Function at 0x100094b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e030
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1414
call fcn.1007a130
push esi
push edi
push 2
lea ecx, [ebp - 0xd00]
call fcn.10018602
and dword [ebp - 4], 0
mov dword [ebp - 0x1cc], 0x9bdba76a
mov dword [ebp - 0x1bc], 0xffffffff
push 3
lea ecx, [ebp - 0x1118]
call fcn.10018602
mov byte [ebp - 4], 1
mov dword [ebp - 0x10b0], 0x58f28d92
mov dword [ebp - 0x10ac], 0x58f28d92
mov dword [ebp - 0x10a8], 0x58f28d92
mov dword [ebp - 0x10a4], 0x58f28d92
lea ecx, [ebp - 0x35d]
call fcn.10009273
push eax
lea eax, [ebp - 0x10a0]
push eax
lea eax, [ebp - 0x10b0]
push eax
lea ecx, [ebp - 0x13a4]
call fcn.100186af
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11b4]
call fcn.1001865e
mov byte [ebp - 4], 2
mov dword [ebp - 0xcc], 0
jmp 0x10009588
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x100095aa
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xd00]
call fcn.100186a0
mov dword [eax], 0xfffffffb
jmp 0x1000957b
mov dword [ebp - 0xcc], 0
jmp 0x100095c3
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x100095e2
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x1118]
call fcn.100186a0
or dword [eax], 0xffffffff
jmp 0x100095b6
mov dword [ebp - 0x1cc], 0
jmp 0x100095fb
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 1
jg 0x10009ace
push 2
lea ecx, [ebp - 0x1100]
call fcn.10018602
mov byte [ebp - 4], 3
mov dword [ebp - 0xd8], 0
jmp 0x10009632
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x1000964e
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x84], 0x7a888ada
jmp 0x10009625
mov dword [ebp - 0xd8], 0
jmp 0x10009667
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x10009689
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1100]
call fcn.100186a0
mov dword [eax], 0x25bb5a27
jmp 0x1000965a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x84], 1
jmp 0x100096b7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x84], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x84], 0
jl 0x10009aba
push 4
lea ecx, [ebp - 0xc10]
call fcn.10018602
mov byte [ebp - 4], 4
mov dword [ebp - 0x1308], 0xf8278b7
mov dword [ebp - 0x12bc], 0x29efec1a
mov dword [ebp - 0x1f8], 0
jmp 0x10009709
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 4
jge 0x1000972b
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xc10]
call fcn.100186a0
mov dword [eax], 5
jmp 0x100096fc
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x84]
lea ecx, [ebp - 0xd00]
call fcn.100186a0
cmp dword [eax], 0
je 0x10009771
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x84]
lea ecx, [ebp - 0xd00]
call fcn.100186a0
cmp dword [eax], 0
je 0x10009771
mov dword [ebp - 0xd1c], 1
jmp 0x10009778
and dword [ebp - 0xd1c], 0
push 0
lea ecx, [ebp - 0xc10]
call fcn.100186a0
cmp dword [eax], 0
jne 0x1000979f
cmp dword [ebp - 0x1bc], 0
jne 0x1000979f
mov dword [ebp - 0x808], 1
jmp 0x100097a6
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x808]
jge 0x100097c0
mov dword [ebp - 0xd20], 1
jmp 0x100097c7
and dword [ebp - 0xd20], 0
push 0
lea ecx, [ebp - 0xd00]
call fcn.100186a0
push 0
lea ecx, [ebp - 0xc10]
call fcn.100186a0
cmp dword [eax], 0x5a83d87e
jg 0x100097f5
mov dword [ebp - 0xbdc], 1
jmp 0x100097fc
and dword [ebp - 0xbdc], 0
cmp dword [ebp - 0xbdc], 1
jne 0x10009811
mov dword [ebp - 0xbe4], 1
jmp 0x10009818
and dword [ebp - 0xbe4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
cmp dword [ebp - 0xbe4], eax
je 0x10009839
mov dword [ebp - 0xbec], 1
jmp 0x10009840
and dword [ebp - 0xbec], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x84]
lea ecx, [ebp - 0xd00]
call fcn.100186a0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x84]
add ecx, dword [ebp - 0xbec]
cmp dword [eax], ecx
jg 0x1000987b
mov dword [ebp - 0xad8], 1
jmp 0x10009882
and dword [ebp - 0xad8], 0
cmp dword [ebp - 0xad8], 0x446c
jle 0x10009940
and dword [ebp - 0x1038], 0
and dword [ebp - 0x1034], 0
and dword [ebp - 0x1030], 0
and dword [ebp - 0x102c], 0
lea ecx, [ebp - 0x3b9]
call fcn.10009273
push eax
lea eax, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x1038]
push eax
lea ecx, [ebp - 0x1364]
call fcn.100186af
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10e8]
call fcn.1001865e
mov byte [ebp - 4], 5
push 0
lea ecx, [ebp - 0xc10]
call fcn.100186a0
cmp dword [eax], 0
je 0x1000991c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10e8]
call fcn.10018684
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc10]
call fcn.10018684
jmp 0x10009aba
push 0
lea ecx, [ebp - 0x10e8]
call fcn.100186a0
or dword [eax], 0xffffffff
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10e8]
call fcn.10018684
jmp 0x10009aa6
mov dword [ebp - 0x86c], 0xffffffff
mov dword [ebp - 0x380], 0x82966b91
mov dword [ebp - 0x1bc], 0
jmp 0x1000996d
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 1
jg 0x100099c5
mov dword [ebp - 0x1fc], 1
mov dword [ebp - 0x1fc], 3
jmp 0x10009999
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jl 0x100099c3
mov byte [ebp - 0x14f], 0
movzx eax, byte [ebp - 0x14f]
test eax, eax
je 0x100099c1
push 0x1e34
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1000998c
jmp 0x10009960
push 0
lea ecx, [ebp - 0x11b4]
call fcn.100186a0
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x42c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc10]
call fcn.100186a0
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x1268], eax
mov dword [ebp - 0x380], 0xffff
mov eax, dword [ebp - 0x86c]
add eax, 0xfffd
cmp eax, dword [ebp - 0x380]
jl 0x10009a2b
mov dword [ebp - 0xd28], 1
jmp 0x10009a32
and dword [ebp - 0xd28], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
mov dword [ebp - 0x1150], eax
push 1
lea ecx, [ebp - 0x1100]
call fcn.100186a0
cmp dword [eax], 8
jge 0x10009a63
mov dword [ebp - 0x434], 1
jmp 0x10009a6a
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x86c]
imul eax, dword [ebp - 0x434]
cmp eax, 0xff40b36f
jbe 0x10009a8a
mov dword [ebp - 0x874], 1
jmp 0x10009a91
and dword [ebp - 0x874], 0
push 0
lea ecx, [ebp - 0x1118]
call fcn.100186a0
mov ecx, dword [ebp - 0x874]
mov dword [eax], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc10]
call fcn.10018684
jmp 0x1000969c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1100]
call fcn.10018684
jmp 0x100095ee
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x11b4]
call fcn.10018684
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1118]
call fcn.10018684
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd00]
call fcn.10018684
push 2
lea ecx, [ebp - 0xd18]
call fcn.10018602
mov dword [ebp - 4], 6
mov dword [ebp - 0x1ac], 0x9bdba76a
mov dword [ebp - 0x1c4], 0xffffffff
push 3
lea ecx, [ebp - 0x10f4]
call fcn.10018602
mov byte [ebp - 4], 7
mov dword [ebp - 0x94], 0xfffffff9
mov dword [ebp - 0x15c], 0xffff
push 4
lea ecx, [ebp - 0xe90]
call fcn.10018602
mov byte [ebp - 4], 8
mov dword [ebp - 0xe50], 0xfffffffc
mov dword [ebp - 0x30], 0
jmp 0x10009b73
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10009b89
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x350], 0xd8ef068c
jmp 0x10009b6c
mov dword [ebp - 0x30], 0
jmp 0x10009b99
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x10009bb5
push dword [ebp - 0x30]
lea ecx, [ebp - 0xe90]
call fcn.100186a0
mov dword [eax], 0xee676845
jmp 0x10009b92
mov dword [ebp - 0x30], 0
jmp 0x10009bc5
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10009bdb
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1314], 0xffffffff
jmp 0x10009bbe
cmp dword [ebp - 0x94], 0
jne 0x10009cd3
cmp dword [ebp - 0x94], 0
je 0x10009bf8
cmp dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x94]
dec eax
cmp eax, dword [ebp - 0x94]
jne 0x10009c13
mov dword [ebp - 0xe10], 1
jmp 0x10009c1a
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1280], eax
cmp dword [ebp - 0x94], 0
jbe 0x10009c3b
mov dword [ebp - 0x43c], 1
jmp 0x10009c42
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x43c]
jg 0x10009c6c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x350], 0
je 0x10009c6c
mov dword [ebp - 0x87c], 1
jmp 0x10009c73
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x87c], eax
jge 0x10009c8d
mov dword [ebp - 0xe68], 1
jmp 0x10009c94
and dword [ebp - 0xe68], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x350]
mov dword [ebp - 0x1158], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x350]
mov dword [ebp - 0x1288], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x350], 0
jne 0x10009cd3
and dword [ebp - 0x444], 0
jmp 0x10009cdd
mov dword [ebp - 0x444], 1
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x444]
jne 0x10009cf7
mov dword [ebp - 0x884], 1
jmp 0x10009cfe
and dword [ebp - 0x884], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x350]
add esi, dword [ebp - 0x884]
push 2
lea ecx, [ebp - 0xe90]
call fcn.100186a0
mov dword [eax], esi
mov dword [ebp - 0x15c], 0xffffffe4
jmp 0x10009d39
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x3c
je 0x10009f50
mov dword [ebp - 0x1dc], 6
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x8ac], 0xffffffff
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1160], eax
cmp dword [ebp - 0x1dc], 0
jne 0x10009dc4
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x1314], 0x2aec
test eax, eax
je 0x10009da0
cmp dword [ebp - 0x1dc], 0
je 0x10009da0
mov dword [ebp - 0x44c], 1
jmp 0x10009da7
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x44c], eax
jl 0x10009dbb
cmp dword [ebp - 0x1dc], 0
jne 0x10009dc4
and dword [ebp - 0xe18], 0
jmp 0x10009dce
mov dword [ebp - 0xe18], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x350]
cmp dword [ebp - 0x78], eax
jge 0x10009dec
mov dword [ebp - 0x88c], 1
jmp 0x10009df3
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
je 0x10009e1d
cmp dword [ebp - 0x94], 0
je 0x10009e1d
mov dword [ebp - 0x404], 1
jmp 0x10009e24
and dword [ebp - 0x404], 0
push 0
lea ecx, [ebp - 0xe90]
call fcn.100186a0
mov ecx, dword [ebp - 0x404]
mov dword [eax], ecx
cmp dword [ebp - 0x404], 0x99e60473
jb 0x10009e51
mov dword [ebp - 0x454], 1
jmp 0x10009e58
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x454], eax
jne 0x10009e6f
mov dword [ebp - 0x894], 1
jmp 0x10009e76
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x894]
sub eax, dword [ebp - 0x78]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x350]
jl 0x10009e9a
mov dword [ebp - 0x45c], 1
jmp 0x10009ea1
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x45c], eax
jge 0x10009eb8
mov dword [ebp - 0x89c], 1
jmp 0x10009ebf
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x89c], eax
jg 0x10009ed6
mov dword [ebp - 0x464], 1
jmp 0x10009edd
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x464], eax
jl 0x10009ef4
mov dword [ebp - 0x8a4], 1
jmp 0x10009efb
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x8a4]
cmp eax, dword [ebp - 0x78]
je 0x10009f15
mov dword [ebp - 0x46c], 1
jmp 0x10009f1c
and dword [ebp - 0x46c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x350]
neg eax
add eax, dword [ebp - 0x46c]
neg eax
imul eax, dword [ebp - 0x78]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x8ac]
neg eax
mov dword [ebp - 0xe50], eax
jmp 0x10009d2c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xe90]
call fcn.10018684
mov dword [ebp - 0xfe8], 0x58f28d92
mov dword [ebp - 0xfe4], 0x58f28d92
mov dword [ebp - 0xfe0], 0x58f28d92
mov dword [ebp - 0xfdc], 0x58f28d92
lea ecx, [ebp - 0x365]
call fcn.10009273
push eax
lea eax, [ebp - 0xfd8]
push eax
lea eax, [ebp - 0xfe8]
push eax
lea ecx, [ebp - 0x13b4]
call fcn.100186af
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11c4]
call fcn.1001865e
mov byte [ebp - 4], 9
push 2
lea ecx, [ebp - 0xd94]
call fcn.10018602
mov byte [ebp - 4], 0xa
push 2
lea ecx, [ebp - 0xf5c]
call fcn.10018602
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xe78], 0xffffffff
mov dword [ebp - 0x28], 0
jmp 0x10009ffc
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000a015
push dword [ebp - 0x28]
lea ecx, [ebp - 0xd94]
call fcn.100186a0
and dword [eax], 0
jmp 0x10009ff5
mov dword [ebp - 0x28], 0
jmp 0x1000a025
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1000a03b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xfc], 3
jmp 0x1000a01e
mov dword [ebp - 0x28], 0
jmp 0x1000a04b
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000a067
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf5c]
call fcn.100186a0
mov dword [eax], 0xfffffff8
jmp 0x1000a044
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xfc], 1
jmp 0x1000a095
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xfc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xfc], 0
jl 0x1000a295
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x484], 3
mov dword [ebp - 0x44], 0
jmp 0x1000a0ca
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x1000a108
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xfc]
lea ecx, [ebp - 0xd94]
call fcn.100186a0
mov esi, eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xfc]
lea ecx, [ebp - 0xd94]
call fcn.100186a0
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000a0c3
mov dword [ebp - 0x44], 0
jmp 0x1000a118
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x1000a290
mov dword [ebp - 0x32c], 0xfffffffc
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0x32c], eax
jne 0x1000a173
mov eax, dword [ebp - 0x32c]
sub eax, 0xa
cmp eax, dword [ebp - 0x44]
jge 0x1000a154
mov dword [ebp - 0x474], 1
jmp 0x1000a15b
and dword [ebp - 0x474], 0
cmp dword [ebp - 0x474], 0xa41a80d1
jae 0x1000a173
mov dword [ebp - 0x8b4], 1
jmp 0x1000a17a
and dword [ebp - 0x8b4], 0
imul eax, dword [ebp - 0x8b4], 0
test eax, eax
jne 0x1000a194
cmp dword [ebp - 0x44], 0
jne 0x1000a194
and dword [ebp - 0x47c], 0
jmp 0x1000a19e
mov dword [ebp - 0x47c], 1
push 0
lea ecx, [ebp - 0xd94]
call fcn.100186a0
mov ecx, dword [ebp - 0x47c]
cmp ecx, dword [eax]
jg 0x1000a1c1
mov dword [ebp - 0x8bc], 1
jmp 0x1000a1c8
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0x484], eax
jl 0x1000a1ee
mov dword [ebp - 0x388], 1
jmp 0x1000a1f5
and dword [ebp - 0x388], 0
push 0
lea ecx, [ebp - 0xf5c]
call fcn.100186a0
mov ecx, dword [ebp - 0x388]
mov dword [eax], ecx
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x388]
cmp eax, 0x874b
jge 0x1000a226
mov dword [ebp - 0x8c4], 1
jmp 0x1000a22d
and dword [ebp - 0x8c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfc]
cmp dword [ebp - 0x8c4], eax
jne 0x1000a24e
mov dword [ebp - 0xe20], 1
jmp 0x1000a255
and dword [ebp - 0xe20], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1274], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xfc]
push 0
lea ecx, [ebp - 0xf5c]
call fcn.100186a0
add esi, dword [eax]
mov dword [ebp - 0xe78], esi
cmp dword [ebp - 0x44], 0
je 0x1000a28b
jmp 0x1000a111
jmp 0x1000a111
jmp 0x1000a07a
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xf5c]
call fcn.10018684
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xd94]
call fcn.10018684
mov dword [ebp - 0xb8], 0
jmp 0x1000a2cc
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x1000a2ee
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xd18]
call fcn.100186a0
mov dword [eax], 0xfffffffb
jmp 0x1000a2bf
mov dword [ebp - 0xb8], 0
jmp 0x1000a307
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1000a326
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x10f4]
call fcn.100186a0
or dword [eax], 0xffffffff
jmp 0x1000a2fa
mov dword [ebp - 0x1ac], 0
jmp 0x1000a33f
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jg 0x1000a7f1
push 2
lea ecx, [ebp - 0x110c]
call fcn.10018602
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xd0], 0
jmp 0x1000a376
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x1000a38f
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x7c], 0x7a888ada
jmp 0x1000a369
mov dword [ebp - 0xd0], 0
jmp 0x1000a3a8
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x1000a3ca
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x110c]
call fcn.100186a0
mov dword [eax], 0x25bb5a27
jmp 0x1000a39b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x7c], 1
jmp 0x1000a3ef
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c], 0
jl 0x1000a7dd
push 4
lea ecx, [ebp - 0xc70]
call fcn.10018602
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x1168], 0xf8278b7
mov dword [ebp - 0x12e4], 0x29efec1a
mov dword [ebp - 0x204], 0
jmp 0x1000a43e
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 4
jge 0x1000a460
push dword [ebp - 0x204]
lea ecx, [ebp - 0xc70]
call fcn.100186a0
mov dword [eax], 5
jmp 0x1000a431
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x7c]
lea ecx, [ebp - 0xd18]
call fcn.100186a0
cmp dword [eax], 0
je 0x1000a4a0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x7c]
lea ecx, [ebp - 0xd18]
call fcn.100186a0
cmp dword [eax], 0
je 0x1000a4a0
mov dword [ebp - 0xe28], 1
jmp 0x1000a4a7
and dword [ebp - 0xe28], 0
push 0
lea ecx, [ebp - 0xc70]
call fcn.100186a0
cmp dword [eax], 0
jne 0x1000a4ce
cmp dword [ebp - 0x1c4], 0
jne 0x1000a4ce
mov dword [ebp - 0x48c], 1
jmp 0x1000a4d5
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x1ac]
cmp eax, dword [ebp - 0x48c]
jge 0x1000a4ef
mov dword [ebp - 0xd30], 1
jmp 0x1000a4f6
and dword [ebp - 0xd30], 0
push 0
lea ecx, [ebp - 0xd18]
call fcn.100186a0
push 0
lea ecx, [ebp - 0xc70]
call fcn.100186a0
cmp dword [eax], 0x5a83d87e
jg 0x1000a524
mov dword [ebp - 0x8cc], 1
jmp 0x1000a52b
and dword [ebp - 0x8cc], 0
cmp dword [ebp - 0x8cc], 1
jne 0x1000a540
mov dword [ebp - 0x494], 1
jmp 0x1000a547
and dword [ebp - 0x494], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
cmp dword [ebp - 0x494], eax
je 0x1000a565
mov dword [ebp - 0x8d4], 1
jmp 0x1000a56c
and dword [ebp - 0x8d4], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x7c]
lea ecx, [ebp - 0xd18]
call fcn.100186a0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x7c]
add ecx, dword [ebp - 0x8d4]
cmp dword [eax], ecx
jg 0x1000a5a1
mov dword [ebp - 0x49c], 1
jmp 0x1000a5a8
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 0x446c
jle 0x1000a666
and dword [ebp - 0x1060], 0
and dword [ebp - 0x105c], 0
and dword [ebp - 0x1058], 0
and dword [ebp - 0x1054], 0
lea ecx, [ebp - 0x36d]
call fcn.10009273
push eax
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x1060]
push eax
lea ecx, [ebp - 0x13c4]
call fcn.100186af
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1130]
call fcn.1001865e
mov byte [ebp - 4], 0xe
push 0
lea ecx, [ebp - 0xc70]
call fcn.100186a0
cmp dword [eax], 0
je 0x1000a642
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1130]
call fcn.10018684
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xc70]
call fcn.10018684
jmp 0x1000a7dd
push 0
lea ecx, [ebp - 0x1130]
call fcn.100186a0
or dword [eax], 0xffffffff
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1130]
call fcn.10018684
jmp 0x1000a7c9
mov dword [ebp - 0x4a4], 0xffffffff
mov dword [ebp - 0x3cc], 0x82966b91
mov dword [ebp - 0x1c4], 0
jmp 0x1000a693
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jg 0x1000a6eb
mov dword [ebp - 0x2a4], 1
mov dword [ebp - 0x2a4], 3
jmp 0x1000a6bf
mov eax, dword [ebp - 0x2a4]
dec eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jl 0x1000a6e9
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1000a6e7
push 0x1e34
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1000a6b2
jmp 0x1000a686
push 0
lea ecx, [ebp - 0x11c4]
call fcn.100186a0
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp - 0x8dc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x8dc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc70]
call fcn.100186a0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x1170], eax
mov dword [ebp - 0x3cc], 0xffff
mov eax, dword [ebp - 0x4a4]
add eax, 0xfffd
cmp eax, dword [ebp - 0x3cc]
jl 0x1000a751
mov dword [ebp - 0xd34], 1
jmp 0x1000a758
and dword [ebp - 0xd34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
mov dword [ebp - 0x127c], eax
push 1
lea ecx, [ebp - 0x110c]
call fcn.100186a0
cmp dword [eax], 8
jge 0x1000a786
mov dword [ebp - 0x8e4], 1
jmp 0x1000a78d
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x4a4]
imul eax, dword [ebp - 0x8e4]
cmp eax, 0xff40b36f
jbe 0x1000a7ad
mov dword [ebp - 0x4ac], 1
jmp 0x1000a7b4
and dword [ebp - 0x4ac], 0
push 0
lea ecx, [ebp - 0x10f4]
call fcn.100186a0
mov ecx, dword [ebp - 0x4ac]
mov dword [eax], ecx
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xc70]
call fcn.10018684
jmp 0x1000a3da
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x110c]
call fcn.10018684
jmp 0x1000a332
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x11c4]
call fcn.10018684
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x10f4]
call fcn.10018684
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd18]
call fcn.10018684
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x3ec], 0xf8393131
mov dword [ebp - 0x1178], 0xf3af71e1
mov dword [ebp - 0x20c], 0
jmp 0x1000a852
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jge 0x1000a86e
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0xf4], 8
jmp 0x1000a845
mov dword [ebp - 0x80], 0
jmp 0x1000a87e
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x1000ad21
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x164], 0xa1220985
mov dword [ebp - 0x2f4], 0x8530de9b
mov dword [ebp - 0x38], 0
jmp 0x1000a8b3
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1000a910
mov dword [ebp - 0x12c4], 1
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0xf4]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x164], 0
jmp 0x1000a8ec
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jl 0x1000a90e
mov dword [ebp - 0x8ec], 0xfffffff7
mov eax, dword [ebp - 0x8ec]
dec eax
mov dword [ebp - 0x8ec], eax
jmp 0x1000a8df
jmp 0x1000a8ac
mov dword [ebp - 0x2f4], 0
jmp 0x1000a929
mov eax, dword [ebp - 0x2f4]
dec eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0
jl 0x1000ad1c
mov dword [ebp - 0x1a4], 0x5764
mov dword [ebp - 0x38], 0
jmp 0x1000a950
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jg 0x1000ad17
mov dword [ebp - 0x390], 0
mov dword [ebp - 0x514], 8
mov dword [ebp - 0x214], 0
jmp 0x1000a987
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 1
jge 0x1000a9a3
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0x50c], 0xc76e8d2c
jmp 0x1000a97a
cmp dword [ebp - 0x38], 0xfffffffb
jae 0x1000a9b5
mov dword [ebp - 0x4b4], 1
jmp 0x1000a9bc
and dword [ebp - 0x4b4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf4], 0
jne 0x1000a9de
mov eax, 0xfffe
test eax, eax
jne 0x1000a9de
and dword [ebp - 0x8f4], 0
jmp 0x1000a9e8
mov dword [ebp - 0x8f4], 1
mov eax, dword [ebp - 0x4b4]
cmp eax, dword [ebp - 0x8f4]
jl 0x1000aa02
mov dword [ebp - 0x4bc], 1
jmp 0x1000aa09
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x4bc], eax
jle 0x1000aa23
mov dword [ebp - 0x8fc], 1
jmp 0x1000aa2a
and dword [ebp - 0x8fc], 0
cmp dword [ebp - 0x8fc], 0xffffffff
jg 0x1000aa3f
mov dword [ebp - 0x4c4], 1
jmp 0x1000aa46
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x4c4]
je 0x1000aa60
mov dword [ebp - 0x904], 1
jmp 0x1000aa67
and dword [ebp - 0x904], 0
imul eax, dword [ebp - 0x904], 0x3f36
mov ecx, dword [ebp - 0x38]
cmp eax, dword [ebp + ecx*4 - 0xf4]
jge 0x1000aa89
mov dword [ebp - 0x4cc], 1
jmp 0x1000aa90
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xf4]
cmp eax, dword [ebp - 0x4cc]
jg 0x1000aaae
mov dword [ebp - 0x90c], 1
jmp 0x1000aab5
and dword [ebp - 0x90c], 0
cmp dword [ebp - 0x90c], 0xfffffff7
je 0x1000aaca
mov dword [ebp - 0x4d4], 1
jmp 0x1000aad1
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x4d4], eax
jg 0x1000aaeb
mov dword [ebp - 0x914], 1
jmp 0x1000aaf2
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x914], 0x7b69
jg 0x1000ab0a
mov dword [ebp - 0x4dc], 1
jmp 0x1000ab11
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0
jne 0x1000ab38
cmp dword [ebp - 0x1a4], 0
jne 0x1000ab38
and dword [ebp - 0x91c], 0
jmp 0x1000ab42
mov dword [ebp - 0x91c], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xf4]
cmp dword [ebp - 0x91c], eax
jge 0x1000ab60
mov dword [ebp - 0x4e4], 1
jmp 0x1000ab67
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x390], 5
je 0x1000ab88
mov dword [ebp - 0x924], 1
jmp 0x1000ab8f
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x924], eax
jne 0x1000aba9
mov dword [ebp - 0x4ec], 1
jmp 0x1000abb0
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x4ec], eax
jge 0x1000abd3
cmp dword [ebp - 0x3ec], 0
je 0x1000abd3
mov dword [ebp - 0x92c], 1
jmp 0x1000abda
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0x92c]
jl 0x1000abf4
mov dword [ebp - 0x4f4], 1
jmp 0x1000abfb
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 1
je 0x1000ac10
mov dword [ebp - 0x934], 1
jmp 0x1000ac17
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x934]
sub eax, dword [ebp - 0x38]
cmp eax, 0x218a
jne 0x1000ac33
mov dword [ebp - 0x4fc], 1
jmp 0x1000ac3a
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x4fc], eax
jg 0x1000ac54
mov dword [ebp - 0x93c], 1
jmp 0x1000ac5b
and dword [ebp - 0x93c], 0
cmp dword [ebp - 0x93c], 2
je 0x1000ac70
mov dword [ebp - 0x504], 1
jmp 0x1000ac77
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x504]
je 0x1000ac8e
mov dword [ebp - 0x944], 1
jmp 0x1000ac95
and dword [ebp - 0x944], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50c]
cmp dword [ebp - 0x944], eax
jge 0x1000acb6
mov dword [ebp - 0x94c], 1
jmp 0x1000acbd
and dword [ebp - 0x94c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50c]
cmp dword [ebp - 0x94c], eax
je 0x1000acde
mov dword [ebp - 0x954], 1
jmp 0x1000ace5
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0x954]
je 0x1000acff
mov dword [ebp - 0x51c], 1
jmp 0x1000ad06
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x3ec], eax
jmp 0x1000a949
jmp 0x1000a91c
jmp 0x1000a877
mov dword [ebp - 0x80], 0
jmp 0x1000ad31
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xffffffe5
jne 0x1000af48
mov dword [ebp - 0xc0], 0x764457c1
mov dword [ebp - 0x398], 0xfccff5f9
mov dword [ebp - 0xd44], 0xf82eddaa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf4], 0x2446b8cc
jl 0x1000ad78
mov dword [ebp - 0x95c], 1
jmp 0x1000ad7f
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x95c], eax
jg 0x1000ad99
mov dword [ebp - 0x524], 1
jmp 0x1000ada0
and dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 0xb7b3
je 0x1000adb8
mov dword [ebp - 0x964], 1
jmp 0x1000adbf
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x964]
je 0x1000add9
mov dword [ebp - 0x52c], 1
jmp 0x1000ade0
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
add eax, 0x6f5d
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xf4]
jl 0x1000ae06
mov dword [ebp - 0x96c], 1
jmp 0x1000ae0d
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x96c]
jle 0x1000ae27
mov dword [ebp - 0x534], 1
jmp 0x1000ae2e
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x534], eax
jge 0x1000ae48
mov dword [ebp - 0x974], 1
jmp 0x1000ae4f
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x398]
add eax, dword [ebp - 0x974]
cmp eax, dword [ebp - 0x80]
jl 0x1000ae6c
mov dword [ebp - 0x53c], 1
jmp 0x1000ae73
and dword [ebp - 0x53c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
cmp dword [ebp - 0x53c], eax
jg 0x1000ae94
mov dword [ebp - 0x97c], 1
jmp 0x1000ae9b
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x97c], eax
jg 0x1000aeb5
mov dword [ebp - 0x544], 1
jmp 0x1000aebc
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x544], eax
jl 0x1000aed6
mov dword [ebp - 0x984], 1
jmp 0x1000aedd
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x984]
jne 0x1000aef7
mov dword [ebp - 0xd3c], 1
jmp 0x1000aefe
and dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x1180], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x1284], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x398], eax
jne 0x1000af30
mov dword [ebp - 0x54c], 1
jmp 0x1000af37
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0xd44], eax
jmp 0x1000ad2a
push 2
lea ecx, [ebp - 0x11d4]
call fcn.10018602
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x21c], 0xbecba2af
mov dword [ebp - 0x2ac], 0
jmp 0x1000af7f
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 2
jge 0x1000afa1
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0x11d4]
call fcn.100186a0
mov dword [eax], 0xdd33a4a9
jmp 0x1000af72
mov dword [ebp - 0x21c], 0
jmp 0x1000afba
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jg 0x1000b065
push 1
lea ecx, [ebp - 0xf74]
call fcn.10018602
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x31c], 0
jmp 0x1000aff1
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 1
jge 0x1000b013
push dword [ebp - 0x31c]
lea ecx, [ebp - 0xf74]
call fcn.100186a0
mov dword [eax], 0xfffffffa
jmp 0x1000afe4
mov byte [ebp - 0x146], 0
movzx eax, byte [ebp - 0x146]
test eax, eax
je 0x1000b02b
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0
lea ecx, [ebp - 0xf74]
call fcn.100186a0
cmp dword [eax], 0
je 0x1000b051
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf74]
call fcn.10018684
jmp 0x1000afad
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf74]
call fcn.10018684
jmp 0x1000afad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11d4]
call fcn.10018684
push 2
lea ecx, [ebp - 0xcf4]
call fcn.10018602
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x1b0], 0x9bdba76a
mov dword [ebp - 0x1b8], 0xffffffff
push 3
lea ecx, [ebp - 0x11f4]
call fcn.10018602
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x1188], 0
push 2
lea ecx, [ebp - 0x11e4]
call fcn.10018602
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xe0], 0
jmp 0x1000b0eb
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x1000b10d
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x11f4]
call fcn.100186a0
mov dword [eax], 0xfdf99ff6
jmp 0x1000b0de
mov dword [ebp - 0xe0], 0
jmp 0x1000b126
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x1000b148
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x11e4]
call fcn.100186a0
mov dword [eax], 0x87e08a11
jmp 0x1000b119
mov dword [ebp - 0x224], 0
jmp 0x1000b161
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 2
jg 0x1000b24b
mov dword [ebp - 0x104], 0x44696a48
mov dword [ebp - 0x1304], 0x73292c5e
mov dword [ebp - 0x1190], 0xb01d91e6
mov dword [ebp - 0x128c], 0xbfb3a4d
mov dword [ebp - 0x1198], 0xfffffffe
mov dword [ebp - 0x104], 0
jmp 0x1000b1b9
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jg 0x1000b20b
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x1000b209
push 0xfb2
push 0x12dc
push 0x1b18
push 0x111b
push 0x102a
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x1000b1ac
mov dword [ebp - 0x104], 2
jmp 0x1000b224
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jl 0x1000b246
mov dword [ebp - 0x98c], 0xc32b96ce
mov eax, dword [ebp - 0x98c]
inc eax
mov dword [ebp - 0x98c], eax
jmp 0x1000b217
jmp 0x1000b154
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x11e4]
call fcn.10018684
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x11f4]
call fcn.10018684
push 3
lea ecx, [ebp - 0x10d0]
call fcn.10018602
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x16c], 9
mov dword [ebp - 0xd54], 1
mov dword [ebp - 0x2b4], 0
jmp 0x1000b2a7
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 3
jge 0x1000b2c3
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0x1338], 0xffffffff
jmp 0x1000b29a
mov dword [ebp - 0x16c], 0
jmp 0x1000b2dc
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xffffffeb
jg 0x1000b3ca
mov dword [ebp - 0x22c], 0xadae8c9f
mov dword [ebp - 0x994], 0
mov byte [ebp - 0x148], 0
movzx eax, byte [ebp - 0x148]
test eax, eax
je 0x1000b319
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
cmp dword [ebp - 0x22c], 0
jne 0x1000b3a9
cmp dword [ebp - 0x16c], 0xaa0a
jle 0x1000b33e
mov dword [ebp - 0x554], 1
jmp 0x1000b345
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x22c]
add eax, dword [ebp - 0x554]
mov dword [ebp - 0x994], eax
cmp dword [ebp - 0x994], 1
je 0x1000b36c
mov dword [ebp - 0xd4c], 1
jmp 0x1000b373
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x12cc], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x11a0], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x1294], eax
cmp dword [ebp - 0xd54], 0
jne 0x1000b3a9
and dword [ebp - 0x55c], 0
jmp 0x1000b3b3
mov dword [ebp - 0x55c], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x55c]
mov dword [ebp + eax - 0x1338], ecx
jmp 0x1000b2cf
mov dword [ebp - 0xffc], 0x58f28d92
mov dword [ebp - 0xff8], 0x58f28d92
mov dword [ebp - 0xff4], 0x58f28d92
mov dword [ebp - 0xff0], 0x58f28d92
lea ecx, [ebp - 0x3e1]
call fcn.10009273
push eax
lea eax, [ebp - 0xfec]
push eax
lea eax, [ebp - 0xffc]
push eax
lea ecx, [ebp - 0x13d4]
call fcn.100186af
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1204]
call fcn.1001865e
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x68], 0
push 4
lea ecx, [ebp - 0xd0c]
call fcn.10018602
mov byte [ebp - 4], 0x16
push 1
lea ecx, [ebp - 0x420]
call fcn.10018602
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x114], 0xfffffffc
mov dword [ebp - 0x3a0], 0xfffffffc
mov dword [ebp - 0x9c], 0x90ae7359
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x9d4], 1
mov dword [ebp - 0x11a8], 1
mov dword [ebp - 0xc8], 0
jmp 0x1000b4a9
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x1000b4cb
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xd0c]
call fcn.100186a0
mov dword [eax], 6
jmp 0x1000b49c
mov dword [ebp - 0xc8], 0
jmp 0x1000b4e4
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1000b506
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x420]
call fcn.100186a0
mov dword [eax], 6
jmp 0x1000b4d7
cmp dword [ebp - 0x68], 0
jne 0x1000b51b
cmp dword [ebp - 0x68], 0
jne 0x1000b51b
and dword [ebp - 0x3d4], 0
jmp 0x1000b525
mov dword [ebp - 0x3d4], 1
push 0
lea ecx, [ebp - 0x420]
call fcn.100186a0
mov ecx, dword [ebp - 0x3d4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x3d4], eax
jne 0x1000b551
mov dword [ebp - 0x564], 1
jmp 0x1000b558
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x99c], eax
push 3
lea ecx, [ebp - 0xd0c]
call fcn.100186a0
mov ecx, dword [ebp - 0x99c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x99c]
cmp eax, dword [ebp - 0x564]
jl 0x1000b590
mov dword [ebp - 0x9a4], 1
jmp 0x1000b597
and dword [ebp - 0x9a4], 0
cmp dword [ebp - 0x9a4], 1
jb 0x1000b5ac
mov dword [ebp - 0x56c], 1
jmp 0x1000b5b3
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
sub eax, 0x7d18817f
cmp eax, dword [ebp - 0x68]
jg 0x1000b5cf
mov dword [ebp - 0x9ac], 1
jmp 0x1000b5d6
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x114], eax
jl 0x1000b5f9
mov dword [ebp - 0x574], 1
jmp 0x1000b600
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0xe524d43c
jg 0x1000b618
mov dword [ebp - 0x9b4], 1
jmp 0x1000b61f
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x12ec], eax
push 8
pop eax
test eax, eax
je 0x1000b645
cmp dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x9c], 0x225189d9
je 0x1000b65d
mov dword [ebp - 0x57c], 1
jmp 0x1000b664
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x57c], eax
jne 0x1000b67e
mov dword [ebp - 0x9bc], 1
jmp 0x1000b685
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x9bc], eax
jne 0x1000b6a5
cmp dword [ebp - 0x68], 0
je 0x1000b6a5
mov dword [ebp - 0x584], 1
jmp 0x1000b6ac
and dword [ebp - 0x584], 0
cmp dword [ebp - 0x584], 0x8b15b45b
je 0x1000b6c4
mov dword [ebp - 0x9c4], 1
jmp 0x1000b6cb
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x9c4]
cmp eax, dword [ebp - 0x11c]
jge 0x1000b6ec
mov dword [ebp - 0x58c], 1
jmp 0x1000b6f3
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], 0
jmp 0x1000b718
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffe3
jge 0x1000ba29
mov dword [ebp - 0x54], 0xfa4a
push 0
lea ecx, [ebp - 0xd0c]
call fcn.100186a0
mov dword [eax], 0xff8
cmp dword [ebp - 0x114], 0xff8
je 0x1000b757
mov dword [ebp - 0x9cc], 1
jmp 0x1000b75e
and dword [ebp - 0x9cc], 0
cmp dword [ebp - 0x9cc], 1
jne 0x1000b773
mov dword [ebp - 0x594], 1
jmp 0x1000b77a
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x9d4], eax
cmp dword [ebp - 0x9d4], 0
je 0x1000b81d
mov dword [ebp - 0x59c], 0x7999
mov dword [ebp - 0x9c], 0
jmp 0x1000b7b6
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x1000b818
mov dword [ebp - 0x11b8], 0x4d633c66
mov dword [ebp - 0x68], 0
jmp 0x1000b7d9
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jg 0x1000b816
mov byte [ebp - 0x154], 0
movzx eax, byte [ebp - 0x154]
test eax, eax
je 0x1000b807
push 0x495
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x59c]
dec eax
mov dword [ebp - 0x59c], eax
jmp 0x1000b7d2
jmp 0x1000b7a9
jmp 0x1000ba24
mov dword [ebp - 0x9e4], 0xc7f5175d
mov dword [ebp - 0x54], 0
jmp 0x1000b837
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jg 0x1000b9ba
push dword [ebp - 0x54]
lea ecx, [ebp - 0x420]
call fcn.100186a0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x420]
call fcn.100186a0
push 3
lea ecx, [ebp - 0xd0c]
call fcn.100186a0
cmp dword [eax], 0xffffffff
jne 0x1000b87b
mov dword [ebp - 0x9dc], 1
jmp 0x1000b882
and dword [ebp - 0x9dc], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x420]
call fcn.100186a0
mov esi, eax
push dword [ebp - 0x54]
lea ecx, [ebp - 0x420]
call fcn.100186a0
mov ecx, dword [ebp - 0x9dc]
add ecx, dword [eax]
cmp dword [esi], ecx
je 0x1000b8b8
mov dword [ebp - 0x5a4], 1
jmp 0x1000b8bf
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x9e4]
cmp eax, dword [ebp - 0x5a4]
jge 0x1000b8d9
mov dword [ebp - 0x5ac], 1
jmp 0x1000b8e0
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x9e4]
cmp dword [ebp - 0x5ac], eax
jle 0x1000b8fa
mov dword [ebp - 0x9ec], 1
jmp 0x1000b901
and dword [ebp - 0x9ec], 0
cmp dword [ebp - 0x9ec], 0x11012106
jle 0x1000b919
mov dword [ebp - 0x5b4], 1
jmp 0x1000b920
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x5b4], eax
jg 0x1000b93a
mov dword [ebp - 0x9f4], 1
jmp 0x1000b941
and dword [ebp - 0x9f4], 0
cmp dword [ebp - 0x9f4], 1
jge 0x1000b956
mov dword [ebp - 0x5bc], 1
jmp 0x1000b95d
and dword [ebp - 0x5bc], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x420]
call fcn.100186a0
mov eax, dword [eax]
imul eax, dword [ebp - 0x5bc]
imul esi, eax, 0x4484
push dword [ebp - 0x54]
lea ecx, [ebp - 0x420]
call fcn.100186a0
cmp esi, dword [eax]
jge 0x1000b998
mov dword [ebp - 0x9fc], 1
jmp 0x1000b99f
and dword [ebp - 0x9fc], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x420]
call fcn.100186a0
mov ecx, dword [ebp - 0x9fc]
mov dword [eax], ecx
jmp 0x1000b830
mov dword [ebp - 0x11c], 0
jmp 0x1000b9d3
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jl 0x1000ba24
mov eax, dword [ebp - 0x11c]
inc eax
push eax
lea ecx, [ebp - 0xd0c]
call fcn.100186a0
cmp dword [eax], 0
je 0x1000b9f6
jmp 0x1000ba24
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1000ba22
push 0xad8
push 0x742
push 0x362
push 0x2140
call dword [sym.imp.GDI32.dll_CreateRectRgn]
jmp 0x1000b9c6
jmp 0x1000b70b
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x420]
call fcn.10018684
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xd0c]
call fcn.10018684
push 2
lea ecx, [ebp - 0xf8c]
call fcn.10018602
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x18c], 0xfffffffc
mov dword [ebp - 0x2fc], 0
jmp 0x1000ba7b
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 2
jge 0x1000ba9d
push dword [ebp - 0x2fc]
lea ecx, [ebp - 0xf8c]
call fcn.100186a0
mov dword [eax], 0xfffffffa
jmp 0x1000ba6e
mov dword [ebp - 0x18c], 1
jmp 0x1000bab6
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jl 0x1000bb9a
mov dword [ebp - 0x23c], 0xa7275995
mov dword [ebp - 0x234], 0
jmp 0x1000bae6
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
jge 0x1000bb02
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x2bc], 0xd05ba772
jmp 0x1000bad9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2bc], 0
jmp 0x1000bb30
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2bc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2bc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2bc], 1
jg 0x1000bb59
push dword [ebp - 0x18c]
lea ecx, [ebp - 0xf8c]
call fcn.100186a0
mov dword [eax], 0xfffffff9
jmp 0x1000bb15
mov dword [ebp - 0x23c], 0
jmp 0x1000bb72
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jg 0x1000bb95
push dword [ebp - 0x18c]
lea ecx, [ebp - 0xf8c]
call fcn.100186a0
cmp dword [eax], 0
je 0x1000bb93
jmp 0x1000bb95
jmp 0x1000bb65
jmp 0x1000baa9
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xf8c]
call fcn.10018684
mov dword [ebp - 0xac], 0
jmp 0x1000bbc2
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x1000bbe4
push dword [ebp - 0xac]
lea ecx, [ebp - 0xcf4]
call fcn.100186a0
mov dword [eax], 0xfffffffb
jmp 0x1000bbb5
mov dword [ebp - 0xac], 0
jmp 0x1000bbfd
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x1000bc1c
push dword [ebp - 0xac]
lea ecx, [ebp - 0x10d0]
call fcn.100186a0
or dword [eax], 0xffffffff
jmp 0x1000bbf0
push 4
lea ecx, [ebp - 0xda4]
call fcn.10018602
mov byte [ebp - 4], 0x19
mov dword [ebp - 0xb4], 0
jmp 0x1000bc46
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1000bc62
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x1408], 0
jmp 0x1000bc39
mov dword [ebp - 0xb4], 0
jmp 0x1000bc7b
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 4
jge 0x1000bc9d
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xda4]
call fcn.100186a0
mov dword [eax], 0xca4f833f
jmp 0x1000bc6e
push 3
lea ecx, [ebp - 0xda4]
call fcn.100186a0
and dword [eax], 0
jmp 0x1000bcd3
push 3
lea ecx, [ebp - 0xda4]
call fcn.100186a0
mov dword [ebp - 0x5c4], eax
mov eax, dword [ebp - 0x5c4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5c4]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0xda4]
call fcn.100186a0
cmp dword [eax], 2
jg 0x1000be13
mov dword [ebp - 0x33c], 0
jmp 0x1000bd02
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 1
jge 0x1000bd1e
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0x174], 0x7dd68876
jmp 0x1000bcf5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x174], 0
jmp 0x1000bd4c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x174]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x174], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x174], 2
jg 0x1000be0e
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0x244], 2
jmp 0x1000bd83
mov eax, dword [ebp - 0x244]
dec eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jl 0x1000be09
mov dword [ebp - 0xd5c], 0x76e5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x174], 0
je 0x1000bdca
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x174]
mov dword [ebp - 0x129c], eax
xor eax, eax
inc eax
cmp eax, 3
jbe 0x1000bdca
and dword [ebp - 0xa04], 0
jmp 0x1000bdd4
mov dword [ebp - 0xa04], 1
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0xd5c], eax
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1000be04
push 0x1fa4
push 0x1883
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
jmp 0x1000bd76
jmp 0x1000bd31
jmp 0x1000bcaf
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x1000be34
push 0
push 0x1a1e
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xda4]
call fcn.10018684
mov dword [ebp - 0x1b0], 0
jmp 0x1000be5c
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 1
jg 0x1000ca6e
push 2
lea ecx, [ebp - 0x10dc]
call fcn.10018602
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xbc], 0
jmp 0x1000be93
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x1000beaf
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x98], 0x7a888ada
jmp 0x1000be86
mov dword [ebp - 0xbc], 0
jmp 0x1000bec8
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1000beea
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x10dc]
call fcn.100186a0
mov dword [eax], 0x25bb5a27
jmp 0x1000bebb
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x98], 1
jmp 0x1000bf18
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x98], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x98], 0
jl 0x1000ca5a
mov dword [ebp - 0x88], 0xfffffff9
mov dword [ebp - 0x19c], 0xffff
push 4
lea ecx, [ebp - 0xfa4]
call fcn.10018602
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0xd7c], 0xfffffffc
mov dword [ebp - 0x20], 0
jmp 0x1000bf6b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1000bf81
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x348], 0xd8ef068c
jmp 0x1000bf64
mov dword [ebp - 0x20], 0
jmp 0x1000bf91
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000bfad
push dword [ebp - 0x20]
lea ecx, [ebp - 0xfa4]
call fcn.100186a0
mov dword [eax], 0xee676845
jmp 0x1000bf8a
mov dword [ebp - 0x20], 0
jmp 0x1000bfbd
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000bfd3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1320], 0xffffffff
jmp 0x1000bfb6
cmp dword [ebp - 0x88], 0
jne 0x1000c0cb
cmp dword [ebp - 0x88], 0
je 0x1000bff0
cmp dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x88]
dec eax
cmp eax, dword [ebp - 0x88]
jne 0x1000c00b
mov dword [ebp - 0xd64], 1
jmp 0x1000c012
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x11c8], eax
cmp dword [ebp - 0x88], 0
jbe 0x1000c033
mov dword [ebp - 0x5cc], 1
jmp 0x1000c03a
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x5cc]
jg 0x1000c064
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x348], 0
je 0x1000c064
mov dword [ebp - 0xa0c], 1
jmp 0x1000c06b
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xa0c], eax
jge 0x1000c085
mov dword [ebp - 0xd6c], 1
jmp 0x1000c08c
and dword [ebp - 0xd6c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x348]
mov dword [ebp - 0x12d4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x348]
mov dword [ebp - 0x11d8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x348], 0
jne 0x1000c0cb
and dword [ebp - 0x5d4], 0
jmp 0x1000c0d5
mov dword [ebp - 0x5d4], 1
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x5d4]
jne 0x1000c0ef
mov dword [ebp - 0xa14], 1
jmp 0x1000c0f6
and dword [ebp - 0xa14], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x348]
add esi, dword [ebp - 0xa14]
push 2
lea ecx, [ebp - 0xfa4]
call fcn.100186a0
mov dword [eax], esi
mov dword [ebp - 0x19c], 0xffffffe4
jmp 0x1000c131
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0x3c
je 0x1000c369
mov dword [ebp - 0x1d4], 6
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0xa3c], 0xffffffff
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1134], eax
cmp dword [ebp - 0x1d4], 0
jne 0x1000c1c2
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x1320], 0x2aec
test eax, eax
je 0x1000c19b
cmp dword [ebp - 0x1d4], 0
je 0x1000c19b
mov dword [ebp - 0x5dc], 1
jmp 0x1000c1a2
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x5dc], eax
jl 0x1000c1b9
cmp dword [ebp - 0x1d4], 0
jne 0x1000c1c2
and dword [ebp - 0xd74], 0
jmp 0x1000c1cc
mov dword [ebp - 0xd74], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x348]
cmp dword [ebp - 0x90], eax
jge 0x1000c1ed
mov dword [ebp - 0xa1c], 1
jmp 0x1000c1f4
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0xa1c]
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
je 0x1000c21e
cmp dword [ebp - 0x88], 0
je 0x1000c21e
mov dword [ebp - 0x3fc], 1
jmp 0x1000c225
and dword [ebp - 0x3fc], 0
push 0
lea ecx, [ebp - 0xfa4]
call fcn.100186a0
mov ecx, dword [ebp - 0x3fc]
mov dword [eax], ecx
cmp dword [ebp - 0x3fc], 0x99e60473
jb 0x1000c252
mov dword [ebp - 0x5e4], 1
jmp 0x1000c259
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x5e4], eax
jne 0x1000c273
mov dword [ebp - 0xa24], 1
jmp 0x1000c27a
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0xa24]
sub eax, dword [ebp - 0x90]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x348]
jl 0x1000c2a1
mov dword [ebp - 0x5ec], 1
jmp 0x1000c2a8
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x5ec], eax
jge 0x1000c2c2
mov dword [ebp - 0xa2c], 1
jmp 0x1000c2c9
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xa2c], eax
jg 0x1000c2e3
mov dword [ebp - 0x5f4], 1
jmp 0x1000c2ea
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x5f4], eax
jl 0x1000c304
mov dword [ebp - 0xa34], 1
jmp 0x1000c30b
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0xa34]
cmp eax, dword [ebp - 0x90]
je 0x1000c32b
mov dword [ebp - 0x5fc], 1
jmp 0x1000c332
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x348]
neg eax
add eax, dword [ebp - 0x5fc]
neg eax
imul eax, dword [ebp - 0x90]
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp - 0xa3c]
neg eax
mov dword [ebp - 0xd7c], eax
jmp 0x1000c124
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xfa4]
call fcn.10018684
push 4
lea ecx, [ebp - 0xc28]
call fcn.10018602
mov byte [ebp - 4], 0x1c
push 2
lea ecx, [ebp - 0xdb4]
call fcn.10018602
mov byte [ebp - 4], 0x1d
push 2
lea ecx, [ebp - 0xfbc]
call fcn.10018602
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0xe6c], 0xffffffff
mov dword [ebp - 0x24], 0
jmp 0x1000c3c5
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1000c3de
push dword [ebp - 0x24]
lea ecx, [ebp - 0xdb4]
call fcn.100186a0
and dword [eax], 0
jmp 0x1000c3be
mov dword [ebp - 0x24], 0
jmp 0x1000c3ee
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000c404
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xec], 3
jmp 0x1000c3e7
mov dword [ebp - 0x24], 0
jmp 0x1000c414
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1000c430
push dword [ebp - 0x24]
lea ecx, [ebp - 0xfbc]
call fcn.100186a0
mov dword [eax], 0xfffffff8
jmp 0x1000c40d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xec], 1
jmp 0x1000c45e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 0
jl 0x1000c65e
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x614], 3
mov dword [ebp - 0x40], 0
jmp 0x1000c493
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jg 0x1000c4d1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xec]
lea ecx, [ebp - 0xdb4]
call fcn.100186a0
mov esi, eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xec]
lea ecx, [ebp - 0xdb4]
call fcn.100186a0
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000c48c
mov dword [ebp - 0x40], 0
jmp 0x1000c4e1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jg 0x1000c659
mov dword [ebp - 0x2c4], 0xfffffffc
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x2c4], eax
jne 0x1000c53c
mov eax, dword [ebp - 0x2c4]
sub eax, 0xa
cmp eax, dword [ebp - 0x40]
jge 0x1000c51d
mov dword [ebp - 0x604], 1
jmp 0x1000c524
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 0xa41a80d1
jae 0x1000c53c
mov dword [ebp - 0xa44], 1
jmp 0x1000c543
and dword [ebp - 0xa44], 0
imul eax, dword [ebp - 0xa44], 0
test eax, eax
jne 0x1000c55d
cmp dword [ebp - 0x40], 0
jne 0x1000c55d
and dword [ebp - 0x60c], 0
jmp 0x1000c567
mov dword [ebp - 0x60c], 1
push 0
lea ecx, [ebp - 0xdb4]
call fcn.100186a0
mov ecx, dword [ebp - 0x60c]
cmp ecx, dword [eax]
jg 0x1000c58a
mov dword [ebp - 0xa4c], 1
jmp 0x1000c591
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x614], eax
jl 0x1000c5b7
mov dword [ebp - 0x3a8], 1
jmp 0x1000c5be
and dword [ebp - 0x3a8], 0
push 0
lea ecx, [ebp - 0xfbc]
call fcn.100186a0
mov ecx, dword [ebp - 0x3a8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x3a8]
cmp eax, 0x874b
jge 0x1000c5ef
mov dword [ebp - 0xa54], 1
jmp 0x1000c5f6
and dword [ebp - 0xa54], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
cmp dword [ebp - 0xa54], eax
jne 0x1000c617
mov dword [ebp - 0xd84], 1
jmp 0x1000c61e
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x11e8], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xec]
push 0
lea ecx, [ebp - 0xfbc]
call fcn.100186a0
add esi, dword [eax]
mov dword [ebp - 0xe6c], esi
cmp dword [ebp - 0x40], 0
je 0x1000c654
jmp 0x1000c4da
jmp 0x1000c4da
jmp 0x1000c443
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xfbc]
call fcn.10018684
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xdb4]
call fcn.10018684
mov dword [ebp - 0x12fc], 0xf8278b7
mov dword [ebp - 0x11f8], 0x29efec1a
mov dword [ebp - 0x24c], 0
jmp 0x1000c6a9
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 4
jge 0x1000c6cb
push dword [ebp - 0x24c]
lea ecx, [ebp - 0xc28]
call fcn.100186a0
mov dword [eax], 5
jmp 0x1000c69c
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x98]
lea ecx, [ebp - 0xcf4]
call fcn.100186a0
cmp dword [eax], 0
je 0x1000c711
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x98]
lea ecx, [ebp - 0xcf4]
call fcn.100186a0
cmp dword [eax], 0
je 0x1000c711
mov dword [ebp - 0xe74], 1
jmp 0x1000c718
and dword [ebp - 0xe74], 0
push 0
lea ecx, [ebp - 0xc28]
call fcn.100186a0
cmp dword [eax], 0
jne 0x1000c73f
cmp dword [ebp - 0x1b8], 0
jne 0x1000c73f
mov dword [ebp - 0x61c], 1
jmp 0x1000c746
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x61c]
jge 0x1000c760
mov dword [ebp - 0xe7c], 1
jmp 0x1000c767
and dword [ebp - 0xe7c], 0
push 0
lea ecx, [ebp - 0xcf4]
call fcn.100186a0
push 0
lea ecx, [ebp - 0xc28]
call fcn.100186a0
cmp dword [eax], 0x5a83d87e
jg 0x1000c795
mov dword [ebp - 0xa5c], 1
jmp 0x1000c79c
and dword [ebp - 0xa5c], 0
cmp dword [ebp - 0xa5c], 1
jne 0x1000c7b1
mov dword [ebp - 0x624], 1
jmp 0x1000c7b8
and dword [ebp - 0x624], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98]
cmp dword [ebp - 0x624], eax
je 0x1000c7d9
mov dword [ebp - 0xa64], 1
jmp 0x1000c7e0
and dword [ebp - 0xa64], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x98]
lea ecx, [ebp - 0xcf4]
call fcn.100186a0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x98]
add ecx, dword [ebp - 0xa64]
cmp dword [eax], ecx
jg 0x1000c81b
mov dword [ebp - 0x62c], 1
jmp 0x1000c822
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 0x446c
jle 0x1000c8e0
and dword [ebp - 0x1024], 0
and dword [ebp - 0x1020], 0
and dword [ebp - 0x101c], 0
and dword [ebp - 0x1018], 0
lea ecx, [ebp - 0x375]
call fcn.10009273
push eax
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1024]
push eax
lea ecx, [ebp - 0x13e4]
call fcn.100186af
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1124]
call fcn.1001865e
mov byte [ebp - 4], 0x1f
push 0
lea ecx, [ebp - 0xc28]
call fcn.100186a0
cmp dword [eax], 0
je 0x1000c8bc
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1124]
call fcn.10018684
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xc28]
call fcn.10018684
jmp 0x1000ca5a
push 0
lea ecx, [ebp - 0x1124]
call fcn.100186a0
or dword [eax], 0xffffffff
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1124]
call fcn.10018684
jmp 0x1000ca46
mov dword [ebp - 0x634], 0xffffffff
mov dword [ebp - 0x3dc], 0x82966b91
mov dword [ebp - 0x1b8], 0
jmp 0x1000c90d
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jg 0x1000c965
mov dword [ebp - 0x304], 1
mov dword [ebp - 0x304], 3
jmp 0x1000c939
mov eax, dword [ebp - 0x304]
dec eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0
jl 0x1000c963
mov byte [ebp - 0x14a], 0
movzx eax, byte [ebp - 0x14a]
test eax, eax
je 0x1000c961
push 0x1e34
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1000c92c
jmp 0x1000c900
push 0
lea ecx, [ebp - 0x1204]
call fcn.100186a0
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0xa6c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa6c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc28]
call fcn.100186a0
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x12ac], eax
mov dword [ebp - 0x3dc], 0xffff
mov eax, dword [ebp - 0x634]
add eax, 0xfffd
cmp eax, dword [ebp - 0x3dc]
jl 0x1000c9cb
mov dword [ebp - 0xe84], 1
jmp 0x1000c9d2
and dword [ebp - 0xe84], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98]
mov dword [ebp - 0x1208], eax
push 1
lea ecx, [ebp - 0x10dc]
call fcn.100186a0
cmp dword [eax], 8
jge 0x1000ca03
mov dword [ebp - 0xa74], 1
jmp 0x1000ca0a
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0x634]
imul eax, dword [ebp - 0xa74]
cmp eax, 0xff40b36f
jbe 0x1000ca2a
mov dword [ebp - 0x63c], 1
jmp 0x1000ca31
and dword [ebp - 0x63c], 0
push 0
lea ecx, [ebp - 0x10d0]
call fcn.100186a0
mov ecx, dword [ebp - 0x63c]
mov dword [eax], ecx
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xc28]
call fcn.10018684
jmp 0x1000befd
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x10dc]
call fcn.10018684
jmp 0x1000be4f
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1204]
call fcn.10018684
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x10d0]
call fcn.10018684
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf4]
call fcn.10018684
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xe58], 9
mov dword [ebp - 0x3b8], 0xffffffff
mov dword [ebp - 0x3b0], 3
mov dword [ebp - 0xe00], 0xb108
mov dword [ebp - 0x254], 0
jmp 0x1000cae6
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jge 0x1000cb02
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0xea8], 0
jmp 0x1000cad9
mov dword [ebp - 0xf0], 0xfffffffe
jmp 0x1000cb1b
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xfffffffe
jg 0x1000cf4f
mov dword [ebp - 0x1c0], 0x9c1464f1
mov dword [ebp - 0x17c], 1
mov dword [ebp - 0xab4], 0xffffffff
cmp dword [ebp - 0xf0], 1
je 0x1000cb5b
mov dword [ebp - 0xa7c], 1
jmp 0x1000cb62
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0xa7c], eax
jl 0x1000cb7c
mov dword [ebp - 0x644], 1
jmp 0x1000cb83
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x17c]
imul eax, dword [ebp - 0x644]
cmp eax, dword [ebp - 0x17c]
jg 0x1000cbad
mov eax, 0x88c5
test eax, eax
je 0x1000cbad
mov dword [ebp - 0xa84], 1
jmp 0x1000cbb4
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0xa84], eax
jge 0x1000cbce
mov dword [ebp - 0x64c], 1
jmp 0x1000cbd5
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x1c0]
imul eax, dword [ebp - 0x64c]
cmp eax, dword [ebp - 0x17c]
jl 0x1000cbf6
mov dword [ebp - 0xa8c], 1
jmp 0x1000cbfd
and dword [ebp - 0xa8c], 0
cmp dword [ebp - 0xa8c], 0x3cd3
jg 0x1000cc1b
cmp dword [ebp - 0x3b0], 0
jne 0x1000cc1b
and dword [ebp - 0x654], 0
jmp 0x1000cc25
mov dword [ebp - 0x654], 1
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x654], eax
jne 0x1000cc3f
mov dword [ebp - 0xa94], 1
jmp 0x1000cc46
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jne 0x1000cdd6
cmp dword [ebp - 0xf0], 0
je 0x1000cc7d
cmp dword [ebp - 0x17c], 0
je 0x1000cc7d
mov dword [ebp - 0x66c], 1
jmp 0x1000cc84
and dword [ebp - 0x66c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xea8]
mov dword [ebp - 0x12dc], eax
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x17c], eax
jle 0x1000ccb1
mov dword [ebp - 0x65c], 1
jmp 0x1000ccb8
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x65c], 0x46ac1dea
je 0x1000ccd0
mov dword [ebp - 0xa9c], 1
jmp 0x1000ccd7
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0xa9c]
neg eax
cmp eax, 0xffffffff
jb 0x1000ccf0
mov dword [ebp - 0x664], 1
jmp 0x1000ccf7
and dword [ebp - 0x664], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xea8]
imul eax, dword [ebp - 0x664]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xea8]
jle 0x1000cd25
mov dword [ebp - 0xaa4], 1
jmp 0x1000cd2c
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0xaa4]
sub eax, dword [ebp - 0xab4]
test eax, eax
jg 0x1000cd48
mov dword [ebp - 0xaac], 1
jmp 0x1000cd4f
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0x66c]
sub eax, dword [ebp - 0xaac]
cmp eax, dword [ebp - 0xe00]
jle 0x1000cd6f
mov dword [ebp - 0x674], 1
jmp 0x1000cd76
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x3b8], eax
jge 0x1000cd9c
mov dword [ebp - 0x67c], 1
jmp 0x1000cda3
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0xab4]
cmp dword [ebp - 0x67c], eax
jg 0x1000cdbd
mov dword [ebp - 0xabc], 1
jmp 0x1000cdc4
and dword [ebp - 0xabc], 0
cmp dword [ebp - 0xabc], 0
jne 0x1000cdd6
and dword [ebp - 0x684], 0
jmp 0x1000cde0
mov dword [ebp - 0x684], 1
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x684], eax
jle 0x1000cdfa
mov dword [ebp - 0xac4], 1
jmp 0x1000ce01
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0xe58]
cmp dword [ebp - 0xac4], eax
jge 0x1000cee9
mov dword [ebp - 0xacc], 0xffffffff
mov dword [ebp - 0x69c], 0xe6d7
mov dword [ebp - 0xd24], 0xaa0e6852
push 4
pop eax
shl eax, 0
mov ecx, 0xfff6
sub ecx, dword [ebp + eax - 0xea8]
mov eax, dword [ebp - 0xacc]
lea eax, [ecx + eax + 0x146f7e85]
cmp eax, dword [ebp - 0x69c]
jg 0x1000ce6a
cmp dword [ebp - 0x3b8], 0
jne 0x1000ce6a
and dword [ebp - 0x68c], 0
jmp 0x1000ce74
mov dword [ebp - 0x68c], 1
cmp dword [ebp - 0x68c], 0
jle 0x1000ce89
mov dword [ebp - 0x694], 1
jmp 0x1000ce90
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0xacc]
cmp dword [ebp - 0x694], eax
jl 0x1000ceaa
mov dword [ebp - 0xad4], 1
jmp 0x1000ceb1
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0xad4]
neg eax
cmp eax, dword [ebp - 0x69c]
jl 0x1000cecd
mov dword [ebp - 0xadc], 1
jmp 0x1000ced4
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0x17c]
imul eax, dword [ebp - 0xadc]
mov dword [ebp - 0xd24], eax
jmp 0x1000cf4a
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1000cf4a
push 0x257
push 0xb7
push 0x8f6
push 0x1ec7
push 0x1d0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x21c6
push 0x8f0
push 0x6b4
push 0x1c96
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x1000cb0e
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xd2c], 9
mov dword [ebp - 0x35c], 0xffffffff
mov dword [ebp - 0x358], 3
mov dword [ebp - 0xe80], 0xb108
mov dword [ebp - 0x2cc], 0
jmp 0x1000cf9a
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 3
jge 0x1000cfb6
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0xf38], 0
jmp 0x1000cf8d
mov dword [ebp - 0xf8], 0xfffffffe
jmp 0x1000cfcf
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xfffffffe
jg 0x1000d403
mov dword [ebp - 0x1c8], 0x9c1464f1
mov dword [ebp - 0x194], 1
mov dword [ebp - 0x6dc], 0xffffffff
cmp dword [ebp - 0xf8], 1
je 0x1000d00f
mov dword [ebp - 0x6a4], 1
jmp 0x1000d016
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x6a4], eax
jl 0x1000d030
mov dword [ebp - 0xae4], 1
jmp 0x1000d037
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x194]
imul eax, dword [ebp - 0xae4]
cmp eax, dword [ebp - 0x194]
jg 0x1000d061
mov eax, 0x88c5
test eax, eax
je 0x1000d061
mov dword [ebp - 0x6ac], 1
jmp 0x1000d068
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x6ac], eax
jge 0x1000d082
mov dword [ebp - 0xaec], 1
jmp 0x1000d089
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0x1c8]
imul eax, dword [ebp - 0xaec]
cmp eax, dword [ebp - 0x194]
jl 0x1000d0aa
mov dword [ebp - 0x6b4], 1
jmp 0x1000d0b1
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0x3cd3
jg 0x1000d0cf
cmp dword [ebp - 0x358], 0
jne 0x1000d0cf
and dword [ebp - 0xaf4], 0
jmp 0x1000d0d9
mov dword [ebp - 0xaf4], 1
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0xaf4], eax
jne 0x1000d0f3
mov dword [ebp - 0x6bc], 1
jmp 0x1000d0fa
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jne 0x1000d28a
cmp dword [ebp - 0xf8], 0
je 0x1000d131
cmp dword [ebp - 0x194], 0
je 0x1000d131
mov dword [ebp - 0xb0c], 1
jmp 0x1000d138
and dword [ebp - 0xb0c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf38]
mov dword [ebp - 0x1218], eax
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x194], eax
jle 0x1000d165
mov dword [ebp - 0xafc], 1
jmp 0x1000d16c
and dword [ebp - 0xafc], 0
cmp dword [ebp - 0xafc], 0x46ac1dea
je 0x1000d184
mov dword [ebp - 0x6c4], 1
jmp 0x1000d18b
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
neg eax
cmp eax, 0xffffffff
jb 0x1000d1a4
mov dword [ebp - 0xb04], 1
jmp 0x1000d1ab
and dword [ebp - 0xb04], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf38]
imul eax, dword [ebp - 0xb04]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xf38]
jle 0x1000d1d9
mov dword [ebp - 0x6cc], 1
jmp 0x1000d1e0
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
sub eax, dword [ebp - 0x6dc]
test eax, eax
jg 0x1000d1fc
mov dword [ebp - 0x6d4], 1
jmp 0x1000d203
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0xb0c]
sub eax, dword [ebp - 0x6d4]
cmp eax, dword [ebp - 0xe80]
jle 0x1000d223
mov dword [ebp - 0xb14], 1
jmp 0x1000d22a
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x35c], eax
jge 0x1000d250
mov dword [ebp - 0xb1c], 1
jmp 0x1000d257
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0x6dc]
cmp dword [ebp - 0xb1c], eax
jg 0x1000d271
mov dword [ebp - 0x6e4], 1
jmp 0x1000d278
and dword [ebp - 0x6e4], 0
cmp dword [ebp - 0x6e4], 0
jne 0x1000d28a
and dword [ebp - 0xb24], 0
jmp 0x1000d294
mov dword [ebp - 0xb24], 1
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0xb24], eax
jle 0x1000d2ae
mov dword [ebp - 0x6ec], 1
jmp 0x1000d2b5
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0xd2c]
cmp dword [ebp - 0x6ec], eax
jge 0x1000d39d
mov dword [ebp - 0x6f4], 0xffffffff
mov dword [ebp - 0xb3c], 0xe6d7
mov dword [ebp - 0xe08], 0xaa0e6852
push 4
pop eax
shl eax, 0
mov ecx, 0xfff6
sub ecx, dword [ebp + eax - 0xf38]
mov eax, dword [ebp - 0x6f4]
lea eax, [ecx + eax + 0x146f7e85]
cmp eax, dword [ebp - 0xb3c]
jg 0x1000d31e
cmp dword [ebp - 0x35c], 0
jne 0x1000d31e
and dword [ebp - 0xb2c], 0
jmp 0x1000d328
mov dword [ebp - 0xb2c], 1
cmp dword [ebp - 0xb2c], 0
jle 0x1000d33d
mov dword [ebp - 0xb34], 1
jmp 0x1000d344
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0x6f4]
cmp dword [ebp - 0xb34], eax
jl 0x1000d35e
mov dword [ebp - 0x6fc], 1
jmp 0x1000d365
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x6fc]
neg eax
cmp eax, dword [ebp - 0xb3c]
jl 0x1000d381
mov dword [ebp - 0x704], 1
jmp 0x1000d388
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x194]
imul eax, dword [ebp - 0x704]
mov dword [ebp - 0xe08], eax
jmp 0x1000d3fe
mov byte [ebp - 0x14c], 0
movzx eax, byte [ebp - 0x14c]
test eax, eax
je 0x1000d3fe
push 0x257
push 0xb7
push 0x8f6
push 0x1ec7
push 0x1d0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x21c6
push 0x8f0
push 0x6b4
push 0x1c96
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x1000cfc2
or dword [ebp - 0x104c], 0xffffffff
or dword [ebp - 0x1048], 0xffffffff
or dword [ebp - 0x1044], 0xffffffff
or dword [ebp - 0x1040], 0xffffffff
lea ecx, [ebp - 0x3fd]
call fcn.10009273
push eax
lea eax, [ebp - 0x103c]
push eax
lea eax, [ebp - 0x104c]
push eax
lea ecx, [ebp - 0x137c]
call fcn.100186af
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x132c]
call fcn.1001865e
mov dword [ebp - 0x25c], 0xfffffff7
mov dword [ebp - 0x25c], 0
jmp 0x1000d477
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 3
jg 0x1000d4a6
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1000d4a4
push 0x19cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x1000d46a
lea ecx, [ebp - 0x132c]
call fcn.10018684
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xd38], 9
mov dword [ebp - 0x36c], 0xffffffff
mov dword [ebp - 0x364], 3
mov dword [ebp - 0xe48], 0xb108
mov dword [ebp - 0x324], 0
jmp 0x1000d4fc
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 3
jge 0x1000d518
mov eax, dword [ebp - 0x324]
mov dword [ebp + eax*4 - 0xec0], 0
jmp 0x1000d4ef
mov dword [ebp - 0x100], 0xfffffffe
jmp 0x1000d531
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xfffffffe
jg 0x1000d965
mov dword [ebp - 0x1d0], 0x9c1464f1
mov dword [ebp - 0x184], 1
mov dword [ebp - 0xb7c], 0xffffffff
cmp dword [ebp - 0x100], 1
je 0x1000d571
mov dword [ebp - 0xb44], 1
jmp 0x1000d578
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0xb44], eax
jl 0x1000d592
mov dword [ebp - 0x70c], 1
jmp 0x1000d599
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x184]
imul eax, dword [ebp - 0x70c]
cmp eax, dword [ebp - 0x184]
jg 0x1000d5c3
mov eax, 0x88c5
test eax, eax
je 0x1000d5c3
mov dword [ebp - 0xb4c], 1
jmp 0x1000d5ca
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0xb4c], eax
jge 0x1000d5e4
mov dword [ebp - 0x714], 1
jmp 0x1000d5eb
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x1d0]
imul eax, dword [ebp - 0x714]
cmp eax, dword [ebp - 0x184]
jl 0x1000d60c
mov dword [ebp - 0xb54], 1
jmp 0x1000d613
and dword [ebp - 0xb54], 0
cmp dword [ebp - 0xb54], 0x3cd3
jg 0x1000d631
cmp dword [ebp - 0x364], 0
jne 0x1000d631
and dword [ebp - 0x71c], 0
jmp 0x1000d63b
mov dword [ebp - 0x71c], 1
mov eax, dword [ebp - 0x364]
cmp dword [ebp - 0x71c], eax
jne 0x1000d655
mov dword [ebp - 0xb5c], 1
jmp 0x1000d65c
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0xb5c]
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jne 0x1000d7ec
cmp dword [ebp - 0x100], 0
je 0x1000d693
cmp dword [ebp - 0x184], 0
je 0x1000d693
mov dword [ebp - 0x734], 1
jmp 0x1000d69a
and dword [ebp - 0x734], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xec0]
mov dword [ebp - 0x12b4], eax
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x184], eax
jle 0x1000d6c7
mov dword [ebp - 0x724], 1
jmp 0x1000d6ce
and dword [ebp - 0x724], 0
cmp dword [ebp - 0x724], 0x46ac1dea
je 0x1000d6e6
mov dword [ebp - 0xb64], 1
jmp 0x1000d6ed
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0xb64]
neg eax
cmp eax, 0xffffffff
jb 0x1000d706
mov dword [ebp - 0x72c], 1
jmp 0x1000d70d
and dword [ebp - 0x72c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xec0]
imul eax, dword [ebp - 0x72c]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xec0]
jle 0x1000d73b
mov dword [ebp - 0xb6c], 1
jmp 0x1000d742
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0xb6c]
sub eax, dword [ebp - 0xb7c]
test eax, eax
jg 0x1000d75e
mov dword [ebp - 0xb74], 1
jmp 0x1000d765
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0xb74]
cmp eax, dword [ebp - 0xe48]
jle 0x1000d785
mov dword [ebp - 0x73c], 1
jmp 0x1000d78c
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x364]
cmp dword [ebp - 0x36c], eax
jge 0x1000d7b2
mov dword [ebp - 0x744], 1
jmp 0x1000d7b9
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0xb7c]
cmp dword [ebp - 0x744], eax
jg 0x1000d7d3
mov dword [ebp - 0xb84], 1
jmp 0x1000d7da
and dword [ebp - 0xb84], 0
cmp dword [ebp - 0xb84], 0
jne 0x1000d7ec
and dword [ebp - 0x74c], 0
jmp 0x1000d7f6
mov dword [ebp - 0x74c], 1
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0x74c], eax
jle 0x1000d810
mov dword [ebp - 0xb8c], 1
jmp 0x1000d817
and dword [ebp - 0xb8c], 0
mov eax, dword [ebp - 0xd38]
cmp dword [ebp - 0xb8c], eax
jge 0x1000d8ff
mov dword [ebp - 0xb94], 0xffffffff
mov dword [ebp - 0x764], 0xe6d7
mov dword [ebp - 0xe30], 0xaa0e6852
push 4
pop eax
shl eax, 0
mov ecx, 0xfff6
sub ecx, dword [ebp + eax - 0xec0]
mov eax, dword [ebp - 0xb94]
lea eax, [ecx + eax + 0x146f7e85]
cmp eax, dword [ebp - 0x764]
jg 0x1000d880
cmp dword [ebp - 0x36c], 0
jne 0x1000d880
and dword [ebp - 0x754], 0
jmp 0x1000d88a
mov dword [ebp - 0x754], 1
cmp dword [ebp - 0x754], 0
jle 0x1000d89f
mov dword [ebp - 0x75c], 1
jmp 0x1000d8a6
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0xb94]
cmp dword [ebp - 0x75c], eax
jl 0x1000d8c0
mov dword [ebp - 0xb9c], 1
jmp 0x1000d8c7
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0xb9c]
neg eax
cmp eax, dword [ebp - 0x764]
jl 0x1000d8e3
mov dword [ebp - 0xba4], 1
jmp 0x1000d8ea
and dword [ebp - 0xba4], 0
mov eax, dword [ebp - 0x184]
imul eax, dword [ebp - 0xba4]
mov dword [ebp - 0xe30], eax
jmp 0x1000d960
mov byte [ebp - 0x14e], 0
movzx eax, byte [ebp - 0x14e]
test eax, eax
je 0x1000d960
push 0x257
push 0xb7
push 0x8f6
push 0x1ec7
push 0x1d0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x21c6
push 0x8f0
push 0x6b4
push 0x1c96
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x1000d524
or dword [ebp - 0x1074], 0xffffffff
or dword [ebp - 0x1070], 0xffffffff
or dword [ebp - 0x106c], 0xffffffff
or dword [ebp - 0x1068], 0xffffffff
lea ecx, [ebp - 0x3ba]
call fcn.10009273
push eax
lea eax, [ebp - 0x1064]
push eax
lea eax, [ebp - 0x1074]
push eax
lea ecx, [ebp - 0x13cc]
call fcn.100186af
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1344]
call fcn.1001865e
mov dword [ebp - 0x264], 0xfffffff7
mov dword [ebp - 0x264], 0
jmp 0x1000d9d9
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jg 0x1000da08
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000da06
push 0x19cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x1000d9cc
lea ecx, [ebp - 0x1344]
call fcn.10018684
mov dword [ebp - 0xccc], 0x4039b642
mov dword [ebp - 0xcc8], 0x4039b642
mov dword [ebp - 0xcc4], 0x4039b642
mov dword [ebp - 0xcc0], 0x4039b642
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x784], 3
mov dword [ebp - 0xbd4], 0xfffffff6
mov dword [ebp - 0x26c], 0x80643b8a
push 2
lea ecx, [ebp - 0xc58]
call fcn.10018602
mov dword [ebp - 4], 0x20
mov dword [ebp - 0xe70], 0x6e3f0e26
mov dword [ebp - 0x2d4], 0
jmp 0x1000da9a
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 2
jge 0x1000dab9
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0xc58]
call fcn.100186a0
and dword [eax], 0
jmp 0x1000da8d
mov eax, dword [ebp - 0x30c]
dec eax
mov dword [ebp - 0x30c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xccc]
mov dword [ebp - 0x1228], eax
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
je 0x1000dc79
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xccc], 0x7279
jl 0x1000db0b
mov dword [ebp - 0x76c], 1
jmp 0x1000db12
and dword [ebp - 0x76c], 0
push 1
lea ecx, [ebp - 0xc58]
call fcn.100186a0
mov ecx, dword [ebp - 0x76c]
cmp ecx, dword [eax]
je 0x1000db3e
cmp dword [ebp - 0x30c], 0
je 0x1000db3e
mov dword [ebp - 0xbac], 1
jmp 0x1000db45
and dword [ebp - 0xbac], 0
cmp dword [ebp - 0xbac], 8
jne 0x1000db5a
mov dword [ebp - 0x774], 1
jmp 0x1000db61
and dword [ebp - 0x774], 0
push 1
lea ecx, [ebp - 0xc58]
call fcn.100186a0
mov ecx, dword [ebp - 0x774]
cmp ecx, dword [eax]
jge 0x1000db84
mov dword [ebp - 0xbb4], 1
jmp 0x1000db8b
and dword [ebp - 0xbb4], 0
imul eax, dword [ebp - 0xbb4], 0xffff
test eax, eax
jne 0x1000dba7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xccc], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x30c], eax
jle 0x1000dbc1
mov dword [ebp - 0x77c], 1
jmp 0x1000dbc8
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x784]
cmp eax, dword [ebp - 0x77c]
je 0x1000dbe2
mov dword [ebp - 0xbbc], 1
jmp 0x1000dbe9
and dword [ebp - 0xbbc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xccc]
cmp eax, dword [ebp - 0xbbc]
jle 0x1000dc0a
mov dword [ebp - 0xd40], 1
jmp 0x1000dc11
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0x12f4], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xccc]
push 1
lea ecx, [ebp - 0xc58]
call fcn.100186a0
add esi, dword [eax]
cmp esi, 1
je 0x1000dc4a
mov dword [ebp - 0x374], 1
jmp 0x1000dc51
and dword [ebp - 0x374], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x374]
mov dword [ebp + eax - 0xccc], ecx
cmp dword [ebp - 0x374], 0
je 0x1000dc79
mov dword [ebp - 0xbc4], 1
jmp 0x1000dc80
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0x784]
cmp dword [ebp - 0xbc4], eax
jle 0x1000dc9a
mov dword [ebp - 0x78c], 1
jmp 0x1000dca1
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x78c], 9
jle 0x1000dcb6
mov dword [ebp - 0xbcc], 1
jmp 0x1000dcbd
and dword [ebp - 0xbcc], 0
push 1
lea ecx, [ebp - 0xc58]
call fcn.100186a0
mov esi, dword [ebp - 0xbcc]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0xc58]
call fcn.100186a0
sub esi, dword [eax]
imul esi, dword [ebp - 0xbd4]
mov dword [ebp - 0xe70], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc58]
call fcn.10018684
or dword [ebp - 0x109c], 0xffffffff
or dword [ebp - 0x1098], 0xffffffff
or dword [ebp - 0x1094], 0xffffffff
or dword [ebp - 0x1090], 0xffffffff
lea ecx, [ebp - 0x3c1]
call fcn.10009273
push eax
lea eax, [ebp - 0x108c]
push eax
lea eax, [ebp - 0x109c]
push eax
lea ecx, [ebp - 0x138c]
call fcn.100186af
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x135c]
call fcn.1001865e
mov dword [ebp - 0x274], 0xfffffff7
mov dword [ebp - 0x274], 0
jmp 0x1000dd71
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jg 0x1000dda0
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000dd9e
push 0x19cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x1000dd64
lea ecx, [ebp - 0x135c]
call fcn.10018684
mov dword [ebp - 0xc9c], 0x4039b642
mov dword [ebp - 0xc98], 0x4039b642
mov dword [ebp - 0xc94], 0x4039b642
mov dword [ebp - 0xc90], 0x4039b642
mov dword [ebp - 0x334], 0
mov dword [ebp - 0x7b0], 3
mov dword [ebp - 0x7c0], 0xfffffff6
mov dword [ebp - 0x27c], 0x80643b8a
push 2
lea ecx, [ebp - 0xc40]
call fcn.10018602
mov dword [ebp - 4], 0x21
mov dword [ebp - 0xe38], 0x6e3f0e26
mov dword [ebp - 0x2dc], 0
jmp 0x1000de32
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x1000de51
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0xc40]
call fcn.100186a0
and dword [eax], 0
jmp 0x1000de25
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc9c]
mov dword [ebp - 0x1238], eax
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
je 0x1000e011
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc9c], 0x7279
jl 0x1000dea3
mov dword [ebp - 0x7ec], 1
jmp 0x1000deaa
and dword [ebp - 0x7ec], 0
push 1
lea ecx, [ebp - 0xc40]
call fcn.100186a0
mov ecx, dword [ebp - 0x7ec]
cmp ecx, dword [eax]
je 0x1000ded6
cmp dword [ebp - 0x334], 0
je 0x1000ded6
mov dword [ebp - 0x7c4], 1
jmp 0x1000dedd
and dword [ebp - 0x7c4], 0
cmp dword [ebp - 0x7c4], 8
jne 0x1000def2
mov dword [ebp - 0x7a0], 1
jmp 0x1000def9
and dword [ebp - 0x7a0], 0
push 1
lea ecx, [ebp - 0xc40]
call fcn.100186a0
mov ecx, dword [ebp - 0x7a0]
cmp ecx, dword [eax]
jge 0x1000df1c
mov dword [ebp - 0x9c8], 1
jmp 0x1000df23
and dword [ebp - 0x9c8], 0
imul eax, dword [ebp - 0x9c8], 0xffff
test eax, eax
jne 0x1000df3f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc9c], 0
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x334], eax
jle 0x1000df59
mov dword [ebp - 0x7a8], 1
jmp 0x1000df60
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7b0]
cmp eax, dword [ebp - 0x7a8]
je 0x1000df7a
mov dword [ebp - 0xba8], 1
jmp 0x1000df81
and dword [ebp - 0xba8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc9c]
cmp eax, dword [ebp - 0xba8]
jle 0x1000dfa2
mov dword [ebp - 0xd48], 1
jmp 0x1000dfa9
and dword [ebp - 0xd48], 0
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x1138], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xc9c]
push 1
lea ecx, [ebp - 0xc40]
call fcn.100186a0
add esi, dword [eax]
cmp esi, 1
je 0x1000dfe2
mov dword [ebp - 0x37c], 1
jmp 0x1000dfe9
and dword [ebp - 0x37c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x37c]
mov dword [ebp + eax - 0xc9c], ecx
cmp dword [ebp - 0x37c], 0
je 0x1000e011
mov dword [ebp - 0x9d0], 1
jmp 0x1000e018
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x7b0]
cmp dword [ebp - 0x9d0], eax
jle 0x1000e032
mov dword [ebp - 0x7b8], 1
jmp 0x1000e039
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 9
jle 0x1000e04e
mov dword [ebp - 0xae0], 1
jmp 0x1000e055
and dword [ebp - 0xae0], 0
push 1
lea ecx, [ebp - 0xc40]
call fcn.100186a0
mov esi, dword [ebp - 0xae0]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0xc40]
call fcn.100186a0
sub esi, dword [eax]
imul esi, dword [ebp - 0x7c0]
mov dword [ebp - 0xe38], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.10018684
movzx eax, byte [0x107345f8]
test eax, eax
je 0x1000e0b3
mov esi, 0x100857c0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10012a61
mov dword [ebp - 0x10], 0xd453
mov dword [ebp - 0x124], 0x207182b4
mov dword [ebp - 0x1d8], 7
mov dword [ebp - 0x7d8], 0x2e71cc54
mov dword [ebp - 0x9f8], 0xd4fe9304
mov dword [ebp - 0xb70], 0x4f86fc33
mov dword [ebp - 0x284], 0
jmp 0x1000e105
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jge 0x1000e121
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0xd50], 0x461d0ee3
jmp 0x1000e0f8
cmp dword [ebp - 0x10], 0
jne 0x1000e1c6
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
je 0x1000e137
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x1d8]
shl eax, 2
test eax, eax
jne 0x1000e156
mov eax, 0xa3f30045
test eax, eax
jne 0x1000e156
and dword [ebp - 0x9d8], 0
jmp 0x1000e160
mov dword [ebp - 0x9d8], 1
mov eax, dword [ebp - 0x1d8]
imul eax, dword [ebp - 0x9d8]
add eax, 0x6bd2
jne 0x1000e183
cmp dword [ebp - 0x10], 0
jne 0x1000e183
and dword [ebp - 0x7c8], 0
jmp 0x1000e18d
mov dword [ebp - 0x7c8], 1
cmp dword [ebp - 0x7c8], 0xffffffff
jge 0x1000e1a2
mov dword [ebp - 0xb68], 1
jmp 0x1000e1a9
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xb68]
jne 0x1000e1c6
cmp dword [ebp - 0x1d8], 0
jne 0x1000e1c6
and dword [ebp - 0x7d0], 0
jmp 0x1000e1d0
mov dword [ebp - 0x7d0], 1
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x113c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1144], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x1000e205
mov dword [ebp - 0x9e0], 1
jmp 0x1000e20c
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x7d8], eax
je 0x1000e22f
mov dword [ebp - 0xae8], 1
jmp 0x1000e236
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0xae8]
jle 0x1000e259
mov dword [ebp - 0x7e0], 1
jmp 0x1000e260
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x7e0], eax
jge 0x1000e277
mov dword [ebp - 0x9e8], 1
jmp 0x1000e27e
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x9e8], eax
jl 0x1000e295
mov dword [ebp - 0x7e8], 1
jmp 0x1000e29c
and dword [ebp - 0x7e8], 0
cmp dword [ebp - 0x7e8], 0xca6d786f
je 0x1000e2b4
mov dword [ebp - 0xbe8], 1
jmp 0x1000e2bb
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xbe8]
jle 0x1000e2d2
mov dword [ebp - 0x7f0], 1
jmp 0x1000e2d9
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x7f0], eax
jl 0x1000e2f0
mov dword [ebp - 0x9f0], 1
jmp 0x1000e2f7
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x9f0], eax
jle 0x1000e30e
mov dword [ebp - 0x7f8], 1
jmp 0x1000e315
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x7f8]
neg eax
cmp eax, dword [ebp - 0x10]
jl 0x1000e32e
mov dword [ebp - 0xaf0], 1
jmp 0x1000e335
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xaf0], eax
je 0x1000e34c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret