Function at 0x1005368e
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c7b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x97c
push esi
push edi
push 1
lea eax, [ebp - 0x988]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.10052ee4
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x920]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x920]
lea edi, [ebp - 0x75c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1ac], 0x4e6d4f28
mov dword [ebp - 0x1a8], 0x4e6d4f28
mov dword [ebp - 0x1a4], 0x4e6d4f28
mov dword [ebp - 0x1a0], 0x4e6d4f28
mov dword [ebp - 0x134], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x204], 5
mov dword [ebp - 0x5c4], 0xe2095e04
mov dword [ebp - 0x5d0], 0xddbc75b1
mov dword [ebp - 0x474], 0x3f0bde8a
mov dword [ebp - 0x638], 0xe17c927d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1ac], 0
jne 0x100537a8
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1ac], 0
jle 0x10053775
mov dword [ebp - 0x418], 1
jmp 0x1005377c
and dword [ebp - 0x418], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ac]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1ac]
imul ecx, dword [ebp - 0x418]
push 4
pop edx
shl edx, 1
imul ecx, dword [ebp + edx - 0x1ac]
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1ac]
push 4
pop edx
shl edx, 1
sub ecx, dword [ebp + edx - 0x1ac]
cmp dword [ebp + eax - 0x1ac], ecx
jg 0x100537da
mov dword [ebp - 0x54c], 1
jmp 0x100537e1
and dword [ebp - 0x54c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ac]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x54c]
je 0x1005380d
mov dword [ebp - 0x554], 1
jmp 0x10053814
and dword [ebp - 0x554], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ac]
cmp dword [ebp - 0x554], eax
jl 0x10053834
mov dword [ebp - 0x55c], 1
jmp 0x1005383b
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
push 4
pop eax
shl eax, 1
imul eax, dword [ebp + eax - 0x1ac], 0
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x8f4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1ac], 0x705e8c87
jg 0x1005388b
mov dword [ebp - 0x5c8], 1
jmp 0x10053892
and dword [ebp - 0x5c8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ac]
add eax, dword [ebp - 0x5c8]
jne 0x100538af
cmp dword [ebp - 0x5d0], 0
je 0x100538c4
cmp dword [ebp - 0x5d0], 0
je 0x100538c4
mov dword [ebp - 0x5d8], 1
jmp 0x100538cb
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d8]
dec eax
cmp eax, 0xfffffffd
jge 0x100538e3
mov dword [ebp - 0x5e0], 1
jmp 0x100538ea
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x5e0], eax
jg 0x10053904
mov dword [ebp - 0x320], 1
jmp 0x1005390b
and dword [ebp - 0x320], 0
mov dword [ebp - 0x134], 0xa012
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x5c4], eax
mov eax, dword [ebp - 0x5c4]
cmp eax, dword [ebp - 0x320]
jle 0x1005393b
mov dword [ebp - 0x250], 1
jmp 0x10053942
and dword [ebp - 0x250], 0
mov dword [ebp - 0x204], 0xffffffff
mov eax, dword [ebp - 0x204]
mov ecx, dword [ebp - 0xcc]
imul ecx, dword [ebp - 0x250]
imul eax, ecx
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x1cc], 0x4e6d4f28
mov dword [ebp - 0x1c8], 0x4e6d4f28
mov dword [ebp - 0x1c4], 0x4e6d4f28
mov dword [ebp - 0x1c0], 0x4e6d4f28
mov dword [ebp - 0x28], 0
mov dword [ebp - 0xac], 0
push 2
lea ecx, [ebp - 0x7b4]
call fcn.1001737a
and dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0x7d8]
call fcn.1001737a
mov byte [ebp - 4], 1
mov dword [ebp - 0x20c], 0xffffffff
mov dword [ebp - 0x18], 0
jmp 0x100539e9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100539ff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x22c], 0x2edc7555
jmp 0x100539e2
mov dword [ebp - 0x18], 0
jmp 0x10053a0f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10053a2b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7b4]
call fcn.10017408
mov dword [eax], 0x71cf
jmp 0x10053a08
mov dword [ebp - 0x18], 0
jmp 0x10053a3b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10053a57
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7d8]
call fcn.10017408
mov dword [eax], 0xfffffffd
jmp 0x10053a34
mov eax, 0xa162
test eax, eax
je 0x10053b1d
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x22c], 0
jne 0x10053b11
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x22c]
mov dword [ebp - 0x910], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x22c]
add eax, 0x6eed1e11
mov dword [ebp - 0x28], eax
je 0x10053abb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x22c], 0
je 0x10053abb
and dword [ebp - 0x718], 0
jmp 0x10053ac5
mov dword [ebp - 0x718], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22c]
mov dword [ebp - 0x87c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x22c], 0
je 0x10053aee
cmp dword [ebp - 0x28], 0
jne 0x10053afc
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x22c], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x22c], 0x5dce
test eax, eax
je 0x10053b1d
mov dword [ebp - 0x258], 1
jmp 0x10053b24
and dword [ebp - 0x258], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x22c]
cmp eax, dword [ebp - 0x258]
jle 0x10053b45
mov dword [ebp - 0x47c], 1
jmp 0x10053b4c
and dword [ebp - 0x47c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x22c]
cmp dword [ebp - 0x47c], eax
jl 0x10053b6d
mov dword [ebp - 0x260], 1
jmp 0x10053b74
and dword [ebp - 0x260], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x22c]
add eax, dword [ebp - 0x260]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x22c]
jne 0x10053cfb
mov dword [ebp - 0x268], 0x892657cf
push 3
lea ecx, [ebp - 0x7fc]
call fcn.1001737a
mov byte [ebp - 4], 2
mov dword [ebp - 0x12c], 0
jmp 0x10053bce
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x10053bf0
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x7fc]
call fcn.10017408
mov dword [eax], 0x96d56a42
jmp 0x10053bc1
cmp dword [ebp - 0x28], 0
jne 0x10053c02
mov dword [ebp - 0x494], 1
jmp 0x10053c09
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x8d8], eax
push 0xfffffffffffffffb
pop eax
sub eax, dword [ebp - 0x28]
cmp dword [ebp - 0xac], eax
jg 0x10053c2f
mov dword [ebp - 0x484], 1
jmp 0x10053c36
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0x211e
jl 0x10053c5a
mov dword [ebp - 0x48c], 1
jmp 0x10053c61
and dword [ebp - 0x48c], 0
imul eax, dword [ebp - 0x48c], 0x2742
test eax, eax
jne 0x10053c7b
mov dword [ebp - 0x270], 1
jmp 0x10053c82
and dword [ebp - 0x270], 0
push 1
lea ecx, [ebp - 0x7fc]
call fcn.10017408
mov ecx, dword [ebp - 0x270]
cmp ecx, dword [eax]
jle 0x10053ca5
mov dword [ebp - 0x278], 1
jmp 0x10053cac
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x494]
cmp eax, dword [ebp - 0x278]
jg 0x10053cc6
mov dword [ebp - 0x49c], 1
jmp 0x10053ccd
and dword [ebp - 0x49c], 0
mov esi, 0xddb7
sub esi, dword [ebp - 0x49c]
push 1
lea ecx, [ebp - 0x7b4]
call fcn.10017408
mov dword [eax], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x7fc]
call fcn.10017403
jmp 0x10053fc3
mov dword [ebp - 0x63c], 0xffffffff
mov dword [ebp - 0x7a8], 0xc4f4fcf4
mov dword [ebp - 0x7a4], 0xc4f4fcf4
mov dword [ebp - 0x7a0], 0xc4f4fcf4
mov dword [ebp - 0x79c], 0xc4f4fcf4
lea ecx, [ebp - 0x1e1]
call fcn.10008cd3
push eax
lea eax, [ebp - 0x798]
push eax
lea eax, [ebp - 0x7a8]
push eax
lea ecx, [ebp - 0x97c]
call fcn.10017417
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7c0]
call fcn.100173d9
mov byte [ebp - 4], 3
mov dword [ebp - 0xac], 0x19
jmp 0x10053d7f
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xffffffe4
jl 0x10053fb4
mov dword [ebp - 0x640], 0xffffffff
mov dword [ebp - 0x6e8], 0xffff
mov dword [ebp - 0x884], 0xfffffff9
push 1
lea ecx, [ebp - 0x738]
call fcn.1001737a
mov byte [ebp - 4], 4
mov dword [ebp - 0x104], 0
jmp 0x10053dd4
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x10053df6
push dword [ebp - 0x104]
lea ecx, [ebp - 0x738]
call fcn.10017408
mov dword [eax], 1
jmp 0x10053dc7
mov dword [ebp - 0x28], 0xfffffff0
jmp 0x10053e06
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffe
jne 0x10053e20
mov esi, dword [ebp - 0x28]
push 0
lea ecx, [ebp - 0x7d8]
call fcn.10017408
mov dword [eax], esi
jmp 0x10053dff
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x6e0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x22c]
mov dword [ebp - 0x708], eax
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x6e0]
cmp eax, dword [ebp - 0x708]
jl 0x10053e65
mov dword [ebp - 0x280], 1
jmp 0x10053e6c
and dword [ebp - 0x280], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x22c]
cmp dword [ebp - 0x280], eax
jne 0x10053e93
cmp dword [ebp - 0x28], 0
je 0x10053e93
mov dword [ebp - 0x4a4], 1
jmp 0x10053e9a
and dword [ebp - 0x4a4], 0
mov esi, 0xf607
sub esi, dword [ebp - 0x4a4]
push 0
lea ecx, [ebp - 0x7c0]
call fcn.10017408
cmp esi, dword [eax]
jle 0x10053ec2
mov dword [ebp - 0x288], 1
jmp 0x10053ec9
and dword [ebp - 0x288], 0
push 0
lea ecx, [ebp - 0x738]
call fcn.10017408
mov ecx, dword [ebp - 0x288]
cmp ecx, dword [eax]
jl 0x10053eec
mov dword [ebp - 0x4ac], 1
jmp 0x10053ef3
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x6e8]
cmp eax, dword [ebp - 0x4ac]
je 0x10053f16
cmp dword [ebp - 0x63c], 0
je 0x10053f16
mov dword [ebp - 0x290], 1
jmp 0x10053f1d
and dword [ebp - 0x290], 0
push 0
lea ecx, [ebp - 0x7c0]
call fcn.10017408
mov ecx, dword [ebp - 0x290]
cmp ecx, dword [eax]
jle 0x10053f40
mov dword [ebp - 0x4b4], 1
jmp 0x10053f47
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
neg eax
cmp eax, 0xfffffff7
jb 0x10053f60
mov dword [ebp - 0x298], 1
jmp 0x10053f67
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x298]
add eax, 7
cmp dword [ebp - 0x640], eax
jne 0x10053f84
mov dword [ebp - 0x4bc], 1
jmp 0x10053f8b
and dword [ebp - 0x4bc], 0
push 0
lea ecx, [ebp - 0x738]
call fcn.10017408
mov ecx, dword [ebp - 0x4bc]
mov dword [eax], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x738]
call fcn.10017403
jmp 0x10053d72
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x7c0]
call fcn.10017403
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7d8]
call fcn.10017403
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b4]
call fcn.10017403
mov dword [ebp - 0x180], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x1f8], 5
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x80], 0x9e7
mov dword [ebp - 0x1d8], 0x228d5fea
mov dword [ebp - 0x2b0], 0xe80c6548
mov dword [ebp - 0x100], 0
jmp 0x1005403a
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x10054056
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x95c], 0x237f4a7d
jmp 0x1005402d
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x10054070
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jge 0x10054084
mov dword [ebp - 0x4d4], 1
jmp 0x1005408b
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jne 0x1005409f
mov dword [ebp - 0x648], 1
jmp 0x100540a6
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x58], eax
jge 0x100540bd
cmp dword [ebp - 0x58], 0
jne 0x100540bd
and dword [ebp - 0x2a0], 0
jmp 0x100540c7
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x2a0]
jge 0x100540e1
cmp dword [ebp - 0x80], 0
jne 0x100540e1
and dword [ebp - 0x4c4], 0
jmp 0x100540eb
mov dword [ebp - 0x4c4], 1
imul eax, dword [ebp - 0x4c4], 0x50d8
add eax, dword [ebp - 0x80]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x1d8], eax
jne 0x10054115
mov dword [ebp - 0x2a8], 1
jmp 0x1005411c
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x2a8], eax
jle 0x10054133
mov dword [ebp - 0x4cc], 1
jmp 0x1005413a
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x56411d7f
je 0x1005415e
mov dword [ebp - 0x2b8], 1
jmp 0x10054165
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0x2b8]
jge 0x1005417f
mov dword [ebp - 0x650], 1
jmp 0x10054186
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x80], 0
jne 0x100541a7
cmp dword [ebp - 0x1d8], 0
jne 0x100541a7
and dword [ebp - 0x4dc], 0
jmp 0x100541b1
mov dword [ebp - 0x4dc], 1
mov eax, dword [ebp - 0x4dc]
sub eax, dword [ebp - 0x80]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x95c], eax
mov dword [ebp - 0x308], 0xe2095e04
mov dword [ebp - 0x51c], 0xddbc75b1
push 2
lea ecx, [ebp - 0x56c]
call fcn.1001737a
mov dword [ebp - 4], 5
mov dword [ebp - 0x5c], 0x35d56974
mov dword [ebp - 0x148], 0
jmp 0x1005420e
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x10054230
push dword [ebp - 0x148]
lea ecx, [ebp - 0x56c]
call fcn.10017408
mov dword [eax], 4
jmp 0x10054201
push 0
lea ecx, [ebp - 0x56c]
call fcn.10017408
and dword [eax], 0
jmp 0x10054266
push 0
lea ecx, [ebp - 0x56c]
call fcn.10017408
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2c0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x56c]
call fcn.10017408
cmp dword [eax], 7
jg 0x10054492
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x4fc], 0xb2b058ef
mov dword [ebp - 0x108], 0
jmp 0x100542a9
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jge 0x100542c5
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x8d0], 1
jmp 0x1005429c
mov dword [ebp - 0x188], 0xffffffe4
jmp 0x100542de
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xffffffe2
je 0x1005448d
push 2
lea ecx, [ebp - 0x610]
call fcn.1001737a
mov byte [ebp - 4], 6
mov dword [ebp - 0x660], 0x5b38
mov dword [ebp - 0x110], 0
jmp 0x1005431f
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x1005433e
push dword [ebp - 0x110]
lea ecx, [ebp - 0x610]
call fcn.10017408
and dword [eax], 0
jmp 0x10054312
push 1
lea ecx, [ebp - 0x610]
call fcn.10017408
cmp dword [eax], 0x2a3b3f36
jg 0x1005435f
mov dword [ebp - 0x2d0], 1
jmp 0x10054366
and dword [ebp - 0x2d0], 0
push 0
lea ecx, [ebp - 0x56c]
call fcn.10017408
mov eax, dword [eax]
sub eax, 0xedf6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x8d0]
jge 0x10054395
mov dword [ebp - 0x4e4], 1
jmp 0x1005439c
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffffb
jae 0x100543b7
mov dword [ebp - 0x2c8], 1
jmp 0x100543be
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0xfffffff7
je 0x100543d3
mov dword [ebp - 0x658], 1
jmp 0x100543da
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x660]
mov dword [ebp - 0x88c], eax
mov esi, dword [ebp - 0x4fc]
push 0
lea ecx, [ebp - 0x610]
call fcn.10017408
cmp esi, dword [eax]
jge 0x1005441b
push 1
lea ecx, [ebp - 0x610]
call fcn.10017408
cmp dword [eax], 0
je 0x1005441b
mov dword [ebp - 0x4ec], 1
jmp 0x10054422
and dword [ebp - 0x4ec], 0
push 0
lea ecx, [ebp - 0x610]
call fcn.10017408
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4ec]
je 0x10054445
mov dword [ebp - 0x4f4], 1
jmp 0x1005444c
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x2d0]
cmp eax, dword [ebp - 0x4f4]
jle 0x10054466
mov dword [ebp - 0x2d8], 1
jmp 0x1005446d
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x4fc], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x610]
call fcn.10017403
jmp 0x100542d1
jmp 0x10054242
mov dword [ebp - 0x5c], 0
jmp 0x100544a2
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jg 0x100544d3
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x56c]
call fcn.10017408
cmp dword [eax], 0
je 0x100544bd
jmp 0x100544d3
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x56c]
call fcn.10017408
mov dword [eax], 0x7f4a7d2a
jmp 0x1005449b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x56c]
call fcn.10017403
mov dword [ebp - 0x534], 0x3f0bde8a
mov dword [ebp - 0x678], 0xe17c927d
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x170], 1
mov dword [ebp - 0xdc], 0xfffffffa
mov dword [ebp - 0x150], 0
jmp 0x1005452d
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x10054549
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x938], 2
jmp 0x10054520
mov dword [ebp - 0x118], 0
jmp 0x10054562
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jg 0x1005475c
mov dword [ebp - 0xb8], 0xfffffff7
xor eax, eax
je 0x1005459e
mov eax, 0x191b4956
test eax, eax
je 0x1005459e
cmp dword [ebp - 0xb8], 0
je 0x1005459e
mov dword [ebp - 0xb8], 0x588c5561
jmp 0x10054757
mov dword [ebp - 0x170], 0xfffffff2
jmp 0x100545b7
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xfffffff7
je 0x10054757
mov dword [ebp - 0xdc], 0x1c
jmp 0x100545dd
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x15
jg 0x10054752
mov dword [ebp - 0xb8], 5
jmp 0x10054603
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xf
jg 0x1005474d
push 2
lea ecx, [ebp - 0x5f8]
call fcn.1001737a
mov dword [ebp - 4], 7
mov dword [ebp - 0x120], 0
jmp 0x1005463d
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x1005465c
push dword [ebp - 0x120]
lea ecx, [ebp - 0x5f8]
call fcn.10017408
or dword [eax], 0xffffffff
jmp 0x10054630
push 0
lea ecx, [ebp - 0x5f8]
call fcn.10017408
and dword [eax], 0
jmp 0x10054692
push 0
lea ecx, [ebp - 0x5f8]
call fcn.10017408
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2e0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x5f8]
call fcn.10017408
cmp dword [eax], 2
jg 0x10054711
mov dword [ebp - 0x668], 0xffffffff
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x100546d0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
lea ecx, [ebp - 0x5f8]
call fcn.10017408
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x938], 0
je 0x100546f9
xor eax, eax
je 0x100546f9
mov dword [ebp - 0x504], 1
jmp 0x10054700
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x668], eax
jmp 0x1005466e
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x10054739
push 0x42d
push 0xe24
push 0xcf8
push 0x4c4
push 0
call dword [sym.imp.USER32.dll_SetRect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5f8]
call fcn.10017403
jmp 0x100545f6
jmp 0x100545d0
jmp 0x100545aa
jmp 0x10054555
mov dword [ebp - 0xdc], 0x514faf14
mov dword [ebp - 0x158], 0x8a61928c
mov dword [ebp - 0x158], 0xd
jmp 0x10054789
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x1c
jl 0x100547af
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x100547ad
push 0
push 0x15bb
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x1005477c
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x100547da
push 0
push 0xc2f
push 0x25f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1cc], 0
jne 0x10054837
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1cc], 0
jle 0x10054804
mov dword [ebp - 0x2e8], 1
jmp 0x1005480b
and dword [ebp - 0x2e8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1cc]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1cc]
imul ecx, dword [ebp - 0x2e8]
push 4
pop edx
shl edx, 1
imul ecx, dword [ebp + edx - 0x1cc]
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1cc]
push 4
pop edx
shl edx, 1
sub ecx, dword [ebp + edx - 0x1cc]
cmp dword [ebp + eax - 0x1cc], ecx
jg 0x10054869
mov dword [ebp - 0x50c], 1
jmp 0x10054870
and dword [ebp - 0x50c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1cc]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x50c]
je 0x1005489c
mov dword [ebp - 0x2f0], 1
jmp 0x100548a3
and dword [ebp - 0x2f0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1cc]
cmp dword [ebp - 0x2f0], eax
jl 0x100548c3
mov dword [ebp - 0x514], 1
jmp 0x100548ca
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
push 4
pop eax
shl eax, 1
imul eax, dword [ebp + eax - 0x1cc], 0
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x670], 0x2b29949d
mov dword [ebp - 0x128], 0
jmp 0x10054913
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jge 0x1005492f
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x808], 0
jmp 0x10054906
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x808], 0
je 0x100549a1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x2c], 0
jmp 0x10054956
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffea
jle 0x10054967
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x670], eax
jmp 0x1005494f
mov dword [ebp - 0x2c], 2
jmp 0x10054977
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1005499f
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x808], 0
je 0x1005498c
jmp 0x1005499f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x808], 0
je 0x1005499d
jmp 0x1005499f
jmp 0x10054970
jmp 0x100549ba
mov byte [ebp - 0x74], 0
movzx eax, byte [ebp - 0x74]
test eax, eax
je 0x100549ba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x8e0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1cc], 0x705e8c87
jg 0x100549e4
mov dword [ebp - 0x2f8], 1
jmp 0x100549eb
and dword [ebp - 0x2f8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1cc]
add eax, dword [ebp - 0x2f8]
jne 0x10054a08
cmp dword [ebp - 0x51c], 0
je 0x10054a1d
cmp dword [ebp - 0x51c], 0
je 0x10054a1d
mov dword [ebp - 0x300], 1
jmp 0x10054a24
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x300]
dec eax
cmp eax, 0xfffffffd
jge 0x10054a3c
mov dword [ebp - 0x524], 1
jmp 0x10054a43
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x524], eax
jg 0x10054a5d
mov dword [ebp - 0x52c], 1
jmp 0x10054a64
and dword [ebp - 0x52c], 0
mov dword [ebp - 0x180], 0xa012
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
cmp eax, dword [ebp - 0x52c]
jle 0x10054a94
mov dword [ebp - 0x310], 1
jmp 0x10054a9b
and dword [ebp - 0x310], 0
mov dword [ebp - 0x1f8], 0xffffffff
mov eax, dword [ebp - 0x1f8]
mov ecx, dword [ebp - 0xc0]
imul ecx, dword [ebp - 0x310]
imul eax, ecx
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x678], eax
mov dword [ebp - 0x130], 0xfe0a8eac
mov dword [ebp - 0x130], 0xffffffed
jmp 0x10054af0
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffe7
je 0x10054b1d
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x10054b1b
push 0x1a9f
push 0x10bc
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x10054ae3
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x10054b38
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 1
lea ecx, [ebp - 0x744]
call fcn.1001737a
mov dword [ebp - 4], 8
mov dword [ebp - 0x160], 0x71c7bf0b
mov dword [ebp - 0x44], 0
jmp 0x10054b66
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x10054b82
push dword [ebp - 0x44]
lea ecx, [ebp - 0x744]
call fcn.10017408
mov dword [eax], 0xfffffffa
jmp 0x10054b5f
mov dword [ebp - 0x44], 0
jmp 0x10054b92
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10054ba8
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x964], 1
jmp 0x10054b8b
push 0
lea ecx, [ebp - 0x744]
call fcn.10017408
mov dword [eax], 8
mov dword [ebp - 0x160], 0
jmp 0x10054bd4
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x14
jle 0x10054cc3
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x704], 0x112def90
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x13
jmp 0x10054c09
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x25
je 0x10054cbe
mov dword [ebp - 0x680], 0xa13b2885
cmp dword [ebp - 0x3c], 0
jne 0x10054c2c
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x680]
push 0
lea ecx, [ebp - 0x744]
call fcn.10017408
cmp dword [eax], 9
je 0x10054c4a
mov dword [ebp - 0x318], 1
jmp 0x10054c51
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 0x4204
jne 0x10054c69
mov dword [ebp - 0x53c], 1
jmp 0x10054c70
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x53c], eax
jge 0x10054c87
mov dword [ebp - 0x544], 1
jmp 0x10054c8e
and dword [ebp - 0x544], 0
cmp dword [ebp - 0x544], 0xffff
jbe 0x10054ca6
mov dword [ebp - 0x480], 1
jmp 0x10054cad
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x704], eax
jmp 0x10054c02
jmp 0x10054bc7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x744]
call fcn.10017403
mov dword [ebp - 0x1bc], 0x4e6d4f28
mov dword [ebp - 0x1b8], 0x4e6d4f28
mov dword [ebp - 0x1b4], 0x4e6d4f28
mov dword [ebp - 0x1b0], 0x4e6d4f28
mov dword [ebp - 0x6b8], 0xfffffffd
mov dword [ebp - 0x6b4], 0xfffffffd
mov dword [ebp - 0x6b0], 0xfffffffd
mov dword [ebp - 0x6ac], 0xfffffffd
mov dword [ebp - 0x88], 0xc1ec2db2
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x6b8]
mov dword [ebp - 0x88], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x6b8], 0
je 0x10054d80
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x10054d7e
push 0
push 0
push 0
push 0
push 0xcc2
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10054dc8
mov dword [ebp - 0x88], 0
jmp 0x10054d99
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jg 0x10054dc8
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0x6b8], 0
je 0x10054db4
jmp 0x10054dc8
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0x6b8], 0
je 0x10054dc6
jmp 0x10054dc8
jmp 0x10054d8c
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0xb0], 0
push 2
lea ecx, [ebp - 0x7f0]
call fcn.1001737a
mov dword [ebp - 4], 9
push 1
lea ecx, [ebp - 0x814]
call fcn.1001737a
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1e0], 0xffffffff
mov dword [ebp - 0x1c], 0
jmp 0x10054e22
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10054e38
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x21c], 0x2edc7555
jmp 0x10054e1b
mov dword [ebp - 0x1c], 0
jmp 0x10054e48
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10054e64
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x7f0]
call fcn.10017408
mov dword [eax], 0x71cf
jmp 0x10054e41
mov dword [ebp - 0x1c], 0
jmp 0x10054e74
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10054e90
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x814]
call fcn.10017408
mov dword [eax], 0xfffffffd
jmp 0x10054e6d
mov eax, 0xa162
test eax, eax
je 0x10054f56
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x21c], 0
jne 0x10054f4a
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x21c]
mov dword [ebp - 0x894], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x21c]
add eax, 0x6eed1e11
mov dword [ebp - 0x24], eax
je 0x10054ef4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21c], 0
je 0x10054ef4
and dword [ebp - 0x70c], 0
jmp 0x10054efe
mov dword [ebp - 0x70c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
mov dword [ebp - 0x8a8], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x21c], 0
je 0x10054f27
cmp dword [ebp - 0x24], 0
jne 0x10054f35
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x21c], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x21c], 0x5dce
test eax, eax
je 0x10054f56
mov dword [ebp - 0x328], 1
jmp 0x10054f5d
and dword [ebp - 0x328], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x21c]
cmp eax, dword [ebp - 0x328]
jle 0x10054f7e
mov dword [ebp - 0x530], 1
jmp 0x10054f85
and dword [ebp - 0x530], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x21c]
cmp dword [ebp - 0x530], eax
jl 0x10054fa6
mov dword [ebp - 0x330], 1
jmp 0x10054fad
and dword [ebp - 0x330], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x21c]
add eax, dword [ebp - 0x330]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x21c]
jne 0x10055134
mov dword [ebp - 0x338], 0x892657cf
push 3
lea ecx, [ebp - 0x7cc]
call fcn.1001737a
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x138], 0
jmp 0x10055007
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jge 0x10055029
push dword [ebp - 0x138]
lea ecx, [ebp - 0x7cc]
call fcn.10017408
mov dword [eax], 0x96d56a42
jmp 0x10054ffa
cmp dword [ebp - 0x24], 0
jne 0x1005503b
mov dword [ebp - 0x490], 1
jmp 0x10055042
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x89c], eax
push 0xfffffffffffffffb
pop eax
sub eax, dword [ebp - 0x24]
cmp dword [ebp - 0xb0], eax
jg 0x10055068
mov dword [ebp - 0x488], 1
jmp 0x1005506f
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0x211e
jl 0x10055093
mov dword [ebp - 0x5c0], 1
jmp 0x1005509a
and dword [ebp - 0x5c0], 0
imul eax, dword [ebp - 0x5c0], 0x2742
test eax, eax
jne 0x100550b4
mov dword [ebp - 0x340], 1
jmp 0x100550bb
and dword [ebp - 0x340], 0
push 1
lea ecx, [ebp - 0x7cc]
call fcn.10017408
mov ecx, dword [ebp - 0x340]
cmp ecx, dword [eax]
jle 0x100550de
mov dword [ebp - 0x348], 1
jmp 0x100550e5
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x490]
cmp eax, dword [ebp - 0x348]
jg 0x100550ff
mov dword [ebp - 0x538], 1
jmp 0x10055106
and dword [ebp - 0x538], 0
mov esi, 0xddb7
sub esi, dword [ebp - 0x538]
push 1
lea ecx, [ebp - 0x7f0]
call fcn.10017408
mov dword [eax], esi
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x7cc]
call fcn.10017403
jmp 0x100553fc
mov dword [ebp - 0x72c], 0xffffffff
mov dword [ebp - 0x794], 0xc4f4fcf4
mov dword [ebp - 0x790], 0xc4f4fcf4
mov dword [ebp - 0x78c], 0xc4f4fcf4
mov dword [ebp - 0x788], 0xc4f4fcf4
lea ecx, [ebp - 0x1f9]
call fcn.10008cd3
push eax
lea eax, [ebp - 0x784]
push eax
lea eax, [ebp - 0x794]
push eax
lea ecx, [ebp - 0x96c]
call fcn.10017417
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7e4]
call fcn.100173d9
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xb0], 0x19
jmp 0x100551b8
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xffffffe4
jl 0x100553ed
mov dword [ebp - 0x6d8], 0xffffffff
mov dword [ebp - 0x724], 0xffff
mov dword [ebp - 0x8b0], 0xfffffff9
push 1
lea ecx, [ebp - 0x750]
call fcn.1001737a
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x178], 0
jmp 0x1005520d
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x1005522f
push dword [ebp - 0x178]
lea ecx, [ebp - 0x750]
call fcn.10017408
mov dword [eax], 1
jmp 0x10055200
mov dword [ebp - 0x24], 0xfffffff0
jmp 0x1005523f
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffffe
jne 0x10055259
mov esi, dword [ebp - 0x24]
push 0
lea ecx, [ebp - 0x814]
call fcn.10017408
mov dword [eax], esi
jmp 0x10055238
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x714], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x21c]
mov dword [ebp - 0x71c], eax
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x714]
cmp eax, dword [ebp - 0x71c]
jl 0x1005529e
mov dword [ebp - 0x350], 1
jmp 0x100552a5
and dword [ebp - 0x350], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x21c]
cmp dword [ebp - 0x350], eax
jne 0x100552cc
cmp dword [ebp - 0x24], 0
je 0x100552cc
mov dword [ebp - 0x498], 1
jmp 0x100552d3
and dword [ebp - 0x498], 0
mov esi, 0xf607
sub esi, dword [ebp - 0x498]
push 0
lea ecx, [ebp - 0x7e4]
call fcn.10017408
cmp esi, dword [eax]
jle 0x100552fb
mov dword [ebp - 0x358], 1
jmp 0x10055302
and dword [ebp - 0x358], 0
push 0
lea ecx, [ebp - 0x750]
call fcn.10017408
mov ecx, dword [ebp - 0x358]
cmp ecx, dword [eax]
jl 0x10055325
mov dword [ebp - 0x5ac], 1
jmp 0x1005532c
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x724]
cmp eax, dword [ebp - 0x5ac]
je 0x1005534f
cmp dword [ebp - 0x72c], 0
je 0x1005534f
mov dword [ebp - 0x360], 1
jmp 0x10055356
and dword [ebp - 0x360], 0
push 0
lea ecx, [ebp - 0x7e4]
call fcn.10017408
mov ecx, dword [ebp - 0x360]
cmp ecx, dword [eax]
jle 0x10055379
mov dword [ebp - 0x4a0], 1
jmp 0x10055380
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
neg eax
cmp eax, 0xfffffff7
jb 0x10055399
mov dword [ebp - 0x368], 1
jmp 0x100553a0
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x368]
add eax, 7
cmp dword [ebp - 0x6d8], eax
jne 0x100553bd
mov dword [ebp - 0x540], 1
jmp 0x100553c4
and dword [ebp - 0x540], 0
push 0
lea ecx, [ebp - 0x750]
call fcn.10017408
mov ecx, dword [ebp - 0x540]
mov dword [eax], ecx
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x750]
call fcn.10017403
jmp 0x100551ab
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x7e4]
call fcn.10017403
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x814]
call fcn.10017403
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7f0]
call fcn.10017403
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x83c], 0x286e871d
mov dword [ebp - 0x838], 0x286e871d
mov dword [ebp - 0x834], 0x286e871d
mov dword [ebp - 0x830], 0x286e871d
mov dword [ebp - 0x140], 0
jmp 0x10055465
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 8
jle 0x100554b0
mov dword [ebp - 0xc4], 2
mov dword [ebp - 0xc4], 0
jmp 0x10055491
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jg 0x100554ae
mov eax, dword [ebp - 0xc4]
cmp dword [ebp + eax*4 - 0x83c], 0
je 0x100554ac
jmp 0x100554ae
jmp 0x10055484
jmp 0x10055458
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0x20], 0xbac04ee7
mov dword [ebp - 0xb4], 0x8551b32e
push 2
lea ecx, [ebp - 0x820]
call fcn.1001737a
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xf8], 0
jmp 0x100554f8
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x1005551a
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x820]
call fcn.10017408
mov dword [eax], 5
jmp 0x100554eb
mov byte [ebp - 0x78], 0
movzx eax, byte [ebp - 0x78]
test eax, eax
je 0x1005553a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jl 0x10055557
mov dword [ebp - 0x370], 1
jmp 0x1005555e
and dword [ebp - 0x370], 0
imul eax, dword [ebp - 0x370], 0xadb8
test eax, eax
je 0x1005557e
cmp dword [ebp - 0x20], 0
je 0x1005557e
mov dword [ebp - 0x4a8], 1
jmp 0x10055585
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x4a8]
lea eax, [ecx + eax + 5]
xor ecx, ecx
inc ecx
sub ecx, eax
cmp ecx, 0x1eb2391c
jle 0x100555ab
mov dword [ebp - 0x378], 1
jmp 0x100555b2
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x378], eax
jg 0x100555c9
mov dword [ebp - 0x5d4], 1
jmp 0x100555d0
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x5d4], eax
jle 0x100555ed
cmp dword [ebp - 0x20], 0
je 0x100555ed
mov dword [ebp - 0x380], 1
jmp 0x100555f4
and dword [ebp - 0x380], 0
cmp dword [ebp - 0x380], 0xfffffffc
jbe 0x10055609
mov dword [ebp - 0x4b0], 1
jmp 0x10055610
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4b0], eax
jl 0x10055627
mov dword [ebp - 0x388], 1
jmp 0x1005562e
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
neg eax
cmp eax, dword [ebp - 0x20]
jle 0x10055647
mov dword [ebp - 0x548], 1
jmp 0x1005564e
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
neg eax
cmp eax, dword [ebp - 0x20]
je 0x10055673
mov dword [ebp - 0x390], 1
jmp 0x1005567a
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x390]
inc eax
inc eax
imul eax, dword [ebp - 0x20]
test eax, eax
je 0x1005573b
push 2
lea ecx, [ebp - 0x82c]
call fcn.1001737a
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x644], 0xd8720725
mov dword [ebp - 0xfc], 0
jmp 0x100556c6
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x100556e8
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x82c]
call fcn.10017408
mov dword [eax], 0x55a61940
jmp 0x100556b9
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x10055711
push 0xcfd
push 0x4bc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 1
lea ecx, [ebp - 0x82c]
call fcn.10017408
mov eax, dword [eax]
inc eax
mov dword [ebp - 0x644], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x82c]
call fcn.10017403
jmp 0x100557da
mov dword [ebp - 0x8b8], 0xffffffff
mov dword [ebp - 0x8c0], 0xbdae8940
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0x908], 0xffffffff
mov dword [ebp - 0xb4], 0
jmp 0x1005577c
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xffffffe7
jl 0x1005579e
mov dword [ebp - 0x4b8], 0xfffffff6
mov eax, dword [ebp - 0x4b8]
inc eax
mov dword [ebp - 0x4b8], eax
jmp 0x1005576f
mov dword [ebp - 0xc8], 1
jmp 0x100557b7
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x100557da
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x820]
call fcn.10017408
cmp dword [eax], 0
je 0x100557d8
jmp 0x100557da
jmp 0x100557aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x820]
call fcn.10017403
mov dword [ebp - 0x1dc], 5
mov dword [ebp - 0x10], 5
mov dword [ebp - 0xd0], 7
push 3
lea ecx, [ebp - 0x690]
call fcn.1001737a
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x6f0], 0
mov dword [ebp - 0x4c], 0
jmp 0x10055832
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x10055845
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x30], 0xf393
jmp 0x1005582b
mov dword [ebp - 0x4c], 0
jmp 0x10055855
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10055871
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x690]
call fcn.10017408
mov dword [eax], 0x9f5ab171
jmp 0x1005584e
cmp dword [ebp - 0x10], 0
je 0x10055922
cmp dword [ebp - 0x10], 0
je 0x10055893
cmp dword [ebp - 0x10], 0
je 0x10055893
mov dword [ebp - 0x728], 1
jmp 0x1005589a
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x100558b7
mov dword [ebp - 0x398], 1
jmp 0x100558be
and dword [ebp - 0x398], 0
imul eax, dword [ebp - 0x398], 0xfffffff6
test eax, eax
je 0x100558dc
push 8
pop eax
test eax, eax
je 0x100558dc
mov dword [ebp - 0x5b4], 1
jmp 0x100558e3
and dword [ebp - 0x5b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0x5b4], eax
jl 0x10055901
mov dword [ebp - 0x64c], 1
jmp 0x10055908
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x8e8], eax
cmp dword [ebp - 0x10], 0
jae 0x10055922
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
mov dword [ebp - 0xd0], 0x467b47e0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xd0], eax
jne 0x10055943
mov dword [ebp - 0x3a0], 1
jmp 0x1005594a
and dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x3a0], 0x66c93ee
jne 0x10055962
mov dword [ebp - 0x4c0], 1
jmp 0x10055969
and dword [ebp - 0x4c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
imul eax, dword [ebp - 0x4c0]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x30]
jge 0x10055992
mov dword [ebp - 0x3a8], 1
jmp 0x10055999
and dword [ebp - 0x3a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0x3a8], eax
jne 0x100559b7
mov dword [ebp - 0x550], 1
jmp 0x100559be
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x550], eax
jle 0x100559d5
mov dword [ebp - 0x3b0], 1
jmp 0x100559dc
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10055ab7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
mov dword [ebp - 0x8bc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0xd0], eax
jne 0x10055a21
mov dword [ebp - 0x4c8], 1
jmp 0x10055a28
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0xd0]
imul eax, dword [ebp - 0x4c8]
mov ecx, 0xffff
sub ecx, eax
test ecx, ecx
jle 0x10055a4c
mov dword [ebp - 0x3b8], 1
jmp 0x10055a53
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0xd0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
je 0x10055a85
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
je 0x10055a85
mov dword [ebp - 0x5cc], 1
jmp 0x10055a8c
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
push 1
lea ecx, [ebp - 0x690]
call fcn.10017408
mov ecx, dword [ebp - 0x5cc]
add ecx, dword [eax]
cmp esi, ecx
jl 0x10055ab7
and dword [ebp - 0x3c0], 0
jmp 0x10055ac1
mov dword [ebp - 0x3c0], 1
push 1
lea ecx, [ebp - 0x690]
call fcn.10017408
mov ecx, dword [ebp - 0x3c0]
cmp ecx, dword [eax]
jne 0x10055ae4
mov dword [ebp - 0x4d0], 1
jmp 0x10055aeb
and dword [ebp - 0x4d0], 0
push 1
lea ecx, [ebp - 0x690]
call fcn.10017408
mov ecx, dword [ebp - 0x4d0]
cmp ecx, dword [eax]
jne 0x10055b0e
mov dword [ebp - 0x3c8], 1
jmp 0x10055b15
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
add eax, 6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x30]
jle 0x10055b36
mov dword [ebp - 0x558], 1
jmp 0x10055b3d
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x6f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x690]
call fcn.10017403
mov dword [ebp - 0x2fc], 0xe2095e04
mov dword [ebp - 0x780], 0xfe0a8eac
mov dword [ebp - 0x77c], 0xfe0a8eac
mov dword [ebp - 0x778], 0xfe0a8eac
mov dword [ebp - 0x774], 0xfe0a8eac
lea ecx, [ebp - 0x1cd]
call fcn.10008cd3
push eax
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x780]
push eax
lea ecx, [ebp - 0x974]
call fcn.10017417
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x604]
call fcn.100173d9
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x54], 0
jmp 0x10055bd6
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10055bec
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x57c], 0
jmp 0x10055bcf
mov dword [ebp - 0x54], 0
jmp 0x10055bfc
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10055c12
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x950], 0x1e13
jmp 0x10055bf5
push 0
lea ecx, [ebp - 0x604]
call fcn.10017408
and dword [eax], 0
jmp 0x10055c48
push 0
lea ecx, [ebp - 0x604]
call fcn.10017408
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3d0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x604]
call fcn.10017408
cmp dword [eax], 0xffffffeb
jle 0x10055c95
mov dword [ebp - 0x4d8], 0x42a1
mov byte [ebp - 0x7a], 0
movzx eax, byte [ebp - 0x7a]
test eax, eax
je 0x10055c86
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
jmp 0x10055c24
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x57c]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x57c]
push 4
pop edx
shl edx, 0
add ecx, dword [ebp + edx - 0x57c]
sub eax, ecx
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x57c]
jl 0x10055cdd
push 5
pop eax
test eax, eax
jne 0x10055cdd
and dword [ebp - 0x3d8], 0
jmp 0x10055ce7
mov dword [ebp - 0x3d8], 1
cmp dword [ebp - 0x3d8], 0xd0c1
jle 0x10055cff
mov dword [ebp - 0x654], 1
jmp 0x10055d06
and dword [ebp - 0x654], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x57c]
mov dword [ebp - 0x844], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x57c]
mov dword [ebp - 0x848], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x57c], 6
jg 0x10055d51
mov eax, 0x1f0dfbc4
test eax, eax
je 0x10055d51
mov dword [ebp - 0x3e0], 1
jmp 0x10055d58
and dword [ebp - 0x3e0], 0
push 0
lea ecx, [ebp - 0x604]
call fcn.10017408
mov eax, dword [eax]
add eax, 0x6b471dfd
mov dword [ebp - 0x5bc], eax
push 2
lea ecx, [ebp - 0x604]
call fcn.10017408
mov ecx, dword [ebp - 0x5bc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5bc]
cmp eax, dword [ebp - 0x3e0]
jg 0x10055da1
mov dword [ebp - 0x4e0], 1
jmp 0x10055da8
and dword [ebp - 0x4e0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x950]
cmp dword [ebp - 0x4e0], eax
jg 0x10055dc8