Function at 0x1002ba6f
Capabilities:
Accept command line arguments
Allocate thread local storage
Check for time delay via gettickcount
Create pipe
Create process on windows
Create thread
Delete registry value
Get common file path
Get geographical location
Query environment variable
Set thread local storage value

Disassembly:
mov eax, 0x10084d1d
call fcn.100846a8
mov eax, 0x1000
call fcn.1006a3c0
push ebx
push esi
xor eax, eax
mov byte [ebp - 0x85], dl
xor esi, esi
mov dword [ebp - 0x24], eax
inc esi
mov dword [ebp - 0x5c], ecx
push edi
cmp dword [ebp - 0x24], esi
jge 0x1002bab4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb84], 0xfffffff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002ba9c
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, 0x231b
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002bae1
push eax
push ebx
push 0x1c54
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002baf2
call dword [sym.imp.USER32.dll_DestroyCaret]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002bb12
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xae0], 0xfffffff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002bafa
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002bb34
push eax
push ebx
push 0x1c54
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002bb45
call dword [sym.imp.USER32.dll_DestroyCaret]
xor eax, eax
mov dword [ebp - 0x40], 0xf4f46db5
mov dword [ebp - 0x24], eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x24], esi
jge 0x1002bb6b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x33c], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002bb57
xor eax, eax
push 0xfffffffffffffffe
pop edx
mov dword [ebp - 0x40], eax
push 2
pop ebx
cmp dword [ebp - 0x40], eax
jl 0x1002bd34
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002bba0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xbc], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002bb8c
xor eax, eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], eax
jl 0x1002bd2b
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], 0xfad54077
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002bc2a
mov dword [ebp - 0x3c], edx
xor edx, edx
mov dword [ebp - 0x30], 0xd3672969
mov eax, dword [ebp - 0x40]
push 0xfffffffffffffffe
mov esi, dword [ebp + eax*4 - 0x33c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x33c], esi
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
imul ecx, eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x40]
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, esi
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub edx, 0x246a63bb
cmp edx, eax
pop edx
setne cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x1c]
jns 0x1002bbc7
xor esi, esi
xor eax, eax
inc esi
or ecx, 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1c
jl 0x1002bd17
mov dword [ebp - 0x948], ecx
mov dword [ebp - 0x944], ecx
mov dword [ebp - 0x940], ecx
mov dword [ebp - 0x93c], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002bc6f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x32c], 0x16e2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002bc57
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002bc8d
push eax
push eax
push 0x4bf
push 0x2282
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
cmp dword [ebp - 0x328], eax
jne 0x1002bcc7
mov eax, dword [ebp - 0x328]
mov eax, dword [ebp - 0x328]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x328]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
je 0x1002bcd9
mov edx, esi
cmp dword [ebp - 0x328], eax
jne 0x1002bcdb
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
push 0
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x28], 0xfffffffc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x940], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1c
pop eax
push 0xffffffffffffffff
pop ecx
jge 0x1002bc37
dec dword [ebp - 0xbc]
push 0xffffffffffffffff
pop ecx
push 0xfffffffffffffffe
pop edx
jns 0x1002bbb2
or ecx, ecx
dec dword [ebp - 0x40]
jns 0x1002bb7d
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002bd4b
push 0x15b9
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x50], 0x345fe46c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x48], 0xc13fe66
mov dword [ebp - 0x28], 0x6b8d9637
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x24], 0xf665
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002bda0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9ec], 0x45ccb972
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002bd87
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002bdbc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5e4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002bda8
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002be14
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x9e8]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
cmp ecx, 0xdbc7
setl dl
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x5e4]
inc dword [ebp - 0x5e4]
cmp eax, edx
je 0x1002be14
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x1002be16
mov edx, esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x2c]
sub edx, 0x20c8
cmp edx, eax
mov eax, dword [ebp - 0x9e8]
push 2
setg cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x50]
pop ebx
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
or eax, 0xffffffff
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002be7d
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002be7a
push eax
push 0x12a1
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1002be62
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002bea2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb1c], 0xfffffff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002be8a
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002bec8
push eax
push 0x231b
push 0x1c54
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002bed9
call dword [sym.imp.USER32.dll_DestroyCaret]
xor eax, eax
mov dword [ebp - 0x48], 0xfffa
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002bef9
push 0x1244
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002bf0b
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
xor eax, eax
mov dword [ebp - 0x1c], 4
or ecx, 0xffffffff
mov dword [ebp - 0x3c], 0x544bd1a6
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x1c], 0x22124f84
jne 0x1002bf3e
cmp eax, dword [ebp - 0x1c]
je 0x1002bf41
mov eax, esi
cmp eax, dword [ebp - 0x1c]
push 0xfffffffffffffffb
pop edx
je 0x1002bf76
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002bf6b
mov dword [ebp - 0x28], 0x5cc25bfc
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002bf65
call dword [sym.imp.KERNEL32.dll_GetACP]
xor eax, eax
dec dword [ebp - 0x28]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1c
jg 0x1002bf4d
jmp 0x1002c074
xor eax, eax
mov dword [ebp - 0x24], 0x52509e71
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3c
jne 0x1002c06e
push 7
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x1002bfb5
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x138], 0xfa9b
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1002bf9d
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jl 0x1002c05c
mov dword [ebp - 0x28], 0x61943ec3
mov dword [ebp - 0x3c], 0x58e7
mov dword [ebp - 0x30], 0x594484f7
cmp dword [ebp - 0x24], eax
je 0x1002c01f
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x138]
cmp eax, 0xec0
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002c01f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
push 0
mov esi, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp esi, ecx
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setle cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x40]
jns 0x1002bfc1
push 7
pop ecx
xor esi, esi
push 0xfffffffffffffffb
inc esi
pop edx
cmp dword [ebp - 0x34], eax
jne 0x1002c06e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x3c
je 0x1002bf8f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002c0a1
mov dword [ebp - 0x48], 0x3ac16b40
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], 0xfffffffd
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
inc dword [ebp - 0x50]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1002c07b
mov dword [ebp - 0x40], 0xf4f46db5
or ecx, 0xffffffff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002c0cd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2a8], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002c0b9
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jl 0x1002c288
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002c0fc
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb8], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002c0e8
xor eax, eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], eax
jl 0x1002c27c
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], 0xfad54077
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002c183
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x3c], eax
xor edx, edx
mov dword [ebp - 0x30], 0xd3672969
mov eax, dword [ebp - 0x40]
mov esi, dword [ebp + eax*4 - 0x2a8]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2a8], esi
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
imul ecx, eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x40]
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, esi
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub edx, 0x246a63bb
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x1c]
jns 0x1002c123
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1c
jl 0x1002c270
or ecx, 0xffffffff
mov dword [ebp - 0x848], ecx
mov dword [ebp - 0x844], ecx
mov dword [ebp - 0x840], ecx
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002c1cb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2b8], 0x16e2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002c1b3
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002c1e9
push eax
push eax
push 0x4bf
push 0x2282
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
cmp dword [ebp - 0x2b4], eax
jne 0x1002c223
mov eax, dword [ebp - 0x2b4]
mov eax, dword [ebp - 0x2b4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x2b4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
je 0x1002c235
mov edx, esi
cmp dword [ebp - 0x2b4], eax
jne 0x1002c237
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
push 0
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x28], 0xfffffffc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x840], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1c
pop eax
jge 0x1002c190
dec dword [ebp - 0xb8]
jns 0x1002c10e
dec dword [ebp - 0x40]
push 0xffffffffffffffff
pop ecx
jns 0x1002c0d9
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002c29f
push 0x15b9
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor eax, eax
push 7
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x50], 0x345fe46c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x48], 0xc13fe66
mov dword [ebp - 0x28], 0x6b8d9637
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], 0xf665
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002c2f3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb94], 0x45ccb972
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002c2da
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c30f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4f0], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c2fb
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002c367
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xb90]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
cmp ecx, 0xdbc7
setl dl
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4f0]
inc dword [ebp - 0x4f0]
cmp eax, edx
je 0x1002c367
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x1002c369
mov edx, esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x2c]
sub edx, 0x20c8
cmp edx, eax
mov eax, dword [ebp - 0xb90]
setg cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x50]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
or edx, 0xffffffff
cmp ecx, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x1002c3da
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002c3ce
push eax
push 0x12a1
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x1002c3b6
or edx, 0xffffffff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002c3fa
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xaec], 0xfffffff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002c3e2
xor eax, eax
mov dword [ebp - 0x40], 0x8a59
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002c43f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x794], 0x55ebda18
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002c426
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002c449
mov dword [ebp - 0x3c], edx
mov eax, esi
xor ecx, ecx
push 6
pop edx
cmp eax, edx
mov eax, dword [ebp - 0x40]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x78c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setg cl
xor ebx, ebx
cmp ecx, 2
setle bl
xor edx, edx
sub ebx, eax
add ebx, dword [ebp - 0x28]
imul ebx, dword [ebp - 0x50]
add ebx, dword [ebp - 0x28]
cmp ebx, 0x2b56
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x794]
cmp ecx, 0x8777
je 0x1002c4b5
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x78c], eax
je 0x1002c4b7
mov ecx, esi
mov eax, dword [ebp - 0x40]
xor edx, edx
cmp eax, ecx
push 3
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
pop ebx
push 0xfffffffffffffff7
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x34], 0xe81a7ecc
mov dword [ebp - 0x38], 0xc46ddcd1
mov dword [ebp - 0x28], 0xda0bdbd
mov dword [ebp - 0x54], ebx
pop ecx
mov dword [ebp - 0x20], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x24], eax
jmp 0x1002c520
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2e4], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002c513
mov eax, dword [ebp - 0x58]
xor edx, edx
mov eax, dword [ebp - 0x2e0]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x2e0]
cmp eax, ecx
setne dl
imul ecx, edx, 0x3fa
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
mov dword [ebp - 0x2dc], ecx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
cmp eax, edx
mov eax, dword [ebp - 0x54]
setne cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, 0x5c74
je 0x1002c5fe
mov dword [ebp - 0x48], 0x4182
or ecx, 0xffffffff
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x48], esi
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], 0x395830af
mov dword [ebp - 0x48], 0x870e7c4b
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x740], eax
mov dword [ebp - 0x73c], eax
mov dword [ebp - 0x738], eax
mov dword [ebp - 0x734], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002c5ee
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb20], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002c5e1
inc dword [ebp - 0x740]
jmp 0x1002c771
mov dword [ebp - 0x18], 0x3f04bf7a
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002c629
push 7
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7dc], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002c615
xor eax, eax
mov dword [ebp - 0x20], 0xffffffe3
jmp 0x1002c767
mov dword [ebp - 0x50], 0x297e1152
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x1002c745
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x2e4], 0
jne 0x1002c6a7
mov dword [ebp - 0x34], 4
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x2e4]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
mov dword [ebp + eax*4 - 0x2e4], edx
test edx, edx
jne 0x1002c6a1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2e4]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x28]
inc eax
je 0x1002c6be
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002c6c0
mov edx, esi
jmp 0x1002c6c2
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x7dc]
dec edx
imul edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x7dc]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x552b10a2
setl al
xor edx, edx
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
setne dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x2958
mov eax, dword [ebp - 0x7dc]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002c736
push eax
push 0x7ec
push 0x26e1
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1002c649
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002c764
push eax
push 0xdba
push eax
push eax
push 0x71d
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x31
jg 0x1002c635
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002c79f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xef4], 0x2071
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002c786
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x1002c836
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002c7ce
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x518], 0x5059b8bc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002c7b6
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c7ea
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd78], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c7d6
xor eax, eax
cmp dword [ebp - 0x518], eax
jne 0x1002c7f7
cmp dword [ebp - 0x24], eax
je 0x1002c7f9
mov eax, esi
mov dword [ebp - 0xd74], eax
xor eax, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], eax
jl 0x1002c827
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002c822
push 0xbf6
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1002c809
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], esi
jle 0x1002c7ab
cmp byte [ebp - 0xd], 0
je 0x1002c925
mov dword [ebp - 0x24], 0xe60f951f
mov dword [ebp - 0x28], 0xb14f4e79
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c86e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6cc], 0xb6f65e79
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c856
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002c88e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x53c], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002c876
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c8a3
push eax
push 0x2618
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov eax, dword [ebp - 0x6c4]
mov ecx, 0xfff7
sub ecx, eax
je 0x1002c8cf
mov eax, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002c8d1
mov ecx, esi
jmp 0x1002c8d3
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x6cc]
sub ecx, eax
mov dword [ebp - 0x6c4], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
sub ecx, 0x123d
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
or edx, 0xffffffff
cmp ecx, edx
setge al
mov dword [ebp - 0x53c], eax
xor eax, eax
push eax
push 0x231b
push 0x1c54
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov dword [ebp - 0x48], 0xf75d
xor eax, eax
mov dword [ebp - 0x48], 0xd490c4d8
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x48], 0xa11c
mov dword [ebp - 0x48], 0xc7be0218
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002c96d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xaf8], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002c955
xor eax, eax
inc dword [ebp - 0x28]
or edx, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0x1eefb6f6
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], 0xa3735b26
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x3c], 0x1af7
mov dword [ebp - 0x48], 0x1b49
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002c9c0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5a4], 0xe5b14f4e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002c9a7
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c9d8
push eax
call edi
push eax
call ebx
or edx, 0xffffffff
inc dword [ebp - 0x28]
mov ecx, dword [ebp - 0x5a0]
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x50]
sub ecx, eax
imul eax, ecx, 0x54e5
mov ecx, 0xfffc
cmp eax, ecx
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
inc ecx
sub eax, ecx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x5a0]
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x34]
jne 0x1002ca1a
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x5a0], eax
xor eax, eax
push 4
pop ecx
mov byte [ebp - 0x49], al
mov dword [ebp - 0x20], ecx
push 0xfffffffffffffffb
pop edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], edx
mov edx, 0xffff
cmp dword [ebp - 0x20], eax
je 0x1002cad3
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002ca7b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc6c], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002ca67
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe3
jge 0x1002caa3
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ca94
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
push 0
pop eax
jl 0x1002ca84
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1002cae8
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xc6c]
mov eax, dword [ebp - 0xc64]
cmp ecx, eax
setl dl
neg edx
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x1002caac
jmp 0x1002cae6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002cae8
push 0x1d66
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cafc
call edi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor eax, eax
cmp byte [ebp - 0x49], 0
mov edi, dword [sym.imp.GDI32.dll_Polyline]
je 0x1002cb93
mov dword [ebp - 0x14], 0xdc85f70a
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cb34
push 0x21f0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jl 0x1002cb8d
push 6
pop edi
jmp 0x1002cb44
xor eax, eax
mov ecx, 0xffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], edi
cmp dword [ebp - 0x14], eax
je 0x1002cb57
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg eax
je 0x1002cb72
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002cb74
mov ecx, esi
jmp 0x1002cb76
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jge 0x1002cb42
mov edi, dword [sym.imp.GDI32.dll_Polyline]
call dword [sym.imp.USER32.dll_DestroyCaret]
or ecx, 0xffffffff
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x698], ecx
mov dword [ebp - 0x694], ecx
mov dword [ebp - 0x690], ecx
mov dword [ebp - 0x68c], ecx
mov dword [ebp - 0x48], 0x9ced66e5
mov dword [ebp - 0x24], 0x3cfcb8f1
cmp dword [ebp - 0x40], eax
je 0x1002cd87
mov dword [ebp - 0x28], 0x3f1571c0
mov dword [ebp - 0x3c], eax
push 4
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x1002cbfa
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3cc], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002cbe2
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002cc18
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa64], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002cc03
xor eax, eax
mov dword [ebp - 0x40], 0xffffffeb
jmp 0x1002cd55
mov dword [ebp - 0x20], 0x32937a3a
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1002cd52
mov dword [ebp - 0x48], 9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cc66
push 0xd19
push 0x1a40
push 0x20cd
push 0x25de
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x3c0]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002cc83
cmp dword [ebp - 0x40], eax
jne 0x1002cc83
mov esi, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x3cc]
mov eax, dword [ebp - 0x20]
cmp esi, eax
sete cl
xor eax, eax
cmp edx, ecx
setg al
cmp eax, 0xc257a10d
sbb eax, eax
neg eax
mov dword [ebp - 0x690], eax
mov eax, dword [ebp - 0x3c4]
imul eax, dword [ebp - 0x20]
sub eax, 0xfffffffa
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
or edx, 0xffffffff
cmp eax, edx
mov eax, dword [ebp - 0x20]
setle cl
mov eax, dword [ebp + eax*4 - 0x3cc]
imul eax, ecx
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002ccf4
mov dword [ebp - 0x28], 0x925f
dec dword [ebp - 0x28]
cmp dword [ebp - 0x690], eax
jne 0x1002cd4a
jmp 0x1002cd37
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x3cc]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3cc], ecx
mov dword [ebp - 0x24], 0xffffffe3
jmp 0x1002cd31
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x3cc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x3cc]
mov dword [ebp - 0xa64], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff1
jl 0x1002cd11
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
push 0
pop eax
push 1
pop esi
jle 0x1002cc3b
xor esi, esi
xor eax, eax
inc esi
or ecx, 0xffffffff
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 8
jne 0x1002cc24
mov ecx, dword [ebp - 0x3c0]
xor edx, edx
mov eax, dword [ebp - 0x690]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xed83
setne al
mov dword [ebp - 0x24], eax
xor eax, eax
or ecx, 0xffffffff
jmp 0x1002cd91
mov dword [ebp - 0x3c], 0x42f34c93
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x638], ecx
mov dword [ebp - 0x634], ecx
mov dword [ebp - 0x630], ecx
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 0x48], 0x9ced66e5
mov dword [ebp - 0x24], 0x3cfcb8f1
cmp dword [ebp - 0x40], eax
je 0x1002cf81
mov dword [ebp - 0x28], 0x3f1571c0
mov dword [ebp - 0x3c], eax
push 4
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x1002cdf4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3e4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002cddc
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002ce12
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa74], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002cdfd
xor eax, eax
mov dword [ebp - 0x40], 0xffffffeb
jmp 0x1002cf4f
mov dword [ebp - 0x20], 0x32937a3a
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1002cf49
mov dword [ebp - 0x48], 9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ce60
push 0xd19
push 0x1a40
push 0x20cd
push 0x25de
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x3d8]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002ce7d
cmp dword [ebp - 0x40], eax
jne 0x1002ce7d
mov esi, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x3e4]
mov eax, dword [ebp - 0x20]
cmp esi, eax
sete cl
xor eax, eax
cmp edx, ecx
setg al
cmp eax, 0xc257a10d
sbb eax, eax
neg eax
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x3dc]
sub eax, 0xfffffffa
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
or edx, 0xffffffff
cmp eax, edx
mov eax, dword [ebp - 0x20]
setle cl
mov eax, dword [ebp + eax*4 - 0x3e4]
imul eax, ecx
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002ceee
mov dword [ebp - 0x28], 0x925f
dec dword [ebp - 0x28]
cmp dword [ebp - 0x630], eax
jne 0x1002cf44
jmp 0x1002cf31
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x3e4]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3e4], ecx
mov dword [ebp - 0x24], 0xffffffe3
jmp 0x1002cf2b
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x3e4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x3e4]
mov dword [ebp - 0xa74], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff1
jl 0x1002cf0b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
push 0
pop eax
push 1
pop esi
jle 0x1002ce35
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x40]
push 1
pop esi
cmp dword [ebp - 0x40], 8
jne 0x1002ce1e
mov ecx, dword [ebp - 0x3d8]
xor edx, edx
mov eax, dword [ebp - 0x630]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xed83
setne al
mov dword [ebp - 0x24], eax
xor eax, eax
or ecx, 0xffffffff
jmp 0x1002cf8b
mov dword [ebp - 0x3c], 0x42f34c93
mov dword [ebp - 0x3c], ecx
xor esi, esi
mov dword [ebp - 0x34], 0x6b8f3d42
inc esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x6f65e790
mov dword [ebp - 0x24], eax
jmp 0x1002cfb1
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa84], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002cfa4
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 9
jle 0x1002cfde
mov dword [ebp - 0x3c], 0xd947597a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
jmp 0x1002d01b
xor eax, eax
mov dword [ebp - 0x3c], 0xd2038e85
mov dword [ebp - 0x24], eax
jmp 0x1002cffd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe5c], 0x53589fe5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002cfec
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
sbb edx, edx
inc edx
cmp eax, edx
setle cl
mov dword [ebp - 0xe5c], ecx
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], esi
jg 0x1002d03c
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0xa84], 0
jne 0x1002d03a
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jle 0x1002d025
xor eax, eax
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x40], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x678], ecx
mov dword [ebp - 0x674], ecx
mov dword [ebp - 0x670], ecx
mov dword [ebp - 0x66c], ecx
mov dword [ebp - 0x48], 0x9ced66e5
mov dword [ebp - 0x24], 0x3cfcb8f1
cmp dword [ebp - 0x40], eax
je 0x1002d235
mov dword [ebp - 0x28], 0x3f1571c0
mov dword [ebp - 0x3c], eax
push 4
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x1002d0a1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3fc], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002d089
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002d0bf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa94], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002d0aa
xor eax, eax
mov dword [ebp - 0x40], 0xffffffeb
cmp dword [ebp - 0x40], 8
je 0x1002d210
xor edi, edi
mov dword [ebp - 0x20], 0x32937a3a
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1002d1fd
mov dword [ebp - 0x48], 9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d114
push 0xd19
push 0x1a40
push 0x20cd
push 0x25de
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x3f0]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002d131
mov esi, eax
cmp dword [ebp - 0x40], eax
je 0x1002d134
lea esi, [edi + 1]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x3fc]
mov eax, dword [ebp - 0x20]
cmp esi, eax
sete cl
xor eax, eax
cmp edx, ecx
setg al
cmp eax, 0xc257a10d
sbb eax, eax
neg eax
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x3f4]
sub eax, 0xfffffffa
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
or edx, 0xffffffff
cmp eax, edx
mov eax, dword [ebp - 0x20]
setle cl
mov eax, dword [ebp + eax*4 - 0x3fc]
imul eax, ecx
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002d1a5
mov dword [ebp - 0x28], 0x925f
dec dword [ebp - 0x28]
cmp dword [ebp - 0x670], eax
jne 0x1002d1f8
jmp 0x1002d1e8
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x3fc]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3fc], ecx
mov dword [ebp - 0x24], 0xffffffe3
jmp 0x1002d1e2
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x3fc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x3fc]
mov dword [ebp - 0xa94], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff1
jl 0x1002d1c2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
push 0
pop eax
jle 0x1002d0e9
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 8
jne 0x1002d0d2
mov edi, dword [sym.imp.GDI32.dll_Polyline]
mov ecx, dword [ebp - 0x670]
xor edx, edx
mov eax, dword [ebp - 0x3f0]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 0xed83
setne al
mov dword [ebp - 0x24], eax
xor eax, eax
jmp 0x1002d23f
mov dword [ebp - 0x3c], 0x42f34c93
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x20], 0x99841b3c
push 7
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], 0xfffb
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002d275
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xaa4], 0xf9ed02e8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002d25c
xor eax, eax
mov esi, dword [sym.imp.GDI32.dll_PtInRegion]
mov dword [ebp - 0x20], eax
jmp 0x1002d29b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d298
push 0x18f2
push 0x1681
push eax
call esi
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
je 0x1002d280
mov dword [ebp - 0x20], 0x12
mov ecx, 0xc1464f16
cmp dword [ebp - 0x20], 0xffffffe3
jl 0x1002d349
xor edi, edi
jmp 0x1002d2bd
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x50], 4
cmp dword [ebp - 0x20], eax
jne 0x1002d30f
mov eax, dword [ebp - 0x24]
sub eax, 0x3cc47d1a
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
jne 0x1002d2e5
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002d2e8
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], 0xfffd
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
push 6
setne dl
pop eax
sub edx, eax
jne 0x1002d30f
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x1002d312
lea ecx, [edi + 1]
mov eax, dword [ebp - 0x24]
imul eax, ecx
xor ecx, ecx
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x49bc
setne cl
mov dword [ebp - 0x50], ecx
mov ecx, 0xc1464f16
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jge 0x1002d2bb
mov edi, dword [sym.imp.GDI32.dll_Polyline]
xor ecx, ecx
mov dword [ebp - 0x34], 0x6b8f3d42
inc ecx
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x6f65e790
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002d37e
or edx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xab4], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002d36b
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 9
jle 0x1002d3a5
mov dword [ebp - 0x3c], 0xd947597a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
jmp 0x1002d3e5
xor eax, eax
mov dword [ebp - 0x3c], 0xd2038e85
mov dword [ebp - 0x24], eax
jmp 0x1002d3c4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xedc], 0x53589fe5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002d3b3
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
sbb edx, edx
inc edx
cmp eax, edx
setle cl
mov dword [ebp - 0xedc], ecx
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ecx
jg 0x1002d406
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0xab4], 0
jne 0x1002d404
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ecx
jle 0x1002d3ef
xor eax, eax
mov dword [ebp - 0x34], 0x6b8f3d42
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x6f65e790
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002d436
or edx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xac8], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002d423
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 9
jle 0x1002d45d
mov dword [ebp - 0x3c], 0xd947597a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
jmp 0x1002d49d
xor eax, eax
mov dword [ebp - 0x3c], 0xd2038e85
mov dword [ebp - 0x24], eax
jmp 0x1002d47c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xdcc], 0x53589fe5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002d46b
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
sbb edx, edx
inc edx
cmp eax, edx
setle cl
mov dword [ebp - 0xdcc], ecx
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ecx
jg 0x1002d4be
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0xac8], 0
jne 0x1002d4bc
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ecx
jle 0x1002d4a7
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002d4e7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf40], 0x10c93b4e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002d4ce
xor eax, eax
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], eax
jl 0x1002d522
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d51a
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x34]
jns 0x1002d4f3
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x20], 0x66a756a3
mov dword [ebp - 0x2c], 0xfcdf
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x505d01cd
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002d566
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30c], 0xddbf4df7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002d54d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002d586
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c4], 0x7f35
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002d56e
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d5a7
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
xor ecx, ecx
xor eax, eax
inc ecx
cmp dword [ebp - 0x20], eax
je 0x1002d5e6
mov eax, dword [ebp - 0x20]
xor edx, edx
imul eax, ecx
imul ecx, eax, 3
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
xor eax, eax
or ecx, 0xffffffff
cmp edx, ecx
setg al
add eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x20]
xor eax, eax
lea edx, [eax + 1]
jmp 0x1002d5e8
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
setle al
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002d740
mov dword [ebp - 0x40], 0xd1456014
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002d630
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x394], 0x2ff5ff74
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002d617
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002d652
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xddc], 0x493a50eb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002d639
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
jmp 0x1002d66b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x58c], 0xd9132e88
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002d65a
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30c]
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x308]
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x390]
mov eax, dword [ebp - 0x30c]
mov eax, dword [ebp - 0x394]
mov eax, dword [ebp - 0x390]
mov eax, dword [ebp - 0x390]
sub eax, 0xfffa
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xef9f
mov dword [ebp - 0x30c], eax
mov dword [ebp - 0xdd4], eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
xor eax, eax
mov dword [ebp - 0x58c], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1002d738
mov dword [ebp - 0x20], 0x16
jmp 0x1002d70f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d70c
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x2a
jg 0x1002d6fa
mov dword [ebp - 0x40], eax
jmp 0x1002d72f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d72c
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x12
jne 0x1002d71a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xc
jne 0x1002d6f1
jmp 0x1002d767
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002d769
push 0x326
push 0x1708
push 0x1ac2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x618], ecx
mov dword [ebp - 0x614], ecx
mov dword [ebp - 0x610], ecx
mov dword [ebp - 0x60c], ecx
mov dword [ebp - 0x48], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d79c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d7cc
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x1ae
push 0x2281
push 0x19eb
push 0x1089
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
xor eax, eax
mov dword [ebp - 0x48], 0x9ced66e5
mov dword [ebp - 0x14], 0x7e2799ac
mov dword [ebp - 0x28], 0x56574b60
mov dword [ebp - 0x3c], 0xd1b7e280
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe6
je 0x1002d8cc
mov ebx, 0x427
xor edi, edi
mov dword [ebp - 0x480], ebx
mov dword [ebp - 0x47c], ebx
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x28], 0xfffffffa
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d841
push eax
push 0x4be
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002d8b3
mov eax, dword [ebp - 0x47c]
xor ecx, ecx
imul eax, dword [ebp - 0x14]
cmp eax, 9
mov eax, dword [ebp - 0x47c]
setg cl
imul eax, ecx
test eax, eax
jne 0x1002d868
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x47c]
lea ecx, [edi + 1]
mov eax, dword [ebp - 0x47c]
xor edx, edx
mov dword [ebp - 0x28], 0xfffffffa
mov eax, dword [ebp - 0x28]
add eax, 9
imul eax, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x47c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x14]
jl 0x1002d8b1
lea eax, [edi + 1]
jmp 0x1002d8b3
xor eax, eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe6
push 0
pop eax
jne 0x1002d7fc
mov edi, dword [sym.imp.GDI32.dll_Polyline]
mov dword [ebp - 0x24], 0x3cfcb8f1
mov dword [ebp - 0x34], 0xec79e672
mov dword [ebp - 0x28], 0xfcfbce00
mov dword [ebp - 0x54], 0x44cf5927
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x18], 0xa165018
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 0x189d9e62
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002d924
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2c8], 0xe64f6cbc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002d90b
xor eax, eax
push 3
xor ecx, ecx
mov dword [ebp - 0x1c], eax
pop edx
inc ecx
cmp dword [ebp - 0x1c], edx
jge 0x1002d946
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x374], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002d932
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002d958
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1b0], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002d94b
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x36c]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
push 0xfffffffffffffff7
setl dl
xor ecx, ecx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x28]
cmp eax, 0x59e4
mov eax, dword [ebp - 0x2c4]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ebx, ebx
sub edx, eax
dec edx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x370]
mov eax, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x1b0]
mov edx, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setge bl
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x36c]
imul ebx, edx
cmp ebx, eax
pop eax
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x370]
mov eax, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x36c]
mov eax, dword [ebp - 0x36c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002da39
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
mov dword [ebp - 0x20], eax
push 4
mov dword [ebp - 0x24], eax
pop ebx
cmp dword [ebp - 0x24], ebx
jge 0x1002da5f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x414], 0x841b3c69
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002da47
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1002dac9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x414]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x414]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x414]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x414]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x414]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x414]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x414]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x414], ecx
mov eax, dword [ebp - 0x408]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x1002da68
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002f4ef
or ecx, 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x48], ecx
inc ebx
mov dword [ebp - 0x48], 0x9dada439
xor ecx, ecx
mov dword [ebp - 0x3c], 0x7dc4b4e1
mov dword [ebp - 0x48], 0x90a624cd
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x48], 0x3921ded6
mov dword [ebp - 0x48], 0x55950707
mov dword [ebp - 0x48], 0xbda7fe64
mov dword [ebp - 0x48], eax
mov eax, 0x3414b58e
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x28], 0x3d0bb94d
dec dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setg cl
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x2c], 0x77862fd4
mov dword [ebp - 0x2c], 0xfffffff0
cmp dword [ebp - 0x2c], 0xb
jl 0x1002dc99
xor eax, eax
mov edi, 0xffff
mov dword [ebp - 0x28], edi
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002db97
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7ac], 0xade2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002db7f
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002dbb7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1e8], 0x8974b66
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002db9f
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002dbda
push 0x8ae
push eax
push 0x462
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jg 0x1002dc86
mov dword [ebp - 0x34], 0x6febfb2c
mov dword [ebp - 0x24], eax
jmp 0x1002dc0a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4f4], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002dbf9
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x1e8]
push 0
mov ecx, dword [ebp + eax*4 - 0x7ac]
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x7ac], ecx
xor eax, eax
cmp ecx, 0x100cd
setne al
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4f4], eax
inc dword [ebp - 0x1e8]
cmp dword [ebp - 0x1e8], 2
pop eax
jle 0x1002dbed
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xb
jge 0x1002db71
mov edi, dword [sym.imp.GDI32.dll_Polyline]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002dcb5
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SetMenu]
xor eax, eax
mov dword [ebp - 0x28], 0x3f1571c0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], 0x799333c7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002dce4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc0c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002dccf
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002dd04
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c8], 0x145714ff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002dcec
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002ddbe
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x1002dd8e
mov dword [ebp - 0x40], 0x801fc3ee
mov dword [ebp - 0x40], eax
jmp 0x1002dd79
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1002dd46
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1f8], 0xc4888999
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jl 0x1002dd2d
xor eax, eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 4
jge 0x1002dd76
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0xc0c], ecx
inc dword [ebp - 0x1f8]
cmp dword [ebp - 0x1f8], 4
jl 0x1002dd58
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 3
jle 0x1002dd24
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
push 0
pop eax
jle 0x1002dd18
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ddbb
push 0xb09
push eax
push eax
push 0x9d1
push 0x22a3
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe5
jge 0x1002dd0c
push 3
pop ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x1002de20
or edi, 0xffffffff
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xc0c], 0
jne 0x1002de18
mov dword [ebp - 0x24], ecx
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x1002de13
mov dword [ebp - 0x3c], 0x7d373ee7
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
neg eax
mov dword [ebp - 0x5c8], eax
dec dword [ebp - 0x24]
jns 0x1002ddf0
dec dword [ebp - 0x14]
jns 0x1002ddd6
mov edi, dword [sym.imp.GDI32.dll_Polyline]
xor eax, eax
mov dword [ebp - 0x3c], eax
or edx, 0xffffffff
mov dword [ebp - 0x24], 0x62fd
mov dword [ebp - 0x18], 0x3ff14eb4
mov dword [ebp - 0x50], 0x714ad38d
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0xb06d9e96
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002de75
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x148], 0xe0184dcc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002de5d
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002de8b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc88], 0xc151d1a9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002de7a
dec dword [ebp - 0x24]
xor edx, edx
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setl dl
xor ebx, ebx
sub edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x148]
cmp edx, 0x7972
setne bl
xor ecx, ecx
cmp ebx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x148]
sub eax, dword [ebp - 0x50]
dec eax
neg eax
sbb eax, eax
or ecx, 0xffffffff
neg eax
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xd2c2
setge cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc eax
add ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
xor ebx, ebx
mov dword [ebp - 0xc80], edx
mov eax, dword [ebp - 0x1c]
sub edx, eax
mov dword [ebp - 0x18], edx
inc ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x40], 0xd00585b
xor eax, eax
mov dword [ebp - 0x28], eax
push 9
mov dword [ebp - 0x50], 0xfaa23240
pop edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x50], 0x9b03be46
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002dfb4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4c8], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002df9c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002dfd0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5d4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002dfbc
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002dff2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xadc], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002dfd9
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002e004
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcd0], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002dff7
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002e02a
push 5
pop edi
mov dword [ebp - 0x48], edi
xor edi, edi
mov dword [ebp - 0x30], 0x14b733c6
inc edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002f51f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb04], 0x1cecb457
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002f507
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f53b
push 0x810
push 0x9d4
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor eax, eax
dec dword [ebp - 0x30]
mov dword [ebp - 0x3c], 0x42f34c93
mov dword [ebp - 0x20], 0x99841b3c
push 7
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], 0xfffb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002f57b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb18], 0xf9ed02e8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002f562
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002f59b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f598
push 0x18f2
push 0x1681
push eax
call esi
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
je 0x1002f580
mov dword [ebp - 0x20], 0x12
cmp dword [ebp - 0x20], 0xffffffe3
jl 0x1002f632
jmp 0x1002f5b6
xor eax, eax
mov dword [ebp - 0x18], 0xc1464f16
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x20], eax
jne 0x1002f608
mov eax, dword [ebp - 0x18]
sub eax, 0x3cc47d1a
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
jne 0x1002f5de
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f5e1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], 0xfffd
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
push 6
setne dl
pop eax
sub edx, eax
jne 0x1002f608
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002f60a
mov ecx, edi
mov eax, dword [ebp - 0x18]
imul eax, ecx
xor ecx, ecx
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0x49bc
setne cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jge 0x1002f5b4
or eax, 0xffffffff
mov dword [ebp - 0x3c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
mov dword [ebp - 0x34], 0xb0f73838
mov ecx, 0xfff9
mov dword [ebp - 0x2c], 0x64a53aa9
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x54], 0x1f199e1f
mov dword [ebp - 0x50], 0x92e7baa9
mov dword [ebp - 0x58], 8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002f7b1
mov dword [ebp - 0x40], 0x93e0
xor esi, esi
mov dword [ebp - 0x3c], 2
inc esi
mov dword [ebp - 0x3c], 0x807c1abd
mov dword [ebp - 0x30], 0xc769
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x28], 0x1846e972
mov dword [ebp - 0x3c], 0x6c2db602
mov dword [ebp - 0x18], eax
jmp 0x1002f6c2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc4c], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002f6b1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002f778
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x40]
test eax, eax
je 0x1002f6f8
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002f6fa
mov eax, esi
jmp 0x1002f6fa
xor eax, eax
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, esi
setle cl
mov dword [ebp - 0xc40], ecx
mov eax, dword [ebp - 0x40]
sub ecx, eax
mov dword [ebp - 0x3c], ecx
je 0x1002f722
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002f724
mov edx, esi
jmp 0x1002f726
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x54]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp ecx, 0x1defcecb
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x30]
jne 0x1002f759
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc40]
xor edx, edx
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setl dl
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x54]
inc eax
jne 0x1002f776
mov eax, esi
jmp 0x1002f778
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x30]
jge 0x1002f787
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002f78e
jmp 0x1002f789
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002f790
mov eax, esi
mov dword [ebp - 0x58], eax
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x1002f79d
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x28], 0x23541209
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
xor eax, eax
jmp 0x1002f86c
push 9
pop eax
mov dword [ebp - 0x868], eax
mov dword [ebp - 0x864], eax
mov dword [ebp - 0x860], eax
mov dword [ebp - 0x85c], eax
mov dword [ebp - 0x28], 0x8161dbfa
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002f7f8
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x18]
je 0x1002f7f8
xor eax, eax
mov edx, eax
jmp 0x1002f7fa
mov edx, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edi
push 0xfffffffffffffff7
setle cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov dword [ebp - 0x85c], eax
mov eax, dword [ebp - 0x30]
sub edx, eax
mov eax, dword [ebp - 0x3c]
cmp edx, eax
pop eax
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
sbb esi, esi
xor ecx, ecx
inc esi
test eax, eax
mov eax, dword [ebp - 0x30]
setg cl
xor edx, edx
cmp ecx, esi
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xbca0f963
sbb eax, eax
inc eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x18], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f869
push 0x28e
push eax
push eax
push eax
call ebx
xor eax, eax
xor esi, esi
inc esi
mov dword [ebp - 0x20], 0x99841b3c
push 7
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], 0xfffb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002f8a2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb70], 0xf9ed02e8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002f889
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002f8c6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f8c3
push 0x18f2
push 0x1681
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
je 0x1002f8a7
mov dword [ebp - 0x20], 0x12
cmp dword [ebp - 0x20], 0xffffffe3
jl 0x1002f965
jmp 0x1002f8e1
xor eax, eax
mov dword [ebp - 0x18], 0xc1464f16
mov dword [ebp - 0x28], 4
cmp dword [ebp - 0x20], eax
jne 0x1002f937
mov eax, dword [ebp - 0x18]
sub eax, 0x3cc47d1a
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
jne 0x1002f90d
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f910
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], 0xfffd
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
push 6
setne dl
pop eax
sub edx, eax
jne 0x1002f937
mov ecx, esi
mov eax, dword [ebp - 0x18]
imul eax, ecx
xor ecx, ecx
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0xb70], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0x49bc
setne cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jge 0x1002f8df
mov edi, dword [sym.imp.USER32.dll_BeginPaint]
xor eax, eax
mov dword [ebp - 0x48], 0x70ad6f2e
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f988
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f9ac
push eax
push eax
push 0x6c5
push 0xcf3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
xor eax, eax
mov dword [ebp - 0x20], 0x99841b3c
push 7
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], 0xfffb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002f9e2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb80], 0xf9ed02e8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002f9c9
mov dword [ebp - 0x20], eax
jmp 0x1002fa06