ebp - 0x824]
call fcn.100157d3
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002db21
xor ebx, ebx
inc ebx
push 2
lea ecx, [ebp - 0x824]
call fcn.100157d3
cmp dword [eax], 0
jne 0x1002db51
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp eax, ebx
mov eax, 0xffff
setge cl
cmp ecx, eax
je 0x1002db70
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x538], eax
je 0x1002db72
mov esi, ebx
push 2
lea ecx, [ebp - 0xb5c]
call fcn.100157d3
mov dword [eax], esi
test esi, esi
je 0x1002db88
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x538]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x268]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x4c]
push 2
call fcn.100157d3
push 2
lea ecx, [ebp - 0x824]
mov esi, eax
call fcn.100157d3
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x824]
call fcn.100157ce
mov esi, 0x7c2076a
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x1002dbf8
push eax
push ebx
push 0xd50
call edi
or eax, 0xffffffff
lea ecx, [ebp - 0xb5c]
mov dword [ebp - 4], eax
call fcn.100157ce
push 3
pop edi
push edi
lea ecx, [ebp - 0xd00]
call fcn.10015766
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x20], 0xee76f502
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002dc47
push 9
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf34], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002dc33
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1002dc60
push 0x2182
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1002dc94
xor ebx, ebx
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002dc79
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002dc89
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1002dc6a
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x740]
mov dword [ebp - 0x30], eax
mov eax, 0xffff
mov dword [ebp - 0x54], eax
push 2
call fcn.10015766
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x9d0]
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x44], 0x7bd55fd0
push edi
call fcn.10015766
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002dcfb
push dword [ebp - 0x10]
lea ecx, [ebp - 0x740]
call fcn.100157d3
mov dword [eax], 0xafbd13d8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002dcdc
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002dd1e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9d0]
call fcn.100157d3
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002dd03
xor eax, eax
mov dword [ebp - 0x30], 0x905c
cmp dword [ebp - 0x30], eax
je 0x1002ddb5
cmp dword [ebp - 0x54], eax
jne 0x1002dd82
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x740]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.100157d3
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x740]
push ebx
call fcn.100157d3
mov ecx, dword [ebp - 0x40]
add ecx, dword [eax]
or eax, 0xffffffff
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x54]
jle 0x1002dd77
xor eax, eax
lea ecx, [ebp - 0x740]
push eax
call fcn.100157d3
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
lea ecx, [ebp - 0x9d0]
call fcn.100157d3
xor ebx, ebx
lea ecx, [ebp - 0x9d0]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.100157d3
mov dword [eax], ebx
test ebx, ebx
je 0x1002ddb0
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1002ddb5
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x9d0]
call fcn.100157ce
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 0xb
call fcn.100157ce
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002ddfa
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd00]
call fcn.100157d3
mov dword [eax], 0x751c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002dddc
xor eax, eax
mov dword [ebp - 0x24], 0x648261f9
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1002de22
push 0x5ca
push eax
push 0x498
push 0xea9
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1002de34
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov dword [ebp - 0x34], 0xf
or edi, 0xffffffff
cmp dword [ebp - 0x34], ebx
jl 0x1002e061
jmp 0x1002de4b
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x30], 7
push 3
mov dword [ebp - 0x24], 0xafbf2617
mov dword [ebp - 0x10], 0xfffffffa
pop ecx
cmp dword [ebp - 0x10], 0xc
jge 0x1002dead
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002de91
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1814], 0xa136951a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002de78
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x1002dea8
mov dword [ebp - 0x54], 0x54165132
inc dword [ebp - 0x54]
dec dword [ebp - 0x3c]
jns 0x1002de99
inc dword [ebp - 0x10]
jmp 0x1002de66
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], 0xfffffff0
jne 0x1002df5b
xor ebx, ebx
mov dword [ebp - 0x1c], 0x66941fc9
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x19
je 0x1002df4b
mov dword [ebp - 0x54], 0x1b98
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], ebx
jmp 0x1002def0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa84], 0xcf81320f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002dedf
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
sub edx, 0x3061ece3
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], ebx
jmp 0x1002df39
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xa84], 0x3e5ec352
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1002df28
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x19
jne 0x1002ded0
push 3
pop ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff0
je 0x1002dec0
xor ebx, ebx
inc ebx
mov dword [ebp - 0x40], edi
xor eax, eax
mov dword [ebp - 0x30], 0xd29be1d9
mov dword [ebp - 0x40], 0x5872d9ee
mov dword [ebp - 0x54], 0x12df3d37
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x50], 0x345fe46c
mov dword [ebp - 0x4c], 0x5931
mov dword [ebp - 0x58], 0xcb6a7f4e
mov dword [ebp - 0x44], 0x9034
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002dfb4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x179c], 0x648261f9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002df9c
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1002dfda
xor ebx, ebx
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002dfce
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jle 0x1002dfbf
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x4c]
mov dword [ebp - 0x30], 0xafd7
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x40]
cmp edx, eax
mov eax, dword [ebp - 0x58]
setle cl
sub eax, ecx
je 0x1002e009
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
cmp eax, ebx
mov eax, dword [ebp - 0x44]
setl dl
sub edx, 0xbfad
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x58]
setle cl
xor edx, edx
cmp ecx, ebx
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xd00]
push eax
call fcn.100157d3
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jge 0x1002de49
lea ecx, [ebp - 0xd00]
mov dword [ebp - 4], edi
call fcn.100157ce
mov dword [ebp - 0x10], 0x3ae35568
mov edi, 0xc02a3062
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x3c], 0x4ed09eb
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x10], 6
cmp dword [ebp - 0x10], 0x13
jne 0x1002e159
xor ebx, ebx
mov dword [ebp - 0x4c4], esi
mov dword [ebp - 0x4c0], esi
mov dword [ebp - 0x4bc], esi
mov dword [ebp - 0x4b8], esi
mov dword [ebp - 0x20], ebx
jmp 0x1002e0cd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12a8], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002e0bc
mov eax, dword [ebp - 0x4c4]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4bc]
mov eax, dword [ebp - 0x12a4]
mov dword [ebp - 0x12a4], eax
lea ecx, [eax - 7]
mov eax, dword [ebp - 0x4c4]
cmp ecx, eax
mov eax, dword [ebp - 0x4c4]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c4]
setne cl
xor edx, edx
imul eax, ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x13
je 0x1002e09f
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], 0x3ae35568
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x3c], 0x4ed09eb
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x10], 6
cmp dword [ebp - 0x10], 0x13
jne 0x1002e23e
xor ebx, ebx
mov dword [ebp - 0x4d4], esi
mov dword [ebp - 0x4d0], esi
mov dword [ebp - 0x4cc], esi
mov dword [ebp - 0x4c8], esi
mov dword [ebp - 0x20], ebx
jmp 0x1002e1b2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x14c8], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002e1a1
mov eax, dword [ebp - 0x4d4]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4d4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4cc]
mov eax, dword [ebp - 0x14c4]
mov dword [ebp - 0x14c4], eax
lea ecx, [eax - 7]
mov eax, dword [ebp - 0x4d4]
cmp ecx, eax
mov eax, dword [ebp - 0x4d4]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4d4]
setne cl
xor edx, edx
imul eax, ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x13
je 0x1002e184
xor ebx, ebx
inc ebx
mov esi, 0xc7bf0b96
lea ecx, [ebp - 0x3ec]
mov dword [ebp - 0x38], esi
push ebx
call fcn.10015766
mov dword [ebp - 4], 0xe
or eax, 0xffffffff
mov dword [ebp - 0x4c], eax
mov edi, 0x40e708be
mov dword [ebp - 0x34], ebx
xor eax, eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002e2a2
push dword [ebp - 0x20]
lea ecx, [ebp - 0x3ec]
call fcn.100157d3
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002e287
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002e338
mov eax, dword [ebp - 0x38]
xor ebx, ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
lea ecx, [ebp - 0x3ec]
sete bl
xor eax, eax
push eax
call fcn.100157d3
mov dword [eax], ebx
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x38]
cmp ecx, 0xfffffffd
setne al
mov dword [ebp - 0x54], eax
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1002e310
push eax
lea ecx, [ebp - 0x3ec]
call fcn.100157d3
xor eax, eax
push eax
lea ecx, [ebp - 0x3ec]
call fcn.100157d3
xor eax, eax
lea ecx, [ebp - 0x3ec]
push eax
call fcn.100157d3
xor ebx, ebx
inc ebx
cmp dword [eax], 0
je 0x1002e336
mov eax, ebx
jmp 0x1002e338
xor eax, eax
mov dword [ebp - 0x14], eax
xor edx, edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setge dl
sub edx, 0xf2c9
jne 0x1002e35f
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x3ec]
xor eax, eax
push eax
call fcn.100157d3
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x3ec]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.100157ce
push 2
lea ecx, [ebp - 0xed0]
call fcn.10015766
mov dword [ebp - 4], 0xf
or ecx, 0xffffffff
mov dword [ebp - 0x3c], 0x57976326
xor eax, eax
mov dword [ebp - 0x24], 0xa485bf25
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002e3ee
push dword [ebp - 0x20]
lea ecx, [ebp - 0xed0]
call fcn.100157d3
mov dword [eax], 0xffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002e3cc
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x1002e405
mov dword [ebp - 0x54], 0xbeb7
dec dword [ebp - 0x54]
dec dword [ebp - 0x3c]
jns 0x1002e3f6
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0xed0]
call fcn.100157ce
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x464]
push ebx
call fcn.10015766
mov dword [ebp - 4], 0x10
or eax, 0xffffffff
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002e46d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x464]
call fcn.100157d3
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002e452
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002e503
mov eax, dword [ebp - 0x38]
xor ebx, ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
lea ecx, [ebp - 0x464]
sete bl
xor eax, eax
push eax
call fcn.100157d3
mov dword [eax], ebx
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x38]
cmp ecx, 0xfffffffd
setne al
mov dword [ebp - 0x54], eax
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1002e4db
push eax
lea ecx, [ebp - 0x464]
call fcn.100157d3
xor eax, eax
push eax
lea ecx, [ebp - 0x464]
call fcn.100157d3
xor eax, eax
lea ecx, [ebp - 0x464]
push eax
call fcn.100157d3
xor ebx, ebx
inc ebx
cmp dword [eax], 0
je 0x1002e501
mov eax, ebx
jmp 0x1002e503
xor eax, eax
mov dword [ebp - 0x14], eax
xor edx, edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setge dl
sub edx, 0xf2c9
jne 0x1002e52a
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x464]
xor eax, eax
push eax
call fcn.100157d3
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x464]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.100157ce
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov dword [ebp - 0x24], 0x1e66c619
mov dword [ebp - 0x24], 0x3a4df6f9
mov dword [ebp - 0x24], 0xe9378f1e
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002e5a2
push 9
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16a0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002e58d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002e5c4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1854], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002e5ab
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe3
je 0x1002e747
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0x67a876e6
mov dword [ebp - 0x24], 0xcc92ea21
mov dword [ebp - 0x24], 0x32b96ce0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0x395e2de4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x54], 0x915bb002
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 8
jne 0x1002e737
mov dword [ebp - 0x34], 0xf25cbd94
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff6
jg 0x1002e70b
push 4
lea ecx, [ebp - 0x5cc]
call fcn.10015766
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x20], eax
jmp 0x1002e64d
push dword [ebp - 0x20]
call fcn.100157d3
mov dword [eax], 0x946507e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
lea ecx, [ebp - 0x5cc]
jl 0x1002e63c
push ebx
call fcn.100157d3
and dword [eax], 0
jmp 0x1002e6d4
push 3
pop eax
push eax
lea ecx, [ebp - 0xa18]
call fcn.10015766
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002e6a6
push 3
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa18]
call fcn.100157d3
mov dword [eax], 0xffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002e685
xor ebx, ebx
inc ebx
xor eax, eax
push eax
lea ecx, [ebp - 0xa18]
call fcn.100157d3
lea ecx, [ebp - 0xa18]
cmp dword [eax], 0
jne 0x1002e6e6
mov byte [ebp - 4], 0x11
call fcn.100157ce
push ebx
lea ecx, [ebp - 0x5cc]
call fcn.100157d3
inc dword [eax]
push ebx
lea ecx, [ebp - 0x5cc]
call fcn.100157d3
cmp dword [eax], ebx
jle 0x1002e664
jmp 0x1002e6eb
call fcn.100157ce
or eax, 0xffffffff
lea ecx, [ebp - 0x5cc]
mov dword [ebp - 4], eax
call fcn.100157ce
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff6
jle 0x1002e621
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1002e727
push eax
push 0x8c0
push 0x59d
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 8
je 0x1002e60d
or ecx, 0xffffffff
inc dword [ebp - 0x54]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
jne 0x1002e5d4
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x404]
push ebx
call fcn.10015766
mov dword [ebp - 4], 0x13
or esi, 0xffffffff
mov dword [ebp - 0x4c], esi
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x3c], edi
push 0xfffffffffffffffd
pop edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002e7a0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x404]
call fcn.100157d3
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002e785
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002e835
mov eax, dword [ebp - 0x38]
xor ebx, ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
lea ecx, [ebp - 0x404]
sete bl
xor eax, eax
push eax
call fcn.100157d3
mov dword [eax], ebx
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x38]
cmp ecx, edi
setne al
mov dword [ebp - 0x54], eax
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1002e80d
push eax
lea ecx, [ebp - 0x404]
call fcn.100157d3
xor eax, eax
push eax
lea ecx, [ebp - 0x404]
call fcn.100157d3
xor eax, eax
lea ecx, [ebp - 0x404]
push eax
call fcn.100157d3
xor ebx, ebx
inc ebx
cmp dword [eax], 0
je 0x1002e833
mov eax, ebx
jmp 0x1002e835
xor eax, eax
mov dword [ebp - 0x14], eax
xor edx, edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setge dl
sub edx, 0xf2c9
jne 0x1002e85c
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x404]
xor eax, eax
push eax
call fcn.100157d3
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x404]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], esi
call fcn.100157ce
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffed
jl 0x1002e8cf
xor ebx, ebx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002e8c1
push ebx
push 0xc2f
push ebx
call dword [sym.imp.GDI32.dll_GetRegionData]
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffed
jge 0x1002e8a6
xor ebx, ebx
inc ebx
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x1c], esi
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x4ec], ecx
mov dword [ebp - 0x4e8], ecx
mov dword [ebp - 0x4e4], ecx
mov dword [ebp - 0x4e0], ecx
mov dword [ebp - 0x50], 0xa0a82b5d
mov dword [ebp - 0x48], 0x96fc
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x58], 0x66ab0c02
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffe9
push 3
pop esi
je 0x1002e9f5
mov dword [ebp - 0x54], 0x696a
mov dword [ebp - 0x40], 0xf6f97812
mov dword [ebp - 0x20], eax
jmp 0x1002e950
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8f8], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002e943
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x38]
sub ecx, 0x336dacad
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x15aa961
setg al
add eax, 0x6c870e1d
mov dword [ebp - 0x8f0], eax
cmp eax, dword [ebp - 0x38]
je 0x1002e989
mov eax, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x8f0]
je 0x1002e9a6
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1002e9f3
jmp 0x1002e9e0
imul eax, dword [ebp - 0x8f8], 0x8ebdb88c
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x1002e9e0
xor ebx, ebx
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002e9d8
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
push ebx
call edi
dec dword [ebp - 0x1c]
jns 0x1002e9c3
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe9
push 0
pop eax
jne 0x1002e930
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jg 0x1002ebe0
mov edi, 0xdbc55146
jmp 0x1002ea0a
xor eax, eax
mov dword [ebp - 0x54], 0xfffffffc
lea ecx, [ebp - 0xb74]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0xa8d6e859
push 2
call fcn.10015766
mov dword [ebp - 4], 0x14
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 0x3c], ebx
push ebx
call fcn.10015766
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002ea6f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb74]
call fcn.100157d3
mov dword [eax], 0xe495ee35
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002ea50
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002ea91
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5f0]
call fcn.100157d3
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002ea77
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x1002eb99
mov eax, dword [ebp - 0x54]
cmp edi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4ec]
sub ecx, eax
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
cmp eax, dword [ebp - 0x4e0]
jne 0x1002eacd
mov eax, dword [ebp - 0x48]
xor eax, eax
lea ecx, [ebp - 0x5f0]
push eax
call fcn.100157d3
cmp dword [eax], 0xfff8
jb 0x1002eae6
mov eax, dword [ebp - 0x58]
xor eax, eax
lea ecx, [ebp - 0x5f0]
push eax
call fcn.100157d3
xor ebx, ebx
lea ecx, [ebp - 0x5f0]
cmp dword [eax], ebx
setle bl
xor eax, eax
push eax
call fcn.100157d3
mov ecx, dword [ebp - 0x50]
xor edx, edx
imul ecx, ebx
neg ecx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x4e0]
setle dl
xor ecx, ecx
add edx, 0x22ad
cmp edx, esi
setne cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x5f0]
setl bl
xor eax, eax
push eax
call fcn.100157d3
mov esi, dword [ebp - 0x40]
xor edx, edx
mov ecx, dword [ebp - 0x4e0]
imul esi, ebx
cmp esi, ecx
setg dl
cmp edx, dword [eax]
jge 0x1002eb65
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002eb67
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002eb6c
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xb74]
mov eax, dword [ebp - 0x3c]
xor eax, eax
push eax
call fcn.100157d3
mov dword [ebp - 0x54], esi
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
xor eax, eax
push 3
pop esi
cmp dword [ebp - 0x58], eax
je 0x1002eb97
mov edx, ebx
jmp 0x1002eb9b
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4ec]
cmp edx, eax
sete cl
mov dword [ebp - 0x4e8], ecx
lea ecx, [ebp - 0x5f0]
call fcn.100157ce
or eax, 0xffffffff
lea ecx, [ebp - 0xb74]
mov dword [ebp - 4], eax
call fcn.100157ce
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x1002ea08
mov edi, dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov dword [ebp - 0x1c], 0x28ade19d
lea ecx, [ebp - 0xe08]
push esi
call fcn.10015766
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x54], 0x5b1b6fd4
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002ec2f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe08]
call fcn.100157d3
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002ec11
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002ec45
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x15b4], 0x310c13fe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002ec34
or eax, 0xffffffff
lea ecx, [ebp - 0xe08]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x54], 0xccb9
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.100157d3
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov dword [eax], esi
mov dword [ebp - 0x15ac], ecx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
add ecx, 0x6000ed0d
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
sub edx, 0xfffffffd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x664a
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp - 0x54]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp esi, ecx
lea ecx, [ebp - 0xe08]
setge al
or esi, 0xffffffff
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], esi
call fcn.100157ce
mov dword [ebp - 0x1c], 0x3ae35568
xor eax, eax
mov dword [ebp - 0x40], 0x847d228d
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002ed1a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc0], 0xfffffffb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002ed02
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1002ed30
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor eax, eax
mov dword [ebp - 0xc0], 0xffffffe4
jmp 0x1002ee3b
mov dword [ebp - 0x10], 0x4768c0aa
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002ed6e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8b0], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002ed55
xor eax, eax
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], eax
jl 0x1002ee35
push ebx
lea ecx, [ebp - 0xb8c]
call fcn.10015766
xor eax, eax
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002edb9
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb8c]
call fcn.100157d3
mov dword [eax], 0x90350d8a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002ed9b
xor eax, eax
cmp dword [ebp - 0x8ac], eax
je 0x1002edc4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x8b0]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x8b0]
mov eax, dword [ebp - 0x8ac]
cmp ecx, eax
lea ecx, [ebp - 0xb8c]
setg dl
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x8b0]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp + eax*4 - 0x8b0], 0x34ed
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.100157d3
lea ecx, [ebp - 0xb8c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], esi
call fcn.100157ce
dec dword [ebp - 0x10]
jns 0x1002ed7e
xor eax, eax
inc dword [ebp - 0xc0]
cmp dword [ebp - 0xc0], 5
jg 0x1002ed3f
movdqa xmm0, xmmword [0x10008070]
lea eax, [ebp - 0x12b8]
mov dword [ebp - 0x14], 0xc02a3062
lea ecx, [ebp - 0x1710]
mov dword [ebp - 0x20], 0x25b0
mov dword [ebp - 0x38], 0x87cf2e56
mov dword [ebp - 0x4c], 0xfe46c2e7
mov dword [ebp - 0x10], 0x5f5b1b6f
mov dword [ebp - 0x54], 0x289fff12
push eax
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x12c8]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 0xc4e2bf5
push eax
movdqu xmmword [ebp - 0x12c8], xmm0
call fcn.100157e2
lea ecx, [ebp - 0x1cf]
mov esi, eax
call fcn.100092f3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x47c]
push dword [esi]
call fcn.100157a8
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x54], 0xfff8
cmp dword [ebp - 0x20], eax
jne 0x1002eef3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xdc9e
je 0x1002eef3
xor eax, eax
mov edx, eax
jmp 0x1002eef7
mov edx, ebx
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002ef0c
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002ef0a
mov eax, ebx
jmp 0x1002ef0c
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, 0x10c13fe6
setle cl
imul ecx, edx
test ecx, ecx
je 0x1002ef70
push 3
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x106c]
mov dword [ebp - 0x24], eax
push esi
call fcn.10015766
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x20], eax
jmp 0x1002ef54
push dword [ebp - 0x20]
call fcn.100157d3
mov dword [eax], 0x6e9f0866
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x106c]
cmp dword [ebp - 0x20], esi
jl 0x1002ef43
dec dword [ebp - 0x54]
mov byte [ebp - 4], 0x18
call fcn.100157ce
jmp 0x1002f141
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x50], 0x8d7
mov dword [ebp - 0x58], 0x1dfba308
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x40], 0xfffffff7
cmp dword [ebp - 0x30], eax
je 0x1002f0bd
mov dword [ebp - 0x48], 0x642d9490
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x1a
jg 0x1002f0f7
push 3
pop edi
jmp 0x1002efbc
xor eax, eax
mov dword [ebp - 0x44], 0xfff9
mov dword [ebp - 0x3c], 0x3f0b
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1002f041
jmp 0x1002efd6
xor eax, eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x47c]
push dword [ebp - 0x1c]
call fcn.100157d3
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
push dword [ebp - 0x1c]
cmp dword [eax], ecx
lea ecx, [ebp - 0x47c]
setne bl
call fcn.100157d3
cmp dword [eax], ebx
jl 0x1002f01f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x47c]
call fcn.100157d3
cmp dword [eax], 0
jne 0x1002f01f
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x1002f024
xor ebx, ebx
inc ebx
mov esi, ebx
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x47c]
push dword [ebp - 0x1c]
call fcn.100157d3
mov ecx, dword [ebp - 0x30]
sub esi, ecx
mov dword [eax], esi
dec dword [ebp - 0x1c]
jns 0x1002efd4
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x47c]
mov dword [ebp - 0x54], eax
push edi
call fcn.100157d3
imul edx, dword [ebp - 0x3c], 0x26aa
mov esi, eax
mov ecx, dword [ebp - 0x30]
xor eax, eax
cmp edx, ecx
setne al
or ecx, 0xffffffff
neg eax
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
add edx, 0x164c
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, dword [esi]
setle al
cmp eax, 0xfffffffd
je 0x1002f091
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x1a
jle 0x1002efba
mov edi, dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
jmp 0x1002f0f7
mov dword [ebp - 0x38], 0x10
jmp 0x1002f0f1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002f0e6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x754], 0xce51
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002f0ce
xor eax, eax
cmp dword [ebp - 0x754], eax
jne 0x1002f0f7
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xb
jne 0x1002f0c6
mov eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
add eax, 0xffff3b2c
cmp eax, ebx
je 0x1002f112
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x1002f114
mov edx, ebx
jmp 0x1002f116
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, eax
push 9
setle cl
pop eax
add ecx, eax
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x30]
jg 0x1002f135
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
push 2
lea ecx, [ebp - 0x47c]
call fcn.100157d3
mov ecx, dword [ebp - 0x10]
or esi, 0xffffffff
mov dword [ebp - 4], esi
mov dword [eax], ecx
lea ecx, [ebp - 0x47c]
call fcn.100157ce
mov dword [ebp - 0x4c], 0x4ed09eb
mov dword [ebp - 0x844], esi
mov dword [ebp - 0x840], esi
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x38], 0xd2703d9b
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x1c], 0xfffffffb
cmp dword [ebp - 0x840], 0x86bd085c
push 3
sbb esi, esi
neg esi
mov dword [ebp - 0x840], esi
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp esi, eax
setle cl
sub ecx, edx
sub ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x38]
pop ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002f27f
mov dword [ebp - 0x38], eax
jmp 0x1002f277
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1002f21c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x1002f274
mov dword [ebp - 0x20], 0xac0faab3
mov dword [ebp - 0x20], eax
jmp 0x1002f25d
mov dword [ebp - 0x3c], 0xdbc9b780
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x1002f25a
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x844]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x3c]
jns 0x1002f246
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x1002f230
mov eax, dword [ebp - 0x1c]
push 0
mov eax, dword [ebp + eax*4 - 0x844]
dec dword [ebp - 0x30]
pop eax
jns 0x1002f224
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jle 0x1002f207
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1002f202
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x1c], 6
jmp 0x1002fbf2
movdqa xmm0, xmmword [0x10008160]
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x1428]
mov dword [ebp - 0x4c], 0xe307b5ca
push eax
lea ecx, [ebp - 0x16b0]
movdqu xmmword [ebp - 0x1428], xmm0
call fcn.100157e2
lea ecx, [ebp - 0x1f8]
mov esi, eax
call fcn.100092f3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x638]
push dword [esi]
call fcn.100157a8
lea eax, [ebp - 0x12d8]
mov dword [ebp - 4], 0x1a
movdqa xmm0, xmmword [0x100080b0]
lea ecx, [ebp - 0x1720]
push eax
lea eax, [ebp - 0x12e8]
push eax
movdqu xmmword [ebp - 0x12e8], xmm0
call fcn.100157e2
lea ecx, [ebp - 0x1db]
mov esi, eax
call fcn.100092f3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xee0]
push dword [esi]
call fcn.100157a8
xor eax, eax
mov byte [ebp - 4], 0x1b
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x1002f352
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x638]
push 3
pop eax
push eax
call fcn.100157d3
xor esi, esi
cmp dword [eax], esi
je 0x1002f37d
push 3
pop eax
push eax
lea ecx, [ebp - 0x638]
call fcn.100157d3
cmp dword [eax], esi
jne 0x1002f381
xor eax, eax
mov ebx, eax
push 3
pop eax
push eax
lea ecx, [ebp - 0x638]
call fcn.100157d3
mov ecx, dword [ebp - 0x4c]
mov esi, eax
mov edx, dword [ebp - 0x4c]
xor eax, eax
cmp ecx, ebx
push 3
setg al
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor ebx, ebx
cmp ecx, dword [esi]
lea ecx, [ebp - 0x638]
pop esi
push esi
setg bl
call fcn.100157d3
cmp ebx, dword [eax]
jne 0x1002f3dd
push esi
lea ecx, [ebp - 0x638]
call fcn.100157d3
cmp dword [eax], 0
je 0x1002f3dd
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002f3e4
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push 2
lea ecx, [ebp - 0xee0]
call fcn.100157d3
lea ecx, [esi + 0x42c7]
mov dword [eax], ecx
lea ecx, [ebp - 0xee0]
call fcn.100157ce
or esi, 0xffffffff
lea ecx, [ebp - 0x638]
mov dword [ebp - 4], esi
call fcn.100157ce
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x10], esi
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x504], eax
mov dword [ebp - 0x500], eax
xor eax, eax
mov dword [ebp - 0x50], 0xa0a82b5d
mov dword [ebp - 0x48], 0x96fc
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x58], 0x66ab0c02
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffe9
push 3
pop esi
je 0x1002f537
mov dword [ebp - 0x54], 0x696a
mov dword [ebp - 0x40], 0xf6f97812
mov dword [ebp - 0x20], eax
jmp 0x1002f492
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x910], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002f485
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x38]
sub ecx, 0x336dacad
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x15aa961
setg al
add eax, 0x6c870e1d
mov dword [ebp - 0x908], eax
cmp eax, dword [ebp - 0x38]
je 0x1002f4cb
mov eax, dword [ebp - 0x908]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x908]
add eax, dword [ebp - 0x54]
je 0x1002f4e8
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1002f535
jmp 0x1002f522
imul eax, dword [ebp - 0x910], 0x8ebdb88c
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x1002f522
xor ebx, ebx
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002f51a
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
push ebx
call edi
dec dword [ebp - 0x10]
jns 0x1002f505
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe9
push 0
pop eax
jne 0x1002f472
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jg 0x1002f721
mov edi, 0xdbc55146
mov dword [ebp - 0x54], 0xfffffffc
lea ecx, [ebp - 0xd18]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0xa8d6e859
push 2
call fcn.10015766
mov dword [ebp - 4], 0x1c
lea ecx, [ebp - 0x608]
mov dword [ebp - 0x3c], ebx
push ebx
call fcn.10015766
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002f5ad
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd18]
call fcn.100157d3
mov dword [eax], 0xe495ee35
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002f58e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002f5cf
push dword [ebp - 0x10]
lea ecx, [ebp - 0x608]
call fcn.100157d3
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f5b5
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x1002f6d7
mov eax, dword [ebp - 0x54]
cmp edi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50c]
sub ecx, eax
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
cmp eax, dword [ebp - 0x500]
jne 0x1002f60b
mov eax, dword [ebp - 0x48]
xor eax, eax
lea ecx, [ebp - 0x608]
push eax
call fcn.100157d3
cmp dword [eax], 0xfff8
jb 0x1002f624
mov eax, dword [ebp - 0x58]
xor eax, eax
lea ecx, [ebp - 0x608]
push eax
call fcn.100157d3
xor ebx, ebx
lea ecx, [ebp - 0x608]
cmp dword [eax], ebx
setle bl
xor eax, eax
push eax
call fcn.100157d3
mov ecx, dword [ebp - 0x50]
xor edx, edx
imul ecx, ebx
neg ecx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x500]
setle dl
xor ecx, ecx
add edx, 0x22ad
cmp edx, esi
setne cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x608]
setl bl
xor eax, eax
push eax
call fcn.100157d3
mov esi, dword [ebp - 0x40]
xor edx, edx
mov ecx, dword [ebp - 0x500]
imul esi, ebx
cmp esi, ecx
setg dl
cmp edx, dword [eax]
jge 0x1002f6a3
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002f6a5
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002f6aa
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xd18]
mov eax, dword [ebp - 0x3c]
xor eax, eax
push eax
call fcn.100157d3
mov dword [ebp - 0x54], esi
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
xor eax, eax
push 3
pop esi
cmp dword [ebp - 0x58], eax
je 0x1002f6d5
mov edx, ebx
jmp 0x1002f6d9
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x50c]
cmp edx, eax
sete cl
mov dword [ebp - 0x508], ecx
lea ecx, [ebp - 0x608]
call fcn.100157ce
or eax, 0xffffffff
lea ecx, [ebp - 0xd18]
mov dword [ebp - 4], eax
call fcn.100157ce
inc dword [ebp - 0x38]
push 0
pop eax
cmp dword [ebp - 0x38], esi
jle 0x1002f548
mov edi, dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov ecx, 0x7c2076a
or esi, 0xffffffff
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x528], ecx
mov dword [ebp - 0x524], ecx
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x48], 0x9398
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x15
jl 0x1002f947
mov dword [ebp - 0x2c], 0x1013923c
mov dword [ebp - 0x30], 0x30fc353
mov dword [ebp - 0x40], 0xea1325a4
mov dword [ebp - 0x4c], 0xba424acd
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x20], eax
jmp 0x1002f79a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x364], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002f78d
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x2c]
je 0x1002f7ab
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0xaa29
setl cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
sub eax, 0x1639956a
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x2c]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
je 0x1002f7ed
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002f7ef
mov edx, ebx
jmp 0x1002f7f1
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
setne cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x360], eax
imul eax, eax, 0xa382
test eax, eax
jne 0x1002f832
mov eax, dword [ebp - 0x360]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x2c], 2
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
cmp ecx, esi
setne dl
sub edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x3c], ebx
sbb edx, edx
neg edx
sub edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
inc edx
cmp edx, 0x9d242ec2
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, esi
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
mov ecx, 0xddd2e786
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x1002f8ea
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, 0x99c0
setle cl
cmp ecx, 0xc408
je 0x1002f902
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x360]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x360]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
neg ecx
push 0
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x364]
cmp eax, ebx
pop eax
setge cl
mov dword [ebp - 0x54], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x15
jge 0x1002f765
mov dword [ebp - 0x20], eax
jmp 0x1002f95d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1528], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002f94c
push 2
lea ecx, [ebp - 0x650]
call fcn.10015766
xor eax, eax
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002f9a1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x650]
call fcn.100157d3
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002f982
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002f9b7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3a8], 0x45f1dbec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f9a6
push ebx
lea ecx, [ebp - 0x650]
call fcn.100157d3
mov dword [eax], 0xe
jmp 0x1002fa63
mov dword [ebp - 0x10], 0xd37ad435
xor eax, eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1002fa55
mov dword [ebp - 0x4c], 0x61bf
mov dword [ebp - 0x40], 0xe2294bb4
mov eax, dword [ebp - 0x4c]
cmp esi, eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1002fa11
cmp dword [ebp - 0x4c], eax
jne 0x1002fa13
mov ebx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add ecx, ebx
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge bl
xor edx, edx
push 1
add ebx, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x10]
add ebx, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x10]
cmp ebx, eax
mov eax, dword [ebp - 0x4c]
setge dl
xor ecx, ecx
cmp edx, eax
pop ebx
setl cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x10]
jns 0x1002f9e7
push ebx
lea ecx, [ebp - 0x650]
call fcn.100157d3
dec dword [eax]
push ebx
lea ecx, [ebp - 0x650]
call fcn.100157d3
cmp dword [eax], 0xffffffe4
jle 0x1002f9d3
lea ecx, [ebp - 0x650]
mov dword [ebp - 4], esi
call fcn.100157ce
mov eax, dword [ebp - 0x52c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x52c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x524]
mov eax, dword [ebp - 0x1524]
mov dword [ebp - 0x1524], eax
lea ecx, [eax - 7]
mov eax, dword [ebp - 0x52c]
cmp ecx, eax
mov eax, dword [ebp - 0x52c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x52c]
setne cl
xor edx, edx
imul eax, ecx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
or eax, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x4c], 0x60e7
mov dword [ebp - 0x58], esi
mov esi, 0x1d594d03
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0xad4], esi
mov dword [ebp - 0xad0], esi
mov dword [ebp - 0xacc], esi
mov dword [ebp - 0xac8], esi
mov esi, 0x7f47073
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x5a94
mov dword [ebp - 0x50], 0x48110cbb
mov dword [ebp - 0xe9c], esi
mov dword [ebp - 0xe98], esi
mov dword [ebp - 0xe94], esi
mov dword [ebp - 0xe90], esi
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002fb70
cmp dword [ebp - 0x20], 2
jl 0x1002fb5f
cmp dword [ebp - 0x1c], 0x13
je 0x1002f29b
mov edi, dword [sym.imp.USER32.dll_MapWindowPoints]
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0x1b
je 0x1002fc4f
xor ebx, ebx
mov dword [ebp - 0x40], 0x2fd4914d
mov dword [ebp - 0x48], 0x555b7cef
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002fc43
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x6bc
push ebx
call esi
push eax
call esi
push eax
call edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1b
jne 0x1002fc13
xor ebx, ebx
inc ebx
push 2
lea ecx, [ebp - 0x1078]
call fcn.10015766
mov dword [ebp - 4], 0x1f
mov esi, 0x57976326
mov dword [ebp - 0x3c], esi
or ecx, 0xffffffff
mov dword [ebp - 0x24], 0xa485bf25
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002fca5
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1078]
call fcn.100157d3
mov dword [eax], 0xffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002fc83
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x1002fcbc
mov dword [ebp - 0x54], 0xbeb7
dec dword [ebp - 0x54]
dec dword [ebp - 0x3c]
jns 0x1002fcad
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x1078]
call fcn.100157ce
push 2
lea ecx, [ebp - 0xef0]
call fcn.10015766
mov dword [ebp - 4], 0x20
or ecx, 0xffffffff
mov dword [ebp - 0x3c], esi
xor eax, eax
mov dword [ebp - 0x24], 0xa485bf25
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002fd1b
push dword [ebp - 0x20]
lea ecx, [ebp - 0xef0]
call fcn.100157d3
mov dword [eax], 0xffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002fcf9
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x1002fd32
mov dword [ebp - 0x54], 0xbeb7
dec dword [ebp - 0x54]
dec dword [ebp - 0x3c]
jns 0x1002fd23
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0xef0]
call fcn.100157ce
mov dword [ebp - 0x1c], ebx
mov esi, 0x1e66c619
mov dword [ebp - 0x24], esi
xor eax, eax
mov dword [ebp - 0x24], 0x3a4df6f9
mov dword [ebp - 0x24], 0xe9378f1e
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002fd7f
push 9
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1730], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002fd6a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002fda1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x17f4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002fd88
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe3
je 0x1002ff24
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0x67a876e6
mov dword [ebp - 0x24], 0xcc92ea21
mov dword [ebp - 0x24], 0x32b96ce0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0x395e2de4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x54], 0x915bb002
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 8
jne 0x1002ff14
mov dword [ebp - 0x34], 0xf25cbd94
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff6
jg 0x1002fee8
push 4
lea ecx, [ebp - 0x620]
call fcn.10015766
xor eax, eax
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x20], eax
jmp 0x1002fe2a
push dword [ebp - 0x20]
call fcn.100157d3
mov dword [eax], 0x946507e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
lea ecx, [ebp - 0x620]
jl 0x1002fe19
push ebx
call fcn.100157d3
and dword [eax], 0
jmp 0x1002feb1
push 3
pop eax
push eax
lea ecx, [ebp - 0x928]
call fcn.10015766
xor eax, eax
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002fe83
push 3
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x928]
call fcn.100157d3
mov dword [eax], 0xffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002fe62
xor ebx, ebx
inc ebx
xor eax, eax
push eax
lea ecx, [ebp - 0x928]
call fcn.100157d3
lea ecx, [ebp - 0x928]
cmp dword [eax], 0
jne 0x1002fec3
mov byte [ebp - 4], 0x21
call fcn.100157ce
push ebx
lea ecx, [ebp - 0x620]
call fcn.100157d3
inc dword [eax]
push ebx
lea ecx, [ebp - 0x620]
call fcn.100157d3
cmp dword [eax], ebx
jle 0x1002fe41
jmp 0x1002fec8
call fcn.100157ce
or eax, 0xffffffff
lea ecx, [ebp - 0x620]
mov dword [ebp - 4], eax
call fcn.100157ce
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff6
jle 0x1002fdfe
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1002ff04
push eax
push 0x8c0
push 0x59d
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 8
je 0x1002fdea
or ecx, 0xffffffff
inc dword [ebp - 0x54]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
jne 0x1002fdb1
push 2
lea ecx, [ebp - 0x1090]
call fcn.10015766
mov dword [ebp - 4], 0x23
xor eax, eax
mov dword [ebp - 0x3c], 0xd8e5ccc9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002ff69
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1090]
call fcn.100157d3
mov dword [eax], 0xdf75dcec
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002ff4a
xor eax, eax
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x1002ff87
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1002ff82
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x1002ff71
or eax, 0xffffffff
lea ecx, [ebp - 0x1090]
mov dword [ebp - 4], eax
call fcn.100157ce
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffed
jl 0x1002ffda
xor ebx, ebx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x16], bl
cmp byte [ebp - 0x16], bl
je 0x1002ffc9
push ebx
push 0xc2f
push ebx
call dword [sym.imp.GDI32.dll_GetRegionData]
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffed
jge 0x1002ffae
xor ebx, ebx
xor eax, eax
inc ebx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0x3a4df6f9
mov dword [ebp - 0x24], 0xe9378f1e
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10030013
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1728], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002fffa
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10030035
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1834], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003001c
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100301b1
mov dword [ebp - 0x30], 0x67a876e6
mov dword [ebp - 0x24], 0xcc92ea21
mov dword [ebp - 0x24], 0x32b96ce0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0x395e2de4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x54], 0x915bb002
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 8
jne 0x100301ab
mov dword [ebp - 0x34], 0xf25cbd94
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff6
jg 0x1003017f
push 4
lea ecx, [ebp - 0x584]
call fcn.10015766
xor eax, eax
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x20], eax
jmp 0x100300b6
cmp dword [ebp - 0x20], 4
lea ecx, [ebp - 0x584]
jl 0x100300a5
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1003019b
push eax
push 0x8c0
push 0x59d
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 8
je 0x10030076
inc dword [ebp - 0x54]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
jne 0x1003003d
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x958]
mov dword [ebp - 0x54], eax
push ebx
call fcn.10015766
mov dword [ebp - 4], 0x26
xor eax, eax
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], eax
jmp 0x100301f9
cmp dword [ebp - 0x20], ebx
jl 0x100301e2