Function at 0x1004cafa
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b694
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x960
push esi
push edi
mov dword [ebp - 0x30], 1
push 4
lea ecx, [ebp - 0x200]
call fcn.10016d5e
and dword [ebp - 4], 0
mov dword [ebp - 0x60], 0
jmp 0x1004cb42
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x1004cb5b
push dword [ebp - 0x60]
lea ecx, [ebp - 0x200]
call fcn.10016dfc
and dword [eax], 0
jmp 0x1004cb3b
mov dword [ebp - 0x60], 0
jmp 0x1004cb6b
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1004cb81
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x744], 1
jmp 0x1004cb64
mov dword [ebp - 0x30], 0
jmp 0x1004cb91
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x12
jge 0x1004cedb
mov dword [ebp - 0x94], 0x5ba77230
mov dword [ebp - 0x490], 0x37ff
mov dword [ebp - 0x678], 1
mov dword [ebp - 0x94], 0
jmp 0x1004cbd2
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jg 0x1004ce3f
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x198], 2
mov dword [ebp - 0x84], 3
jmp 0x1004cc0c
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x1004ce3a
mov dword [ebp - 0xc4], 0x66e58d02
mov dword [ebp - 0xc4], 0
jmp 0x1004cc3c
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jg 0x1004cc96
mov dword [ebp - 0x128], 0xe135e1f6
mov dword [ebp - 0x128], 3
jmp 0x1004cc68
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jl 0x1004cc94
mov byte [ebp - 0xde], 0
movzx eax, byte [ebp - 0xde]
test eax, eax
je 0x1004cc92
push 0x11a8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x1004cc5b
jmp 0x1004cc2f
cmp dword [ebp - 0x30], 0
je 0x1004cd7b
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x8d4], eax
mov eax, dword [ebp - 0x198]
add eax, 5
je 0x1004ccd9
push dword [ebp - 0x84]
lea ecx, [ebp - 0x200]
call fcn.10016dfc
cmp dword [eax], 0
je 0x1004ccd9
mov dword [ebp - 0x5fc], 1
jmp 0x1004cce0
and dword [ebp - 0x5fc], 0
push 2
lea ecx, [ebp - 0x200]
call fcn.10016dfc
cmp dword [eax], 0x9a98
jl 0x1004cd01
mov dword [ebp - 0x4d4], 1
jmp 0x1004cd08
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0xc4], eax
jle 0x1004cd2e
mov dword [ebp - 0x574], 1
jmp 0x1004cd35
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0
jne 0x1004cd4e
push 8
pop eax
test eax, eax
jne 0x1004cd4e
and dword [ebp - 0x57c], 0
jmp 0x1004cd58
mov dword [ebp - 0x57c], 1
push 0
lea ecx, [ebp - 0x200]
call fcn.10016dfc
mov ecx, dword [ebp - 0x57c]
cmp ecx, dword [eax]
jg 0x1004cd7b
mov dword [ebp - 0x584], 1
jmp 0x1004cd82
and dword [ebp - 0x584], 0
push 2
lea ecx, [ebp - 0x200]
call fcn.10016dfc
mov eax, dword [eax]
add eax, dword [ebp - 0x584]
cmp eax, 0xfffffffa
jle 0x1004cda8
mov dword [ebp - 0x668], 1
jmp 0x1004cdaf
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jl 0x1004cdd8
mov dword [ebp - 0x58c], 1
jmp 0x1004cddf
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x58c], eax
je 0x1004cdf4
cmp dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0xc4], eax
jle 0x1004ce0e
mov dword [ebp - 0x594], 1
jmp 0x1004ce15
and dword [ebp - 0x594], 0
push dword [ebp - 0x84]
lea ecx, [ebp - 0x200]
call fcn.10016dfc
mov eax, dword [eax]
imul eax, dword [ebp - 0x594]
mov dword [ebp - 0x490], eax
jmp 0x1004cbff
jmp 0x1004cbc5
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x88c], eax
push 2
lea ecx, [ebp - 0x200]
call fcn.10016dfc
cmp dword [eax], 0
je 0x1004cea7
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x744]
mov dword [ebp - 0x21c], eax
push 1
lea ecx, [ebp - 0x200]
call fcn.10016dfc
mov ecx, dword [ebp - 0x21c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x21c]
cmp dword [eax], 9
jle 0x1004cea7
mov eax, 0xf81a770a
test eax, eax
je 0x1004cea7
mov dword [ebp - 0x670], 1
jmp 0x1004ceae
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x8d0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x744]
mov dword [ebp - 0x678], eax
jmp 0x1004cb8a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x200]
call fcn.10016de0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0xf0], 0x61fbc9fa
mov dword [ebp - 0x130], 0xfffffffa
mov dword [ebp - 0x8c], 0xfffffff9
jmp 0x1004cf21
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffef
jl 0x1004d32b
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0x4a8], 1
mov dword [ebp - 0x77c], 1
mov dword [ebp - 0x778], 1
mov dword [ebp - 0x774], 1
mov dword [ebp - 0x770], 1
lea ecx, [ebp - 0x1d9]
call fcn.10009623
push eax
lea eax, [ebp - 0x76c]
push eax
lea eax, [ebp - 0x77c]
push eax
lea ecx, [ebp - 0x93c]
call fcn.10016e0b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6ec]
call fcn.10016dba
mov dword [ebp - 4], 1
mov dword [ebp - 0x184], 0
jmp 0x1004cfbf
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 4
jge 0x1004cfdb
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x914], 0xcc7bc501
jmp 0x1004cfb2
push 3
pop eax
test eax, eax
je 0x1004d0cc
or eax, 0xffffffff
je 0x1004d0cc
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x8f4], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x898], eax
mov dword [ebp - 0x130], 0x6acb
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0x130], eax
jl 0x1004d037
mov dword [ebp - 0x498], 1
jmp 0x1004d03e
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x498], eax
jle 0x1004d058
mov dword [ebp - 0x224], 1
jmp 0x1004d05f
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x224]
jg 0x1004d079
mov dword [ebp - 0x4a0], 1
jmp 0x1004d080
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0xe4]
add eax, dword [ebp - 0x4a0]
add eax, dword [ebp - 0xe4]
cmp eax, 1
ja 0x1004d0a9
cmp dword [ebp - 0xf0], 0
jne 0x1004d0a9
and dword [ebp - 0x22c], 0
jmp 0x1004d0b3
mov dword [ebp - 0x22c], 1
mov eax, dword [ebp - 0x22c]
add eax, 0x62a4b15
je 0x1004d0cc
mov dword [ebp - 0x234], 1
jmp 0x1004d0d3
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0x234], eax
jg 0x1004d0ed
mov dword [ebp - 0x4b0], 1
jmp 0x1004d0f4
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0
je 0x1004d109
mov dword [ebp - 0x23c], 1
jmp 0x1004d110
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x23c]
sub eax, 0xf777
cmp eax, dword [ebp - 0xe4]
jl 0x1004d12f
mov dword [ebp - 0x4b8], 1
jmp 0x1004d136
and dword [ebp - 0x4b8], 0
push 1
lea ecx, [ebp - 0x6ec]
call fcn.10016dfc
mov ecx, dword [ebp - 0x4b8]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x914]
mov dword [ebp - 0x8d8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x130]
cmp dword [ebp + eax - 0x914], ecx
jne 0x1004d181
xor eax, eax
inc eax
jne 0x1004d181
and dword [ebp - 0x680], 0
jmp 0x1004d18b
mov dword [ebp - 0x680], 1
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x814], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x914], 0xaa7054f8
ja 0x1004d1b6
mov dword [ebp - 0x244], 1
jmp 0x1004d1bd
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 0xf9e84ebf
jbe 0x1004d1d5
mov dword [ebp - 0x4c0], 1
jmp 0x1004d1dc
and dword [ebp - 0x4c0], 0
cmp dword [ebp - 0x4c0], 0x3cd4
jne 0x1004d1f4
mov dword [ebp - 0x24c], 1
jmp 0x1004d1fb
and dword [ebp - 0x24c], 0
imul eax, dword [ebp - 0x24c], 0x3261
test eax, eax
je 0x1004d21e
mov eax, 0x691f3a4b
test eax, eax
je 0x1004d21e
mov dword [ebp - 0x4c8], 1
jmp 0x1004d225
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x4c8]
cmp eax, 7
ja 0x1004d242
mov dword [ebp - 0x254], 1
jmp 0x1004d249
and dword [ebp - 0x254], 0
imul eax, dword [ebp - 0x254], 0x3978
test eax, eax
je 0x1004d26c
cmp dword [ebp - 0xe4], 0
je 0x1004d26c
mov dword [ebp - 0x4d0], 1
jmp 0x1004d273
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0xf0]
imul eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0xf0]
jle 0x1004d294
mov dword [ebp - 0x688], 1
jmp 0x1004d29b
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x8c], eax
jl 0x1004d2c1
mov dword [ebp - 0x690], 1
jmp 0x1004d2c8
and dword [ebp - 0x690], 0
push 1
lea ecx, [ebp - 0x6ec]
call fcn.10016dfc
mov esi, eax
push 1
lea ecx, [ebp - 0x6ec]
call fcn.10016dfc
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1004d2f8
xor eax, eax
inc eax
jne 0x1004d2f8
and dword [ebp - 0x25c], 0
jmp 0x1004d302
mov dword [ebp - 0x25c], 1
push 0
lea ecx, [ebp - 0x6ec]
call fcn.10016dfc
mov ecx, dword [ebp - 0x25c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6ec]
call fcn.10016de0
jmp 0x1004cf14
mov dword [ebp - 0x2c], 0x8a1f9496
mov dword [ebp - 0x820], 0x6482
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x1004d356
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1004d377
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 0x1e0], 1
mov dword [ebp - 0xfc], 7
mov dword [ebp - 0xcc], 0xfffffffd
mov dword [ebp - 0x108], 0xffffffff
push 1
lea ecx, [ebp - 0x5d4]
call fcn.10016d5e
mov dword [ebp - 4], 2
mov dword [ebp - 0x27c], 0xa8f1edd1
push 2
lea ecx, [ebp - 0x7b8]
call fcn.10016d5e
mov byte [ebp - 4], 3
mov dword [ebp - 0x44], 0
jmp 0x1004d3de
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1004d3f7
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5d4]
call fcn.10016dfc
or dword [eax], 0xffffffff
jmp 0x1004d3d7
mov dword [ebp - 0x44], 0
jmp 0x1004d407
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1004d420
push dword [ebp - 0x44]
lea ecx, [ebp - 0x7b8]
call fcn.10016dfc
or dword [eax], 0xffffffff
jmp 0x1004d400
mov dword [ebp - 0xfc], 0x732aa61f
cmp dword [ebp - 0xcc], 0xfffa
je 0x1004d442
mov dword [ebp - 0x4d8], 1
jmp 0x1004d449
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 0xbc99
jle 0x1004d461
mov dword [ebp - 0x264], 1
jmp 0x1004d468
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0xcc], eax
jne 0x1004d48e
mov dword [ebp - 0x4e0], 1
jmp 0x1004d495
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x108]
imul eax, dword [ebp - 0x4e0]
imul eax, dword [ebp - 0x108]
cmp eax, 0xdb856137
jne 0x1004d4ce
push 0
lea ecx, [ebp - 0x5d4]
call fcn.10016dfc
cmp dword [eax], 0
je 0x1004d4ce
mov dword [ebp - 0x6a4], 1
jmp 0x1004d4d5
and dword [ebp - 0x6a4], 0
push 0
lea ecx, [ebp - 0x5d4]
call fcn.10016dfc
cmp dword [eax], 5
je 0x1004d4f3
mov dword [ebp - 0x26c], 1
jmp 0x1004d4fa
and dword [ebp - 0x26c], 0
push 0
lea ecx, [ebp - 0x5d4]
call fcn.10016dfc
mov ecx, dword [ebp - 0x26c]
cmp ecx, dword [eax]
je 0x1004d51d
mov dword [ebp - 0x4e8], 1
jmp 0x1004d524
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x108], eax
mov esi, dword [ebp - 0x108]
push 0
lea ecx, [ebp - 0x5d4]
call fcn.10016dfc
mov eax, 0xbb00
cmp eax, 0xffffffff
jne 0x1004d559
mov dword [ebp - 0x274], 1
jmp 0x1004d560
and dword [ebp - 0x274], 0
cmp dword [ebp - 0x274], 0xfff7
jae 0x1004d57e
cmp dword [ebp - 0xfc], 0
jne 0x1004d57e
and dword [ebp - 0x4fc], 0
jmp 0x1004d588
mov dword [ebp - 0x4fc], 1
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x27c], eax
mov esi, dword [ebp - 0x27c]
push 0
lea ecx, [ebp - 0x7b8]
call fcn.10016dfc
mov dword [eax], esi
mov dword [ebp - 0xcc], 0
jmp 0x1004d5c2
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jg 0x1004d612
mov dword [ebp - 0xfc], 0
jmp 0x1004d5e4
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jg 0x1004d610
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1004d60e
push 0x66f
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
jmp 0x1004d5d7
jmp 0x1004d5b5
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7b8]
call fcn.10016de0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d4]
call fcn.10016de0
mov dword [ebp - 0x1a8], 0xa05d
push 1
lea ecx, [ebp - 0x5a4]
call fcn.10016d5e
mov dword [ebp - 4], 4
mov dword [ebp - 0x51c], 0xfffffffb
mov dword [ebp - 0x6b4], 1
mov dword [ebp - 0x6c], 0
jmp 0x1004d672
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1004d68b
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x5a4]
call fcn.10016dfc
and dword [eax], 0
jmp 0x1004d66b
mov dword [ebp - 0x6c], 0
jmp 0x1004d69b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1004d6b1
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x1a0], 0xdedb
jmp 0x1004d694
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x1a0]
push 0
lea ecx, [ebp - 0x5a4]
call fcn.10016dfc
cmp esi, dword [eax]
jle 0x1004d6db
mov dword [ebp - 0x504], 1
jmp 0x1004d6e2
and dword [ebp - 0x504], 0
push 0
lea ecx, [ebp - 0x5a4]
call fcn.10016dfc
mov eax, dword [eax]
cmp eax, dword [ebp - 0x504]
jl 0x1004d705
mov dword [ebp - 0x50c], 1
jmp 0x1004d70c
and dword [ebp - 0x50c], 0
push 0
lea ecx, [ebp - 0x5a4]
call fcn.10016dfc
cmp dword [eax], 0x6e229edc
jl 0x1004d72d
mov dword [ebp - 0x6ac], 1
jmp 0x1004d734
and dword [ebp - 0x6ac], 0
push 0
lea ecx, [ebp - 0x5a4]
call fcn.10016dfc
push 0
lea ecx, [ebp - 0x5a4]
call fcn.10016dfc
cmp dword [eax], 0
je 0x1004d76f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a0], 0
je 0x1004d76f
mov dword [ebp - 0x284], 1
jmp 0x1004d776
and dword [ebp - 0x284], 0
cmp dword [ebp - 0x284], 0xfecafe8
je 0x1004d78e
mov dword [ebp - 0x28c], 1
jmp 0x1004d795
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0x28c]
je 0x1004d7af
mov dword [ebp - 0x514], 1
jmp 0x1004d7b6
and dword [ebp - 0x514], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp - 0x514], eax
je 0x1004d7e6
push 0
lea ecx, [ebp - 0x5a4]
call fcn.10016dfc
cmp dword [eax], 0
jne 0x1004d7e6
and dword [ebp - 0x294], 0
jmp 0x1004d7f0
mov dword [ebp - 0x294], 1
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x6b4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5a4]
call fcn.10016de0
mov dword [ebp - 0x1d0], 8
mov dword [ebp - 0x2dc], 0x6084edc0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x118], 0
jmp 0x1004d84e
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xfffffff1
jg 0x1004d8a3
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1004d896
push 0x2636
push 0x1dc3
push 0x230f
push 0x2599
push 0x68f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
cmp dword [ebp - 0x118], 0
je 0x1004d8a1
jmp 0x1004d841
jmp 0x1004d841
mov dword [ebp - 0x2ec], 0xf7c2f5a2
mov dword [ebp - 0x9c], 0x5540d7f8
mov dword [ebp - 0x2a4], 0xffffffff
mov dword [ebp - 0x534], 0x8039d6b9
push 3
lea ecx, [ebp - 0x7f4]
call fcn.10016d5e
mov dword [ebp - 4], 5
mov dword [ebp - 0x6bc], 0xbec5
mov dword [ebp - 0x6c4], 0x3c86
mov dword [ebp - 0x4c], 0
jmp 0x1004d903
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1004d919
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xf8], 0x73ff82f
jmp 0x1004d8fc
mov dword [ebp - 0x4c], 0
jmp 0x1004d929
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1004d945
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x7f4]
call fcn.10016dfc
mov dword [eax], 0x1ec2184e
jmp 0x1004d922
mov dword [ebp - 0x9c], 3
jmp 0x1004d95e
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xfffffff8
jg 0x1004d98f
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x1004d98d
push 0
push 0x211e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x1004d951
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
mov dword [ebp - 0x828], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf8], 0
je 0x1004d9e8
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], eax
jle 0x1004d9cc
mov dword [ebp - 0x29c], 1
jmp 0x1004d9d3
and dword [ebp - 0x29c], 0
cmp dword [ebp - 0x29c], 0
je 0x1004d9e8
mov dword [ebp - 0x524], 1
jmp 0x1004d9ef
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2a4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
cmp eax, dword [ebp - 0x2a4]
jg 0x1004da28
mov dword [ebp - 0x52c], 1
jmp 0x1004da2f
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0xffff
jne 0x1004da47
mov dword [ebp - 0x2ac], 1
jmp 0x1004da4e
and dword [ebp - 0x2ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
imul eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x2b4], eax
push 1
lea ecx, [ebp - 0x7f4]
call fcn.10016dfc
mov ecx, dword [ebp - 0x2b4]
mov dword [eax], ecx
cmp dword [ebp - 0x2b4], 0
jne 0x1004da9e
mov dword [ebp - 0x53c], 1
jmp 0x1004daa5
and dword [ebp - 0x53c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
cmp dword [ebp - 0x53c], eax
jl 0x1004dac6
mov dword [ebp - 0x2bc], 1
jmp 0x1004dacd
and dword [ebp - 0x2bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
sub eax, dword [ebp - 0x2bc]
je 0x1004daf7
cmp dword [ebp - 0x6bc], 0
je 0x1004daf7
mov dword [ebp - 0x544], 1
jmp 0x1004dafe
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x6c4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7f4]
call fcn.10016de0
push 3
lea ecx, [ebp - 0x80c]
call fcn.10016d5e
mov dword [ebp - 4], 6
mov dword [ebp - 0x18c], 0
jmp 0x1004db46
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x1004db65
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x80c]
call fcn.10016dfc
or dword [eax], 0xffffffff
jmp 0x1004db39
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
je 0x1004db82
mov dword [ebp - 0x2c4], 1
jmp 0x1004db89
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c4], eax
jge 0x1004dba6
cmp dword [ebp - 0x2c], 0
je 0x1004dba6
mov dword [ebp - 0x54c], 1
jmp 0x1004dbad
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1e0], eax
je 0x1004dbe5
mov dword [ebp - 0x2cc], 1
jmp 0x1004dbec
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x2cc], eax
jne 0x1004dc06
mov dword [ebp - 0x554], 1
jmp 0x1004dc0d
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x1d0], eax
jl 0x1004dc33
mov dword [ebp - 0x2d4], 1
jmp 0x1004dc3a
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2d4]
jne 0x1004dc57
mov eax, 0x721f
test eax, eax
jne 0x1004dc57
and dword [ebp - 0x55c], 0
jmp 0x1004dc61
mov dword [ebp - 0x55c], 1
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2dc], eax
jle 0x1004dc89
xor eax, eax
inc eax
je 0x1004dc89
mov dword [ebp - 0x564], 1
jmp 0x1004dc90
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x564], eax
jl 0x1004dca7
mov dword [ebp - 0x56c], 1
jmp 0x1004dcae
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x56c], eax
jne 0x1004dcc5
mov dword [ebp - 0x6cc], 1
jmp 0x1004dccc
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0x2c], eax
jl 0x1004dcef
mov dword [ebp - 0x2f8], 1
jmp 0x1004dcf6
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x2ec], eax
push 2
lea ecx, [ebp - 0x80c]
call fcn.10016dfc
mov eax, dword [eax]
mov dword [ebp - 0x2ec], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80c]
call fcn.10016de0
mov dword [ebp - 0x14], 0xf825
push 2
lea ecx, [ebp - 0x5ec]
call fcn.10016d5e
mov dword [ebp - 4], 7
mov dword [ebp - 0x454], 0x61e33ecd
mov dword [ebp - 0x850], 6
mov dword [ebp - 0x194], 0
jmp 0x1004dd6e
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x1004dd8d
push dword [ebp - 0x194]
lea ecx, [ebp - 0x5ec]
call fcn.10016dfc
and dword [eax], 0
jmp 0x1004dd61
cmp dword [ebp - 0x14], 0
je 0x1004dda8
mov eax, 0xac48
test eax, eax
je 0x1004dda8
mov dword [ebp - 0x444], 1
jmp 0x1004ddaf
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x444]
cmp dword [ebp - 0x14], eax
jg 0x1004ddcf
xor eax, eax
inc eax
jne 0x1004ddcf
and dword [ebp - 0x2f4], 0
jmp 0x1004ddd9
mov dword [ebp - 0x2f4], 1
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x2f4]
je 0x1004deba
mov dword [ebp - 0x6d4], 1
push 2
lea ecx, [ebp - 0x7a0]
call fcn.10016d5e
mov byte [ebp - 4], 8
mov dword [ebp - 0x64], 0
jmp 0x1004de13
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1004de29
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x4ec], 0xffff
jmp 0x1004de0c
mov dword [ebp - 0x64], 0
jmp 0x1004de39
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1004de52
push dword [ebp - 0x64]
lea ecx, [ebp - 0x7a0]
call fcn.10016dfc
and dword [eax], 0
jmp 0x1004de32
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4ec], 0
je 0x1004de8b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4ec], 6
jg 0x1004de7e
mov dword [ebp - 0x2fc], 1
jmp 0x1004de85
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x6d4]
mov esi, dword [ebp - 0x14]
sub esi, dword [ebp - 0x14]
sub esi, 0x5714ffd8
push 1
lea ecx, [ebp - 0x7a0]
call fcn.10016dfc
mov dword [eax], esi
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7a0]
call fcn.10016de0
jmp 0x1004e02b
mov dword [ebp - 0x180], 0xfffffffc
mov dword [ebp - 0x14], 0
jmp 0x1004ded4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x1004e00e
mov dword [ebp - 0x61c], 0xfffffffe
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5ec]
call fcn.10016dfc
cmp dword [eax], 0
je 0x1004df00
jmp 0x1004e00e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5ec]
call fcn.10016dfc
mov ecx, dword [ebp - 0x14]
cmp dword [eax], ecx
jge 0x1004df21
mov dword [ebp - 0x44c], 1
jmp 0x1004df28
and dword [ebp - 0x44c], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5ec]
call fcn.10016dfc
mov ecx, dword [ebp - 0x180]
add ecx, dword [eax]
cmp dword [ebp - 0x44c], ecx
jge 0x1004df52
mov dword [ebp - 0x304], 1
jmp 0x1004df59
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x304], eax
jg 0x1004df73
mov dword [ebp - 0x588], 1
jmp 0x1004df7a
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 0x214f
je 0x1004df92
mov dword [ebp - 0x6dc], 1
jmp 0x1004df99
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x858], eax
mov esi, dword [ebp - 0x180]
neg esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5ec]
call fcn.10016dfc
cmp esi, dword [eax]
jle 0x1004dfcb
mov dword [ebp - 0x30c], 1
jmp 0x1004dfd2
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
inc eax
cmp eax, dword [ebp - 0x14]
je 0x1004dff6
mov dword [ebp - 0x314], 1
jmp 0x1004dffd
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x61c], eax
jmp 0x1004decd
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1004e02b
push 0x2508
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5ec]
call fcn.10016de0
mov dword [ebp - 0x608], 0x85299dad
push 1
lea ecx, [ebp - 0x800]
call fcn.10016d5e
mov dword [ebp - 4], 9
mov dword [ebp - 0x148], 0
jmp 0x1004e071
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jge 0x1004e093
push dword [ebp - 0x148]
lea ecx, [ebp - 0x800]
call fcn.10016dfc
mov dword [eax], 0xfffffff6
jmp 0x1004e064
mov esi, dword [ebp - 0x608]
push 0
lea ecx, [ebp - 0x800]
call fcn.10016dfc
mov dword [eax], esi
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1004e0c2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x800]
call fcn.10016de0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x10c], 0
jmp 0x1004e0f4
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xfffffff1
jg 0x1004e149
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x1004e13c
push 0x2636
push 0x1dc3
push 0x230f
push 0x2599
push 0x68f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
cmp dword [ebp - 0x10c], 0
je 0x1004e147
jmp 0x1004e0e7
jmp 0x1004e0e7
mov dword [ebp - 0x1c], 0xdb22124f
push 2
lea ecx, [ebp - 0x140]
call fcn.10016d5e
mov dword [ebp - 4], 0xa
push 2
lea ecx, [ebp - 0x788]
call fcn.10016d5e
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x20], 0
jmp 0x1004e185
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1004e1a1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x140]
call fcn.10016dfc
mov dword [eax], 0xfffffff9
jmp 0x1004e17e
mov dword [ebp - 0x20], 0
jmp 0x1004e1b1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1004e1c7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x610], 0xbd90
jmp 0x1004e1aa
mov dword [ebp - 0x20], 0
jmp 0x1004e1d7
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1004e1f3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x788]
call fcn.10016dfc
mov dword [eax], 0x56237581
jmp 0x1004e1d0
push 0
lea ecx, [ebp - 0x140]
call fcn.10016dfc
mov dword [eax], 0xffffffec
jmp 0x1004e22c
push 0
lea ecx, [ebp - 0x140]
call fcn.10016dfc
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x500]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x500]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x140]
call fcn.10016dfc
cmp dword [eax], 0xffffffef
je 0x1004e4ba
mov dword [ebp - 0x104], 1
mov dword [ebp - 0x170], 0
jmp 0x1004e265
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 4
jge 0x1004e281
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x94c], 0x8451d77f
jmp 0x1004e258
push 0
lea ecx, [ebp - 0x140]
call fcn.10016dfc
cmp dword [eax], 0
je 0x1004e499
push 1
lea ecx, [ebp - 0x140]
call fcn.10016dfc
mov esi, eax
push 0
lea ecx, [ebp - 0x140]
call fcn.10016dfc
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1004e2c5
mov dword [ebp - 0x31c], 1
jmp 0x1004e2cc
and dword [ebp - 0x31c], 0
push 0
lea ecx, [ebp - 0x140]
call fcn.10016dfc
mov eax, dword [eax]
cmp eax, dword [ebp - 0x31c]
je 0x1004e2ef
mov dword [ebp - 0x640], 1
jmp 0x1004e2f6
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x860], eax
push 0
lea ecx, [ebp - 0x140]
call fcn.10016dfc
cmp dword [eax], 0
je 0x1004e332
push 0
lea ecx, [ebp - 0x140]
call fcn.10016dfc
cmp dword [eax], 0
je 0x1004e332
mov dword [ebp - 0x45c], 1
jmp 0x1004e339
and dword [ebp - 0x45c], 0
push 1
lea ecx, [ebp - 0x140]
call fcn.10016dfc
mov ecx, dword [ebp - 0x45c]
imul ecx, dword [eax]
cmp ecx, 0x65251c60
jl 0x1004e363
mov dword [ebp - 0x1b0], 1
jmp 0x1004e36a
and dword [ebp - 0x1b0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b0]
mov dword [ebp + eax - 0x94c], ecx
cmp dword [ebp - 0x1b0], 0
jne 0x1004e392
mov dword [ebp - 0x324], 1
jmp 0x1004e399
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x104]
imul eax, dword [ebp - 0x324]
cmp eax, 0x1c36
jle 0x1004e3b9
mov dword [ebp - 0x550], 1
jmp 0x1004e3c0
and dword [ebp - 0x550], 0
push 0
lea ecx, [ebp - 0x140]
call fcn.10016dfc
mov ecx, dword [ebp - 0x550]
cmp ecx, dword [eax]
jne 0x1004e3e3
mov dword [ebp - 0x32c], 1
jmp 0x1004e3ea
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x32c]
sub eax, dword [ebp - 0x104]
jns 0x1004e404
mov dword [ebp - 0x464], 1
jmp 0x1004e40b
and dword [ebp - 0x464], 0
mov esi, dword [ebp - 0x104]
sub esi, dword [ebp - 0x464]
push 0
lea ecx, [ebp - 0x140]
call fcn.10016dfc
cmp esi, dword [eax]
jne 0x1004e43d
mov eax, 0xf844
test eax, eax
je 0x1004e43d
mov dword [ebp - 0x1e8], 1
jmp 0x1004e444
and dword [ebp - 0x1e8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e8]
mov dword [ebp + eax - 0x610], ecx
mov eax, dword [ebp - 0x1e8]
dec eax
cmp eax, 0x5bb5
jl 0x1004e471
mov dword [ebp - 0x334], 1
jmp 0x1004e478
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x1004e499
mov dword [ebp - 0x508], 1
jmp 0x1004e4a0
and dword [ebp - 0x508], 0
push 0
lea ecx, [ebp - 0x788]
call fcn.10016dfc
mov ecx, dword [ebp - 0x508]
mov dword [eax], ecx
jmp 0x1004e208
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x788]
call fcn.10016de0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.10016de0
mov dword [ebp - 0x114], 0xf86f25db
push 2
lea ecx, [ebp - 0xb0]
call fcn.10016d5e
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x47c], 7
mov dword [ebp - 0x484], 0xffffffff
mov dword [ebp - 0x150], 0
jmp 0x1004e523
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x1004e545
push dword [ebp - 0x150]
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov dword [eax], 0x90ac204e
jmp 0x1004e516
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov dword [eax], 0xfffffff2
jmp 0x1004e57e
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x33c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
cmp dword [eax], 0x14
je 0x1004e7d8
mov dword [ebp - 0x34], 1
push 1
lea ecx, [ebp - 0x5b0]
call fcn.10016d5e
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x190], 0
jmp 0x1004e5c5
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jge 0x1004e5e4
push dword [ebp - 0x190]
lea ecx, [ebp - 0x5b0]
call fcn.10016dfc
or dword [eax], 0xffffffff
jmp 0x1004e5b8
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0
jmp 0x1004e606
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jg 0x1004e7c4
mov dword [ebp - 0x620], 1
xor eax, eax
jne 0x1004e65d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x868], eax
mov eax, 0x63b0a6d0
cmp eax, 0xfc80ae7b
jbe 0x1004e63f
mov dword [ebp - 0x46c], 1
jmp 0x1004e646
and dword [ebp - 0x46c], 0
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov ecx, dword [ebp - 0x46c]
cmp ecx, dword [eax]
je 0x1004e66b
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b0]
call fcn.10016dfc
mov esi, 0x886a
sub esi, 0x65b0
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
cmp esi, dword [eax]
je 0x1004e693
mov dword [ebp - 0x648], 1
jmp 0x1004e69a
and dword [ebp - 0x648], 0
push 1
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov esi, eax
push 1
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1004e6d5
mov dword [ebp - 0x618], 1
jmp 0x1004e6dc
and dword [ebp - 0x618], 0
push 0
lea ecx, [ebp - 0x5b0]
call fcn.10016dfc
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x870], eax
push 0xfffffffffffffff9
pop eax
cmp eax, 0x5db5a26c
jl 0x1004e708
mov dword [ebp - 0x344], 1
jmp 0x1004e70f
and dword [ebp - 0x344], 0
push 0
lea ecx, [ebp - 0x5b0]
call fcn.10016dfc
mov ecx, dword [ebp - 0x344]
cmp ecx, dword [eax]
jle 0x1004e732
mov dword [ebp - 0x578], 1
jmp 0x1004e739
and dword [ebp - 0x578], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b0]
call fcn.10016dfc
mov eax, dword [eax]
cmp eax, dword [ebp - 0x578]
jg 0x1004e75d
mov dword [ebp - 0x650], 1
jmp 0x1004e764
and dword [ebp - 0x650], 0
push 0
lea ecx, [ebp - 0x5b0]
call fcn.10016dfc
push 1
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
or eax, 0xffffffff
cmp eax, 0x33bab721
jne 0x1004e794
mov dword [ebp - 0x34c], 1
jmp 0x1004e79b
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x620], eax
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1004e7bf
call dword [sym.imp.USER32.dll_GetCapture]
jmp 0x1004e5ff
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x5b0]
call fcn.10016de0
jmp 0x1004e55a
push 1
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov esi, eax
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1004e813
mov dword [ebp - 0x474], 1
jmp 0x1004e81a
and dword [ebp - 0x474], 0
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov eax, dword [eax]
cmp eax, dword [ebp - 0x474]
je 0x1004e83d
mov dword [ebp - 0x354], 1
jmp 0x1004e844
and dword [ebp - 0x354], 0
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov ecx, dword [ebp - 0x354]
cmp ecx, dword [eax]
jle 0x1004e867
mov dword [ebp - 0x510], 1
jmp 0x1004e86e
and dword [ebp - 0x510], 0
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov ecx, dword [ebp - 0x510]
cmp ecx, dword [eax]
je 0x1004e891
mov dword [ebp - 0x35c], 1
jmp 0x1004e898
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x47c], eax
mov esi, dword [ebp - 0x47c]
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
cmp esi, dword [eax]
jl 0x1004e8d6
mov dword [ebp - 0x364], 1
jmp 0x1004e8dd
and dword [ebp - 0x364], 0
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov ecx, dword [ebp - 0x364]
cmp ecx, dword [eax]
jle 0x1004e900
mov dword [ebp - 0x558], 1
jmp 0x1004e907
and dword [ebp - 0x558], 0
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov eax, dword [eax]
cmp eax, dword [ebp - 0x558]
je 0x1004e92a
mov dword [ebp - 0x1b8], 1
jmp 0x1004e931
and dword [ebp - 0x1b8], 0
push 0
lea ecx, [ebp - 0xb0]
call fcn.10016dfc
mov ecx, dword [ebp - 0x1b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x484]
cmp dword [ebp - 0x1b8], eax
je 0x1004e960
mov dword [ebp - 0x36c], 1
jmp 0x1004e967
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x484], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.10016de0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x24], 0xfc07e17f
mov dword [ebp - 0x598], 0xffffffff
push 2
lea ecx, [ebp - 0x730]
call fcn.10016d5e
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x39c], 0x34071e99
mov dword [ebp - 0x62c], 0xcf162c80
mov dword [ebp - 0x54], 0
jmp 0x1004e9df
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1004e9f5
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x74c], 0
jmp 0x1004e9d8
mov dword [ebp - 0x54], 0
jmp 0x1004ea05
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1004ea21
push dword [ebp - 0x54]
lea ecx, [ebp - 0x730]
call fcn.10016dfc
mov dword [eax], 4
jmp 0x1004e9fe
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x880], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x74c], 0x16
push 0xfffffffffffffffa
pop eax
cmp eax, 0x16
jle 0x1004ea58
mov dword [ebp - 0x374], 1
jmp 0x1004ea5f
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
add eax, 6
cmp eax, dword [ebp - 0x24]
je 0x1004ea79
mov dword [ebp - 0x518], 1
jmp 0x1004ea80
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0x90a
jl 0x1004ea98
mov dword [ebp - 0x1d8], 1
jmp 0x1004ea9f
and dword [ebp - 0x1d8], 0
push 1
lea ecx, [ebp - 0x730]
call fcn.10016dfc
mov ecx, dword [ebp - 0x1d8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1d8], eax
jg 0x1004eacb
mov dword [ebp - 0x37c], 1
jmp 0x1004ead2
and dword [ebp - 0x37c], 0
cmp dword [ebp - 0x37c], 0xfffffff7
jae 0x1004eae7
mov dword [ebp - 0x48c], 1
jmp 0x1004eaee
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x658], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x74c]
add eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jge 0x1004eb1b
mov dword [ebp - 0x384], 1
jmp 0x1004eb22
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jge 0x1004eb3c
mov dword [ebp - 0x38c], 1
jmp 0x1004eb43
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x598]
cmp eax, dword [ebp - 0x38c]
jle 0x1004eb66
mov dword [ebp - 0x494], 1
jmp 0x1004eb6d
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x494], eax
jl 0x1004eb84
mov dword [ebp - 0x394], 1
jmp 0x1004eb8b
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 6
ja 0x1004eba0
mov dword [ebp - 0x520], 1
jmp 0x1004eba7
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x520]
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0x3b03c3fa
je 0x1004ebce
mov dword [ebp - 0x660], 1
jmp 0x1004ebd5
and dword [ebp - 0x660], 0
push 1
lea ecx, [ebp - 0x730]
call fcn.10016dfc
cmp dword [eax], 2
jle 0x1004ebf3
mov dword [ebp - 0x49c], 1
jmp 0x1004ebfa
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x49c], eax
jne 0x1004ec14
cmp dword [ebp - 0x24], 0
jne 0x1004ec14
and dword [ebp - 0x3a4], 0
jmp 0x1004ec1e
mov dword [ebp - 0x3a4], 1
cmp dword [ebp - 0x3a4], 0x1361131e
jge 0x1004ec36
mov dword [ebp - 0x560], 1
jmp 0x1004ec3d
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x62c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x730]
call fcn.10016de0
mov dword [ebp - 0x6b0], 0x7cdd5376
mov dword [ebp - 0x158], 0
jmp 0x1004ec7b
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x1004ec97
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x20c], 0xb56411d7
jmp 0x1004ec6e
mov dword [ebp - 0x18], 0xf825
push 2
lea ecx, [ebp - 0x5c8]
call fcn.10016d5e
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x3cc], 0x61e33ecd
mov dword [ebp - 0x894], 6
mov dword [ebp - 0x178], 0
jmp 0x1004ecdf
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x1004ecfe
push dword [ebp - 0x178]
lea ecx, [ebp - 0x5c8]
call fcn.10016dfc
and dword [eax], 0
jmp 0x1004ecd2
cmp dword [ebp - 0x18], 0
je 0x1004ed19
mov eax, 0xac48
test eax, eax
je 0x1004ed19
mov dword [ebp - 0x3ac], 1
jmp 0x1004ed20
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x18], eax
jg 0x1004ed40
xor eax, eax
inc eax
jne 0x1004ed40
and dword [ebp - 0x4a4], 0
jmp 0x1004ed4a
mov dword [ebp - 0x4a4], 1
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x4a4]
je 0x1004ee2b
mov dword [ebp - 0x6d8], 1
push 2
lea ecx, [ebp - 0x7e8]
call fcn.10016d5e
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x74], 0
jmp 0x1004ed84
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1004ed9a
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x3b4], 0xffff
jmp 0x1004ed7d
mov dword [ebp - 0x74], 0
jmp 0x1004edaa
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1004edc3
push dword [ebp - 0x74]
lea ecx, [ebp - 0x7e8]
call fcn.10016dfc
and dword [eax], 0
jmp 0x1004eda3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b4], 0
je 0x1004edfc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b4], 6
jg 0x1004edef
mov dword [ebp - 0x528], 1
jmp 0x1004edf6
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x6d8]
mov esi, dword [ebp - 0x18]
sub esi, dword [ebp - 0x18]
sub esi, 0x5714ffd8
push 1
lea ecx, [ebp - 0x7e8]
call fcn.10016dfc
mov dword [eax], esi
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x7e8]
call fcn.10016de0
jmp 0x1004ef9c
mov dword [ebp - 0x160], 0xfffffffc
mov dword [ebp - 0x18], 0
jmp 0x1004ee45
cmp dword [ebp - 0x18], 1
jg 0x1004ef7f
mov dword [ebp - 0x6a8], 0xfffffffe
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5c8]
call fcn.10016dfc
cmp dword [eax], 0
je 0x1004ee71
jmp 0x1004ef7f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5c8]
call fcn.10016dfc
mov ecx, dword [ebp - 0x18]
cmp dword [eax], ecx
jge 0x1004ee92
mov dword [ebp - 0x3bc], 1
jmp 0x1004ee99
and dword [ebp - 0x3bc], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5c8]
call fcn.10016dfc
mov ecx, dword [ebp - 0x160]
add ecx, dword [eax]
cmp dword [ebp - 0x3bc], ecx
jge 0x1004eec3
mov dword [ebp - 0x4ac], 1
jmp 0x1004eeca
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x4ac], eax
jg 0x1004eee4
mov dword [ebp - 0x3c4], 1
jmp 0x1004eeeb
and dword [ebp - 0x3c4], 0
cmp dword [ebp - 0x3c4], 0x214f
je 0x1004ef03
mov dword [ebp - 0x634], 1
jmp 0x1004ef0a
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x89c], eax
mov esi, dword [ebp - 0x160]
neg esi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5c8]
call fcn.10016dfc
cmp esi, dword [eax]
jle 0x1004ef3c
mov dword [ebp - 0x580], 1
jmp 0x1004ef43
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3cc]
inc eax
cmp eax, dword [ebp - 0x18]
je 0x1004ef67
mov dword [ebp - 0x4b4], 1
jmp 0x1004ef6e
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x6a8], eax
jmp 0x1004ee3e
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x1004ef9c
push 0x2508
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c8]
call fcn.10016de0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1004efc3
push 2
pop eax
test eax, eax
jne 0x1004efc3
and dword [ebp - 0x3d4], 0
jmp 0x1004efcd
mov dword [ebp - 0x3d4], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3d4], eax
jne 0x1004efe4
mov dword [ebp - 0x530], 1
jmp 0x1004efeb
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
sub eax, 0xd
cmp eax, 0x1afa9b64
jle 0x1004f007
mov dword [ebp - 0x3dc], 1
jmp 0x1004f00e
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x3dc]
jl 0x1004f025
mov dword [ebp - 0x63c], 1
jmp 0x1004f02c
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jne 0x1004f049
mov dword [ebp - 0x720], 1
jmp 0x1004f050
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x1c], eax
jle 0x1004f070
mov dword [ebp - 0x4bc], 1
jmp 0x1004f077
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x4bc]
jge 0x1004f08e