Function at 0x10008dc9
Capabilities:
Get geographical location
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100870ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf44
push esi
push edi
mov dword [ebp - 0x3c], 0xa624cdb
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 0x3dc], 0
push 1
lea ecx, [ebp - 0xb8c]
call fcn.100180d9
and dword [ebp - 4], 0
mov dword [ebp - 0x9c], 0
jmp 0x10008e35
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x10008e51
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x924], 1
jmp 0x10008e28
mov dword [ebp - 0x9c], 0
jmp 0x10008e6a
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x10008e8c
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xb8c]
call fcn.10018146
mov dword [eax], 2
jmp 0x10008e5d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10008eab
mov dword [ebp - 0x63c], 1
jmp 0x10008eb2
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0x39be
jne 0x10008eca
mov dword [ebp - 0x864], 1
jmp 0x10008ed1
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
add eax, 6
je 0x100092e5
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x1f8], 0
jmp 0x10008f00
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x10008f1c
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0xce8], 0xcd7820ea
jmp 0x10008ef3
mov dword [ebp - 0x3c], 0x15
jmp 0x10008f2c
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x36
jge 0x10009294
mov dword [ebp - 0xe4], 0xe64f
push 1
lea ecx, [ebp - 0x8f0]
call fcn.100180d9
mov byte [ebp - 4], 1
mov dword [ebp - 0x1e8], 0
jmp 0x10008f6a
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x10008f8c
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x8f0]
call fcn.10018146
mov dword [eax], 3
jmp 0x10008f5d
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xd60], eax
mov eax, 0xffff
test eax, eax
jae 0x10008fb6
cmp dword [ebp - 0xe4], 0
je 0x10008fb6
mov dword [ebp - 0x86c], 1
jmp 0x10008fbd
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
add esi, dword [ebp - 0x86c]
push 0
lea ecx, [ebp - 0x8f0]
call fcn.10018146
mov dword [eax], esi
mov dword [ebp - 0x24], 0
jmp 0x10008feb
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x10009280
mov dword [ebp - 0x308], 0x58aa
mov dword [ebp - 0x3bc], 0xffffffff
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0xdc0], eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x8f0]
call fcn.10018146
mov dword [eax], 0x8cbdb62b
mov eax, 0x8cbdb62b
test eax, eax
je 0x1000904d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xcc0], eax
cmp dword [ebp - 0x24], 6
jbe 0x1000904d
mov dword [ebp - 0x874], 1
jmp 0x10009054
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0xe4]
sub eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x874]
cmp eax, dword [ebp - 0x74]
jl 0x10009086
push 0
lea ecx, [ebp - 0x8f0]
call fcn.10018146
cmp dword [eax], 0
je 0x10009086
mov dword [ebp - 0x87c], 1
jmp 0x1000908d
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x308]
add eax, dword [ebp - 0x87c]
cmp eax, dword [ebp - 0xe4]
jge 0x100090ad
mov dword [ebp - 0x884], 1
jmp 0x100090b4
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x884], eax
jl 0x100090ce
mov dword [ebp - 0x88c], 1
jmp 0x100090d5
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x88c], eax
jge 0x100090ec
mov dword [ebp - 0x918], 1
jmp 0x100090f3
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xe34], eax
cmp dword [ebp - 0xe4], 1
jbe 0x10009111
mov dword [ebp - 0x474], 1
jmp 0x10009118
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x474], eax
jl 0x10009132
mov dword [ebp - 0x768], 1
jmp 0x10009139
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x768], eax
jg 0x10009153
mov dword [ebp - 0x3b4], 1
jmp 0x1000915a
and dword [ebp - 0x3b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x924]
imul eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x3bc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x924], 0
je 0x1000925e
cmp dword [ebp - 0x3c], 0xfffffff8
jne 0x100091a6
mov dword [ebp - 0x3c4], 1
jmp 0x100091ad
and dword [ebp - 0x3c4], 0
cmp dword [ebp - 0x74], 0xfeceb2cf
je 0x100091c2
mov dword [ebp - 0x770], 1
jmp 0x100091c9
and dword [ebp - 0x770], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x924]
imul eax, dword [ebp - 0x770]
cmp eax, dword [ebp - 0x3bc]
jne 0x100091f1
mov dword [ebp - 0x778], 1
jmp 0x100091f8
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x778], eax
jle 0x1000920f
mov dword [ebp - 0x780], 1
jmp 0x10009216
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x780]
je 0x10009236
mov eax, 0x2cc684ca
test eax, eax
jne 0x10009236
and dword [ebp - 0xa64], 0
jmp 0x10009240
mov dword [ebp - 0xa64], 1
push 0
lea ecx, [ebp - 0x8f0]
call fcn.10018146
or eax, 0xffffffff
je 0x1000925e
mov dword [ebp - 0x3cc], 1
jmp 0x10009265
and dword [ebp - 0x3cc], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x3cc]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xce8], eax
jmp 0x10008fe4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8f0]
call fcn.10018141
jmp 0x10008f25
mov dword [ebp - 0x74], 0
jmp 0x100092a4
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x2d
jg 0x100092e0
mov dword [ebp - 0x3c], 0
jmp 0x100092ba
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x100092de
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x100092dc
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x100092b3
jmp 0x1000929d
jmp 0x1000941a
mov dword [ebp - 0xec], 0xfffffffe
mov dword [ebp - 0x91c], 0xef155d2
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xcc8], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0x1d4]
sub eax, 0x5c01cf56
cmp eax, 0xd6df
je 0x1000932f
mov dword [ebp - 0x788], 1
jmp 0x10009336
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0x788]
je 0x10009359
cmp dword [ebp - 0xec], 0
je 0x10009359
mov dword [ebp - 0x3d4], 1
jmp 0x10009360
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xcd0], eax
cmp dword [ebp - 0x3dc], 0
jne 0x1000938b
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1000938b
and dword [ebp - 0x790], 0
jmp 0x10009395
mov dword [ebp - 0x790], 1
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff6
jae 0x100093b0
mov dword [ebp - 0xa34], 1
jmp 0x100093b7
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xe5c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xcf8], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x798], eax
push 0
lea ecx, [ebp - 0xb8c]
call fcn.10018146
mov ecx, dword [ebp - 0x798]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0x798], eax
jle 0x10009407
mov dword [ebp - 0x3e4], 1
jmp 0x1000940e
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1d4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8c]
call fcn.10018141
mov dword [ebp - 0x34], 0xa624cdb
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x1dc], 1
mov dword [ebp - 0x434], 0
push 1
lea ecx, [ebp - 0xb74]
call fcn.100180d9
mov dword [ebp - 4], 2
mov dword [ebp - 0xa8], 0
jmp 0x10009481
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1000949d
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x930], 1
jmp 0x10009474
mov dword [ebp - 0xa8], 0
jmp 0x100094b6
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x100094d8
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xb74]
call fcn.10018146
mov dword [eax], 2
jmp 0x100094a9
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x100094f7
mov dword [ebp - 0x7a0], 1
jmp 0x100094fe
and dword [ebp - 0x7a0], 0
cmp dword [ebp - 0x7a0], 0x39be
jne 0x10009516
mov dword [ebp - 0x3ec], 1
jmp 0x1000951d
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
add eax, 6
je 0x10009931
mov dword [ebp - 0x7c], 0xffffffff
mov dword [ebp - 0x278], 0
jmp 0x1000954c
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jge 0x10009568
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xcdc], 0xcd7820ea
jmp 0x1000953f
mov dword [ebp - 0x34], 0x15
jmp 0x10009578
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x36
jge 0x100098e0
mov dword [ebp - 0xf4], 0xe64f
push 1
lea ecx, [ebp - 0x914]
call fcn.100180d9
mov byte [ebp - 4], 3
mov dword [ebp - 0x200], 0
jmp 0x100095b6
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x100095d8
push dword [ebp - 0x200]
lea ecx, [ebp - 0x914]
call fcn.10018146
mov dword [eax], 3
jmp 0x100095a9
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xde0], eax
mov eax, 0xffff
test eax, eax
jae 0x10009602
cmp dword [ebp - 0xf4], 0
je 0x10009602
mov dword [ebp - 0x7a8], 1
jmp 0x10009609
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x2c]
add esi, dword [ebp - 0x7a8]
push 0
lea ecx, [ebp - 0x914]
call fcn.10018146
mov dword [eax], esi
mov dword [ebp - 0x2c], 0
jmp 0x10009637
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x100098cc
mov dword [ebp - 0x340], 0x58aa
mov dword [ebp - 0x414], 0xffffffff
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0xd00], eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x914]
call fcn.10018146
mov dword [eax], 0x8cbdb62b
mov eax, 0x8cbdb62b
test eax, eax
je 0x10009699
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe3c], eax
cmp dword [ebp - 0x2c], 6
jbe 0x10009699
mov dword [ebp - 0x3f4], 1
jmp 0x100096a0
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0xf4]
sub eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x3f4]
cmp eax, dword [ebp - 0x7c]
jl 0x100096d2
push 0
lea ecx, [ebp - 0x914]
call fcn.10018146
cmp dword [eax], 0
je 0x100096d2
mov dword [ebp - 0x7b0], 1
jmp 0x100096d9
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x340]
add eax, dword [ebp - 0x7b0]
cmp eax, dword [ebp - 0xf4]
jge 0x100096f9
mov dword [ebp - 0x3fc], 1
jmp 0x10009700
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0x3fc], eax
jl 0x1000971a
mov dword [ebp - 0x7b8], 1
jmp 0x10009721
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x7b8], eax
jge 0x10009738
mov dword [ebp - 0x944], 1
jmp 0x1000973f
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xd08], eax
cmp dword [ebp - 0xf4], 1
jbe 0x1000975d
mov dword [ebp - 0x404], 1
jmp 0x10009764
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x404], eax
jl 0x1000977e
mov dword [ebp - 0x7c0], 1
jmp 0x10009785
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x7c0], eax
jg 0x1000979f
mov dword [ebp - 0x40c], 1
jmp 0x100097a6
and dword [ebp - 0x40c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x930]
imul eax, dword [ebp - 0x40c]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x414], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x930], 0
je 0x100098aa
cmp dword [ebp - 0x34], 0xfffffff8
jne 0x100097f2
mov dword [ebp - 0x41c], 1
jmp 0x100097f9
and dword [ebp - 0x41c], 0
cmp dword [ebp - 0x7c], 0xfeceb2cf
je 0x1000980e
mov dword [ebp - 0x7c8], 1
jmp 0x10009815
and dword [ebp - 0x7c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x930]
imul eax, dword [ebp - 0x7c8]
cmp eax, dword [ebp - 0x414]
jne 0x1000983d
mov dword [ebp - 0x7d0], 1
jmp 0x10009844
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x7d0], eax
jle 0x1000985b
mov dword [ebp - 0x7d8], 1
jmp 0x10009862
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x7d8]
je 0x10009882
mov eax, 0x2cc684ca
test eax, eax
jne 0x10009882
and dword [ebp - 0x94c], 0
jmp 0x1000988c
mov dword [ebp - 0x94c], 1
push 0
lea ecx, [ebp - 0x914]
call fcn.10018146
or eax, 0xffffffff
je 0x100098aa
mov dword [ebp - 0x424], 1
jmp 0x100098b1
and dword [ebp - 0x424], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x424]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xcdc], eax
jmp 0x10009630
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x914]
call fcn.10018141
jmp 0x10009571
mov dword [ebp - 0x7c], 0
jmp 0x100098f0
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x2d
jg 0x1000992c
mov dword [ebp - 0x34], 0
jmp 0x10009906
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jg 0x1000992a
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x10009928
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x100098ff
jmp 0x100098e9
jmp 0x10009a66
mov dword [ebp - 0xfc], 0xfffffffe
mov dword [ebp - 0x95c], 0xef155d2
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xdf0], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xd10], eax
mov eax, dword [ebp - 0x1dc]
sub eax, 0x5c01cf56
cmp eax, 0xd6df
je 0x1000997b
mov dword [ebp - 0x7e0], 1
jmp 0x10009982
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x7e0]
je 0x100099a5
cmp dword [ebp - 0xfc], 0
je 0x100099a5
mov dword [ebp - 0x42c], 1
jmp 0x100099ac
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe14], eax
cmp dword [ebp - 0x434], 0
jne 0x100099d7
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x100099d7
and dword [ebp - 0x7e8], 0
jmp 0x100099e1
mov dword [ebp - 0x7e8], 1
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff6
jae 0x100099fc
mov dword [ebp - 0x954], 1
jmp 0x10009a03
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xd18], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xe00], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x7f0], eax
push 0
lea ecx, [ebp - 0xb74]
call fcn.10018146
mov ecx, dword [ebp - 0x7f0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0x7f0], eax
jle 0x10009a53
mov dword [ebp - 0x43c], 1
jmp 0x10009a5a
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1dc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb74]
call fcn.10018141
and dword [ebp - 0xb20], 0
and dword [ebp - 0xb1c], 0
and dword [ebp - 0xb18], 0
and dword [ebp - 0xb14], 0
lea ecx, [ebp - 0x2fd]
call fcn.10008b83
push eax
lea eax, [ebp - 0xb10]
push eax
lea eax, [ebp - 0xb20]
push eax
lea ecx, [ebp - 0xeac]
call fcn.10018155
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xaa4]
call fcn.1001811b
mov dword [ebp - 4], 4
push 0
lea ecx, [ebp - 0xaa4]
call fcn.10018146
mov dword [eax], 7
jmp 0x10009b0f
push 0
lea ecx, [ebp - 0xaa4]
call fcn.10018146
mov dword [ebp - 0x7f8], eax
mov eax, dword [ebp - 0x7f8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7f8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xaa4]
call fcn.10018146
cmp dword [eax], 9
jg 0x10009b3f
mov byte [ebp - 0xcc], 0
movzx eax, byte [ebp - 0xcc]
test eax, eax
je 0x10009b3d
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x10009aeb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaa4]
call fcn.10018141
mov dword [ebp - 0x54], 0xa624cdb
mov dword [ebp - 0x208], 6
push 3
lea ecx, [ebp - 0xabc]
call fcn.100180d9
mov dword [ebp - 4], 5
mov dword [ebp - 0x96c], 0x3281
mov dword [ebp - 0x2b8], 0
jmp 0x10009b96
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x10009bb5
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0xabc]
call fcn.10018146
or dword [eax], 0xffffffff
jmp 0x10009b89
mov dword [ebp - 0x208], 0
jmp 0x10009bce
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x15
jl 0x10009c51
mov dword [ebp - 0x964], 1
mov dword [ebp - 0xd20], 0x407858f9
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x280], 0
jmp 0x10009c0e
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 1
jge 0x10009c2a
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0xe18], 0x7d65121a
jmp 0x10009c01
mov esi, dword [ebp - 0x964]
push 1
lea ecx, [ebp - 0xabc]
call fcn.10018146
mov dword [eax], esi
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
jmp 0x10009bc1
mov esi, dword [ebp - 0x96c]
push 1
lea ecx, [ebp - 0xabc]
call fcn.10018146
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xabc]
call fcn.10018141
mov dword [ebp - 0x20], 0xfffffff8
push 4
lea ecx, [ebp - 0x1ac]
call fcn.100180d9
mov dword [ebp - 4], 6
mov dword [ebp - 0x47c], 0xffffffff
mov dword [ebp - 0x44], 0
jmp 0x10009caa
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x10009cc0
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x3a4], 0x540d
jmp 0x10009ca3
mov dword [ebp - 0x44], 0
jmp 0x10009cd0
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x10009ce9
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1ac]
call fcn.10018146
and dword [eax], 0
jmp 0x10009cc9
mov dword [ebp - 0x44], 0
jmp 0x10009cf9
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10009d0f
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xd2c], 0
jmp 0x10009cf2
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov dword [eax], 3
jmp 0x10009d48
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov dword [ebp - 0x800], eax
mov eax, dword [ebp - 0x800]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x800]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
cmp dword [eax], 0
jl 0x1000a0ad
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x97c], 0xffffffff
mov dword [ebp - 0x210], 0
jmp 0x10009d8b
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x10009da7
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0xe74], 7
jmp 0x10009d7e
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x3a4]
mov dword [ebp - 0xd30], eax
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
cmp dword [eax], 0
je 0x10009dfa
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x3a4], 0
je 0x10009dfa
mov dword [ebp - 0x44c], 1
jmp 0x10009e01
and dword [ebp - 0x44c], 0
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x3a4]
cmp eax, dword [ebp - 0x44c]
jle 0x10009e2b
mov dword [ebp - 0x808], 1
jmp 0x10009e32
and dword [ebp - 0x808], 0
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x3a4]
cmp eax, dword [ebp - 0x808]
jne 0x10009e5c
mov dword [ebp - 0x454], 1
jmp 0x10009e63
and dword [ebp - 0x454], 0
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x3a4]
cmp dword [ebp - 0x454], eax
jne 0x10009e8d
mov dword [ebp - 0x810], 1
jmp 0x10009e94
and dword [ebp - 0x810], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp - 0x810], eax
je 0x10009eb5
mov dword [ebp - 0x45c], 1
jmp 0x10009ebc
and dword [ebp - 0x45c], 0
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov ecx, dword [ebp - 0x45c]
cmp ecx, dword [eax]
jg 0x10009edf
mov dword [ebp - 0x818], 1
jmp 0x10009ee6
and dword [ebp - 0x818], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x818]
sub ecx, dword [ebp + eax - 0xd2c]
je 0x10009f13
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd2c], 0
jne 0x10009f13
and dword [ebp - 0x464], 0
jmp 0x10009f1d
mov dword [ebp - 0x464], 1
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x3a4]
cmp dword [ebp - 0x464], eax
jge 0x10009f59
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
cmp dword [eax], 0
je 0x10009f59
mov dword [ebp - 0x820], 1
jmp 0x10009f60
and dword [ebp - 0x820], 0
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x3a4]
cmp dword [ebp - 0x820], eax
jl 0x10009f8a
mov dword [ebp - 0x46c], 1
jmp 0x10009f91
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x828], eax
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov eax, dword [eax]
mov ecx, dword [ebp - 0x828]
sub ecx, dword [ebp + eax*4 - 0x3a4]
mov dword [ebp - 0x830], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x830]
mov dword [ebp + eax - 0xe74], ecx
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x3a4]
cmp eax, dword [ebp - 0x830]
je 0x10009ffc
mov dword [ebp - 0x69c], 1
jmp 0x1000a003
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x47c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp - 0x47c], eax
jge 0x1000a030
mov dword [ebp - 0x974], 1
jmp 0x1000a037
and dword [ebp - 0x974], 0
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x3a4]
mov dword [ebp - 0xc30], eax
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10018146
cmp dword [eax], 0xcb44
jne 0x1000a074
mov dword [ebp - 0x854], 1
jmp 0x1000a07b
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x97c], eax
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1000a0a8
push 0x104b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x10009d24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ac]
call fcn.10018141
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x188], 0
jmp 0x1000a0df
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xffffffe2
jge 0x1000a10a
mov dword [ebp - 0x484], 0xd95e17ca
cmp dword [ebp - 0x484], 0
je 0x1000a0fd
jmp 0x1000a10a
cmp dword [ebp - 0x484], 0
je 0x1000a108
jmp 0x1000a10a
jmp 0x1000a0d2
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x1e4], 1
mov dword [ebp - 0x1d8], 0x41e55969
mov dword [ebp - 0xc34], 7
mov dword [ebp - 0x2d8], 0
jmp 0x1000a14d
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jge 0x1000a169
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0x984], 9
jmp 0x1000a140
mov dword [ebp - 0x1d8], 0
jmp 0x1000a182
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x1000a19e
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x984], 0xf57a7c20
jmp 0x1000a175
mov dword [ebp - 0x4d4], 0
push 1
lea ecx, [ebp - 0xb80]
call fcn.100180d9
mov dword [ebp - 4], 7
mov dword [ebp - 0xa0], 0
jmp 0x1000a1d5
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1000a1f1
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x93c], 1
jmp 0x1000a1c8
mov dword [ebp - 0xa0], 0
jmp 0x1000a20a
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x1000a22c
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xb80]
call fcn.10018146
mov dword [eax], 2
jmp 0x1000a1fd
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1000a24b
mov dword [ebp - 0x6a4], 1
jmp 0x1000a252
and dword [ebp - 0x6a4], 0
cmp dword [ebp - 0x6a4], 0x39be
jne 0x1000a26a
mov dword [ebp - 0x48c], 1
jmp 0x1000a271
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
add eax, 6
je 0x1000a6a3
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x218], 0
jmp 0x1000a2a3
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x1000a2bf
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0xcf4], 0xcd7820ea
jmp 0x1000a296
mov dword [ebp - 0x54], 0x15
jmp 0x1000a2cf
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x36
jge 0x1000a646
mov dword [ebp - 0x104], 0xe64f
push 1
lea ecx, [ebp - 0x8d8]
call fcn.100180d9
mov byte [ebp - 4], 8
mov dword [ebp - 0x288], 0
jmp 0x1000a30d
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jge 0x1000a32f
push dword [ebp - 0x288]
lea ecx, [ebp - 0x8d8]
call fcn.10018146
mov dword [eax], 3
jmp 0x1000a300
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xc3c], eax
mov eax, 0xffff
test eax, eax
jae 0x1000a359
cmp dword [ebp - 0x104], 0
je 0x1000a359
mov dword [ebp - 0x7b4], 1
jmp 0x1000a360
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
add esi, dword [ebp - 0x7b4]
push 0
lea ecx, [ebp - 0x8d8]
call fcn.10018146
mov dword [eax], esi
mov dword [ebp - 0x20], 0
jmp 0x1000a38e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x1000a632
mov dword [ebp - 0x310], 0x58aa
mov dword [ebp - 0x4b4], 0xffffffff
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0xc44], eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x8d8]
call fcn.10018146
mov dword [eax], 0x8cbdb62b
mov eax, 0x8cbdb62b
test eax, eax
je 0x1000a3f0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc4c], eax
cmp dword [ebp - 0x20], 6
jbe 0x1000a3f0
mov dword [ebp - 0x494], 1
jmp 0x1000a3f7
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x104]
sub eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x494]
cmp eax, dword [ebp - 0x84]
jl 0x1000a42f
push 0
lea ecx, [ebp - 0x8d8]
call fcn.10018146
cmp dword [eax], 0
je 0x1000a42f
mov dword [ebp - 0x6ac], 1
jmp 0x1000a436
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x310]
add eax, dword [ebp - 0x6ac]
cmp eax, dword [ebp - 0x104]
jge 0x1000a456
mov dword [ebp - 0x49c], 1
jmp 0x1000a45d
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x49c], eax
jl 0x1000a477
mov dword [ebp - 0x85c], 1
jmp 0x1000a47e
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x85c], eax
jge 0x1000a495
mov dword [ebp - 0x98c], 1
jmp 0x1000a49c
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xc54], eax
cmp dword [ebp - 0x104], 1
jbe 0x1000a4bd
mov dword [ebp - 0x4a4], 1
jmp 0x1000a4c4
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x4a4], eax
jl 0x1000a4de
mov dword [ebp - 0x6b4], 1
jmp 0x1000a4e5
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x6b4], eax
jg 0x1000a4ff
mov dword [ebp - 0x4ac], 1
jmp 0x1000a506
and dword [ebp - 0x4ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x93c]
imul eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x4b4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x93c], 0
je 0x1000a610
cmp dword [ebp - 0x54], 0xfffffff8
jne 0x1000a552
mov dword [ebp - 0x4bc], 1
jmp 0x1000a559
and dword [ebp - 0x4bc], 0
cmp dword [ebp - 0x84], 0xfeceb2cf
je 0x1000a571
mov dword [ebp - 0x7bc], 1
jmp 0x1000a578
and dword [ebp - 0x7bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x93c]
imul eax, dword [ebp - 0x7bc]
cmp eax, dword [ebp - 0x4b4]
jne 0x1000a5a0
mov dword [ebp - 0x6bc], 1
jmp 0x1000a5a7
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x6bc], eax
jle 0x1000a5c1
mov dword [ebp - 0x840], 1
jmp 0x1000a5c8
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x4bc]
cmp eax, dword [ebp - 0x840]
je 0x1000a5e8
mov eax, 0x2cc684ca
test eax, eax
jne 0x1000a5e8
and dword [ebp - 0x994], 0
jmp 0x1000a5f2
mov dword [ebp - 0x994], 1
push 0
lea ecx, [ebp - 0x8d8]
call fcn.10018146
or eax, 0xffffffff
je 0x1000a610
mov dword [ebp - 0x4c4], 1
jmp 0x1000a617
and dword [ebp - 0x4c4], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x4c4]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xcf4], eax
jmp 0x1000a387
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x8d8]
call fcn.10018141
jmp 0x1000a2c8
mov dword [ebp - 0x84], 0
jmp 0x1000a65f
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x2d
jg 0x1000a69e
mov dword [ebp - 0x54], 0
jmp 0x1000a678
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jg 0x1000a69c
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1000a69a
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x1000a671
jmp 0x1000a652
jmp 0x1000a7d8
mov dword [ebp - 0x10c], 0xfffffffe
mov dword [ebp - 0x9a4], 0xef155d2
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xc5c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp - 0x1e4]
sub eax, 0x5c01cf56
cmp eax, 0xd6df
je 0x1000a6ed
mov dword [ebp - 0x6c4], 1
jmp 0x1000a6f4
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x6c4]
je 0x1000a717
cmp dword [ebp - 0x10c], 0
je 0x1000a717
mov dword [ebp - 0x4cc], 1
jmp 0x1000a71e
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xc6c], eax
cmp dword [ebp - 0x4d4], 0
jne 0x1000a749
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1000a749
and dword [ebp - 0x7c4], 0
jmp 0x1000a753
mov dword [ebp - 0x7c4], 1
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff6
jae 0x1000a76e
mov dword [ebp - 0x99c], 1
jmp 0x1000a775
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x6cc], eax
push 0
lea ecx, [ebp - 0xb80]
call fcn.10018146
mov ecx, dword [ebp - 0x6cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4d4]
cmp dword [ebp - 0x6cc], eax
jle 0x1000a7c5
mov dword [ebp - 0x4dc], 1
jmp 0x1000a7cc
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1e4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb80]
call fcn.10018141
push 2
lea ecx, [ebp - 0x378]
call fcn.100180d9
mov dword [ebp - 4], 9
push 3
lea ecx, [ebp - 0xb98]
call fcn.100180d9
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xb0], 0
jmp 0x1000a82e
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1000a850
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x378]
call fcn.10018146
mov dword [eax], 0xe60
jmp 0x1000a821
mov dword [ebp - 0xb0], 0
jmp 0x1000a869
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x1000a88b
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xb98]
call fcn.10018146
mov dword [eax], 0x96bc97de
jmp 0x1000a85c
push 1
lea ecx, [ebp - 0x378]
call fcn.10018146
cmp dword [eax], 0
je 0x1000a8bb
push 1
lea ecx, [ebp - 0x378]
call fcn.10018146
cmp dword [eax], 0
je 0x1000a8bb
mov dword [ebp - 0x870], 1
jmp 0x1000a8c2
and dword [ebp - 0x870], 0
push 1
lea ecx, [ebp - 0x378]
call fcn.10018146
mov ecx, dword [ebp - 0x870]
imul ecx, dword [eax]
test ecx, ecx
je 0x1000aabf
mov dword [ebp - 0x114], 0xfffffff7
mov dword [ebp - 0x2c0], 0x556123d4
mov dword [ebp - 0x220], 0
jmp 0x1000a90d
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 4
jge 0x1000a929
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0xf04], 0x9339b884
jmp 0x1000a900
cmp dword [ebp - 0x114], 1
jl 0x1000a93e
mov dword [ebp - 0x7cc], 1
jmp 0x1000a945
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xc84], eax
mov esi, dword [ebp - 0x2c0]
push 0
lea ecx, [ebp - 0x378]
call fcn.10018146
cmp esi, dword [eax]
je 0x1000a974
mov dword [ebp - 0x4e4], 1
jmp 0x1000a97b
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0xef7d
je 0x1000a993
mov dword [ebp - 0x6d4], 1
jmp 0x1000a99a
and dword [ebp - 0x6d4], 0
cmp dword [ebp - 0x6d4], 0
jne 0x1000a9af
mov dword [ebp - 0x9ac], 1
jmp 0x1000a9b6
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xc8c], eax
push 1
lea ecx, [ebp - 0x378]
call fcn.10018146
mov esi, dword [ebp - 0x2c0]
push 0
lea ecx, [ebp - 0x378]
call fcn.10018146
sub esi, dword [eax]
jne 0x1000a9ef
mov eax, 0xe13c
test eax, eax
je 0x1000aa04
cmp dword [ebp - 0x114], 0
je 0x1000aa04
mov dword [ebp - 0xa98], 1
jmp 0x1000aa0b
and dword [ebp - 0xa98], 0
push 1
lea ecx, [ebp - 0x378]
call fcn.10018146
cmp dword [ebp - 0x114], 0x7c39c9d9
je 0x1000aa30
mov dword [ebp - 0x4ec], 1
jmp 0x1000aa37
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x114]
imul eax, dword [ebp - 0x4ec]
add eax, dword [ebp - 0x7cc]
cmp eax, dword [ebp - 0x2c0]
jne 0x1000aa5e
mov dword [ebp - 0x4f4], 1
jmp 0x1000aa65
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x4f4], eax
jle 0x1000aa7f
mov dword [ebp - 0x6dc], 1
jmp 0x1000aa86
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x6dc], eax
je 0x1000aaa0
mov dword [ebp - 0x4fc], 1
jmp 0x1000aaa7
and dword [ebp - 0x4fc], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp + eax - 0xf04], ecx
jmp 0x1000ac88
mov dword [ebp - 0x1b8], 0x3c94681c
mov dword [ebp - 0x1d0], 0xfffffffb
mov dword [ebp - 0x228], 0
jmp 0x1000aaec
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x1000ab08
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x8bc], 0xc23782ec
jmp 0x1000aadf
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8bc], 0
jmp 0x1000ab36
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8bc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8bc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8bc], 1
jg 0x1000ac88
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x11c], 1
jmp 0x1000ab6d
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jl 0x1000ac83
cmp dword [ebp - 0x11c], 0
jne 0x1000abb0
cmp dword [ebp - 0x11c], 0xbde6
jne 0x1000ab9b
mov dword [ebp - 0x848], 1
jmp 0x1000aba2
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x11c]
je 0x1000abb7
push 8
pop eax
test eax, eax
jne 0x1000abc9
cmp dword [ebp - 0x1b8], 0
jne 0x1000abc9
and dword [ebp - 0x504], 0
jmp 0x1000abd3
mov dword [ebp - 0x504], 1
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1b8], 0
jmp 0x1000abf8
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jg 0x1000ac7e
mov dword [ebp - 0x1d0], 1
jmp 0x1000ac1a
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jl 0x1000ac79
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x290], 0
jmp 0x1000ac46
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 1
jg 0x1000ac77
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x1000ac75
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
jmp 0x1000ac39
jmp 0x1000ac0d
jmp 0x1000abeb
jmp 0x1000ab60
jmp 0x1000ab1b
push 1
lea ecx, [ebp - 0x378]
call fcn.10018146
mov esi, eax
push 1
lea ecx, [ebp - 0xb98]
call fcn.10018146
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb98]
call fcn.10018141
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x378]
call fcn.10018141
push 2
lea ecx, [ebp - 0x384]
call fcn.100180d9
mov dword [ebp - 4], 0xb
push 3
lea ecx, [ebp - 0xbb0]
call fcn.100180d9
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x8c], 0
jmp 0x1000ad04
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1000ad26
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x384]
call fcn.10018146
mov dword [eax], 0xe60
jmp 0x1000acf7
mov dword [ebp - 0x8c], 0
jmp 0x1000ad3f
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1000ad61
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xbb0]
call fcn.10018146
mov dword [eax], 0x96bc97de
jmp 0x1000ad32
push 1
lea ecx, [ebp - 0x384]
call fcn.10018146
cmp dword [eax], 0
je 0x1000ad91
push 1
lea ecx, [ebp - 0x384]
call fcn.10018146
cmp dword [eax], 0
je 0x1000ad91
mov dword [ebp - 0x6e4], 1
jmp 0x1000ad98
and dword [ebp - 0x6e4], 0
push 1
lea ecx, [ebp - 0x384]
call fcn.10018146
mov ecx, dword [ebp - 0x6e4]
imul ecx, dword [eax]
test ecx, ecx
je 0x1000af95
mov dword [ebp - 0x124], 0xfffffff7
mov dword [ebp - 0x2e8], 0x556123d4
mov dword [ebp - 0x230], 0
jmp 0x1000ade3
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 4
jge 0x1000adff
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0xef4], 0x9339b884
jmp 0x1000add6
cmp dword [ebp - 0x124], 1
jl 0x1000ae14
mov dword [ebp - 0x6ec], 1
jmp 0x1000ae1b
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xc94], eax
mov esi, dword [ebp - 0x2e8]
push 0
lea ecx, [ebp - 0x384]
call fcn.10018146
cmp esi, dword [eax]
je 0x1000ae4a
mov dword [ebp - 0x50c], 1
jmp 0x1000ae51
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 0xef7d
je 0x1000ae69
mov dword [ebp - 0x7d4], 1
jmp 0x1000ae70
and dword [ebp - 0x7d4], 0
cmp dword [ebp - 0x7d4], 0
jne 0x1000ae85
mov dword [ebp - 0xa7c], 1
jmp 0x1000ae8c
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xc9c], eax
push 1
lea ecx, [ebp - 0x384]
call fcn.10018146
mov esi, dword [ebp - 0x2e8]
push 0
lea ecx, [ebp - 0x384]
call fcn.10018146
sub esi, dword [eax]
jne 0x1000aec5
mov eax, 0xe13c
test eax, eax
je 0x1000aeda
cmp dword [ebp - 0x124], 0
je 0x1000aeda
mov dword [ebp - 0xa2c], 1
jmp 0x1000aee1
and dword [ebp - 0xa2c], 0
push 1
lea ecx, [ebp - 0x384]
call fcn.10018146
cmp dword [ebp - 0x124], 0x7c39c9d9
je 0x1000af06
mov dword [ebp - 0x514], 1
jmp 0x1000af0d
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x514]
add eax, dword [ebp - 0x6ec]
cmp eax, dword [ebp - 0x2e8]
jne 0x1000af34
mov dword [ebp - 0x51c], 1
jmp 0x1000af3b
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x51c], eax
jle 0x1000af55
mov dword [ebp - 0x888], 1
jmp 0x1000af5c
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x888], eax
je 0x1000af76
mov dword [ebp - 0x524], 1
jmp 0x1000af7d
and dword [ebp - 0x524], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x524]
mov dword [ebp + eax - 0xef4], ecx
jmp 0x1000b15e
mov dword [ebp - 0x1c0], 0x3c94681c
mov dword [ebp - 0x1e0], 0xfffffffb
mov dword [ebp - 0x238], 0
jmp 0x1000afc2
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x1000afde
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x8c4], 0xc23782ec
jmp 0x1000afb5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8c4], 0
jmp 0x1000b00c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8c4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8c4], 1
jg 0x1000b15e
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x12c], 1
jmp 0x1000b043
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jl 0x1000b159
cmp dword [ebp - 0x12c], 0
jne 0x1000b086
cmp dword [ebp - 0x12c], 0xbde6
jne 0x1000b071
mov dword [ebp - 0x6f4], 1
jmp 0x1000b078
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
sub eax, dword [ebp - 0x12c]
je 0x1000b08d
push 8
pop eax
test eax, eax
jne 0x1000b09f
cmp dword [ebp - 0x1c0], 0
jne 0x1000b09f
and dword [ebp - 0x52c], 0
jmp 0x1000b0a9
mov dword [ebp - 0x52c], 1
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1c0], 0
jmp 0x1000b0ce
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jg 0x1000b154
mov dword [ebp - 0x1e0], 1
jmp 0x1000b0f0
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x1000b14f
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x298], 0
jmp 0x1000b11c
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 1
jg 0x1000b14d
mov byte [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
test eax, eax
je 0x1000b14b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
jmp 0x1000b10f
jmp 0x1000b0e3
jmp 0x1000b0c1
jmp 0x1000b036
jmp 0x1000aff1
push 1
lea ecx, [ebp - 0x384]
call fcn.10018146
mov esi, eax
push 1
lea ecx, [ebp - 0xbb0]
call fcn.10018146
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xbb0]
call fcn.10018141
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x384]
call fcn.10018141
mov dword [ebp - 0x94], 0x5baf43b7
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000b1be
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [ebp - 0x94], 0
je 0x1000b20a
mov dword [ebp - 0x94], 0xffffffe4
jmp 0x1000b1e0
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xa
jl 0x1000b208
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x1000b206
push 0x59f
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x1000b1d3
jmp 0x1000b24f
mov dword [ebp - 0x94], 0
jmp 0x1000b223
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x1d
jge 0x1000b24f
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x1000b24d
push 0
push 0xd03
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
jmp 0x1000b216
push 2
lea ecx, [ebp - 0x36c]
call fcn.100180d9
mov dword [ebp - 4], 0xd
push 3
lea ecx, [ebp - 0xbc8]
call fcn.100180d9
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x68], 0
jmp 0x1000b284
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1000b2a0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x36c]
call fcn.10018146
mov dword [eax], 0xe60
jmp 0x1000b27d
mov dword [ebp - 0x68], 0
jmp 0x1000b2b0
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1000b2cc
push dword [ebp - 0x68]
lea ecx, [ebp - 0xbc8]
call fcn.10018146
mov dword [eax], 0x96bc97de
jmp 0x1000b2a9
push 1
lea ecx, [ebp - 0x36c]
call fcn.10018146
cmp dword [eax], 0
je 0x1000b2fc
push 1
lea ecx, [ebp - 0x36c]
call fcn.10018146
cmp dword [eax], 0
je 0x1000b2fc
mov dword [ebp - 0x7dc], 1
jmp 0x1000b303
and dword [ebp - 0x7dc], 0
push 1
lea ecx, [ebp - 0x36c]
call fcn.10018146
mov ecx, dword [ebp - 0x7dc]
imul ecx, dword [eax]
test ecx, ecx
je 0x1000b500
mov dword [ebp - 0x134], 0xfffffff7
mov dword [ebp - 0x2c8], 0x556123d4
mov dword [ebp - 0x240], 0
jmp 0x1000b34e
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
jge 0x1000b36a
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xebc], 0x9339b884
jmp 0x1000b341
cmp dword [ebp - 0x134], 1
jl 0x1000b37f
mov dword [ebp - 0x850], 1
jmp 0x1000b386
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xca4], eax
mov esi, dword [ebp - 0x2c8]
push 0
lea ecx, [ebp - 0x36c]
call fcn.10018146
cmp esi, dword [eax]
je 0x1000b3b5
mov dword [ebp - 0x534], 1
jmp 0x1000b3bc
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 0xef7d
je 0x1000b3d4
mov dword [ebp - 0x6fc], 1
jmp 0x1000b3db
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 0
jne 0x1000b3f0
mov dword [ebp - 0x928], 1
jmp 0x1000b3f7
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xcac], eax
push 1
lea ecx, [ebp - 0x36c]
call fcn.10018146
mov esi, dword [ebp - 0x2c8]
push 0
lea ecx, [ebp - 0x36c]
call fcn.10018146
sub esi, dword [eax]
jne 0x1000b430
mov eax, 0xe13c
test eax, eax
je 0x1000b445
cmp dword [ebp - 0x134], 0
je 0x1000b445
mov dword [ebp - 0xa8c], 1
jmp 0x1000b44c
and dword [ebp - 0xa8c], 0
push 1
lea ecx, [ebp - 0x36c]
call fcn.10018146
cmp dword [ebp - 0x134], 0x7c39c9d9
je 0x1000b471
mov dword [ebp - 0x53c], 1
jmp 0x1000b478
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x134]
imul eax, dword [ebp - 0x53c]
add eax, dword [ebp - 0x850]
cmp eax, dword [ebp - 0x2c8]
jne 0x1000b49f
mov dword [ebp - 0x544], 1
jmp 0x1000b4a6
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x544], eax
jle 0x1000b4c0
mov dword [ebp - 0x704], 1
jmp 0x1000b4c7
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x704], eax
je 0x1000b4e1
mov dword [ebp - 0x54c], 1
jmp 0x1000b4e8
and dword [ebp - 0x54c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x54c]
mov dword [ebp + eax - 0xebc], ecx
jmp 0x1000b6c9
mov dword [ebp - 0x1c8], 0x3c94681c
mov dword [ebp - 0x1b0], 0xfffffffb
mov dword [ebp - 0x248], 0
jmp 0x1000b52d
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 2
jge 0x1000b549
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x8cc], 0xc23782ec
jmp 0x1000b520
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8cc], 0
jmp 0x1000b577
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8cc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8cc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8cc], 1
jg 0x1000b6c9
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x13c], 1
jmp 0x1000b5ae
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x1000b6c4
cmp dword [ebp - 0x13c], 0
jne 0x1000b5f1
cmp dword [ebp - 0x13c], 0xbde6
jne 0x1000b5dc
mov dword [ebp - 0x7e4], 1
jmp 0x1000b5e3
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x7e4]
sub eax, dword [ebp - 0x13c]
je 0x1000b5f8
push 8
pop eax
test eax, eax
jne 0x1000b60a
cmp dword [ebp - 0x1c8], 0
jne 0x1000b60a
and dword [ebp - 0x554], 0
jmp 0x1000b614
mov dword [ebp - 0x554], 1
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1c8], 0
jmp 0x1000b639
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jg 0x1000b6bf
mov dword [ebp - 0x1b0], 1
jmp 0x1000b65b
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jl 0x1000b6ba
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x2a0], 0
jmp 0x1000b687
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jg 0x1000b6b8
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1000b6b6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
jmp 0x1000b67a
jmp 0x1000b64e
jmp 0x1000b62c
jmp 0x1000b5a1
jmp 0x1000b55c
push 1
lea ecx, [ebp - 0x36c]
call fcn.10018146
mov esi, eax
push 1
lea ecx, [ebp - 0xbc8]
call fcn.10018146
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xbc8]
call fcn.10018141
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x36c]
call fcn.10018141
mov dword [ebp - 0x6c], 0x5baf43b7
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000b726
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [ebp - 0x6c], 0
je 0x1000b763
mov dword [ebp - 0x6c], 0xffffffe4
jmp 0x1000b73c
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xa
jl 0x1000b761
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1000b75f
push 0x59f
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x1000b735
jmp 0x1000b79c
mov dword [ebp - 0x6c], 0
jmp 0x1000b773
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x1d
jge 0x1000b79c
mov byte [ebp - 0x182], 0
movzx eax, byte [ebp - 0x182]
test eax, eax
je 0x1000b79a
push 0
push 0xd03
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
jmp 0x1000b76c
mov dword [ebp - 0xbc], 8
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xa3c], 5
mov dword [ebp - 0xbc], 0
jmp 0x1000b7d0
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 9
jl 0x1000b7f9
mov dword [ebp - 0x70c], 0x905d
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x70c], 0
je 0x1000b7f7
jmp 0x1000b7c3
jmp 0x1000b7c3
mov dword [ebp - 0x10], 0xffffffe4
jmp 0x1000b809
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x19
jge 0x1000bafe
push 4
lea ecx, [ebp - 0x89c]
call fcn.100180d9
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x934], 0xe2138b36
mov dword [ebp - 0x70], 0
jmp 0x1000b841
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1000b85d
push dword [ebp - 0x70]
lea ecx, [ebp - 0x89c]
call fcn.10018146
mov dword [eax], 1
jmp 0x1000b83a
mov dword [ebp - 0x70], 0
jmp 0x1000b86d
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1000b883
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x940], 4
jmp 0x1000b866
push 3
lea ecx, [ebp - 0x89c]
call fcn.10018146
cmp dword [eax], 0
jne 0x1000ba4f
mov eax, dword [ebp - 0x10]
add eax, 9
cmp eax, dword [ebp - 0x10]
je 0x1000b8b0
mov dword [ebp - 0x55c], 1
jmp 0x1000b8b7
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x55c], eax
jl 0x1000b8ce
mov dword [ebp - 0x878], 1
jmp 0x1000b8d5
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x878]
jl 0x1000b8ec
mov dword [ebp - 0x564], 1
jmp 0x1000b8f3
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0xd711
jle 0x1000b90b
mov dword [ebp - 0x714], 1
jmp 0x1000b912
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xbc], eax
mov esi, dword [ebp - 0xbc]
imul esi, dword [ebp - 0x714]
push 3
lea ecx, [ebp - 0x89c]
call fcn.10018146
cmp esi, dword [eax]
jge 0x1000b951
cmp dword [ebp - 0xbc], 0
je 0x1000b951
mov dword [ebp - 0x56c], 1
jmp 0x1000b958
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x56c], eax
je 0x1000b96f
mov dword [ebp - 0x7ec], 1
jmp 0x1000b976
and dword [ebp - 0x7ec], 0
push 3
lea ecx, [ebp - 0x89c]
call fcn.10018146
mov ecx, dword [ebp - 0x7ec]
cmp ecx, dword [eax]
jge 0x1000b999
mov dword [ebp - 0x574], 1
jmp 0x1000b9a0
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x574], eax
jg 0x1000b9b7
mov dword [ebp - 0x71c], 1
jmp 0x1000b9be
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x71c], eax
jl 0x1000b9d5
mov dword [ebp - 0x57c], 1
jmp 0x1000b9dc
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 0xffffffff
jae 0x1000b9f1
mov dword [ebp - 0x858], 1
jmp 0x1000b9f8
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x934]
add eax, dword [ebp - 0x858]
cmp eax, dword [ebp - 0x10]
je 0x1000ba15
mov dword [ebp - 0x584], 1
jmp 0x1000ba1c
and dword [ebp - 0x584], 0
push 3
lea ecx, [ebp - 0x89c]
call fcn.10018146
mov eax, dword [eax]
cmp eax, dword [ebp - 0x584]
jg 0x1000ba42
cmp dword [ebp - 0x10], 0
jne 0x1000ba42
and dword [ebp - 0x724], 0
jmp 0x1000ba4c
mov dword [ebp - 0x724], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xa3c]
jge 0x1000ba69
mov dword [ebp - 0x58c], 1
jmp 0x1000ba70
and dword [ebp - 0x58c], 0
cmp dword [ebp - 0x58c], 0x85e1
jne 0x1000ba88
mov dword [ebp - 0x7f4], 1
jmp 0x1000ba8f
and dword [ebp - 0x7f4], 0
push 0
lea ecx, [ebp - 0x89c]
call fcn.10018146
mov ecx, dword [ebp - 0x7f4]
cmp ecx, dword [eax]
jl 0x1000bab2
mov dword [ebp - 0x594], 1
jmp 0x1000bab9
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x594], eax
jge 0x1000bad0
mov dword [ebp - 0x72c], 1
jmp 0x1000bad7
and dword [ebp - 0x72c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x72c]
mov dword [ebp + eax - 0x940], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x89c]
call fcn.10018141
jmp 0x1000b802
mov dword [ebp - 0x78], 0x5baf43b7
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1000bb1d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [ebp - 0x78], 0
je 0x1000bb5a
mov dword [ebp - 0x78], 0xffffffe4
jmp 0x1000bb33
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xa
jl 0x1000bb58
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1000bb56
push 0x59f
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x1000bb2c
jmp 0x1000bb93
mov dword [ebp - 0x78], 0
jmp 0x1000bb6a
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x1d
jge 0x1000bb93
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x1000bb91
push 0
push 0xd03
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
jmp 0x1000bb63
mov dword [ebp - 0xcb4], 0xfffffff6
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x1000bbc3
push 0x1bb0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov byte [ebp - 0xdc], 0
movzx eax, byte [ebp - 0xdc]
test eax, eax
je 0x1000bbe5
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 1
lea ecx, [ebp - 0xd3c]
call fcn.100180d9
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x2e0], 0xf833fcb5
mov dword [ebp - 0x250], 0
jmp 0x1000bc1c
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jge 0x1000bc3e
push dword [ebp - 0x250]
lea ecx, [ebp - 0xd3c]
call fcn.10018146
mov dword [eax], 1
jmp 0x1000bc0f
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1000bc56
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [ebp - 0x2e0], 0
jmp 0x1000bc6f
mov eax, dword [ebp - 0x2e0]
dec eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
jl 0x1000bc97
mov byte [ebp - 0xde], 0
movzx eax, byte [ebp - 0xde]
test eax, eax
je 0x1000bc95
push 0x80c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000bc62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd3c]
call fcn.10018141
movzx eax, byte [0x1067a020]
test eax, eax
je 0x1000bcc4
mov esi, 0x1008e834
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1000fdf4
mov dword [ebp - 0x144], 0xd5e48d32
mov dword [ebp - 0x144], 0xfffffff6
jmp 0x1000bce7
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xfffffff1
jl 0x1000c066
push 1
lea ecx, [ebp - 0x9bc]
call fcn.100180d9
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x5ac], 0x551b32e2
push 3
lea ecx, [ebp - 0xbe0]
call fcn.100180d9
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x38], 0
jmp 0x1000bd33
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000bd4f
push dword [ebp - 0x38]
lea ecx, [ebp - 0x9bc]
call fcn.10018146
mov dword [eax], 0x665683c8
jmp 0x1000bd2c
mov dword [ebp - 0x38], 0
jmp 0x1000bd5f
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000bd75
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x14c], 0x7b8f5f49
jmp 0x1000bd58
mov dword [ebp - 0x38], 0
jmp 0x1000bd85
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1000bd9e
push dword [ebp - 0x38]
lea ecx, [ebp - 0xbe0]
call fcn.10018146
or dword [eax], 0xffffffff
jmp 0x1000bd7e
push 0
lea ecx, [ebp - 0x9bc]
call fcn.10018146
mov dword [eax], 0xd
jmp 0x1000bdd7
push 0
lea ecx, [ebp - 0x9bc]
call fcn.10018146
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x59c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x9bc]
call fcn.10018146
cmp dword [eax], 8
jge 0x1000c043
push 1
lea ecx, [ebp - 0x908]
call fcn.100180d9
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x258], 0
jmp 0x1000be17
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x1000be39
push dword [ebp - 0x258]
lea ecx, [ebp - 0x908]
call fcn.10018146
mov dword [eax], 0xfffffff7
jmp 0x1000be0a
push 0
lea ecx, [ebp - 0x908]
call fcn.10018146
and dword [eax], 0
jmp 0x1000be6f
push 0
lea ecx, [ebp - 0x908]
call fcn.10018146
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x890]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x890]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x908]
call fcn.10018146
cmp dword [eax], 0xfffffffa
je 0x1000c02f
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x28], 0
jmp 0x1000be9c
cmp dword [ebp - 0x28], 0
jg 0x1000c016
mov dword [ebp - 0x948], 0xe5f58cdc
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x14c]
cmp dword [ebp + eax*4 - 0x14c], ecx
je 0x1000bed8
cmp dword [ebp - 0x144], 0
jne 0x1000bed8
and dword [ebp - 0x5a4], 0
jmp 0x1000bee2
mov dword [ebp - 0x5a4], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x14c]
cmp eax, dword [ebp - 0x5a4]
jg 0x1000bf00
mov dword [ebp - 0x734], 1
jmp 0x1000bf07
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
imul eax, dword [ebp - 0x28]
test eax, eax
jne 0x1000bf2d
push 0
lea ecx, [ebp - 0x908]
call fcn.10018146
cmp dword [eax], 0
je 0x1000c02a
jmp 0x1000c02f
jmp 0x1000be4b
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x908]
call fcn.10018141
jmp 0x1000bdb3
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xbe0]
call fcn.10018141
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9bc]
call fcn.10018141
jmp 0x1000bcda
mov dword [ebp - 0xc0], 8
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x950], 5
mov dword [ebp - 0xc0], 0
jmp 0x1000c09a
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 9
jl 0x1000c0c3
mov dword [ebp - 0x5bc], 0x905d
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x5bc], 0
je 0x1000c0c1
jmp 0x1000c08d
jmp 0x1000c08d
mov dword [ebp - 0x18], 0xffffffe4
jmp 0x1000c0d3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x19
jge 0x1000c3c8
push 4
lea ecx, [ebp - 0x8a8]
call fcn.100180d9
mov dword [ebp - 4], 0x14
mov dword [ebp - 0xa44], 0xe2138b36
mov dword [ebp - 0x80], 0
jmp 0x1000c10b
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x1000c127
push dword [ebp - 0x80]
lea ecx, [ebp - 0x8a8]
call fcn.10018146
mov dword [eax], 1
jmp 0x1000c104
mov dword [ebp - 0x80], 0
jmp 0x1000c137
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1000c14d
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xa84], 4
jmp 0x1000c130
push 3
lea ecx, [ebp - 0x8a8]
call fcn.10018146
cmp dword [eax], 0
jne 0x1000c319
mov eax, dword [ebp - 0x18]
add eax, 9
cmp eax, dword [ebp - 0x18]
je 0x1000c17a
mov dword [ebp - 0x860], 1
jmp 0x1000c181
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x860], eax
jl 0x1000c198
mov dword [ebp - 0x5c4], 1
jmp 0x1000c19f
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x5c4]
jl 0x1000c1b6
mov dword [ebp - 0x744], 1
jmp 0x1000c1bd
and dword [ebp - 0x744], 0
cmp dword [ebp - 0x744], 0xd711
jle 0x1000c1d5
mov dword [ebp - 0x5cc], 1
jmp 0x1000c1dc
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc0], eax
mov esi, dword [ebp - 0xc0]
imul esi, dword [ebp - 0x5cc]
push 3
lea ecx, [ebp - 0x8a8]
call fcn.10018146
cmp esi, dword [eax]
jge 0x1000c21b
cmp dword [ebp - 0xc0], 0
je 0x1000c21b
mov dword [ebp - 0x804], 1
jmp 0x1000c222
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x804], eax
je 0x1000c239
mov dword [ebp - 0x5d4], 1
jmp 0x1000c240
and dword [ebp - 0x5d4], 0
push 3
lea ecx, [ebp - 0x8a8]
call fcn.10018146
mov ecx, dword [ebp - 0x5d4]
cmp ecx, dword [eax]
jge 0x1000c263
mov dword [ebp - 0x74c], 1
jmp 0x1000c26a
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x74c], eax
jg 0x1000c281
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x950]
jge 0x1000c333
mov dword [ebp - 0x80c], 1
jmp 0x1000c33a
and dword [ebp - 0x80c], 0
cmp dword [ebp - 0x80c], 0x85e1
jne 0x1000c352
mov dword [ebp - 0x5f4], 1
jmp 0x1000c359
and dword [ebp - 0x5f4], 0
push 0
lea ecx, [ebp - 0x8a8]
call fcn.10018146
mov ecx, dword [ebp - 0x5f4]
cmp ecx, dword [eax]
jl 0x1000c37c
mov dword [ebp - 0x75c], 1
jmp 0x1000c383
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x75c], eax
jge 0x1000c39a
mov dword [ebp - 0x5fc], 1
jmp 0x1000c3a1
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5fc]
mov dword [ebp + eax - 0xa84], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a8]
call fcn.10018141
jmp 0x1000c0cc
mov dword [ebp - 0x154], 0x9cfe0482
mov dword [ebp - 0x76c], 0xdca8fecf
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x960], 0xffffffff
mov dword [ebp - 0x348], 0xfffffffb
mov dword [ebp - 0xad8], 0x6f9b6917
mov dword [ebp - 0xad4], 0x6f9b6917
mov dword [ebp - 0xad0], 0x6f9b6917
mov dword [ebp - 0xacc], 0x6f9b6917
mov dword [ebp - 0xb34], 0xa38d0672
mov dword [ebp - 0xb30], 0xa38d0672
mov dword [ebp - 0xb2c], 0xa38d0672
mov dword [ebp - 0xb28], 0xa38d0672
lea ecx, [ebp - 0x341]
call fcn.10008b83
push eax
lea eax, [ebp - 0xb24]
push eax
lea eax, [ebp - 0xb34]
push eax
lea ecx, [ebp - 0xedc]
call fcn.10018155
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd4c]
call fcn.1001811b
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x814], 2
mov dword [ebp - 0x320], 0x580
mov dword [ebp - 0xcc4], 0xd1cc0c7f
mov dword [ebp - 0xa74], 6
push 0
lea ecx, [ebp - 0xd4c]
call fcn.10018146
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
mov eax, dword [eax]
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0x318]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x318]
mov dword [ecx], eax
mov eax, dword [ebp - 0x958]
cmp eax, dword [ebp - 0xa4c]
jle 0x1000c506
mov dword [ebp - 0x604], 1
jmp 0x1000c50d
and dword [ebp - 0x604], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xad8]
mov dword [ebp - 0xccc], eax
push 4
pop eax
shl eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0xad8]
mov dword [ebp - 0x868], ecx
mov eax, dword [ebp - 0x868]
cmp dword [ebp - 0x604], eax
jle 0x1000c550
mov dword [ebp - 0x764], 1
jmp 0x1000c557
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x764], eax
je 0x1000c56e
mov eax, 0x9ea5d840
test eax, eax
jne 0x1000c57e
cmp dword [ebp - 0x76c], 0
jne 0x1000c57e
cmp dword [ebp - 0x814], 0
mov eax, 0xe91cb64b
test eax, eax
je 0x1000c598
xor eax, eax
inc eax
je 0x1000c598
mov dword [ebp - 0x60c], 1
jmp 0x1000c59f
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
sub eax, 0x9b95
cmp eax, 0xffffffff
jg 0x1000c5b6
cmp dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x154]
add eax, dword [ebp - 0x814]
cmp dword [ebp - 0x154], eax
jge 0x1000c5d6
mov dword [ebp - 0x614], 1
jmp 0x1000c5dd
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0x76c]
cmp dword [ebp - 0x320], eax
jl 0x1000c61b
mov dword [ebp - 0x61c], 1
jmp 0x1000c622
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x154], 0xe
jmp 0x1000c647
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xfffffffc
jge 0x1000c674
mov dword [ebp - 0x838], 1
mov eax, dword [ebp - 0x838]
inc eax
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0xa74], 0
je 0x1000c672
jmp 0x1000c674
jmp 0x1000c63a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4c]
call fcn.10018141
mov dword [ebp - 0xb8], 8
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xa54], 5
mov dword [ebp - 0xb8], 0
jmp 0x1000c6b7
cmp dword [ebp - 0xb8], 9
jl 0x1000c6e0
mov dword [ebp - 0x624], 0x905d
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x624], 0
je 0x1000c6de
mov dword [ebp - 0x14], 0xffffffe4
jmp 0x1000c6f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret