Function at 0x10008f70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088c7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x13f0
call fcn.10084da0
push esi
push edi
push 2
lea ecx, [ebp - 0x3d0]
call fcn.100185e1
and dword [ebp - 4], 0
mov dword [ebp - 0x1e4], 0
jmp 0x10008fbe
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x10008fe0
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x3d0]
call fcn.1001866d
mov dword [eax], 0xd4e06482
jmp 0x10008fb1
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1001866d
and dword [eax], 0
jmp 0x10009016
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1001866d
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x5a0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5a0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1001866d
cmp dword [eax], 0xffffffe6
jle 0x10009144
mov dword [ebp - 0xe84], 4
mov dword [ebp - 0xe80], 4
mov dword [ebp - 0xe7c], 4
mov dword [ebp - 0xe78], 4
lea ecx, [ebp - 0x316]
call fcn.10008d33
push eax
lea eax, [ebp - 0xe74]
push eax
lea eax, [ebp - 0xe84]
push eax
lea ecx, [ebp - 0x135c]
call fcn.1001867c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbec]
call fcn.10018642
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1001866d
cmp dword [eax], 0
je 0x100090b3
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbec]
call fcn.10018668
jmp 0x10009144
push 1
lea ecx, [ebp - 0xbec]
call fcn.1001866d
mov dword [eax], 0xffffffed
jmp 0x100090ec
push 1
lea ecx, [ebp - 0xbec]
call fcn.1001866d
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x9e8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9e8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xbec]
call fcn.1001866d
cmp dword [eax], 0xffffffee
jge 0x10009130
mov byte [ebp - 0x12b], 0
movzx eax, byte [ebp - 0x12b]
test eax, eax
je 0x1000912e
push 0x230b
push 0x2355
push 0x1f47
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x100090c8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbec]
call fcn.10018668
jmp 0x10008ff2
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1001866d
cmp dword [eax], 0
jne 0x10009163
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1001866d
push 1
lea ecx, [ebp - 0x3d0]
call fcn.1001866d
mov dword [eax], 9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d0]
call fcn.10018668
push 2
lea ecx, [ebp - 0x3e8]
call fcn.100185e1
mov dword [ebp - 4], 2
mov dword [ebp - 0x26c], 0
jmp 0x100091b2
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x100091d4
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x3e8]
call fcn.1001866d
mov dword [eax], 0xd4e06482
jmp 0x100091a5
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1001866d
and dword [eax], 0
jmp 0x1000920a
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1001866d
mov dword [ebp - 0x9f0], eax
mov eax, dword [ebp - 0x9f0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x9f0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1001866d
cmp dword [eax], 0xffffffe6
jle 0x10009338
mov dword [ebp - 0xe34], 4
mov dword [ebp - 0xe30], 4
mov dword [ebp - 0xe2c], 4
mov dword [ebp - 0xe28], 4
lea ecx, [ebp - 0x30d]
call fcn.10008d33
push eax
lea eax, [ebp - 0xe24]
push eax
lea eax, [ebp - 0xe34]
push eax
lea ecx, [ebp - 0x138c]
call fcn.1001867c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbfc]
call fcn.10018642
mov byte [ebp - 4], 3
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1001866d
cmp dword [eax], 0
je 0x100092a7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbfc]
call fcn.10018668
jmp 0x10009338
push 1
lea ecx, [ebp - 0xbfc]
call fcn.1001866d
mov dword [eax], 0xffffffed
jmp 0x100092e0
push 1
lea ecx, [ebp - 0xbfc]
call fcn.1001866d
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x9f8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9f8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xbfc]
call fcn.1001866d
cmp dword [eax], 0xffffffee
jge 0x10009324
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x10009322
push 0x230b
push 0x2355
push 0x1f47
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x100092bc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbfc]
call fcn.10018668
jmp 0x100091e6
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1001866d
cmp dword [eax], 0
jne 0x10009357
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1001866d
push 1
lea ecx, [ebp - 0x3e8]
call fcn.1001866d
mov dword [eax], 9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3e8]
call fcn.10018668
mov dword [ebp - 0x1ec], 0x831713b9
mov dword [ebp - 0x12a8], 0xfffffffd
mov dword [ebp - 0x1214], 0x62751c76
mov dword [ebp - 0x10b8], 0xffffffff
mov dword [ebp - 0x1228], 0xb5934215
mov dword [ebp - 0x10c0], 1
mov dword [ebp - 0x1f4], 0x69be541
mov dword [ebp - 0xde4], 0xb994b748
mov dword [ebp - 0xde0], 0xb994b748
mov dword [ebp - 0xddc], 0xb994b748
mov dword [ebp - 0xdd8], 0xb994b748
lea ecx, [ebp - 0x396]
call fcn.10008d33
push eax
lea eax, [ebp - 0xdd4]
push eax
lea eax, [ebp - 0xde4]
push eax
lea ecx, [ebp - 0x139c]
call fcn.1001867c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1130]
call fcn.10018642
mov dword [ebp - 4], 4
mov dword [ebp - 0x98], 0
jmp 0x1000943c
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x10009458
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1224], 0x34678dc2
jmp 0x1000942f
mov dword [ebp - 0x98], 0
jmp 0x10009471
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1000948d
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x13ac], 0x1a93826a
jmp 0x10009464
mov dword [ebp - 0x1ec], 0xfffffffe
jmp 0x100094a6
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0xc
jge 0x100095b9
mov dword [ebp - 0x10c8], 0xfffffff6
mov dword [ebp - 0x122c], 0x74c38b6b
mov dword [ebp - 0x274], 0x552bf338
push 1
lea ecx, [ebp - 0x1120]
call fcn.100185e1
mov byte [ebp - 4], 5
mov dword [ebp - 0x2f4], 0
jmp 0x100094fb
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 1
jge 0x1000951d
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0x1120]
call fcn.1001866d
mov dword [eax], 0xccde6bc0
jmp 0x100094ee
push 0
lea ecx, [ebp - 0x1130]
call fcn.1001866d
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp - 0xa00]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa00]
mov dword [ecx], eax
mov dword [ebp - 0x1f4], 0
jmp 0x1000955a
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
jg 0x100095a5
mov dword [ebp - 0x274], 0
jmp 0x1000957c
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jg 0x100095a3
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x100095a1
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x1000956f
jmp 0x1000954d
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1120]
call fcn.10018668
jmp 0x10009499
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1130]
call fcn.10018668
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xf0], 0x16
jmp 0x100095eb
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x1c
jle 0x10009610
mov byte [ebp - 0x118], 0
movzx eax, byte [ebp - 0x118]
test eax, eax
je 0x1000960e
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
jmp 0x100095de
mov dword [ebp - 0xf0], 0
jmp 0x10009629
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xffffffef
jg 0x10009685
mov dword [ebp - 0x1fc], 1
mov dword [ebp - 0x1fc], 0
jmp 0x10009655
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0xd
jl 0x10009683
mov byte [ebp - 0x128], 0
movzx eax, byte [ebp - 0x128]
test eax, eax
je 0x10009681
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x10009648
jmp 0x1000961c
push 2
lea ecx, [ebp - 0x3c4]
call fcn.100185e1
mov dword [ebp - 4], 6
mov dword [ebp - 0x134], 0xc45cdbe8
mov dword [ebp - 0x2b8], 0
jmp 0x100096bc
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x100096d8
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0x1140], 1
jmp 0x100096af
mov dword [ebp - 0x134], 0
jmp 0x100096f1
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jge 0x1000970d
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x1140], 0xfffffffd
jmp 0x100096e4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1140], 0x999f
jle 0x1000972c
mov dword [ebp - 0xa08], 1
jmp 0x10009733
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0xb30], 0xce125d16
mov dword [ebp - 0xb2c], 0xce125d16
mov dword [ebp - 0xb28], 0xce125d16
mov dword [ebp - 0xb24], 0xce125d16
mov dword [ebp - 0x10d0], 0x2d34caa8
mov dword [ebp - 0x10fc], 0xffffffff
mov dword [ebp - 0x1298], 0xffffffff
mov dword [ebp - 0x1104], 0xfffffff8
mov dword [ebp - 0xf98], 0x91b86007
mov dword [ebp - 0xa20], 0xeccdf493
mov dword [ebp - 0xf9c], 0
mov dword [ebp - 0x84], 0
jmp 0x100097c6
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x100097e2
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xa18], 8
jmp 0x100097b9
mov dword [ebp - 0x84], 0
jmp 0x100097fb
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x10009817
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x13bc], 0xfffffff7
jmp 0x100097ee
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xb30], 0
jmp 0x10009842
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb30]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xb30], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb30], 0
jl 0x10009954
push 1
lea ecx, [ebp - 0xae4]
call fcn.100185e1
mov byte [ebp - 4], 7
mov dword [ebp - 0x204], 0
jmp 0x1000987f
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x100098a1
push dword [ebp - 0x204]
lea ecx, [ebp - 0xae4]
call fcn.1001866d
mov dword [eax], 1
jmp 0x10009872
push 0
lea ecx, [ebp - 0xae4]
call fcn.1001866d
and dword [eax], 0
jmp 0x100098d7
push 0
lea ecx, [ebp - 0xae4]
call fcn.1001866d
mov dword [ebp - 0xa10], eax
mov eax, dword [ebp - 0xa10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa10]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xae4]
call fcn.1001866d
cmp dword [eax], 0
jg 0x10009940
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0xb30]
push 0
lea ecx, [ebp - 0xae4]
call fcn.1001866d
mov eax, dword [eax]
mov ecx, dword [ebp + esi*4 - 0xa18]
mov dword [ebp + eax*4 - 0xa18], ecx
mov byte [ebp - 0x11a], 0
movzx eax, byte [ebp - 0x11a]
test eax, eax
je 0x1000993b
push 0x21c0
push 0x1555
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x100098b3
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xae4]
call fcn.10018668
jmp 0x10009829
mov eax, dword [ebp - 0xa20]
inc eax
mov dword [ebp - 0xa20], eax
mov dword [ebp - 0x27c], 0
jmp 0x1000997a
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x1000999c
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x3c4]
call fcn.1001866d
mov dword [eax], 0xd4e06482
jmp 0x1000996d
mov dword [ebp - 0x48], 0x6feb9e9d
mov dword [ebp - 0x178], 0xa2b8ea2c
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x170], 0x56fd8c65
mov dword [ebp - 0xc7c], 0x707e294
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xfa4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xfac], eax
cmp dword [ebp - 0x48], 0xffffffff
ja 0x100099ef
mov dword [ebp - 0xb44], 1
jmp 0x100099f6
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xfb4], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jle 0x10009a13
mov dword [ebp - 0xa28], 1
jmp 0x10009a1a
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xa28], eax
jne 0x10009a31
mov dword [ebp - 0xa30], 1
jmp 0x10009a38
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0xa30]
cmp eax, 0x23f
jne 0x10009a58
cmp dword [ebp - 0x48], 0
jne 0x10009a58
and dword [ebp - 0xa38], 0
jmp 0x10009a62
mov dword [ebp - 0xa38], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xa38], eax
jge 0x10009a73
cmp dword [ebp - 0x48], 0
je 0x10009a85
cmp dword [ebp - 0x48], 0
je 0x10009a85
mov dword [ebp - 0xa40], 1
jmp 0x10009a8c
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0xa40]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x178], eax
jle 0x10009aaf
mov dword [ebp - 0xa48], 1
jmp 0x10009ab6
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0xb7b8
jl 0x10009ada
mov dword [ebp - 0xcc4], 1
jmp 0x10009ae1
and dword [ebp - 0xcc4], 0
cmp dword [ebp - 0x48], 0
jne 0x10009af4
xor eax, eax
jne 0x10009af4
and dword [ebp - 0x400], 0
jmp 0x10009afe
mov dword [ebp - 0x400], 1
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x400]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xc7c], eax
mov dword [ebp - 0x170], 0
jmp 0x10009b32
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xffffffe2
je 0x10009b89
mov dword [ebp - 0x178], 0
jmp 0x10009b54
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xffffffe7
jne 0x10009b87
mov dword [ebp - 0xd04], 0xfffc
mov dword [ebp - 0xc84], 0
mov eax, dword [ebp - 0xd04]
mov dword [ebp - 0xc84], eax
cmp dword [ebp - 0x48], 0
je 0x10009b85
jmp 0x10009b47
jmp 0x10009b47
jmp 0x10009b25
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1001866d
and dword [eax], 0
jmp 0x10009bbf
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1001866d
mov dword [ebp - 0x9b8], eax
mov eax, dword [ebp - 0x9b8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x9b8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1001866d
cmp dword [eax], 0xffffffe6
jle 0x10009ced
mov dword [ebp - 0xe5c], 4
mov dword [ebp - 0xe58], 4
mov dword [ebp - 0xe54], 4
mov dword [ebp - 0xe50], 4
lea ecx, [ebp - 0x315]
call fcn.10008d33
push eax
lea eax, [ebp - 0xe4c]
push eax
lea eax, [ebp - 0xe5c]
push eax
lea ecx, [ebp - 0x1354]
call fcn.1001867c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc0c]
call fcn.10018642
mov byte [ebp - 4], 8
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1001866d
cmp dword [eax], 0
je 0x10009c5c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xc0c]
call fcn.10018668
jmp 0x10009ced
push 1
lea ecx, [ebp - 0xc0c]
call fcn.1001866d
mov dword [eax], 0xffffffed
jmp 0x10009c95
push 1
lea ecx, [ebp - 0xc0c]
call fcn.1001866d
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x408]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xc0c]
call fcn.1001866d
cmp dword [eax], 0xffffffee
jge 0x10009cd9
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x10009cd7
push 0x230b
push 0x2355
push 0x1f47
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x10009c71
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xc0c]
call fcn.10018668
jmp 0x10009b9b
push 2
lea ecx, [ebp - 0x1150]
call fcn.100185e1
mov byte [ebp - 4], 9
mov dword [ebp - 0x2d8], 0x667a876e
mov dword [ebp - 0x20c], 0
jmp 0x10009d21
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x10009d43
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x1150]
call fcn.1001866d
mov dword [eax], 0xdf99ff60
jmp 0x10009d14
mov dword [ebp - 0x2d8], 1
jmp 0x10009d5c
mov eax, dword [ebp - 0x2d8]
dec eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0
jl 0x10009d88
mov byte [ebp - 0x11c], 0
movzx eax, byte [ebp - 0x11c]
test eax, eax
je 0x10009d86
push 0
push 0x101b
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x10009d4f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1150]
call fcn.10018668
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1001866d
cmp dword [eax], 0
jne 0x10009db6
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1001866d
push 1
lea ecx, [ebp - 0x3c4]
call fcn.1001866d
mov dword [eax], 9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c4]
call fcn.10018668
mov dword [ebp - 0xe0], 0x24a8c6a5
mov dword [ebp - 0x420], 0xffffffff
mov dword [ebp - 0x9d8], 0xfd78db58
mov dword [ebp - 0xb0], 0
jmp 0x10009e0f
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x10009e2b
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x123c], 0x1da7bc99
jmp 0x10009e02
mov dword [ebp - 0xb0], 0
jmp 0x10009e44
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x10009e60
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x10dc], 4
jmp 0x10009e37
mov dword [ebp - 0xe0], 0
jmp 0x10009e79
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x17
jne 0x10009f8d
mov dword [ebp - 0x180], 0xffffffff
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xfbc], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x123c], 1
xor eax, eax
inc eax
imul eax, eax, 0xffffffff
test eax, eax
je 0x10009ec7
xor eax, eax
je 0x10009ec7
mov dword [ebp - 0xccc], 1
jmp 0x10009ece
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xfc4], eax
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x180], eax
jge 0x10009ef4
mov dword [ebp - 0x9c0], 1
jmp 0x10009efb
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x9c0]
jge 0x10009f15
mov dword [ebp - 0x410], 1
jmp 0x10009f1c
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 8
jne 0x10009f31
mov dword [ebp - 0x9c8], 1
jmp 0x10009f38
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x9c8], eax
jne 0x10009f52
mov dword [ebp - 0x418], 1
jmp 0x10009f59
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 0xffffffff
je 0x10009f6e
mov dword [ebp - 0x9d0], 1
jmp 0x10009f75
and dword [ebp - 0x9d0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9d0]
mov dword [ebp + eax - 0x10dc], ecx
jmp 0x10009e6c
mov dword [ebp - 0xe0], 9
jmp 0x10009fa6
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xfffffff0
jne 0x1000a129
mov dword [ebp - 0x284], 0xeb382e58
mov dword [ebp - 0xfcc], 0x5ee56e31
mov dword [ebp - 0xfd4], 0x7e0fa1a8
mov dword [ebp - 0xfdc], 0xffffffff
mov dword [ebp - 0xfe4], 0
mov dword [ebp - 0xfec], 0
mov dword [ebp - 0xff4], 0xb8342836
mov dword [ebp - 0xffc], 0xfffffff9
mov dword [ebp - 0x1004], 0xe83adeb9
mov dword [ebp - 0x100c], 0x4e5477a7
mov dword [ebp - 0x1014], 0xffffffff
mov dword [ebp - 0x101c], 0x1f08a1ba
mov dword [ebp - 0x1024], 1
mov dword [ebp - 0x102c], 1
mov dword [ebp - 0x1034], 0xfffffffc
push 3
lea ecx, [ebp - 0x1160]
call fcn.100185e1
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x214], 0
jmp 0x1000a076
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jge 0x1000a098
push dword [ebp - 0x214]
lea ecx, [ebp - 0x1160]
call fcn.1001866d
mov dword [eax], 1
jmp 0x1000a069
mov dword [ebp - 0x284], 0
jmp 0x1000a0b1
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jg 0x1000a115
mov dword [ebp - 0x103c], 0xe4ed383d
mov dword [ebp - 0x21c], 0
jmp 0x1000a0dd
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 4
jge 0x1000a0f9
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x13dc], 1
jmp 0x1000a0d0
mov eax, dword [ebp - 0x420]
dec eax
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x9d8]
inc eax
mov dword [ebp - 0x9d8], eax
jmp 0x1000a0a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1160]
call fcn.10018668
jmp 0x10009f99
push 4
lea ecx, [ebp - 0xa9c]
call fcn.100185e1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x190], 0x6fe7d8a8
mov dword [ebp - 0xb48], 2
push 1
lea ecx, [ebp - 0x1180]
call fcn.100185e1
mov byte [ebp - 4], 0xc
push 1
lea ecx, [ebp - 0x1170]
call fcn.100185e1
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x444], 0xe07b88c8
mov dword [ebp - 0xb54], 0xffffffff
mov dword [ebp - 0xb5c], 1
mov dword [ebp - 0x1c], 0
jmp 0x1000a1a1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1000a1ba
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa9c]
call fcn.1001866d
and dword [eax], 0
jmp 0x1000a19a
mov dword [ebp - 0x1c], 0
jmp 0x1000a1ca
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000a1e6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1180]
call fcn.1001866d
mov dword [eax], 0x2314af12
jmp 0x1000a1c3
mov dword [ebp - 0x1c], 0
jmp 0x1000a1f6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000a212
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1170]
call fcn.1001866d
mov dword [eax], 0x90cb933d
jmp 0x1000a1ef
mov dword [ebp - 0x1c], 0
jmp 0x1000a222
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000a238
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x132c], 0
jmp 0x1000a21b
mov dword [ebp - 0x190], 0
jmp 0x1000a251
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jg 0x1000a5cb
mov dword [ebp - 0x34], 9
push 1
lea ecx, [ebp - 0xd34]
call fcn.100185e1
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0xc94], 0x3de7
mov dword [ebp - 0x2c0], 0
jmp 0x1000a2a3
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 1
jge 0x1000a2c5
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0xd34]
call fcn.1001866d
mov dword [eax], 2
jmp 0x1000a296
mov dword [ebp - 0x34], 0
jmp 0x1000a2d5
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x1000a3c5
mov dword [ebp - 0xcec], 7
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1044], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x104c], eax
cmp dword [ebp - 0x34], 0
jl 0x1000a30d
mov dword [ebp - 0x9e0], 1
jmp 0x1000a314
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x9e0]
mov dword [ebp - 0xc8c], eax
push 0
lea ecx, [ebp - 0xd34]
call fcn.1001866d
mov ecx, dword [ebp - 0xc8c]
mov dword [eax], ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa9c]
call fcn.1001866d
mov ecx, dword [ebp - 0x34]
cmp dword [eax], ecx
jg 0x1000a35a
mov dword [ebp - 0x470], 1
jmp 0x1000a361
and dword [ebp - 0x470], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa9c]
call fcn.1001866d
mov eax, dword [eax]
cmp eax, dword [ebp - 0x470]
jne 0x1000a385
mov dword [ebp - 0x460], 1
jmp 0x1000a38c
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0xcec], eax
mov byte [ebp - 0x12c], 0
movzx eax, byte [ebp - 0x12c]
test eax, eax
je 0x1000a3c0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x1000a2ce
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x13c], 0
jmp 0x1000a3eb
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jg 0x1000a5b7
mov dword [ebp - 0x38c], 0
mov dword [ebp - 0x8c4], 8
mov dword [ebp - 0xb4c], 1
mov dword [ebp - 0xeac], 1
mov dword [ebp - 0xea8], 1
mov dword [ebp - 0xea4], 1
mov dword [ebp - 0xea0], 1
lea ecx, [ebp - 0x361]
call fcn.10008d33
push eax
lea eax, [ebp - 0xe9c]
push eax
lea eax, [ebp - 0xeac]
push eax
lea ecx, [ebp - 0x13a4]
call fcn.1001867c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x12fc]
call fcn.10018642
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x1054], 0
mov dword [ebp - 0x34], 3
jmp 0x1000a491
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1000a596
mov dword [ebp - 0x224], 0x72305aba
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa9c]
call fcn.1001866d
cmp dword [ebp - 0xc94], 0
jne 0x1000a506
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x105c], eax
cmp dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x106c], eax
cmp dword [ebp - 0x38c], 0
jne 0x1000a506
and dword [ebp - 0x438], 0
jmp 0x1000a510
mov dword [ebp - 0x438], 1
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 0
jne 0x1000a541
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa9c]
call fcn.1001866d
cmp dword [eax], 0
jne 0x1000a541
and dword [ebp - 0x43c], 0
jmp 0x1000a54b
mov dword [ebp - 0x43c], 1
push 0
lea ecx, [ebp - 0xd34]
call fcn.1001866d
mov ecx, dword [ebp - 0x224]
imul ecx, dword [ebp - 0x43c]
mov eax, dword [eax]
sub eax, ecx
cmp eax, dword [ebp - 0xb48]
jl 0x1000a57d
mov dword [ebp - 0x744], 1
jmp 0x1000a584
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x744]
inc eax
mov dword [ebp - 0xb4c], eax
jmp 0x1000a48a
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x12fc]
call fcn.10018668
jmp 0x1000a3de
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xd34]
call fcn.10018668
jmp 0x1000a244
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0xb5c], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1170]
call fcn.10018668
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1180]
call fcn.10018668
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa9c]
call fcn.10018668
mov dword [ebp - 0x100], 0x24a8c6a5
mov dword [ebp - 0x45c], 0xffffffff
mov dword [ebp - 0x754], 0xfd78db58
mov dword [ebp - 0xa0], 0
jmp 0x1000a63b
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1000a657
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x1234], 0x1da7bc99
jmp 0x1000a62e
mov dword [ebp - 0xa0], 0
jmp 0x1000a670
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1000a68c
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x10e8], 4
jmp 0x1000a663
mov dword [ebp - 0x100], 0
jmp 0x1000a6a5
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x17
jne 0x1000a7b9
mov dword [ebp - 0x17c], 0xffffffff
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1074], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1234], 1
xor eax, eax
inc eax
imul eax, eax, 0xffffffff
test eax, eax
je 0x1000a6f3
xor eax, eax
je 0x1000a6f3
mov dword [ebp - 0xb64], 1
jmp 0x1000a6fa
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x107c], eax
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x17c], eax
jge 0x1000a720
mov dword [ebp - 0xa3c], 1
jmp 0x1000a727
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0xa3c]
jge 0x1000a741
mov dword [ebp - 0x44c], 1
jmp 0x1000a748
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 8
jne 0x1000a75d
mov dword [ebp - 0x74c], 1
jmp 0x1000a764
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x74c], eax
jne 0x1000a77e
mov dword [ebp - 0x454], 1
jmp 0x1000a785
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0xffffffff
je 0x1000a79a
mov dword [ebp - 0x8cc], 1
jmp 0x1000a7a1
and dword [ebp - 0x8cc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8cc]
mov dword [ebp + eax - 0x10e8], ecx
jmp 0x1000a698
mov dword [ebp - 0x100], 9
jmp 0x1000a7d2
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xfffffff0
jne 0x1000a955
mov dword [ebp - 0x22c], 0xeb382e58
mov dword [ebp - 0x1084], 0x5ee56e31
mov dword [ebp - 0x108c], 0x7e0fa1a8
mov dword [ebp - 0x1094], 0xffffffff
mov dword [ebp - 0x109c], 0
mov dword [ebp - 0x10a4], 0
mov dword [ebp - 0x10ac], 0xb8342836
mov dword [ebp - 0x10b4], 0xfffffff9
mov dword [ebp - 0x10bc], 0xe83adeb9
mov dword [ebp - 0x10c4], 0x4e5477a7
mov dword [ebp - 0x10cc], 0xffffffff
mov dword [ebp - 0x10d4], 0x1f08a1ba
mov dword [ebp - 0x10e0], 1
mov dword [ebp - 0x10ec], 1
mov dword [ebp - 0x10f8], 0xfffffffc
push 3
lea ecx, [ebp - 0x1190]
call fcn.100185e1
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x28c], 0
jmp 0x1000a8a2
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 3
jge 0x1000a8c4
push dword [ebp - 0x28c]
lea ecx, [ebp - 0x1190]
call fcn.1001866d
mov dword [eax], 1
jmp 0x1000a895
mov dword [ebp - 0x22c], 0
jmp 0x1000a8dd
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jg 0x1000a941
mov dword [ebp - 0x1100], 0xe4ed383d
mov dword [ebp - 0x2e8], 0
jmp 0x1000a909
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 4
jge 0x1000a925
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0x13cc], 1
jmp 0x1000a8fc
mov eax, dword [ebp - 0x45c]
dec eax
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x754]
inc eax
mov dword [ebp - 0x754], eax
jmp 0x1000a8d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1190]
call fcn.10018668
jmp 0x1000a7c5
mov dword [ebp - 0xc0], 3
mov dword [ebp - 0x75c], 1
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x8d4], 0x4af7bdd4
mov dword [ebp - 0x9ec], 0xfffffff6
mov dword [ebp - 0x1108], 0x14f16367
mov dword [ebp - 0x234], 0
jmp 0x1000a9aa
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x1000a9c6
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0xef4], 1
jmp 0x1000a99d
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xef4]
cmp dword [ebp - 0xc0], eax
jg 0x1000a9e6
mov dword [ebp - 0x464], 1
jmp 0x1000a9ed
and dword [ebp - 0x464], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x464]
cmp eax, 0xffffffff
jl 0x1000aa3b
mov dword [ebp - 0x98c], 0x81d21f1e
mov dword [ebp - 0xc0], 5
jmp 0x1000aa1e
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xfffffff4
jg 0x1000aa36
mov eax, dword [ebp - 0x98c]
inc eax
mov dword [ebp - 0x98c], eax
jmp 0x1000aa11
jmp 0x1000abfb
mov dword [ebp - 0x1b0], 0x333c7d24
mov dword [ebp - 0xc0], 0xf
jmp 0x1000aa5e
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xfffffff7
jge 0x1000abfb
mov dword [ebp - 0x76c], 1
mov dword [ebp - 0xf70], 1
mov dword [ebp - 0xf6c], 1
mov dword [ebp - 0xf68], 1
mov dword [ebp - 0xf64], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b0]
cmp dword [ebp + eax - 0xef4], ecx
jle 0x1000aabe
mov dword [ebp - 0x46c], 1
jmp 0x1000aac5
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x75c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xef4]
cmp eax, dword [ebp - 0x75c]
jne 0x1000aaf1
mov dword [ebp - 0x47c], 1
jmp 0x1000aaf8
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x320], 0xffffffff
jge 0x1000ab0d
mov dword [ebp - 0x474], 1
jmp 0x1000ab14
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x1b0]
imul eax, dword [ebp - 0x474]
mov dword [ebp - 0x8d4], eax
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x1110], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x1244], eax
cmp dword [ebp - 0x1b0], 0x881
jl 0x1000ab57
mov dword [ebp - 0x764], 1
jmp 0x1000ab5e
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x47c]
cmp eax, dword [ebp - 0x764]
jl 0x1000ab78
mov dword [ebp - 0x484], 1
jmp 0x1000ab7f
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x76c]
cmp dword [ebp - 0x9ec], eax
jne 0x1000aba5
mov dword [ebp - 0x48c], 1
jmp 0x1000abac
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x1b0]
imul eax, dword [ebp - 0x48c]
add eax, dword [ebp - 0x76c]
sub eax, dword [ebp - 0x320]
je 0x1000abdc
cmp dword [ebp - 0x1b0], 0
je 0x1000abdc
mov dword [ebp - 0x494], 1
jmp 0x1000abe3
and dword [ebp - 0x494], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x494]
mov dword [ebp + eax - 0xf70], ecx
jmp 0x1000aa51
mov dword [ebp - 0xe8], 0x24a8c6a5
mov dword [ebp - 0x4ac], 0xffffffff
mov dword [ebp - 0x77c], 0xfd78db58
mov dword [ebp - 0xa8], 0
jmp 0x1000ac32
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1000ac4e
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x12c4], 0x1da7bc99
jmp 0x1000ac25
mov dword [ebp - 0xa8], 0
jmp 0x1000ac67
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1000ac83
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x10f4], 4
jmp 0x1000ac5a
mov dword [ebp - 0xe8], 0
jmp 0x1000ac9c
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x17
jne 0x1000adb0
mov dword [ebp - 0x144], 0xffffffff
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x124c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x12c4], 1
xor eax, eax
inc eax
imul eax, eax, 0xffffffff
test eax, eax
je 0x1000acea
xor eax, eax
je 0x1000acea
mov dword [ebp - 0xb6c], 1
jmp 0x1000acf1
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x1254], eax
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x144], eax
jge 0x1000ad17
mov dword [ebp - 0x8dc], 1
jmp 0x1000ad1e
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x144]
cmp eax, dword [ebp - 0x8dc]
jge 0x1000ad38
mov dword [ebp - 0x49c], 1
jmp 0x1000ad3f
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 8
jne 0x1000ad54
mov dword [ebp - 0x774], 1
jmp 0x1000ad5b
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x774], eax
jne 0x1000ad75
mov dword [ebp - 0x4a4], 1
jmp 0x1000ad7c
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0xffffffff
je 0x1000ad91
mov dword [ebp - 0x994], 1
jmp 0x1000ad98
and dword [ebp - 0x994], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x994]
mov dword [ebp + eax - 0x10f4], ecx
jmp 0x1000ac8f
mov dword [ebp - 0xe8], 9
jmp 0x1000adc9
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xfffffff0
jne 0x1000af4c
mov dword [ebp - 0x23c], 0xeb382e58
mov dword [ebp - 0x125c], 0x5ee56e31
mov dword [ebp - 0x1264], 0x7e0fa1a8
mov dword [ebp - 0x126c], 0xffffffff
mov dword [ebp - 0x1274], 0
mov dword [ebp - 0x127c], 0
mov dword [ebp - 0x1284], 0xb8342836
mov dword [ebp - 0x128c], 0xfffffff9
mov dword [ebp - 0x1294], 0xe83adeb9
mov dword [ebp - 0x129c], 0x4e5477a7
mov dword [ebp - 0x12a4], 0xffffffff
mov dword [ebp - 0x12ac], 0x1f08a1ba
mov dword [ebp - 0x12b4], 1
mov dword [ebp - 0x12bc], 1
mov dword [ebp - 0x12c8], 0xfffffffc
push 3
lea ecx, [ebp - 0x11a0]
call fcn.100185e1
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x294], 0
jmp 0x1000ae99
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 3
jge 0x1000aebb
push dword [ebp - 0x294]
lea ecx, [ebp - 0x11a0]
call fcn.1001866d
mov dword [eax], 1
jmp 0x1000ae8c
mov dword [ebp - 0x23c], 0
jmp 0x1000aed4
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jg 0x1000af38
mov dword [ebp - 0x12d0], 0xe4ed383d
mov dword [ebp - 0x2c8], 0
jmp 0x1000af00
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 4
jge 0x1000af1c
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0x13fc], 1
jmp 0x1000aef3
mov eax, dword [ebp - 0x4ac]
dec eax
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
jmp 0x1000aec7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11a0]
call fcn.10018668
jmp 0x1000adbc
mov dword [ebp - 0xb74], 0xe2db58e4
push 2
lea ecx, [ebp - 0xf24]
call fcn.100185e1
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x244], 0
jmp 0x1000af83
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jge 0x1000afa5
push dword [ebp - 0x244]
lea ecx, [ebp - 0xf24]
call fcn.1001866d
mov dword [eax], 0x29bf39
jmp 0x1000af76
cmp dword [ebp - 0xb74], 0
je 0x1000afcf
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x1000afcd
push 0x382
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x1000afe9
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x1000afe9
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 1
lea ecx, [ebp - 0xf24]
call fcn.1001866d
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x4b4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4b4]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf24]
call fcn.10018668
push 4
lea ecx, [ebp - 0xacc]
call fcn.100185e1
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x184], 0x6fe7d8a8
mov dword [ebp - 0xb94], 2
push 1
lea ecx, [ebp - 0x11c0]
call fcn.100185e1
mov byte [ebp - 4], 0x14
push 1
lea ecx, [ebp - 0x11b0]
call fcn.100185e1
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x4d4], 0xe07b88c8
mov dword [ebp - 0xba4], 0xffffffff
mov dword [ebp - 0xbac], 1
mov dword [ebp - 0x20], 0
jmp 0x1000b094
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000b0ad
push dword [ebp - 0x20]
lea ecx, [ebp - 0xacc]
call fcn.1001866d
and dword [eax], 0
jmp 0x1000b08d
mov dword [ebp - 0x20], 0
jmp 0x1000b0bd
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1000b0d9
push dword [ebp - 0x20]
lea ecx, [ebp - 0x11c0]
call fcn.1001866d
mov dword [eax], 0x2314af12
jmp 0x1000b0b6
mov dword [ebp - 0x20], 0
jmp 0x1000b0e9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1000b105
push dword [ebp - 0x20]
lea ecx, [ebp - 0x11b0]
call fcn.1001866d
mov dword [eax], 0x90cb933d
jmp 0x1000b0e2
mov dword [ebp - 0x20], 0
jmp 0x1000b115
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1000b12b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x133c], 0
jmp 0x1000b10e
mov dword [ebp - 0x184], 0
jmp 0x1000b144
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jg 0x1000b4be
mov dword [ebp - 0x38], 9
push 1
lea ecx, [ebp - 0xdc4]
call fcn.100185e1
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x164], 0
mov dword [ebp - 0xb8c], 0x3de7
mov dword [ebp - 0x29c], 0
jmp 0x1000b196
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jge 0x1000b1b8
push dword [ebp - 0x29c]
lea ecx, [ebp - 0xdc4]
call fcn.1001866d
mov dword [eax], 2
jmp 0x1000b189
mov dword [ebp - 0x38], 0
jmp 0x1000b1c8
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x1000b2b8
mov dword [ebp - 0xb84], 7
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x12d8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x12e0], eax
cmp dword [ebp - 0x38], 0
jl 0x1000b200
mov dword [ebp - 0x8e4], 1
jmp 0x1000b207
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x8e4]
mov dword [ebp - 0xb7c], eax
push 0
lea ecx, [ebp - 0xdc4]
call fcn.1001866d
mov ecx, dword [ebp - 0xb7c]
mov dword [eax], ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0xacc]
call fcn.1001866d
mov ecx, dword [ebp - 0x38]
cmp dword [eax], ecx
jg 0x1000b24d
mov dword [ebp - 0x4bc], 1
jmp 0x1000b254
and dword [ebp - 0x4bc], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0xacc]
call fcn.1001866d
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4bc]
jne 0x1000b278
mov dword [ebp - 0x784], 1
jmp 0x1000b27f
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0xb84], eax
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x1000b2b3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x1000b1c1
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x164], 0
jmp 0x1000b2de
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jg 0x1000b4aa
mov dword [ebp - 0x36c], 0
mov dword [ebp - 0xa1c], 8
mov dword [ebp - 0xb9c], 1
mov dword [ebp - 0xdf8], 1
mov dword [ebp - 0xdf4], 1
mov dword [ebp - 0xdf0], 1
mov dword [ebp - 0xdec], 1
lea ecx, [ebp - 0x317]
call fcn.10008d33
push eax
lea eax, [ebp - 0xde8]
push eax
lea eax, [ebp - 0xdf8]
push eax
lea ecx, [ebp - 0x1374]
call fcn.1001867c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1314]
call fcn.10018642
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x12e8], 0
mov dword [ebp - 0x38], 3
jmp 0x1000b384
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1000b489
mov dword [ebp - 0x24c], 0x72305aba
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0xacc]
call fcn.1001866d
cmp dword [ebp - 0xb8c], 0
jne 0x1000b3f9
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x12f0], eax
cmp dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x1290], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1248], eax
cmp dword [ebp - 0x36c], 0
jne 0x1000b3f9
and dword [ebp - 0x4c4], 0
jmp 0x1000b403
mov dword [ebp - 0x4c4], 1
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0xa1c], eax
cmp dword [ebp - 0xa1c], 0
jne 0x1000b434
push dword [ebp - 0x38]
lea ecx, [ebp - 0xacc]
call fcn.1001866d
cmp dword [eax], 0
jne 0x1000b434
and dword [ebp - 0x4cc], 0
jmp 0x1000b43e
mov dword [ebp - 0x4cc], 1
push 0
lea ecx, [ebp - 0xdc4]
call fcn.1001866d
mov ecx, dword [ebp - 0x24c]
imul ecx, dword [ebp - 0x4cc]
mov eax, dword [eax]
sub eax, ecx
cmp eax, dword [ebp - 0xb94]
jl 0x1000b470
mov dword [ebp - 0x78c], 1
jmp 0x1000b477
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x78c]
inc eax
mov dword [ebp - 0xb9c], eax
jmp 0x1000b37d
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1314]
call fcn.10018668
jmp 0x1000b2d1
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xdc4]
call fcn.10018668
jmp 0x1000b137
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xbac], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x11b0]
call fcn.10018668
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x11c0]
call fcn.10018668
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xacc]
call fcn.10018668
mov dword [ebp - 0x14c], 0xc74a
mov dword [ebp - 0x8ec], 0x54bcd76c
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x374], 0xece3051e
mov dword [ebp - 0x328], 0xd4431fad
mov dword [ebp - 0x3a4], 0xf2d6273d
mov dword [ebp - 0xbc4], 0x3ed13222
mov dword [ebp - 0x2e0], 0
jmp 0x1000b556
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 1
jge 0x1000b572
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x79c], 0xfffffffd
jmp 0x1000b549
cmp dword [ebp - 0x14c], 0
jne 0x1000b60d
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0x328]
dec eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0xbb4], 0
jne 0x1000b5ad
mov dword [ebp - 0x4dc], 1
jmp 0x1000b5b4
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x8ec]
cmp eax, dword [ebp - 0x4dc]
jne 0x1000b5da
mov dword [ebp - 0x794], 1
jmp 0x1000b5e1
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x374], eax
jle 0x1000b604
mov eax, 0x542afa01
test eax, eax
jne 0x1000b60d
and dword [ebp - 0x4e4], 0
jmp 0x1000b617
mov dword [ebp - 0x4e4], 1
mov eax, dword [ebp - 0x4e4]
sub eax, dword [ebp - 0x14c]
cmp eax, 0x53bc
jge 0x1000b636
mov dword [ebp - 0xbbc], 1
jmp 0x1000b63d
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x1240], eax
cmp dword [ebp - 0x3a4], 0
je 0x1000b65e
mov dword [ebp - 0x99c], 1
jmp 0x1000b665
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x198], eax
jge 0x1000b68b
mov dword [ebp - 0x4ec], 1
jmp 0x1000b692
and dword [ebp - 0x4ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4ec]
mov dword [ebp + eax - 0x79c], ecx
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xfa0], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x110c], eax
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x3a4], eax
jge 0x1000b6d7
mov dword [ebp - 0x330], 1
jmp 0x1000b6de
and dword [ebp - 0x330], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x330]
mov dword [ebp + eax - 0x79c], ecx
mov eax, dword [ebp - 0x330]
add eax, 0xa81d
mov ecx, 0xf261718b
sub ecx, eax
cmp ecx, 0xfffffff8
je 0x1000b714
mov dword [ebp - 0x4f4], 1
jmp 0x1000b71b
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x374]
mov ecx, dword [ebp - 0x4f4]
lea eax, [eax + ecx + 0x66197039]
cmp eax, dword [ebp - 0xbc4]
jne 0x1000b742
mov dword [ebp - 0x8f4], 1
jmp 0x1000b749
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x90], 3
mov dword [ebp - 0x9f4], 1
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x7ac], 0x4af7bdd4
mov dword [ebp - 0x7b4], 0xfffffff6
mov dword [ebp - 0xfa8], 0x14f16367
mov dword [ebp - 0x254], 0
jmp 0x1000b7aa
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jge 0x1000b7c6
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0xf18], 1
jmp 0x1000b79d
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf18]
cmp dword [ebp - 0x90], eax
jg 0x1000b7e6
mov dword [ebp - 0x4fc], 1
jmp 0x1000b7ed
and dword [ebp - 0x4fc], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x4fc]
cmp eax, 0xffffffff
jl 0x1000b83b
mov dword [ebp - 0x7a4], 0x81d21f1e
mov dword [ebp - 0x90], 5
jmp 0x1000b81e
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffff4
jg 0x1000b836
mov eax, dword [ebp - 0x7a4]
inc eax
mov dword [ebp - 0x7a4], eax
jmp 0x1000b811
jmp 0x1000b9fb
mov dword [ebp - 0x1c0], 0x333c7d24
mov dword [ebp - 0x90], 0xf
jmp 0x1000b85e
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffff7
jge 0x1000b9fb
mov dword [ebp - 0x9a4], 1
mov dword [ebp - 0xf90], 1
mov dword [ebp - 0xf8c], 1
mov dword [ebp - 0xf88], 1
mov dword [ebp - 0xf84], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1c0]
cmp dword [ebp + eax - 0xf18], ecx
jle 0x1000b8be
mov dword [ebp - 0x504], 1
jmp 0x1000b8c5
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x9f4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf18]
cmp eax, dword [ebp - 0x9f4]
jne 0x1000b8f1
mov dword [ebp - 0x514], 1
jmp 0x1000b8f8
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x338], 0xffffffff
jge 0x1000b90d
mov dword [ebp - 0x50c], 1
jmp 0x1000b914
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x1c0]
imul eax, dword [ebp - 0x50c]
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0x12dc], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0xfb0], eax
cmp dword [ebp - 0x1c0], 0x881
jl 0x1000b957
mov dword [ebp - 0x8fc], 1
jmp 0x1000b95e
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0x8fc]
jl 0x1000b978
mov dword [ebp - 0x51c], 1
jmp 0x1000b97f
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x9a4]
cmp dword [ebp - 0x7b4], eax
jne 0x1000b9a5
mov dword [ebp - 0x524], 1
jmp 0x1000b9ac
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x1c0]
imul eax, dword [ebp - 0x524]
add eax, dword [ebp - 0x9a4]
sub eax, dword [ebp - 0x338]
je 0x1000b9dc
cmp dword [ebp - 0x1c0], 0
je 0x1000b9dc
mov dword [ebp - 0x52c], 1
jmp 0x1000b9e3
and dword [ebp - 0x52c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x52c]
mov dword [ebp + eax - 0xf90], ecx
jmp 0x1000b851
push 4
lea ecx, [ebp - 0xab4]
call fcn.100185e1
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x1a0], 0x6fe7d8a8
mov dword [ebp - 0xcf0], 2
push 1
lea ecx, [ebp - 0x11e0]
call fcn.100185e1
mov byte [ebp - 4], 0x19
push 1
lea ecx, [ebp - 0x11d0]
call fcn.100185e1
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x54c], 0xe07b88c8
mov dword [ebp - 0xd00], 0xffffffff
mov dword [ebp - 0xd08], 1
mov dword [ebp - 0x18], 0
jmp 0x1000ba73
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1000ba8c
push dword [ebp - 0x18]
lea ecx, [ebp - 0xab4]
call fcn.1001866d
and dword [eax], 0
jmp 0x1000ba6c
mov dword [ebp - 0x18], 0
jmp 0x1000ba9c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1000bab8
push dword [ebp - 0x18]
lea ecx, [ebp - 0x11e0]
call fcn.1001866d
mov dword [eax], 0x2314af12
jmp 0x1000ba95
mov dword [ebp - 0x18], 0
jmp 0x1000bac8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1000bae4
push dword [ebp - 0x18]
lea ecx, [ebp - 0x11d0]
call fcn.1001866d
mov dword [eax], 0x90cb933d
jmp 0x1000bac1
mov dword [ebp - 0x18], 0
jmp 0x1000baf4
cmp dword [ebp - 0x18], 2
jge 0x1000bb0a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1384], 0
jmp 0x1000baed
mov dword [ebp - 0x1a0], 0
jmp 0x1000bb23