Function at 0x10008f75
Capabilities:
Accept command line arguments
Delete registry key
Enumerate gui resources
Get geographical location
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008008c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1234
call fcn.1007b480
push esi
push edi
mov dword [ebp - 0x290], 0xffffffff
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10008fcc
push 0x1857
push 0x2321
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
mov dword [ebp - 0x290], 0xffffffec
jmp 0x10008fe5
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0xfffffff2
jge 0x1000903e
mov dword [ebp - 0x7e8], 0x29bf39
mov dword [ebp - 0x107c], 6
mov dword [ebp - 0x1078], 6
mov dword [ebp - 0x1074], 6
mov dword [ebp - 0x1070], 6
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7e8]
mov dword [ebp + eax - 0x107c], ecx
mov dword [ebp - 0x7e8], 0xa0b8ee41
jmp 0x10008fd8
mov dword [ebp - 0x224], 0xffffffff
mov byte [ebp - 0x14c], 0
movzx eax, byte [ebp - 0x14c]
test eax, eax
je 0x10009071
push 0x1857
push 0x2321
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
mov dword [ebp - 0x224], 0xffffffec
jmp 0x1000908a
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xfffffff2
jge 0x100090e3
mov dword [ebp - 0xc20], 0x29bf39
mov dword [ebp - 0x109c], 6
mov dword [ebp - 0x1098], 6
mov dword [ebp - 0x1094], 6
mov dword [ebp - 0x1090], 6
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xc20]
mov dword [ebp + eax - 0x109c], ecx
mov dword [ebp - 0xc20], 0xa0b8ee41
jmp 0x1000907d
push 2
lea ecx, [ebp - 0x448]
call fcn.100168de
and dword [ebp - 4], 0
mov dword [ebp - 0xcb0], 0xffffffff
mov dword [ebp - 0xc78], 0x700d35da
mov dword [ebp - 0xd6c], 0x75761ac7
mov dword [ebp - 0x4c], 0
jmp 0x10009122
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1000913e
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x448]
call fcn.1001694b
mov dword [eax], 0x42a4
jmp 0x1000911b
mov dword [ebp - 0x4c], 0
jmp 0x1000914e
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10009164
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xd80], 1
jmp 0x10009147
mov dword [ebp - 0x4c], 0
jmp 0x10009174
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1000918a
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x10ec], 0x752570e8
jmp 0x1000916d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd80]
mov dword [ebp - 0xc28], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc28]
mov dword [ebp + eax - 0xd80], ecx
cmp dword [ebp - 0xc28], 0xfffffffb
jg 0x100091c5
mov dword [ebp - 0xc48], 1
jmp 0x100091cc
and dword [ebp - 0xc48], 0
push 1
lea ecx, [ebp - 0x448]
call fcn.1001694b
cmp dword [eax], 0xf58382bd
jae 0x100091ed
mov dword [ebp - 0xc30], 1
jmp 0x100091f4
and dword [ebp - 0xc30], 0
cmp dword [ebp - 0xc30], 0x9b3a00d0
ja 0x1000920c
mov dword [ebp - 0xc38], 1
jmp 0x10009213
and dword [ebp - 0xc38], 0
push 0
lea ecx, [ebp - 0x448]
call fcn.1001694b
mov ecx, dword [ebp - 0xc38]
cmp ecx, dword [eax]
jge 0x10009236
mov dword [ebp - 0xc40], 1
jmp 0x1000923d
and dword [ebp - 0xc40], 0
push 1
lea ecx, [ebp - 0x448]
call fcn.1001694b
mov esi, dword [ebp - 0xc40]
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x448]
call fcn.1001694b
cmp esi, dword [eax]
jle 0x10009270
mov dword [ebp - 0xc50], 1
jmp 0x10009277
and dword [ebp - 0xc50], 0
mov esi, dword [ebp - 0xc48]
add esi, dword [ebp - 0xc50]
push 1
lea ecx, [ebp - 0x448]
call fcn.1001694b
cmp esi, dword [eax]
jl 0x100092a0
mov dword [ebp - 0xc58], 1
jmp 0x100092a7
and dword [ebp - 0xc58], 0
push 1
lea ecx, [ebp - 0x448]
call fcn.1001694b
mov ecx, dword [ebp - 0xc58]
cmp ecx, dword [eax]
jl 0x100092ca
mov dword [ebp - 0xc60], 1
jmp 0x100092d1
and dword [ebp - 0xc60], 0
cmp dword [ebp - 0xc60], 0xffffffff
je 0x100092e6
mov dword [ebp - 0xc68], 1
jmp 0x100092ed
and dword [ebp - 0xc68], 0
push 1
lea ecx, [ebp - 0x448]
call fcn.1001694b
mov esi, eax
push 1
lea ecx, [ebp - 0x448]
call fcn.1001694b
mov ecx, dword [ebp - 0xc68]
add ecx, dword [eax]
cmp dword [esi], ecx
jl 0x10009321
mov dword [ebp - 0xc70], 1
jmp 0x10009328
and dword [ebp - 0xc70], 0
push 1
lea ecx, [ebp - 0x448]
call fcn.1001694b
mov eax, dword [eax]
add eax, dword [ebp - 0xc70]
mov dword [ebp - 0xcb0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd80]
mov dword [ebp - 0xc78], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc78]
mov dword [ebp + eax - 0x10ec], ecx
mov dword [ebp - 0xd6c], 0x1b07fb07
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x448]
call fcn.10016946
mov dword [ebp - 0x234], 0xffffffff
push 3
lea ecx, [ebp - 0xc88]
call fcn.100168de
mov dword [ebp - 4], 1
mov dword [ebp - 0x68], 1
mov dword [ebp - 0xd74], 0x8b1
mov dword [ebp - 0x400], 0xc6d21cd4
mov dword [ebp - 0x468], 1
mov dword [ebp - 0x2c4], 0
jmp 0x100093de
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 3
jge 0x10009400
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0xc88]
call fcn.1001694b
mov dword [eax], 0xdc85f70a
jmp 0x100093d1
mov dword [ebp - 0x68], 2
jmp 0x10009410
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x1000956b
mov dword [ebp - 0xd94], 0xe11a796d
push dword [ebp - 0x68]
lea ecx, [ebp - 0xc88]
call fcn.1001694b
mov esi, eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0xc88]
call fcn.1001694b
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10009454
mov dword [ebp - 0xc5c], 1
jmp 0x1000945b
and dword [ebp - 0xc5c], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0xc88]
call fcn.1001694b
mov eax, dword [eax]
add eax, 0x8b77
cmp eax, dword [ebp - 0xd74]
jle 0x10009484
mov dword [ebp - 0xa34], 1
jmp 0x1000948b
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x400], eax
jge 0x100094ae
mov dword [ebp - 0x458], 1
jmp 0x100094b5
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 0
jge 0x100094ca
mov dword [ebp - 0x460], 1
jmp 0x100094d1
and dword [ebp - 0x460], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0xc88]
call fcn.1001694b
mov esi, dword [ebp - 0xc5c]
sub esi, dword [eax]
push dword [ebp - 0x68]
lea ecx, [ebp - 0xc88]
call fcn.1001694b
mov ecx, dword [ebp - 0x460]
imul ecx, dword [eax]
cmp esi, ecx
jne 0x1000950e
mov dword [ebp - 0xa3c], 1
jmp 0x10009515
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x468], eax
mov esi, dword [ebp - 0x468]
push dword [ebp - 0x68]
lea ecx, [ebp - 0xc88]
call fcn.1001694b
cmp esi, dword [eax]
jle 0x10009545
mov dword [ebp - 0xb5c], 1
jmp 0x1000954c
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0xb5c]
mov dword [ebp - 0xd94], eax
cmp dword [ebp - 0x400], 0
je 0x10009566
jmp 0x10009409
jmp 0x10009409
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc88]
call fcn.10016946
mov byte [ebp - 0x11f], 0
push 3
lea ecx, [ebp - 0x368]
call fcn.100168de
mov dword [ebp - 4], 2
mov dword [ebp - 0x38], 0x5020f89b
mov dword [ebp - 0x94], 0
mov dword [ebp - 0xdb0], 0xfffffffa
mov dword [ebp - 0x22c], 0
jmp 0x100095c9
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x100095eb
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x368]
call fcn.1001694b
mov dword [eax], 0xdc85f70a
jmp 0x100095bc
mov dword [ebp - 0x38], 2
jmp 0x100095fb
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x10009a43
mov dword [ebp - 0x20], 1
mov dword [ebp - 0xa5c], 0x349b8ae0
mov dword [ebp - 0x4a8], 0x4674
mov dword [ebp - 0x20], 2
jmp 0x10009630
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x10009929
mov byte [ebp - 0x14e], 0
movzx eax, byte [ebp - 0x14e]
test eax, eax
je 0x10009659
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x368]
call fcn.1001694b
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax]
je 0x10009680
cmp dword [ebp - 0x20], 0
je 0x10009680
mov dword [ebp - 0x470], 1
jmp 0x10009687
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jg 0x100096a1
mov dword [ebp - 0xa44], 1
jmp 0x100096a8
and dword [ebp - 0xa44], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x368]
call fcn.1001694b
imul eax, dword [eax], 0xe780
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
neg eax
cmp eax, dword [ebp - 0xa44]
je 0x100096de
mov dword [ebp - 0x478], 1
jmp 0x100096e5
and dword [ebp - 0x478], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x368]
call fcn.1001694b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x478]
jl 0x10009900
mov dword [ebp - 0x314], 8
cmp dword [ebp - 0x314], 0
jne 0x100098ac
push dword [ebp - 0x38]
lea ecx, [ebp - 0x368]
call fcn.1001694b
cmp dword [ebp - 0x94], 0
jne 0x1000974b
mov dword [ebp - 0x94], 1
cmp dword [ebp - 0x94], 0
jne 0x1000974b
and dword [ebp - 0x490], 0
jmp 0x10009755
mov dword [ebp - 0x490], 1
push dword [ebp - 0x38]
lea ecx, [ebp - 0x368]
call fcn.1001694b
mov esi, eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x368]
call fcn.1001694b
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1000978a
xor eax, eax
inc eax
je 0x1000978a
mov dword [ebp - 0xbec], 1
jmp 0x10009791
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0xbec], eax
jle 0x100097ab
mov dword [ebp - 0x480], 1
jmp 0x100097b2
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0x480], eax
jle 0x100097cc
mov dword [ebp - 0xa4c], 1
jmp 0x100097d3
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0xa4c]
inc eax
je 0x100097ee
cmp dword [ebp - 0x38], 0
je 0x100097ee
mov dword [ebp - 0x488], 1
jmp 0x100097f5
and dword [ebp - 0x488], 0
push 2
lea ecx, [ebp - 0x368]
call fcn.1001694b
mov ecx, dword [ebp - 0x488]
cmp ecx, dword [eax]
je 0x10009818
mov dword [ebp - 0xb64], 1
jmp 0x1000981f
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xb64], eax
jge 0x10009836
mov dword [ebp - 0xa54], 1
jmp 0x1000983d
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x490]
cmp eax, dword [ebp - 0xa54]
je 0x10009857
mov dword [ebp - 0x498], 1
jmp 0x1000985e
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 0
jl 0x10009873
mov dword [ebp - 0xd9c], 1
jmp 0x1000987a
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x10dc], eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x368]
call fcn.1001694b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10c8], eax
cmp dword [ebp - 0x20], 0
jne 0x100098ac
and dword [ebp - 0xc3c], 0
jmp 0x100098b6
mov dword [ebp - 0xc3c], 1
push dword [ebp - 0x38]
lea ecx, [ebp - 0x368]
call fcn.1001694b
mov ecx, dword [ebp - 0xc3c]
cmp ecx, dword [eax]
jge 0x100098da
mov dword [ebp - 0x4a0], 1
jmp 0x100098e1
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x4a0]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0xdb0], eax
cmp dword [ebp - 0x20], 0
je 0x100098fe
jmp 0x10009629
jmp 0x10009924
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x10009924
push 0x193f
push 0x2574
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x10009629
mov dword [ebp - 0x94], 0
jmp 0x10009942
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jg 0x10009a3e
mov dword [ebp - 0x20], 0
jmp 0x1000995f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x10009a39
mov dword [ebp - 0xdb8], 0xa349a2dd
mov esi, dword [ebp - 0x20]
push 2
lea ecx, [ebp - 0x368]
call fcn.1001694b
sub esi, dword [eax]
mov dword [ebp - 0xa5c], esi
mov esi, dword [ebp - 0xa5c]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x368]
call fcn.1001694b
cmp dword [eax], esi
jg 0x100099af
mov dword [ebp - 0x4b0], 1
jmp 0x100099b6
and dword [ebp - 0x4b0], 0
mov dword [ebp - 0x4a8], 1
mov eax, dword [ebp - 0x4a8]
add eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x94]
jle 0x100099dd
mov dword [ebp - 0xb6c], 1
jmp 0x100099e4
and dword [ebp - 0xb6c], 0
cmp dword [ebp - 0xb6c], 0x1ae2efaa
jge 0x100099fc
mov dword [ebp - 0xa64], 1
jmp 0x10009a03
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x4b0]
imul eax, dword [ebp - 0xa64]
cmp eax, dword [ebp - 0x20]
jl 0x10009a21
mov dword [ebp - 0x4b8], 1
jmp 0x10009a28
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0xdb8], eax
jmp 0x10009958
jmp 0x10009935
jmp 0x100095f4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368]
call fcn.10016946
movzx eax, byte [ebp - 0x11f]
test eax, eax
je 0x10009a74
push 0x1857
push 0x2321
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
mov dword [ebp - 0x234], 0xffffffec
jmp 0x10009a8d
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xfffffff2
jge 0x1000a3d0
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x158], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10d0], eax
cmp dword [ebp - 0x14], 0
je 0x10009ad5
cmp dword [ebp - 0x14], 0
je 0x10009ad5
mov dword [ebp - 0xbf4], 1
jmp 0x10009adc
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xbf4]
jg 0x10009af3
mov dword [ebp - 0x4c0], 1
jmp 0x10009afa
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4c0], eax
je 0x10009b11
mov dword [ebp - 0xa6c], 1
jmp 0x10009b18
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xa6c], eax
jne 0x10009b2f
mov dword [ebp - 0x4c8], 1
jmp 0x10009b36
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4c8], eax
jg 0x10009b4d
mov dword [ebp - 0xb74], 1
jmp 0x10009b54
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0xb74]
sub eax, 0x61581472
je 0x10009b7f
mov eax, 0xdc99
test eax, eax
je 0x10009b7f
mov eax, 0x365dea31
test eax, eax
je 0x10009b7f
mov dword [ebp - 0x4d0], 1
jmp 0x10009b86
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4d0], eax
jge 0x10009b9d
mov dword [ebp - 0xa74], 1
jmp 0x10009ba4
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xa74]
jg 0x10009bbb
mov dword [ebp - 0x4d8], 1
jmp 0x10009bc2
and dword [ebp - 0x4d8], 0
push 0xfffffffffffffffd
pop eax
sub eax, dword [ebp - 0x4d8]
sub eax, dword [ebp - 0x14]
cmp eax, 1
jae 0x10009c00
mov byte [ebp - 0x150], 0
movzx eax, byte [ebp - 0x150]
test eax, eax
je 0x10009bfb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x10009faa
mov dword [ebp - 0x8c], 2
mov dword [ebp - 0xee4], 0xfff7
mov dword [ebp - 0xee0], 0xfff7
mov dword [ebp - 0xedc], 0xfff7
mov dword [ebp - 0xed8], 0xfff7
mov dword [ebp - 0x14], 0xffffffeb
jmp 0x10009c42
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10009e54
mov dword [ebp - 0xac], 0xc4177fd8
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x11dc], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x14], eax
je 0x10009c79
mov dword [ebp - 0x868], 1
jmp 0x10009c80
and dword [ebp - 0x868], 0
cmp dword [ebp - 0x868], 2
je 0x10009c95
mov dword [ebp - 0x864], 1
jmp 0x10009c9c
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x4e0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4e0]
mov dword [ebp + eax - 0xee4], ecx
mov eax, dword [ebp - 0x4e0]
cmp eax, dword [ebp - 0x864]
jle 0x10009cd4
mov dword [ebp - 0x4e8], 1
jmp 0x10009cdb
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
neg eax
add eax, 0xf323
imul eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x14]
je 0x10009d00
mov dword [ebp - 0x880], 1
jmp 0x10009d07
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x880], eax
jne 0x10009d1e
mov dword [ebp - 0x4f0], 1
jmp 0x10009d25
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jne 0x10009d46
mov dword [ebp - 0xdc0], 1
jmp 0x10009d4d
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10d8], eax
cmp dword [ebp - 0x8c], 0xd2c6
jne 0x10009d6e
mov dword [ebp - 0x888], 1
jmp 0x10009d75
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x888], eax
jl 0x10009d8f
mov dword [ebp - 0x4f8], 1
jmp 0x10009d96
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xac]
cmp eax, 9
ja 0x10009dbc
mov dword [ebp - 0x890], 1
jmp 0x10009dc3
and dword [ebp - 0x890], 0
cmp dword [ebp - 0x890], 0
jne 0x10009dd8
mov dword [ebp - 0x500], 1
jmp 0x10009ddf
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xac], 3
jmp 0x10009e04
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x10009e4f
mov dword [ebp - 0x8c], 0
jmp 0x10009e26
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jg 0x10009e4d
mov byte [ebp - 0x11b], 0
movzx eax, byte [ebp - 0x11b]
test eax, eax
je 0x10009e4b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10009e19
jmp 0x10009df7
jmp 0x10009c3b
mov dword [ebp - 0x14], 0xd
jmp 0x10009e64
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xc
jne 0x10009faa
mov dword [ebp - 0xdc8], 6
mov dword [ebp - 0x158], 0
jmp 0x10009e91
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 4
jge 0x10009ead
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0xee4], 0
jmp 0x10009e84
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xee4], 0
jne 0x10009f8f
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xee4]
mov dword [ebp - 0x1160], eax
mov eax, 0x2df100f8
test eax, eax
jne 0x10009eea
cmp dword [ebp - 0x14], 0
jne 0x10009eea
and dword [ebp - 0x898], 0
jmp 0x10009ef4
mov dword [ebp - 0x898], 1
cmp dword [ebp - 0x898], 0xcdaa9320
jae 0x10009f0c
mov dword [ebp - 0x508], 1
jmp 0x10009f13
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0x47df
jl 0x10009f2b
mov dword [ebp - 0x8a0], 1
jmp 0x10009f32
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0x7d6e
jg 0x10009f4a
mov dword [ebp - 0x510], 1
jmp 0x10009f51
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffff
jb 0x10009f72
mov dword [ebp - 0x8a8], 1
jmp 0x10009f79
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x8a8]
add eax, 0x9ab6
jne 0x10009f8f
and dword [ebp - 0x518], 0
jmp 0x10009f99
mov dword [ebp - 0x518], 1
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0xdc8], eax
jmp 0x10009e5d
mov dword [ebp - 0x520], 0x29bf39
mov dword [ebp - 0x2cc], 0xfffffff7
mov dword [ebp - 0x2cc], 0xf
jmp 0x10009fd7
mov eax, dword [ebp - 0x2cc]
dec eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 7
jg 0x1000a0df
mov dword [ebp - 0x9c], 0x20fe6e32
push 1
lea ecx, [ebp - 0xf50]
call fcn.100168de
mov dword [ebp - 4], 3
mov dword [ebp - 0x23c], 0
jmp 0x1000a01b
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jge 0x1000a03d
push dword [ebp - 0x23c]
lea ecx, [ebp - 0xf50]
call fcn.1001694b
mov dword [eax], 0xffff
jmp 0x1000a00e
mov dword [ebp - 0x9c], 0
jmp 0x1000a056
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x17
jl 0x1000a07f
mov byte [ebp - 0x13f], 0
movzx eax, byte [ebp - 0x13f]
test eax, eax
je 0x1000a07d
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1000a049
mov dword [ebp - 0x9c], 0
jmp 0x1000a098
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jg 0x1000a0cb
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xf50]
call fcn.1001694b
mov esi, eax
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xf50]
call fcn.1001694b
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000a08b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf50]
call fcn.10016946
jmp 0x10009fca
mov dword [ebp - 0x10bc], 6
mov dword [ebp - 0x10b8], 6
mov dword [ebp - 0x10b4], 6
mov dword [ebp - 0x10b0], 6
mov dword [ebp - 0x358], 0
jmp 0x1000a120
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 1
jge 0x1000a13c
mov eax, dword [ebp - 0x358]
mov dword [ebp + eax*4 - 0x8b0], 0
jmp 0x1000a113
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1000a160
push 0x20c6
push 0x1de7
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8b0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8b0], eax
mov dword [ebp - 0xf0], 0x2cb13638
mov dword [ebp - 0x244], 0
jmp 0x1000a19e
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jge 0x1000a1ba
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0xfe4], 0x3342eb9
jmp 0x1000a191
mov dword [ebp - 0xf0], 1
jmp 0x1000a1d3
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x1000a255
mov dword [ebp - 0x1dc], 0xc4530722
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1000a1fe
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [ebp - 0x1dc], 0
jmp 0x1000a217
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jg 0x1000a250
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1000a23c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp + eax*4 - 0xfe4], 0
je 0x1000a24e
jmp 0x1000a20a
jmp 0x1000a20a
jmp 0x1000a1c6
mov dword [ebp - 0xf0], 0
jmp 0x1000a26e
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x1000a28a
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0xfe4], 6
jmp 0x1000a261
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x520]
mov dword [ebp + eax - 0x10bc], ecx
mov dword [ebp - 0x19c], 0xdd1e1e87
mov dword [ebp - 0x10e0], 0
mov dword [ebp - 0x2d4], 0
jmp 0x1000a2c9
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 3
jge 0x1000a2e5
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0x1048], 0xfffffffd
jmp 0x1000a2bc
mov dword [ebp - 0x19c], 0
jmp 0x1000a2fe
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jg 0x1000a398
mov dword [ebp - 0x1e8], 0x56a9ef72
mov dword [ebp - 0x1e8], 0
jmp 0x1000a32e
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jg 0x1000a393
mov dword [ebp - 0x24c], 0xf7d65121
mov dword [ebp - 0x24c], 0
jmp 0x1000a35a
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jg 0x1000a391
mov eax, dword [ebp - 0x19c]
cmp dword [ebp + eax*4 - 0x1048], 0
je 0x1000a375
jmp 0x1000a391
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x1e8]
mov eax, dword [ebp + eax*4 - 0x1048]
mov dword [ebp + ecx*4 - 0x1048], eax
jmp 0x1000a34d
jmp 0x1000a321
jmp 0x1000a2f1
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x1000a3c1
push 0x1af1
push 0x1cf3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [ebp - 0x520], 0xa0b8ee41
jmp 0x10009a80
mov dword [ebp - 0x31c], 3
mov dword [ebp - 0x408], 3
push 1
lea ecx, [ebp - 0xe30]
call fcn.100168de
mov dword [ebp - 4], 4
mov dword [ebp - 0x8f8], 0xffffffff
mov dword [ebp - 0xb4], 0
jmp 0x1000a41b
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1000a43d
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xe30]
call fcn.1001694b
mov dword [eax], 0x17f75960
jmp 0x1000a40e
mov dword [ebp - 0xb4], 0
jmp 0x1000a456
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1000a472
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x540], 0xaafa0b2b
jmp 0x1000a449
mov dword [ebp - 0x31c], 0xfffffff2
jmp 0x1000a48b
mov eax, dword [ebp - 0x31c]
dec eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0xffffffe6
jg 0x1000a78e
mov dword [ebp - 0xdd8], 1
mov dword [ebp - 0xdd0], 0x551da622
mov dword [ebp - 0x8d0], 0x79e672ca
mov dword [ebp - 0x8f0], 0x4da86284
mov dword [ebp - 0x410], 1
mov dword [ebp - 0x254], 0
jmp 0x1000a4e3
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 4
jge 0x1000a4ff
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0xf34], 0x7adf1adb
jmp 0x1000a4d6
mov eax, dword [ebp - 0x410]
dec eax
mov dword [ebp - 0x410], eax
mov esi, dword [ebp - 0xdd0]
push 0
lea ecx, [ebp - 0xe30]
call fcn.1001694b
cmp esi, dword [eax]
jge 0x1000a52f
mov dword [ebp - 0x8d8], 1
jmp 0x1000a536
and dword [ebp - 0x8d8], 0
mov dword [ebp - 0x408], 6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf34]
cmp eax, dword [ebp - 0x408]
jl 0x1000a561
mov dword [ebp - 0x8b8], 1
jmp 0x1000a568
and dword [ebp - 0x8b8], 0
push 0
lea ecx, [ebp - 0xe30]
call fcn.1001694b
mov ecx, dword [ebp - 0x8b8]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0xf34]
jl 0x1000a599
mov dword [ebp - 0x528], 1
jmp 0x1000a5a0
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
dec eax
dec eax
mov dword [ebp - 0x8c0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8c0]
mov dword [ebp + eax - 0x540], ecx
mov eax, dword [ebp - 0x8f8]
add eax, dword [ebp - 0x8c0]
jne 0x1000a5ea
mov eax, 0x914a1265
test eax, eax
jne 0x1000a5ea
cmp dword [ebp - 0x408], 0
jne 0x1000a5ea
and dword [ebp - 0x530], 0
jmp 0x1000a5f4
mov dword [ebp - 0x530], 1
push 0
lea ecx, [ebp - 0xe30]
call fcn.1001694b
mov ecx, dword [ebp - 0x530]
sub ecx, dword [eax]
jne 0x1000a61b
push 8
pop eax
test eax, eax
jne 0x1000a61b
and dword [ebp - 0x8c8], 0
jmp 0x1000a625
mov dword [ebp - 0x8c8], 1
imul eax, dword [ebp - 0x8c8], 0xfffffff8
sub eax, 6
je 0x1000a646
cmp dword [ebp - 0x410], 0
je 0x1000a646
mov dword [ebp - 0x538], 1
jmp 0x1000a64d
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x11a4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf34]
imul eax, dword [ebp - 0x8f0]
test eax, eax
jne 0x1000a696
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x540], 0
jne 0x1000a696
and dword [ebp - 0x548], 0
jmp 0x1000a6a0
mov dword [ebp - 0x548], 1
mov eax, dword [ebp - 0x8d8]
cmp eax, dword [ebp - 0x548]
jg 0x1000a6ba
mov dword [ebp - 0x8e0], 1
jmp 0x1000a6c1
and dword [ebp - 0x8e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf34]
cmp dword [ebp - 0x8e0], eax
je 0x1000a6e2
mov dword [ebp - 0x550], 1
jmp 0x1000a6e9
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0
jl 0x1000a6fe
mov dword [ebp - 0x8e8], 1
jmp 0x1000a705
and dword [ebp - 0x8e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf34]
cmp dword [ebp - 0x8e8], eax
jge 0x1000a726
mov dword [ebp - 0x558], 1
jmp 0x1000a72d
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0xdd8]
cmp dword [ebp - 0x558], eax
jg 0x1000a747
mov dword [ebp - 0x560], 1
jmp 0x1000a74e
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x8f0]
cmp dword [ebp - 0x560], eax
je 0x1000a768
mov dword [ebp - 0x568], 1
jmp 0x1000a76f
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x8f8]
imul eax, dword [ebp - 0x568]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf34], eax
jmp 0x1000a47e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe30]
call fcn.10016946
mov dword [ebp - 0x2dc], 3
mov dword [ebp - 0x418], 3
push 1
lea ecx, [ebp - 0xe40]
call fcn.100168de
mov dword [ebp - 4], 5
mov dword [ebp - 0x940], 0xffffffff
mov dword [ebp - 0xe8], 0
jmp 0x1000a7e8
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x1000a80a
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xe40]
call fcn.1001694b
mov dword [eax], 0x17f75960
jmp 0x1000a7db
mov dword [ebp - 0xe8], 0
jmp 0x1000a823
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x1000a83f
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x588], 0xaafa0b2b
jmp 0x1000a816
mov dword [ebp - 0x2dc], 0xfffffff2
jmp 0x1000a858
mov eax, dword [ebp - 0x2dc]
dec eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0xffffffe6
jg 0x1000ab5b
mov dword [ebp - 0xde8], 1
mov dword [ebp - 0xde0], 0x551da622
mov dword [ebp - 0x918], 0x79e672ca
mov dword [ebp - 0x938], 0x4da86284
mov dword [ebp - 0x420], 1
mov dword [ebp - 0x25c], 0
jmp 0x1000a8b0
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 4
jge 0x1000a8cc
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0xf04], 0x7adf1adb
jmp 0x1000a8a3
mov eax, dword [ebp - 0x420]
dec eax
mov dword [ebp - 0x420], eax
mov esi, dword [ebp - 0xde0]
push 0
lea ecx, [ebp - 0xe40]
call fcn.1001694b
cmp esi, dword [eax]
jge 0x1000a8fc
mov dword [ebp - 0x920], 1
jmp 0x1000a903
and dword [ebp - 0x920], 0
mov dword [ebp - 0x418], 6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf04]
cmp eax, dword [ebp - 0x418]
jl 0x1000a92e
mov dword [ebp - 0x900], 1
jmp 0x1000a935
and dword [ebp - 0x900], 0
push 0
lea ecx, [ebp - 0xe40]
call fcn.1001694b
mov ecx, dword [ebp - 0x900]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0xf04]
jl 0x1000a966
mov dword [ebp - 0x570], 1
jmp 0x1000a96d
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
dec eax
dec eax
mov dword [ebp - 0x908], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x908]
mov dword [ebp + eax - 0x588], ecx
mov eax, dword [ebp - 0x940]
add eax, dword [ebp - 0x908]
jne 0x1000a9b7
mov eax, 0x914a1265
test eax, eax
jne 0x1000a9b7
cmp dword [ebp - 0x418], 0
jne 0x1000a9b7
and dword [ebp - 0x578], 0
jmp 0x1000a9c1
mov dword [ebp - 0x578], 1
push 0
lea ecx, [ebp - 0xe40]
call fcn.1001694b
mov ecx, dword [ebp - 0x578]
sub ecx, dword [eax]
jne 0x1000a9e8
push 8
pop eax
test eax, eax
jne 0x1000a9e8
and dword [ebp - 0x910], 0
jmp 0x1000a9f2
mov dword [ebp - 0x910], 1
imul eax, dword [ebp - 0x910], 0xfffffff8
sub eax, 6
je 0x1000aa13
cmp dword [ebp - 0x420], 0
je 0x1000aa13
mov dword [ebp - 0x580], 1
jmp 0x1000aa1a
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x11c4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf04]
imul eax, dword [ebp - 0x938]
test eax, eax
jne 0x1000aa63
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x588], 0
jne 0x1000aa63
and dword [ebp - 0x590], 0
jmp 0x1000aa6d
mov dword [ebp - 0x590], 1
mov eax, dword [ebp - 0x920]
cmp eax, dword [ebp - 0x590]
jg 0x1000aa87
mov dword [ebp - 0x928], 1
jmp 0x1000aa8e
and dword [ebp - 0x928], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf04]
cmp dword [ebp - 0x928], eax
je 0x1000aaaf
mov dword [ebp - 0x598], 1
jmp 0x1000aab6
and dword [ebp - 0x598], 0
cmp dword [ebp - 0x598], 0
jl 0x1000aacb
mov dword [ebp - 0x930], 1
jmp 0x1000aad2
and dword [ebp - 0x930], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf04]
cmp dword [ebp - 0x930], eax
jge 0x1000aaf3
mov dword [ebp - 0x5a0], 1
jmp 0x1000aafa
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0xde8]
cmp dword [ebp - 0x5a0], eax
jg 0x1000ab14
mov dword [ebp - 0x5a8], 1
jmp 0x1000ab1b
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x938]
cmp dword [ebp - 0x5a8], eax
je 0x1000ab35
mov dword [ebp - 0x5b0], 1
jmp 0x1000ab3c
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x940]
imul eax, dword [ebp - 0x5b0]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf04], eax
jmp 0x1000a84b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe40]
call fcn.10016946
mov dword [ebp - 0x350], 3
mov dword [ebp - 0x428], 3
push 1
lea ecx, [ebp - 0xe50]
call fcn.100168de
mov dword [ebp - 4], 6
mov dword [ebp - 0x988], 0xffffffff
mov dword [ebp - 0xbc], 0
jmp 0x1000abb5
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x1000abd7
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xe50]
call fcn.1001694b
mov dword [eax], 0x17f75960
jmp 0x1000aba8
mov dword [ebp - 0xbc], 0
jmp 0x1000abf0
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x1000ac0c
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x5d0], 0xaafa0b2b
jmp 0x1000abe3
mov dword [ebp - 0x350], 0xfffffff2
jmp 0x1000ac25
mov eax, dword [ebp - 0x350]
dec eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0xffffffe6
jg 0x1000af28
mov dword [ebp - 0xdf8], 1
mov dword [ebp - 0xdf0], 0x551da622
mov dword [ebp - 0x960], 0x79e672ca
mov dword [ebp - 0x980], 0x4da86284
mov dword [ebp - 0x430], 1
mov dword [ebp - 0x264], 0
jmp 0x1000ac7d
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 4
jge 0x1000ac99
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0xf24], 0x7adf1adb
jmp 0x1000ac70
mov eax, dword [ebp - 0x430]
dec eax
mov dword [ebp - 0x430], eax
mov esi, dword [ebp - 0xdf0]
push 0
lea ecx, [ebp - 0xe50]
call fcn.1001694b
cmp esi, dword [eax]
jge 0x1000acc9
mov dword [ebp - 0x968], 1
jmp 0x1000acd0
and dword [ebp - 0x968], 0
mov dword [ebp - 0x428], 6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf24]
cmp eax, dword [ebp - 0x428]
jl 0x1000acfb
mov dword [ebp - 0x948], 1
jmp 0x1000ad02
and dword [ebp - 0x948], 0
push 0
lea ecx, [ebp - 0xe50]
call fcn.1001694b
mov ecx, dword [ebp - 0x948]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0xf24]
jl 0x1000ad33
mov dword [ebp - 0x5b8], 1
jmp 0x1000ad3a
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
dec eax
dec eax
mov dword [ebp - 0x950], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x950]
mov dword [ebp + eax - 0x5d0], ecx
mov eax, dword [ebp - 0x988]
add eax, dword [ebp - 0x950]
jne 0x1000ad84
mov eax, 0x914a1265
test eax, eax
jne 0x1000ad84
cmp dword [ebp - 0x428], 0
jne 0x1000ad84
and dword [ebp - 0x5c0], 0
jmp 0x1000ad8e
mov dword [ebp - 0x5c0], 1
push 0
lea ecx, [ebp - 0xe50]
call fcn.1001694b
mov ecx, dword [ebp - 0x5c0]
sub ecx, dword [eax]
jne 0x1000adb5
push 8
pop eax
test eax, eax
jne 0x1000adb5
and dword [ebp - 0x958], 0
jmp 0x1000adbf
mov dword [ebp - 0x958], 1
imul eax, dword [ebp - 0x958], 0xfffffff8
sub eax, 6
je 0x1000ade0
cmp dword [ebp - 0x430], 0
je 0x1000ade0
mov dword [ebp - 0x5c8], 1
jmp 0x1000ade7
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x960], eax
mov eax, dword [ebp - 0x960]
mov dword [ebp - 0x1100], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf24]
imul eax, dword [ebp - 0x980]
test eax, eax
jne 0x1000ae30
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5d0], 0
jne 0x1000ae30
and dword [ebp - 0x5d8], 0
jmp 0x1000ae3a
mov dword [ebp - 0x5d8], 1
mov eax, dword [ebp - 0x968]
cmp eax, dword [ebp - 0x5d8]
jg 0x1000ae54
mov dword [ebp - 0x970], 1
jmp 0x1000ae5b
and dword [ebp - 0x970], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf24]
cmp dword [ebp - 0x970], eax
je 0x1000ae7c
mov dword [ebp - 0x5e0], 1
jmp 0x1000ae83
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 0
jl 0x1000ae98
mov dword [ebp - 0x978], 1
jmp 0x1000ae9f
and dword [ebp - 0x978], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf24]
cmp dword [ebp - 0x978], eax
jge 0x1000aec0
mov dword [ebp - 0x5e8], 1
jmp 0x1000aec7
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0xdf8]
cmp dword [ebp - 0x5e8], eax
jg 0x1000aee1
mov dword [ebp - 0x5f0], 1
jmp 0x1000aee8
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x980]
cmp dword [ebp - 0x5f0], eax
je 0x1000af02
mov dword [ebp - 0x5f8], 1
jmp 0x1000af09
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x988]
imul eax, dword [ebp - 0x5f8]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf24], eax
jmp 0x1000ac18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe50]
call fcn.10016946
mov dword [ebp - 0x2e4], 0x48261f9c
mov dword [ebp - 0x2e4], 0xffffffee
jmp 0x1000af5a
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 4
jl 0x1000aff5
push 1
lea ecx, [ebp - 0x1054]
call fcn.100168de
mov dword [ebp - 4], 7
mov dword [ebp - 0x26c], 0
jmp 0x1000af94
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1000afb6
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x1054]
call fcn.1001694b
mov dword [eax], 0x34e6d4f2
jmp 0x1000af87
push 0
lea ecx, [ebp - 0x1054]
call fcn.1001694b
mov dword [eax], 0xfffffffe
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x1000afe1
call dword [sym.imp.USER32.dll_GetCapture]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1054]
call fcn.10016946
jmp 0x1000af4d
mov dword [ebp - 0x32c], 3
mov dword [ebp - 0x438], 3
push 1
lea ecx, [ebp - 0xe60]
call fcn.100168de
mov dword [ebp - 4], 8
mov dword [ebp - 0x9d0], 0xffffffff
mov dword [ebp - 0xe0], 0
jmp 0x1000b040
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x1000b062
push dword [ebp - 0xe0]
lea ecx, [ebp - 0xe60]
call fcn.1001694b
mov dword [eax], 0x17f75960
jmp 0x1000b033
mov dword [ebp - 0xe0], 0
jmp 0x1000b07b
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x1000b097
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x618], 0xaafa0b2b
jmp 0x1000b06e
mov dword [ebp - 0x32c], 0xfffffff2
jmp 0x1000b0b0
mov eax, dword [ebp - 0x32c]
dec eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0xffffffe6
jg 0x1000b3b3
mov dword [ebp - 0xe08], 1
mov dword [ebp - 0xe00], 0x551da622
mov dword [ebp - 0x9a8], 0x79e672ca
mov dword [ebp - 0x9c8], 0x4da86284
mov dword [ebp - 0x3c4], 1
mov dword [ebp - 0x274], 0
jmp 0x1000b108
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 4
jge 0x1000b124
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0xf44], 0x7adf1adb
jmp 0x1000b0fb
mov eax, dword [ebp - 0x3c4]
dec eax
mov dword [ebp - 0x3c4], eax
mov esi, dword [ebp - 0xe00]
push 0
lea ecx, [ebp - 0xe60]
call fcn.1001694b
cmp esi, dword [eax]
jge 0x1000b154
mov dword [ebp - 0x9b0], 1
jmp 0x1000b15b
and dword [ebp - 0x9b0], 0
mov dword [ebp - 0x438], 6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf44]
cmp eax, dword [ebp - 0x438]
jl 0x1000b186
mov dword [ebp - 0x990], 1
jmp 0x1000b18d
and dword [ebp - 0x990], 0
push 0
lea ecx, [ebp - 0xe60]
call fcn.1001694b
mov ecx, dword [ebp - 0x990]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0xf44]
jl 0x1000b1be
mov dword [ebp - 0x600], 1
jmp 0x1000b1c5
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
dec eax
dec eax
mov dword [ebp - 0x998], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x998]
mov dword [ebp + eax - 0x618], ecx
mov eax, dword [ebp - 0x9d0]
add eax, dword [ebp - 0x998]
jne 0x1000b20f
mov eax, 0x914a1265
test eax, eax
jne 0x1000b20f
cmp dword [ebp - 0x438], 0
jne 0x1000b20f
and dword [ebp - 0x608], 0
jmp 0x1000b219
mov dword [ebp - 0x608], 1
push 0
lea ecx, [ebp - 0xe60]
call fcn.1001694b
mov ecx, dword [ebp - 0x608]
sub ecx, dword [eax]
jne 0x1000b240
push 8
pop eax
test eax, eax
jne 0x1000b240
and dword [ebp - 0x9a0], 0
jmp 0x1000b24a
mov dword [ebp - 0x9a0], 1
imul eax, dword [ebp - 0x9a0], 0xfffffff8
sub eax, 6
je 0x1000b26b
cmp dword [ebp - 0x3c4], 0
je 0x1000b26b
mov dword [ebp - 0x610], 1
jmp 0x1000b272
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x1174], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf44]
imul eax, dword [ebp - 0x9c8]
test eax, eax
jne 0x1000b2bb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x618], 0
jne 0x1000b2bb
and dword [ebp - 0x620], 0
jmp 0x1000b2c5
mov dword [ebp - 0x620], 1
mov eax, dword [ebp - 0x9b0]
cmp eax, dword [ebp - 0x620]
jg 0x1000b2df
mov dword [ebp - 0x9b8], 1
jmp 0x1000b2e6
and dword [ebp - 0x9b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf44]
cmp dword [ebp - 0x9b8], eax
je 0x1000b307
mov dword [ebp - 0x628], 1
jmp 0x1000b30e
and dword [ebp - 0x628], 0
cmp dword [ebp - 0x628], 0
jl 0x1000b323
mov dword [ebp - 0x9c0], 1
jmp 0x1000b32a
and dword [ebp - 0x9c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf44]
cmp dword [ebp - 0x9c0], eax
jge 0x1000b34b
mov dword [ebp - 0x630], 1
jmp 0x1000b352
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0xe08]
cmp dword [ebp - 0x630], eax
jg 0x1000b36c
mov dword [ebp - 0x638], 1
jmp 0x1000b373
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x9c8]
cmp dword [ebp - 0x638], eax
je 0x1000b38d
mov dword [ebp - 0x640], 1
jmp 0x1000b394
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x9d0]
imul eax, dword [ebp - 0x640]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf44], eax
jmp 0x1000b0a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe60]
call fcn.10016946
push 3
lea ecx, [ebp - 0x38c]
call fcn.100168de
mov dword [ebp - 4], 9
mov dword [ebp - 0x3c], 0x5020f89b
mov dword [ebp - 0x84], 0
mov dword [ebp - 0xe18], 0xfffffffa
mov dword [ebp - 0x2ec], 0
jmp 0x1000b40a
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 3
jge 0x1000b42c
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0x38c]
call fcn.1001694b
mov dword [eax], 0xdc85f70a
jmp 0x1000b3fd
mov dword [ebp - 0x3c], 2
jmp 0x1000b43c
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1000b884
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x678], 0x349b8ae0
mov dword [ebp - 0xa10], 0x4674
mov dword [ebp - 0x28], 2
jmp 0x1000b471
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1000b76a
mov byte [ebp - 0x143], 0
movzx eax, byte [ebp - 0x143]
test eax, eax
je 0x1000b49a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38c]
call fcn.1001694b
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax]
je 0x1000b4c1
cmp dword [ebp - 0x28], 0
je 0x1000b4c1
mov dword [ebp - 0x9d8], 1
jmp 0x1000b4c8
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x9d8]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jg 0x1000b4e2
mov dword [ebp - 0x648], 1
jmp 0x1000b4e9
and dword [ebp - 0x648], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38c]
call fcn.1001694b
imul eax, dword [eax], 0xe780
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
neg eax
cmp eax, dword [ebp - 0x648]
je 0x1000b51f
mov dword [ebp - 0x9e0], 1
jmp 0x1000b526
and dword [ebp - 0x9e0], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38c]
call fcn.1001694b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x9e0]
jl 0x1000b741
mov dword [ebp - 0x27c], 8
cmp dword [ebp - 0x27c], 0
jne 0x1000b6ed
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38c]
call fcn.1001694b
cmp dword [ebp - 0x84], 0
jne 0x1000b58c
mov dword [ebp - 0x84], 1
cmp dword [ebp - 0x84], 0
jne 0x1000b58c
and dword [ebp - 0x9f8], 0
jmp 0x1000b596
mov dword [ebp - 0x9f8], 1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38c]
call fcn.1001694b
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38c]
call fcn.1001694b
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1000b5cb
xor eax, eax
inc eax
je 0x1000b5cb
mov dword [ebp - 0x650], 1
jmp 0x1000b5d2
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x650], eax
jle 0x1000b5ec
mov dword [ebp - 0x9e8], 1
jmp 0x1000b5f3
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x9e8], eax
jle 0x1000b60d
mov dword [ebp - 0x658], 1
jmp 0x1000b614
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
inc eax
je 0x1000b62f
cmp dword [ebp - 0x3c], 0
je 0x1000b62f
mov dword [ebp - 0x9f0], 1
jmp 0x1000b636
and dword [ebp - 0x9f0], 0
push 2
lea ecx, [ebp - 0x38c]
call fcn.1001694b
mov ecx, dword [ebp - 0x9f0]
cmp ecx, dword [eax]
je 0x1000b659
mov dword [ebp - 0x660], 1
jmp 0x1000b660
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x660], eax
jge 0x1000b677
mov dword [ebp - 0x668], 1
jmp 0x1000b67e
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x9f8]
cmp eax, dword [ebp - 0x668]
je 0x1000b698
mov dword [ebp - 0xa00], 1
jmp 0x1000b69f
and dword [ebp - 0xa00], 0
cmp dword [ebp - 0xa00], 0
jl 0x1000b6b4
mov dword [ebp - 0xe10], 1
jmp 0x1000b6bb
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x1108], eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38c]
call fcn.1001694b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x11ac], eax
cmp dword [ebp - 0x28], 0
jne 0x1000b6ed
and dword [ebp - 0x670], 0
jmp 0x1000b6f7
mov dword [ebp - 0x670], 1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38c]
call fcn.1001694b
mov ecx, dword [ebp - 0x670]
cmp ecx, dword [eax]
jge 0x1000b71b
mov dword [ebp - 0xa08], 1
jmp 0x1000b722
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0xa08]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe18], eax
cmp dword [ebp - 0x28], 0
je 0x1000b73f
jmp 0x1000b46a
jmp 0x1000b765
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000b765
push 0x193f
push 0x2574
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x1000b46a
mov dword [ebp - 0x84], 0
jmp 0x1000b783
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jg 0x1000b87f
mov dword [ebp - 0x28], 0
jmp 0x1000b7a0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x1000b87a
mov dword [ebp - 0xe20], 0xa349a2dd
mov esi, dword [ebp - 0x28]
push 2
lea ecx, [ebp - 0x38c]
call fcn.1001694b
sub esi, dword [eax]
mov dword [ebp - 0x678], esi
mov esi, dword [ebp - 0x678]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x38c]
call fcn.1001694b
cmp dword [eax], esi
jg 0x1000b7f0
mov dword [ebp - 0xa18], 1
jmp 0x1000b7f7
and dword [ebp - 0xa18], 0
mov dword [ebp - 0xa10], 1
mov eax, dword [ebp - 0xa10]
add eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x84]
jle 0x1000b81e
mov dword [ebp - 0x680], 1
jmp 0x1000b825
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 0x1ae2efaa
jge 0x1000b83d
mov dword [ebp - 0x688], 1
jmp 0x1000b844
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0xa18]
imul eax, dword [ebp - 0x688]
cmp eax, dword [ebp - 0x28]
jl 0x1000b862
mov dword [ebp - 0xa20], 1
jmp 0x1000b869
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0xa20]
mov dword [ebp - 0xe20], eax
jmp 0x1000b799
jmp 0x1000b776
jmp 0x1000b435
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38c]
call fcn.10016946
mov dword [ebp - 0x354], 3
mov dword [ebp - 0x404], 3
push 1
lea ecx, [ebp - 0xe70]
call fcn.100168de
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x6d0], 0xffffffff
mov dword [ebp - 0xc4], 0
jmp 0x1000b8de
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x1000b900
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xe70]
call fcn.1001694b
mov dword [eax], 0x17f75960
jmp 0x1000b8d1
mov dword [ebp - 0xc4], 0
jmp 0x1000b919
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x1000b935
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0xa40], 0xaafa0b2b
jmp 0x1000b90c
mov dword [ebp - 0x354], 0xfffffff2
jmp 0x1000b94e
mov eax, dword [ebp - 0x354]
dec eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0xffffffe6
jg 0x1000bc51
mov dword [ebp - 0xd3c], 1
mov dword [ebp - 0xd64], 0x551da622
mov dword [ebp - 0x6a8], 0x79e672ca
mov dword [ebp - 0x6c8], 0x4da86284
mov dword [ebp - 0x3cc], 1
mov dword [ebp - 0x284], 0
jmp 0x1000b9a6
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 4
jge 0x1000b9c2
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0xf14], 0x7adf1adb
jmp 0x1000b999
mov eax, dword [ebp - 0x3cc]
dec eax
mov dword [ebp - 0x3cc], eax
mov esi, dword [ebp - 0xd64]
push 0
lea ecx, [ebp - 0xe70]
call fcn.1001694b
cmp esi, dword [eax]
jge 0x1000b9f2
mov dword [ebp - 0x6b0], 1
jmp 0x1000b9f9
and dword [ebp - 0x6b0], 0
mov dword [ebp - 0x404], 6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf14]
cmp eax, dword [ebp - 0x404]
jl 0x1000ba24
mov dword [ebp - 0x690], 1
jmp 0x1000ba2b
and dword [ebp - 0x690], 0
push 0
lea ecx, [ebp - 0xe70]
call fcn.1001694b
mov ecx, dword [ebp - 0x690]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0xf14]
jl 0x1000ba5c
mov dword [ebp - 0xa28], 1
jmp 0x1000ba63
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0xa28]
dec eax
dec eax
mov dword [ebp - 0x698], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x698]
mov dword [ebp + eax - 0xa40], ecx
mov eax, dword [ebp - 0x6d0]
add eax, dword [ebp - 0x698]
jne 0x1000baad
mov eax, 0x914a1265
test eax, eax
jne 0x1000baad
cmp dword [ebp - 0x404], 0
jne 0x1000baad
and dword [ebp - 0xa30], 0
jmp 0x1000bab7
mov dword [ebp - 0xa30], 1
push 0
lea ecx, [ebp - 0xe70]
call fcn.1001694b
mov ecx, dword [ebp - 0xa30]
sub ecx, dword [eax]
jne 0x1000bade
push 8
pop eax
test eax, eax
jne 0x1000bade
and dword [ebp - 0x6a0], 0
jmp 0x1000bae8
mov dword [ebp - 0x6a0], 1
imul eax, dword [ebp - 0x6a0], 0xfffffff8
sub eax, 6
je 0x1000bb09
cmp dword [ebp - 0x3cc], 0
je 0x1000bb09
mov dword [ebp - 0xa38], 1
jmp 0x1000bb10
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0xa38]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x1110], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf14]
imul eax, dword [ebp - 0x6c8]
test eax, eax
jne 0x1000bb59
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa40], 0
jne 0x1000bb59
and dword [ebp - 0xa48], 0
jmp 0x1000bb63
mov dword [ebp - 0xa48], 1
mov eax, dword [ebp - 0x6b0]
cmp eax, dword [ebp - 0xa48]
jg 0x1000bb7d
mov dword [ebp - 0x6b8], 1
jmp 0x1000bb84
and dword [ebp - 0x6b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf14]
cmp dword [ebp - 0x6b8], eax
je 0x1000bba5
mov dword [ebp - 0xa50], 1
jmp 0x1000bbac
and dword [ebp - 0xa50], 0
cmp dword [ebp - 0xa50], 0
jl 0x1000bbc1
mov dword [ebp - 0x6c0], 1
jmp 0x1000bbc8
and dword [ebp - 0x6c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf14]
cmp dword [ebp - 0x6c0], eax
jge 0x1000bbe9
mov dword [ebp - 0xa58], 1
jmp 0x1000bbf0
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0xd3c]
cmp dword [ebp - 0xa58], eax
jg 0x1000bc0a
mov dword [ebp - 0xa60], 1
jmp 0x1000bc11
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x6c8]
cmp dword [ebp - 0xa60], eax
je 0x1000bc2b
mov dword [ebp - 0xa68], 1
jmp 0x1000bc32
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x6d0]
imul eax, dword [ebp - 0xa68]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf14], eax
jmp 0x1000b941
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe70]
call fcn.10016946
mov dword [ebp - 0x2f4], 0x48261f9c
mov dword [ebp - 0x2f4], 0xffffffee
jmp 0x1000bc83
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 4
jl 0x1000bd1e
push 1
lea ecx, [ebp - 0x1060]
call fcn.100168de
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x28c], 0
jmp 0x1000bcbd
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jge 0x1000bcdf
push dword [ebp - 0x28c]
lea ecx, [ebp - 0x1060]
call fcn.1001694b
mov dword [eax], 0x34e6d4f2
jmp 0x1000bcb0
push 0
lea ecx, [ebp - 0x1060]
call fcn.1001694b
mov dword [eax], 0xfffffffe
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x1000bd0a
call dword [sym.imp.USER32.dll_GetCapture]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1060]
call fcn.10016946
jmp 0x1000bc76
movzx eax, byte [0x106734d8]
test eax, eax
je 0x1000bd3c
mov esi, 0x100875c0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10012502
push 3
lea ecx, [ebp - 0x374]
call fcn.100168de
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x40], 0x5020f89b
mov dword [ebp - 0x88], 0
mov dword [ebp - 0xcf4], 0xfffffffa
mov dword [ebp - 0x33c], 0
jmp 0x1000bd84
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 3
jge 0x1000bda6
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x374]
call fcn.1001694b
mov dword [eax], 0xdc85f70a
jmp 0x1000bd77
mov dword [ebp - 0x40], 2
jmp 0x1000bdb6
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1000c1fe
mov dword [ebp - 0x24], 1
mov dword [ebp - 0xaa0], 0x349b8ae0
mov dword [ebp - 0x710], 0x4674
mov dword [ebp - 0x24], 2
jmp 0x1000bdeb
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1000c0e4
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x1000be14
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x374]
call fcn.1001694b
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax]
je 0x1000be3b
cmp dword [ebp - 0x24], 0
je 0x1000be3b
mov dword [ebp - 0x6d8], 1
jmp 0x1000be42
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jg 0x1000be5c
mov dword [ebp - 0xa70], 1
jmp 0x1000be63
and dword [ebp - 0xa70], 0
push dword [ebp - 0x40]
lea ecx, [ebp - 0x374]
call fcn.1001694b
imul eax, dword [eax], 0xe780
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
neg eax
cmp eax, dword [ebp - 0xa70]
je 0x1000be99
mov dword [ebp - 0x6e0], 1
jmp 0x1000bea0
and dword [ebp - 0x6e0], 0
push dword [ebp - 0x40]
lea ecx, [ebp - 0x374]
call fcn.1001694b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6e0]
jl 0x1000c0bb
mov dword [ebp - 0x294], 8
cmp dword [ebp - 0x294], 0
jne 0x1000c067
push dword [ebp - 0x40]
lea ecx, [ebp - 0x374]
call fcn.1001694b
cmp dword [ebp - 0x88], 0
jne 0x1000bf06
mov dword [ebp - 0x88], 1
cmp dword [ebp - 0x88], 0
jne 0x1000bf06
and dword [ebp - 0x6f8], 0
jmp 0x1000bf10
mov dword [ebp - 0x6f8], 1
push dword [ebp - 0x40]
lea ecx, [ebp - 0x374]
call fcn.1001694b
mov esi, eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x374]
call fcn.1001694b
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1000bf45
xor eax, eax
inc eax
je 0x1000bf45
mov dword [ebp - 0xa78], 1
jmp 0x1000bf4c
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x294]
cmp dword [ebp - 0xa78], eax
jle 0x1000bf66
mov dword [ebp - 0x6e8], 1
jmp 0x1000bf6d
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x294]
cmp dword [ebp - 0x6e8], eax
jle 0x1000bf87
mov dword [ebp - 0xa80], 1
jmp 0x1000bf8e
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0xa80]
inc eax
je 0x1000bfa9
cmp dword [ebp - 0x40], 0
je 0x1000bfa9
mov dword [ebp - 0x6f0], 1
jmp 0x1000bfb0
and dword [ebp - 0x6f0], 0
push 2
lea ecx, [ebp - 0x374]
call fcn.1001694b
mov ecx, dword [ebp - 0x6f0]
cmp ecx, dword [eax]
je 0x1000bfd3
mov dword [ebp - 0xa88], 1
jmp 0x1000bfda
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xa88], eax
jge 0x1000bff1
mov dword [ebp - 0xa90], 1
jmp 0x1000bff8
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x6f8]
cmp eax, dword [ebp - 0xa90]
je 0x1000c012
mov dword [ebp - 0x700], 1
jmp 0x1000c019
and dword [ebp - 0x700], 0
cmp dword [ebp - 0x700], 0
jl 0x1000c02e
mov dword [ebp - 0xd0c], 1
jmp 0x1000c035
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x117c], eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x374]
call fcn.1001694b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x24], 0
jne 0x1000c067
and dword [ebp - 0xa98], 0
jmp 0x1000c071
mov dword [ebp - 0xa98], 1
push dword [ebp - 0x40]
lea ecx, [ebp - 0x374]
call fcn.1001694b
mov ecx, dword [ebp - 0xa98]
cmp ecx, dword [eax]
jge 0x1000c095
mov dword [ebp - 0x708], 1
jmp 0x1000c09c
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x708]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0xcf4], eax
cmp dword [ebp - 0x24], 0
je 0x1000c0b9
jmp 0x1000bde4
jmp 0x1000c0df
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x1000c0df
push 0x193f
push 0x2574
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x1000bde4
mov dword [ebp - 0x88], 0
jmp 0x1000c0fd
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jg 0x1000c1f9
mov dword [ebp - 0x24], 0
jmp 0x1000c11a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x1000c1f4
mov dword [ebp - 0xcc8], 0xa349a2dd
mov esi, dword [ebp - 0x24]
push 2
lea ecx, [ebp - 0x374]
call fcn.1001694b
sub esi, dword [eax]
mov dword [ebp - 0xaa0], esi
mov esi, dword [ebp - 0xaa0]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x374]
call fcn.1001694b
cmp dword [eax], esi
jg 0x1000c16a
mov dword [ebp - 0x718], 1
jmp 0x1000c171
and dword [ebp - 0x718], 0
mov dword [ebp - 0x710], 1
mov eax, dword [ebp - 0x710]
add eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x88]
jle 0x1000c198
mov dword [ebp - 0xaa8], 1
jmp 0x1000c19f
and dword [ebp - 0xaa8], 0
cmp dword [ebp - 0xaa8], 0x1ae2efaa
jge 0x1000c1b7
mov dword [ebp - 0xab0], 1
jmp 0x1000c1be
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x718]
imul eax, dword [ebp - 0xab0]
cmp eax, dword [ebp - 0x24]
jl 0x1000c1dc
mov dword [ebp - 0x720], 1
jmp 0x1000c1e3
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0xcc8], eax
jmp 0x1000c113
jmp 0x1000c0f0
jmp 0x1000bdaf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x374]
call fcn.10016946
mov dword [ebp - 0x200], 0xac204e2d
push 1
lea ecx, [ebp - 0xf98]
call fcn.100168de
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x11d4], 1
mov dword [ebp - 0xcd8], 0x52027495
mov dword [ebp - 0x1a8], 0xf889e022
mov dword [ebp - 0x2fc], 0
jmp 0x1000c262
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 1
jge 0x1000c284
push dword [ebp - 0x2fc]
lea ecx, [ebp - 0xf98]
call fcn.1001694b
mov dword [eax], 0x8bea1220
jmp 0x1000c255
mov dword [ebp - 0x200], 0
jmp 0x1000c29d
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x1b
jle 0x1000c65f
mov dword [ebp - 0x1f0], 0x95e17ca0
mov dword [ebp - 0xac0], 0x1cd1ac8c
mov dword [ebp - 0x1f0], 0x10
jmp 0x1000c2d7
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0xfffffffb
jg 0x1000c65a
mov dword [ebp - 0x208], 0x3a0b8ee4
mov dword [ebp - 0x29c], 0
jmp 0x1000c307
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jge 0x1000c323
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x730], 0xd72b90f9
jmp 0x1000c2fa
mov dword [ebp - 0x208], 0
jmp 0x1000c33c
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jl 0x1000c655
mov dword [ebp - 0x101c], 1
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1010], 1
lea ecx, [ebp - 0x3f5]
call fcn.10008d33
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x101c]
push eax
lea ecx, [ebp - 0x11e8]
call fcn.1001695a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xca0]
call fcn.10016920
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x740], 0xfffffff6
mov dword [ebp - 0xdb4], 0xd0188753
push 3
lea ecx, [ebp - 0xca0]
call fcn.1001694b
and dword [eax], 0
jmp 0x1000c3f4
push 3
lea ecx, [ebp - 0xca0]
call fcn.1001694b
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xab8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xab8]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0xca0]
call fcn.1001694b
cmp dword [eax], 0
jg 0x1000c629
push 1
lea ecx, [ebp - 0xe80]
call fcn.100168de
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x35c], 0
jmp 0x1000c434
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 1
jge 0x1000c456
push dword [ebp - 0x35c]
lea ecx, [ebp - 0xe80]
call fcn.1001694b
mov dword [eax], 0x6dd2
jmp 0x1000c427
push 0
lea ecx, [ebp - 0xe80]
call fcn.1001694b
mov dword [ebp - 0x728], eax
mov eax, dword [ebp - 0x728]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x728]
mov dword [ecx], eax
mov dword [ebp - 0x1a8], 0
jmp 0x1000c493
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jl 0x1000c615
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x730], 1
mov dword [ebp - 0xac0], 1
cmp dword [ebp - 0xac0], 0xdb5a
jge 0x1000c4d3
mov dword [ebp - 0xe74], 1
jmp 0x1000c4da
and dword [ebp - 0xe74], 0
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0xf98]
call fcn.1001694b
push 3
lea ecx, [ebp - 0xca0]
call fcn.1001694b
push dword [eax]
lea ecx, [ebp - 0xf98]
call fcn.1001694b
mov esi, eax
mov eax, dword [ebp - 0x1a8]
mov edi, dword [ebp + eax*4 - 0x730]
push 3
lea ecx, [ebp - 0xca0]
call fcn.1001694b
add edi, dword [eax]
cmp dword [esi], edi
jle 0x1000c533
mov dword [ebp - 0xac8], 1
jmp 0x1000c53a
and dword [ebp - 0xac8], 0
cmp dword [ebp - 0xac8], 0x29207965
jge 0x1000c552
mov dword [ebp - 0x738], 1
jmp 0x1000c559
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x738], eax
jne 0x1000c573
mov dword [ebp - 0xcd0], 1
jmp 0x1000c57a
and dword [ebp - 0xcd0], 0
push 0
lea ecx, [ebp - 0xe80]
call fcn.1001694b
push 0
lea ecx, [ebp - 0xe80]
call fcn.1001694b
cmp dword [eax], 0
jne 0x1000c5ab
mov eax, 0xf356
test eax, eax
jne 0x1000c5ab
and dword [ebp - 0xad0], 0
jmp 0x1000c5b5
mov dword [ebp - 0xad0], 1
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0x740], eax
mov esi, dword [ebp - 0x740]
dec esi
push 3
lea ecx, [ebp - 0xca0]
call fcn.1001694b
cmp esi, dword [eax]
jg 0x1000c5e5
mov dword [ebp - 0xad8], 1
jmp 0x1000c5ec
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xdb4], eax
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1000c610
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x1000c486
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xe80]
call fcn.10016946
jmp 0x1000c3d0
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x1000c641
call dword [sym.imp.USER32.dll_GetCapture]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xca0]
call fcn.10016946
jmp 0x1000c32f
jmp 0x1000c2ca
jmp 0x1000c290
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0xcd8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf98]
call fcn.10016946
mov dword [ebp - 0x2a4], 3
mov dword [ebp - 0x424], 3
push 1
lea ecx, [ebp - 0xe90]
call fcn.100168de
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x788], 0xffffffff
mov dword [ebp - 0xe4], 0
jmp 0x1000c6c5
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x1000c6e7
push dword [ebp - 0xe4]
lea ecx, [ebp - 0xe90]
call fcn.1001694b
mov dword [eax], 0x17f75960
jmp 0x1000c6b8
mov dword [ebp - 0xe4], 0
jmp 0x1000c700
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x1000c71c
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0xaf8], 0xaafa0b2b
jmp 0x1000c6f3
mov dword [ebp - 0x2a4], 0xfffffff2
jmp 0x1000c735
mov eax, dword [ebp - 0x2a4]
dec eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0xffffffe6
jg 0x1000ca38
mov dword [ebp - 0xce0], 1
mov dword [ebp - 0xe1c], 0x551da622
mov dword [ebp - 0x760], 0x79e672ca
mov dword [ebp - 0x780], 0x4da86284
mov dword [ebp - 0x3d4], 1
mov dword [ebp - 0x304], 0
jmp 0x1000c78d
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 4
jge 0x1000c7a9
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0xef4], 0x7adf1adb
jmp 0x1000c780
mov eax, dword [ebp - 0x3d4]
dec eax
mov dword [ebp - 0x3d4], eax
mov esi, dword [ebp - 0xe1c]
push 0
lea ecx, [ebp - 0xe90]
call fcn.1001694b
cmp esi, dword [eax]
jge 0x1000c7d9
mov dword [ebp - 0x768], 1
jmp 0x1000c7e0
and dword [ebp - 0x768], 0
mov dword [ebp - 0x424], 6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xef4]
cmp eax, dword [ebp - 0x424]
jl 0x1000c80b
mov dword [ebp - 0x748], 1
jmp 0x1000c812
and dword [ebp - 0x748], 0
push 0
lea ecx, [ebp - 0xe90]
call fcn.1001694b
mov ecx, dword [ebp - 0x748]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0xef4]
jl 0x1000c843
mov dword [ebp - 0xae0], 1
jmp 0x1000c84a
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0xae0]
dec eax
dec eax
mov dword [ebp - 0x750], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x750]
mov dword [ebp + eax - 0xaf8], ecx
mov eax, dword [ebp - 0x788]
add eax, dword [ebp - 0x750]
jne 0x1000c894
mov eax, 0x914a1265
test eax, eax
jne 0x1000c894
cmp dword [ebp - 0x424], 0
jne 0x1000c894
and dword [ebp - 0xae8], 0
jmp 0x1000c89e
mov dword [ebp - 0xae8], 1
push 0
lea ecx, [ebp - 0xe90]
call fcn.1001694b
mov ecx, dword [ebp - 0xae8]
sub ecx, dword [eax]
jne 0x1000c8c5
push 8
pop eax
test eax, eax
jne 0x1000c8c5
and dword [ebp - 0x758], 0
jmp 0x1000c8cf
mov dword [ebp - 0x758], 1
imul eax, dword [ebp - 0x758], 0xfffffff8
sub eax, 6
je 0x1000c8f0
cmp dword [ebp - 0x3d4], 0
je 0x1000c8f0
mov dword [ebp - 0xaf0], 1
jmp 0x1000c8f7
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x1120], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xef4]
imul eax, dword [ebp - 0x780]
test eax, eax
jne 0x1000c940
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xaf8], 0
jne 0x1000c940
and dword [ebp - 0xb00], 0
jmp 0x1000c94a
mov dword [ebp - 0xb00], 1
mov eax, dword [ebp - 0x768]
cmp eax, dword [ebp - 0xb00]
jg 0x1000c964
mov dword [ebp - 0x770], 1
jmp 0x1000c96b
and dword [ebp - 0x770], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xef4]
cmp dword [ebp - 0x770], eax
je 0x1000c98c
mov dword [ebp - 0xb08], 1
jmp 0x1000c993
and dword [ebp - 0xb08], 0
cmp dword [ebp - 0xb08], 0
jl 0x1000c9a8
mov dword [ebp - 0x778], 1
jmp 0x1000c9af
and dword [ebp - 0x778], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xef4]
cmp dword [ebp - 0x778], eax
jge 0x1000c9d0
mov dword [ebp - 0xb10], 1
jmp 0x1000c9d7
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0xce0]
cmp dword [ebp - 0xb10], eax
jg 0x1000c9f1
mov dword [ebp - 0xb18], 1
jmp 0x1000c9f8
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0x780]
cmp dword [ebp - 0xb18], eax
je 0x1000ca12
mov dword [ebp - 0xb20], 1
jmp 0x1000ca19
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0x788]
imul eax, dword [ebp - 0xb20]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xef4], eax
jmp 0x1000c728
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe90]
call fcn.10016946
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x434], 0x8b243e5e
mov dword [ebp - 0x1184], 0x726f2c0e
mov dword [ebp - 0x3dc], 0xffffffff
mov dword [ebp - 0xcc], 0
jmp 0x1000ca85
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x1000ca9e
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x60], 1
jmp 0x1000ca78
mov dword [ebp - 0xcc], 0
jmp 0x1000cab7
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x1000cad3
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x1210], 2
jmp 0x1000caaa
mov dword [ebp - 0x2c], 0
jmp 0x1000cae3
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x1000cf84
mov dword [ebp - 0xb78], 0xdbf12959
mov dword [ebp - 0x7c8], 0
mov dword [ebp - 0x2ac], 0
jmp 0x1000cb1a
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 4
jge 0x1000cb36
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0xfdc], 0xffffffff
jmp 0x1000cb0d
mov byte [ebp - 0x12b], 0
movzx eax, byte [ebp - 0x12b]
test eax, eax
je 0x1000cb52
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x60], 0
je 0x1000cd50
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x1128], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x60], 0xffffffff
ja 0x1000cb83
mov dword [ebp - 0x790], 1
jmp 0x1000cb8a
and dword [ebp - 0x790], 0
cmp dword [ebp - 0x790], 0x9a275ff4
jbe 0x1000cba2
mov dword [ebp - 0xb28], 1
jmp 0x1000cba9
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x60]
cmp dword [ebp - 0xb28], eax
je 0x1000cbc4
mov dword [ebp - 0x798], 1
jmp 0x1000cbcb
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x1000cbf5
mov eax, 0x1521
test eax, eax
je 0x1000cbf5
mov dword [ebp - 0xb30], 1
jmp 0x1000cbfc
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0xb30]
test eax, eax
jne 0x1000cc1d
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x60], 0
jne 0x1000cc1d
and dword [ebp - 0xdbc], 0
jmp 0x1000cc27
mov dword [ebp - 0xdbc], 1
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x60]
cmp dword [ebp + eax - 0x60], ecx
jge 0x1000cc49
mov dword [ebp - 0x7a0], 1
jmp 0x1000cc50
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x7a0], eax
jne 0x1000cc67
mov dword [ebp - 0xb38], 1
jmp 0x1000cc6e
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0xb38]
sub eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
cmp eax, dword [ebp + ecx*4 - 0x60]
jle 0x1000cc8c
mov dword [ebp - 0xce8], 1
jmp 0x1000cc93
and dword [ebp - 0xce8], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xfdc], 0xd68c
jge 0x1000ccb2
mov dword [ebp - 0x7a8], 1
jmp 0x1000ccb9
and dword [ebp - 0x7a8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xfdc]
cmp dword [ebp - 0x7a8], eax
jg 0x1000ccda
mov dword [ebp - 0xb40], 1
jmp 0x1000cce1
and dword [ebp - 0xb40], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
add eax, dword [ebp - 0xb40]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xfdc]
jge 0x1000cd0c
mov dword [ebp - 0x7b0], 1
jmp 0x1000cd13
and dword [ebp - 0x7b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x7b0], eax
jl 0x1000cd31
mov dword [ebp - 0xb48], 1
jmp 0x1000cd38
and dword [ebp - 0xb48], 0
cmp dword [ebp - 0xb48], 0x5b6d
jge 0x1000cd50
mov dword [ebp - 0x7b8], 1
jmp 0x1000cd57
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 0xd72276b8
jb 0x1000cd6f
mov dword [ebp - 0x40c], 1
jmp 0x1000cd76
and dword [ebp - 0x40c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x40c]
mov dword [ebp + eax - 0xfdc], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x40c], eax
jg 0x1000cda0
mov dword [ebp - 0xb50], 1
jmp 0x1000cda7
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x60]
cmp dword [ebp - 0xb50], eax
jge 0x1000cdc2
mov dword [ebp - 0x7c0], 1
jmp 0x1000cdc9
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x7c0], eax
jne 0x1000cde0
mov dword [ebp - 0xb58], 1
jmp 0x1000cde7
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb78], eax
cmp dword [ebp - 0x2c], 0
je 0x1000ce62
mov dword [ebp - 0x11b4], 1
mov dword [ebp - 0x34c], 0
jmp 0x1000ce1c
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 4
jge 0x1000ce38
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0x1240], 0xcbf698ba
jmp 0x1000ce0f
mov byte [ebp - 0x147], 0
movzx eax, byte [ebp - 0x147]
test eax, eax
je 0x1000ce50
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [ebp - 0x3dc]
dec eax
mov dword [ebp - 0x3dc], eax
jmp 0x1000cf7f
mov dword [ebp - 0xec4], 0x92a1dd6b
mov dword [ebp - 0xcf0], 0
mov dword [ebp - 0xb60], 0x6bfe21da
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000cea3
push 0x233a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [ebp - 0xec4]
mov dword [ebp - 0x7c8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xfdc]
cmp eax, dword [ebp - 0x7c8]
jne 0x1000ced0
mov dword [ebp - 0x7d8], 1
jmp 0x1000ced7
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x1130], eax
mov eax, dword [ebp - 0xcf0]
neg eax
mov dword [ebp - 0xb60], eax
cmp dword [ebp - 0xb60], 2
jge 0x1000cf06
mov dword [ebp - 0x7d0], 1
jmp 0x1000cf0d
and dword [ebp - 0x7d0], 0
cmp dword [ebp - 0x7d0], 0x936a74b4
jne 0x1000cf25
mov dword [ebp - 0xb68], 1
jmp 0x1000cf2c
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0xb68], eax
jle 0x1000cf46
mov dword [ebp - 0xb70], 1
jmp 0x1000cf4d
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0x7d8]
add eax, dword [ebp - 0xb70]
cmp eax, 0xbc1f
jne 0x1000cf6c
mov dword [ebp - 0x7e0], 1
jmp 0x1000cf73
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0xb78], eax
jmp 0x1000cadc
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1000cfb1
push 0xb78
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
mov dword [ebp - 0x118c], 0x100875c0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x160], 0xccb97252
mov dword [ebp - 0x70], 0xfffffff6
mov dword [ebp - 0xf8], 0xe13f5e3
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1b0], 0x390f3bd7
mov dword [ebp - 0xd00], 0xb93b5720
mov dword [ebp - 0x830], 0x251b
mov dword [ebp - 0xa4], 0
jmp 0x1000d021
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x1000d03d
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x114], 0x45db
jmp 0x1000d014
mov dword [ebp - 0xa4], 0
jmp 0x1000d056
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1000d072
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x328], 2
jmp 0x1000d049
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x328]
cmp dword [ebp + eax - 0x328], ecx
jl 0x1000d09a
mov dword [ebp - 0xdc4], 1
jmp 0x1000d0a1
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0x104]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x328]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x328]
cmp eax, dword [ebp - 0xf8]
je 0x1000d0d5
mov dword [ebp - 0x44c], 1
jmp 0x1000d0dc
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x160], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x328]
cmp dword [ebp - 0x160], eax
je 0x1000d10a
mov dword [ebp - 0xb80], 1
jmp 0x1000d111
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1138], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x11cc], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1140], eax
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x328]
add eax, dword [ebp - 0x1d0]
cmp eax, 0xae9f9034
jae 0x1000d16b
mov dword [ebp - 0x7f0], 1
jmp 0x1000d172
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x7f0]
neg eax
je 0x1000d191
cmp dword [ebp - 0x1d0], 0
je 0x1000d191
mov dword [ebp - 0xb88], 1
jmp 0x1000d198
and dword [ebp - 0xb88], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x328]
cmp dword [ebp - 0xb88], eax
jle 0x1000d1b9
mov dword [ebp - 0xcf8], 1
jmp 0x1000d1c0
and dword [ebp - 0xcf8], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x328], 0xffff
jae 0x1000d1df
mov dword [ebp - 0xe24], 1
jmp 0x1000d1e6
and dword [ebp - 0xe24], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x114], 0xe44
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x328], 8
je 0x1000d213
mov dword [ebp - 0x3e4], 1
jmp 0x1000d21a
and dword [ebp - 0x3e4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp + eax - 0x328], ecx
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x1b0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x114], 0xfffe
jbe 0x1000d258
mov dword [ebp - 0x810], 1
jmp 0x1000d25f
and dword [ebp - 0x810], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1b0]
cmp dword [ebp + eax - 0x328], ecx
jle 0x1000d27f
mov dword [ebp - 0x7f8], 1
jmp 0x1000d286
and dword [ebp - 0x7f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x328]
cmp dword [ebp - 0x7f8], eax
je 0x1000d2a7
mov dword [ebp - 0xb90], 1
jmp 0x1000d2ae
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x1d0]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x114]
add ecx, dword [ebp - 0xb90]
sub eax, ecx
cmp eax, dword [ebp - 0x1d0]
jl 0x1000d2e9
cmp dword [ebp - 0x70], 0
jne 0x1000d2e9
cmp dword [ebp - 0xf8], 0
jne 0x1000d2e9
and dword [ebp - 0x800], 0
jmp 0x1000d2f3
mov dword [ebp - 0x800], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x800]
sub ecx, dword [ebp + eax - 0x114]
je 0x1000d323
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x328], 0
je 0x1000d323
mov dword [ebp - 0xb98], 1
jmp 0x1000d32a
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0x160], eax
or eax, 0xffffffff
cmp eax, 0x883e
jne 0x1000d34c
mov dword [ebp - 0x808], 1
jmp 0x1000d353
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x1d0]
add eax, dword [ebp - 0x808]
neg eax
jne 0x1000d375
cmp dword [ebp - 0x104], 0
jne 0x1000d375
and dword [ebp - 0xba0], 0
jmp 0x1000d37f
mov dword [ebp - 0xba0], 1
imul eax, dword [ebp - 0xba0], 0x1734
cmp dword [ebp - 0x810], eax
jg 0x1000d4bc
mov dword [ebp - 0xf8], 0
jmp 0x1000d3ae
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jg 0x1000d4b7
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp + eax*4 - 0x114]
mov dword [ebp - 0x1194], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp + eax*4 - 0x114]
sub eax, 0x116104db
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x328], eax
mov dword [ebp - 0x104], 0
jmp 0x1000d406
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jg 0x1000d4b2
mov dword [ebp - 0x160], 0
jmp 0x1000d42c
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jl 0x1000d4ad
mov dword [ebp - 0x70], 0
jmp 0x1000d445
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jg 0x1000d4a8
mov dword [ebp - 0x1b0], 0
jmp 0x1000d464
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jg 0x1000d4a6
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0x114]
mov dword [ebp + ecx*4 - 0x114], eax
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x1000d4a4
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x1000d457
jmp 0x1000d43e
jmp 0x1000d41f
jmp 0x1000d3f9
jmp 0x1000d3a1
jmp 0x1000d5f6
mov dword [ebp - 0x2b4], 0xdfd6825d
mov dword [ebp - 0xdcc], 0
cmp dword [ebp - 0x2b4], 1
jge 0x1000d4e5
mov dword [ebp - 0x828], 1
jmp 0x1000d4ec
and dword [ebp - 0x828], 0
mov eax, 0x1b4c5108
sub eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x2b4]
jle 0x1000d508
mov dword [ebp - 0xba8], 1
jmp 0x1000d50f
and dword [ebp - 0xba8], 0
cmp dword [ebp - 0xba8], 0xcda4f1df
jbe 0x1000d527
mov dword [ebp - 0x818], 1
jmp 0x1000d52e
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0xd00]
cmp eax, dword [ebp - 0x818]
jne 0x1000d548
mov dword [ebp - 0xbb0], 1
jmp 0x1000d54f
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0xbb0]
add eax, 0x8d5b
je 0x1000d571
cmp dword [ebp - 0x2b4], 0
je 0x1000d571
mov dword [ebp - 0x820], 1
jmp 0x1000d578
and dword [ebp - 0x820], 0
cmp dword [ebp - 0x820], 0x43c6211e
jl 0x1000d590
mov dword [ebp - 0xbb8], 1
jmp 0x1000d597
and dword [ebp - 0xbb8], 0
cmp dword [ebp - 0xbb8], 0x5d11
jl 0x1000d5af
mov dword [ebp - 0xbc0], 1
jmp 0x1000d5b6
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0x828]
add eax, dword [ebp - 0xbc0]
sub eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0xdcc], eax
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1000d5f6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x30c], 0x48261f9c
mov dword [ebp - 0x30c], 0xffffffee
jmp 0x1000d619
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 4
jl 0x1000d6b4
push 1
lea ecx, [ebp - 0x106c]
call fcn.100168de
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x2bc], 0
jmp 0x1000d653
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 1
jge 0x1000d675
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0x106c]
call fcn.1001694b
mov dword [eax], 0x34e6d4f2
jmp 0x1000d646
push 0
lea ecx, [ebp - 0x106c]
call fcn.1001694b
mov dword [eax], 0xfffffffe
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1000d6a0
call dword [sym.imp.USER32.dll_GetCapture]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x106c]
call fcn.10016946
jmp 0x1000d60c
mov dword [ebp - 0x1148], 0x100875c4
push 3
lea ecx, [ebp - 0x380]
call fcn.100168de
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x48], 0x5020f89b
mov dword [ebp - 0x90], 0
mov dword [ebp - 0xe84], 0xfffffffa
mov dword [ebp - 0x21c], 0
jmp 0x1000d706
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 3
jge 0x1000d728
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x380]
call fcn.1001694b
mov dword [eax], 0xdc85f70a
jmp 0x1000d6f9
mov dword [ebp - 0x48], 2
jmp 0x1000d738
cmp dword [ebp - 0x48], 0
jl 0x1000db80
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc00], 0x349b8ae0
mov dword [ebp - 0x878], 0x4674
mov dword [ebp - 0x18], 2
jmp 0x1000d76d
cmp dword [ebp - 0x18], 0
jl 0x1000da66
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x1000d796
mov dword [ebp - 0x90], 0
jmp 0x1000da7f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x380]
call fcn.10016946
mov dword [ebp - 0x1ec], 0xac204e2d
push 1
lea ecx, [ebp - 0xf68]
call fcn.100168de
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x119c], 1
mov dword [ebp - 0xd20], 0x52027495
mov dword [ebp - 0x1d8], 0xf889e022
mov dword [ebp - 0x210], 0
jmp 0x1000dbe4
cmp dword [ebp - 0x210], 1
jge 0x1000dc06
push dword [ebp - 0x210]
lea ecx, [ebp - 0xf68]
call fcn.1001694b
mov dword [eax], 0x8bea1220
jmp 0x1000dbd7
mov dword [ebp - 0x1ec], 0
jmp 0x1000dc1f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret