Function at 0x1000a819
Capabilities:
Get keyboard layout
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007cae7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1054
call fcn.1007a290
push esi
push edi
mov dword [ebp - 0xf8c], 0xffffffff
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1000a863
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov byte [ebp - 0x113], 0
movzx eax, byte [ebp - 0x113]
test eax, eax
je 0x1000a87d
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 0x26c], 0xd5e48d32
mov dword [ebp - 0xa24], 0
push 1
lea ecx, [ebp - 0xc90]
call fcn.1001810a
and dword [ebp - 4], 0
mov dword [ebp - 0x6c], 0
jmp 0x1000a8b2
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1000a8c5
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x4c], 9
jmp 0x1000a8ab
mov dword [ebp - 0x6c], 0
jmp 0x1000a8d5
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1000a8f1
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xc90]
call fcn.10018198
mov dword [eax], 0xe2cf4565
jmp 0x1000a8ce
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1000a912
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 0
je 0x1000aa40
mov eax, 0x9d19ac19
test eax, eax
je 0x1000aa06
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 0
jne 0x1000aa18
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 0
jne 0x1000a964
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 0
jne 0x1000a964
and dword [ebp - 0x438], 0
jmp 0x1000a96e
mov dword [ebp - 0x438], 1
mov eax, dword [ebp - 0x438]
dec eax
dec eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x4c]
jle 0x1000a98e
mov dword [ebp - 0x914], 1
jmp 0x1000a995
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x914], 0
jb 0x1000a9aa
mov dword [ebp - 0x42c], 1
jmp 0x1000a9b1
and dword [ebp - 0x42c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
imul eax, dword [ebp - 0x42c]
test eax, eax
je 0x1000a9df
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 0
je 0x1000a9df
mov dword [ebp - 0x93c], 1
jmp 0x1000a9e6
and dword [ebp - 0x93c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
mov dword [ebp - 0xe44], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 0xc5b641b4
ja 0x1000aa18
cmp dword [ebp - 0xa24], 0
jne 0x1000aa18
and dword [ebp - 0x800], 0
jmp 0x1000aa22
mov dword [ebp - 0x800], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
cmp dword [ebp - 0x800], eax
jg 0x1000aa40
mov dword [ebp - 0x360], 1
jmp 0x1000aa47
and dword [ebp - 0x360], 0
push 0
lea ecx, [ebp - 0xc90]
call fcn.10018198
mov ecx, dword [ebp - 0x360]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc90]
call fcn.10018193
mov dword [ebp - 0xbfc], 4
mov dword [ebp - 0xbf8], 4
mov dword [ebp - 0xbf4], 4
mov dword [ebp - 0xbf0], 4
mov dword [ebp - 0x12c], 9
mov dword [ebp - 0x368], 0xe8588d0d
mov dword [ebp - 0x12c], 3
jmp 0x1000aac0
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jl 0x1000ab06
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ebp + ecx*4 - 0xbfc]
cmp dword [ebp + eax*4 - 0xbfc], ecx
jne 0x1000aaf1
mov dword [ebp - 0x808], 1
jmp 0x1000aaf8
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x368], eax
jmp 0x1000aab3
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x117], 0
movzx eax, byte [ebp - 0x117]
test eax, eax
je 0x1000ab31
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x1e4], 0xd5e48d32
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1000ab5a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x1e4], 0xffffffe6
jmp 0x1000ab73
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0x11
jl 0x1000aba6
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1000aba4
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x1000ab66
mov dword [ebp - 0x26c], 0xffffffe6
jmp 0x1000abbf
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x11
jl 0x1000ad67
mov byte [ebp - 0x11b], 0
mov dword [ebp - 0x180], 0xffffffff
mov dword [ebp - 0x304], 0x73bf38c0
mov dword [ebp - 0x818], 0xffffffff
push 2
lea ecx, [ebp - 0xcf0]
call fcn.1001810a
mov dword [ebp - 4], 1
mov dword [ebp - 0xa34], 1
mov dword [ebp - 0xf5c], 0xfffffff7
mov dword [ebp - 0x1ec], 0
jmp 0x1000ac32
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 2
jge 0x1000ac54
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0xcf0]
call fcn.10018198
mov dword [eax], 6
jmp 0x1000ac25
mov eax, dword [ebp - 0x180]
add eax, dword [ebp - 0x180]
cmp eax, 0xa6e4
jle 0x1000ac73
mov dword [ebp - 0x810], 1
jmp 0x1000ac7a
and dword [ebp - 0x810], 0
cmp dword [ebp - 0x810], 1
ja 0x1000ac8f
mov dword [ebp - 0x370], 1
jmp 0x1000ac96
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov ecx, dword [ebp - 0x370]
sub ecx, dword [ebp - 0x180]
sub eax, ecx
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0xa2c], eax
push 0
lea ecx, [ebp - 0xcf0]
call fcn.10018198
mov ecx, dword [ebp - 0xa2c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xe54], eax
cmp dword [ebp - 0x304], 0xffffffff
je 0x1000acfe
mov dword [ebp - 0x378], 1
jmp 0x1000ad05
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x378], eax
je 0x1000ad1f
mov dword [ebp - 0x820], 1
jmp 0x1000ad26
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0xa34], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf0]
call fcn.10018193
movzx eax, byte [ebp - 0x11b]
test eax, eax
je 0x1000ad62
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x1000abb2
mov dword [ebp - 0x244], 0xd5e48d32
mov byte [ebp - 0x11f], 0
movzx eax, byte [ebp - 0x11f]
test eax, eax
je 0x1000ad90
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x244], 0xffffffe6
jmp 0x1000ada9
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x11
jl 0x1000addc
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000adda
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x1000ad9c
mov dword [ebp - 0x1f4], 0xd5e48d32
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1000ae05
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x1f4], 0xffffffe6
jmp 0x1000ae1e
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0x11
jl 0x1000ae51
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x1000ae4f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x1000ae11
mov dword [ebp - 0x184], 0
push 4
lea ecx, [ebp - 0xb8c]
call fcn.1001810a
mov dword [ebp - 4], 2
mov dword [ebp - 0x284], 0
jmp 0x1000ae88
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 4
jge 0x1000aeaa
push dword [ebp - 0x284]
lea ecx, [ebp - 0xb8c]
call fcn.10018198
mov dword [eax], 0x87df2f4a
jmp 0x1000ae7b
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x184], 0
jmp 0x1000aed0
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jg 0x1000af9b
mov dword [ebp - 0x198], 0x3eee2fde
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x1000aeff
call dword [sym.imp.USER32.dll_DestroyCaret]
mov dword [ebp - 0x198], 0
jmp 0x1000af18
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jg 0x1000af96
mov dword [ebp - 0x1b0], 0xffffffff
mov dword [ebp - 0x1b0], 3
jmp 0x1000af44
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jl 0x1000af91
mov byte [ebp - 0x128], 0
movzx eax, byte [ebp - 0x128]
test eax, eax
je 0x1000af67
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push dword [ebp - 0x1b0]
lea ecx, [ebp - 0xb8c]
call fcn.10018198
mov esi, eax
push dword [ebp - 0x198]
lea ecx, [ebp - 0xb8c]
call fcn.10018198
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000af37
jmp 0x1000af0b
jmp 0x1000aec3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8c]
call fcn.10018193
mov dword [ebp - 0x14c], 0
push 4
lea ecx, [ebp - 0xb98]
call fcn.1001810a
mov dword [ebp - 4], 3
mov dword [ebp - 0x1fc], 0
jmp 0x1000afe1
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 4
jge 0x1000b003
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0xb98]
call fcn.10018198
mov dword [eax], 0x87df2f4a
jmp 0x1000afd4
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x14c], 0
jmp 0x1000b029
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 3
jg 0x1000b0f4
mov dword [ebp - 0x1a0], 0x3eee2fde
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x1000b058
call dword [sym.imp.USER32.dll_DestroyCaret]
mov dword [ebp - 0x1a0], 0
jmp 0x1000b071
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jg 0x1000b0ef
mov dword [ebp - 0x1c0], 0xffffffff
mov dword [ebp - 0x1c0], 3
jmp 0x1000b09d
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x1000b0ea
mov byte [ebp - 0x114], 0
movzx eax, byte [ebp - 0x114]
test eax, eax
je 0x1000b0c0
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0xb98]
call fcn.10018198
mov esi, eax
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xb98]
call fcn.10018198
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000b090
jmp 0x1000b064
jmp 0x1000b01c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb98]
call fcn.10018193
mov dword [ebp - 0x24c], 0x7ddc85f7
mov dword [ebp - 0x24c], 0xfffffff4
jmp 0x1000b126
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xf
jge 0x1000b20c
mov dword [ebp - 0xb30], 0x9b546158
mov dword [ebp - 0xb2c], 0x9b546158
mov dword [ebp - 0xb28], 0x9b546158
mov dword [ebp - 0xb24], 0x9b546158
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xb30], 0
jmp 0x1000b189
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb30]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xb30], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb30], 7
jl 0x1000b207
xor eax, eax
inc eax
je 0x1000b1b8
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x1000b1b6
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1000b1d2
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x1000b1d2
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x1000b202
push 0x1278
push 0x206e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x1000b16e
jmp 0x1000b119
mov dword [ebp - 0x16c], 0
push 4
lea ecx, [ebp - 0xba4]
call fcn.1001810a
mov dword [ebp - 4], 4
mov dword [ebp - 0x204], 0
jmp 0x1000b243
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 4
jge 0x1000b265
push dword [ebp - 0x204]
lea ecx, [ebp - 0xba4]
call fcn.10018198
mov dword [eax], 0x87df2f4a
jmp 0x1000b236
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x16c], 0
jmp 0x1000b28b
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jg 0x1000b356
mov dword [ebp - 0x1a8], 0x3eee2fde
mov byte [ebp - 0x116], 0
movzx eax, byte [ebp - 0x116]
test eax, eax
je 0x1000b2ba
call dword [sym.imp.USER32.dll_DestroyCaret]
mov dword [ebp - 0x1a8], 0
jmp 0x1000b2d3
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jg 0x1000b351
mov dword [ebp - 0x1b8], 0xffffffff
mov dword [ebp - 0x1b8], 3
jmp 0x1000b2ff
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x1000b34c
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x1000b322
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0xba4]
call fcn.10018198
mov esi, eax
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0xba4]
call fcn.10018198
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000b2f2
jmp 0x1000b2c6
jmp 0x1000b27e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba4]
call fcn.10018193
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0xc4], 0xfffffff7
mov dword [ebp - 0x44], 0x5b8b78ac
mov dword [ebp - 0x850], 0x8b15
mov dword [ebp - 0x848], 0xccc0
mov dword [ebp - 0x214], 1
mov dword [ebp - 0xf2c], 1
mov dword [ebp - 0xa54], 0
mov dword [ebp - 0xa5c], 0xe2efaada
mov dword [ebp - 0xe64], 9
cmp dword [ebp - 0xb8], 0
jne 0x1000b3db
mov dword [ebp - 0xa3c], 1
jmp 0x1000b3e2
and dword [ebp - 0xa3c], 0
cmp dword [ebp - 0xb8], 0
je 0x1000b43a
cmp dword [ebp - 0xb8], 0
jne 0x1000b406
mov eax, 0x3de0369b
test eax, eax
jne 0x1000b406
and dword [ebp - 0x380], 0
jmp 0x1000b410
mov dword [ebp - 0x380], 1
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
je 0x1000b43a
mov eax, 0x14a9bacd
test eax, eax
je 0x1000b43a
mov dword [ebp - 0xa44], 1
jmp 0x1000b441
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x850], eax
mov eax, 0x64a90c6d
test eax, eax
je 0x1000b47d
mov dword [ebp - 0x44], 0x9642e40c
jmp 0x1000b4e4
mov dword [ebp - 0x274], 0
jmp 0x1000b496
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jge 0x1000b4b2
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0xfb8], 0x64d64ea3
jmp 0x1000b489
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x1000b4d1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb8]
mov dword [ebp + eax - 0xfb8], ecx
mov dword [ebp - 0x44], 0x17
jmp 0x1000b4f4
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffff4
je 0x1000b867
mov dword [ebp - 0x1c8], 0x84cbf776
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x860], 0xb53cf54
mov dword [ebp - 0xd48], 1
mov dword [ebp - 0xd50], 0xffffffff
mov dword [ebp - 0xc20], 0xe410
mov dword [ebp - 0xc1c], 0xe410
mov dword [ebp - 0xc18], 0xe410
mov dword [ebp - 0xc14], 0xe410
lea ecx, [ebp - 0x2b9]
call fcn.1000a663
push eax
lea eax, [ebp - 0xc10]
push eax
lea eax, [ebp - 0xc20]
push eax
lea ecx, [ebp - 0x1040]
call fcn.100181a7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe10]
call fcn.10018169
mov dword [ebp - 4], 5
mov dword [ebp - 0x20c], 0
jmp 0x1000b5ad
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jge 0x1000b5c9
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0x100c], 0xfffffff6
jmp 0x1000b5a0
cmp dword [ebp - 0xc4], 0x4595a2e7
je 0x1000b5e1
mov dword [ebp - 0x3a0], 1
jmp 0x1000b5e8
and dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x44], 0
jne 0x1000b5fa
mov dword [ebp - 0x830], 1
jmp 0x1000b601
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x214], eax
jl 0x1000b639
cmp dword [ebp - 0x214], 0
je 0x1000b639
cmp dword [ebp - 0xc4], 0
je 0x1000b639
mov dword [ebp - 0x828], 1
jmp 0x1000b640
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x828], eax
jl 0x1000b65a
mov dword [ebp - 0x388], 1
jmp 0x1000b661
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x388], eax
jl 0x1000b67b
mov dword [ebp - 0x390], 1
jmp 0x1000b682
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x830]
imul eax, dword [ebp - 0x390]
cmp eax, dword [ebp - 0xb8]
jle 0x1000b6ac
mov eax, 0x2cb566e6
test eax, eax
je 0x1000b6ac
mov dword [ebp - 0x838], 1
jmp 0x1000b6b3
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x838], eax
jne 0x1000b6cd
mov dword [ebp - 0x398], 1
jmp 0x1000b6d4
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x398]
cmp eax, dword [ebp - 0xc4]
jle 0x1000b6f5
mov dword [ebp - 0x840], 1
jmp 0x1000b6fc
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x840], eax
jg 0x1000b716
mov dword [ebp - 0x3a8], 1
jmp 0x1000b71d
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x848]
neg eax
cmp eax, dword [ebp - 0x3a8]
jge 0x1000b745
mov dword [ebp - 0xa4c], 1
jmp 0x1000b74c
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xd58], eax
imul eax, dword [ebp - 0x1c8], 0x3555
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x850]
add eax, 0x3b02
cmp dword [ebp - 0x254], eax
jl 0x1000b78d
mov dword [ebp - 0x858], 1
jmp 0x1000b794
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0xa54]
cmp dword [ebp - 0x860], eax
je 0x1000b7ae
mov dword [ebp - 0x3b0], 1
jmp 0x1000b7b5
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x214]
add eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 0xa5c]
jne 0x1000b7d5
mov dword [ebp - 0xa64], 1
jmp 0x1000b7dc
and dword [ebp - 0xa64], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x100c]
mov dword [ebp - 0xd60], eax
push 3
lea ecx, [ebp - 0xe10]
call fcn.10018198
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x2c4]
mov edx, dword [ebp - 0x858]
imul edx, dword [ecx]
mov ecx, dword [ebp - 0x2c4]
mov ecx, dword [ecx]
dec ecx
mov esi, dword [ebp - 0x2c4]
mov dword [esi], ecx
cmp edx, eax
jle 0x1000b83d
mov eax, 0x98b9db5d
test eax, eax
jne 0x1000b83d
and dword [ebp - 0x3b8], 0
jmp 0x1000b847
mov dword [ebp - 0x3b8], 1
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x860], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe10]
call fcn.10018193
jmp 0x1000b4ed
movzx eax, byte [0x1066fae4]
test eax, eax
je 0x1000b885
mov esi, 0x10083834
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10011ef8
mov dword [ebp - 0xb44], 0x2d5e48d3
mov dword [ebp - 0xb40], 0x2d5e48d3
mov dword [ebp - 0xb3c], 0x2d5e48d3
mov dword [ebp - 0xb38], 0x2d5e48d3
mov dword [ebp - 0x294], 7
mov dword [ebp - 0x344], 0x6ab2aee5
mov dword [ebp - 0x138], 6
mov dword [ebp - 0x400], 0x19adb821
mov dword [ebp - 0xa6c], 0xffffffff
mov dword [ebp - 0x950], 0x74d2d97b
mov dword [ebp - 0x294], 3
jmp 0x1000b902
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
jl 0x1000bddb
mov dword [ebp - 0xec], 0xfffffffe
mov dword [ebp - 0xd68], 0x8213af72
mov dword [ebp - 0x3c0], 1
mov dword [ebp - 0xa4], 0
jmp 0x1000b946
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1000b962
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x8dc], 0xfffffff7
jmp 0x1000b939
mov dword [ebp - 0xa4], 0
jmp 0x1000b97b
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x1000b997
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x21c], 0x66c1932e
jmp 0x1000b96e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8dc], 3
jmp 0x1000b9c5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8dc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8dc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8dc], 0
jl 0x1000b9ff
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x1000b9fd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
jmp 0x1000b9aa
mov dword [ebp - 0xec], 0
jmp 0x1000ba18
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jg 0x1000bd26
push 2
lea ecx, [ebp - 0xa7c]
call fcn.1001810a
mov dword [ebp - 4], 6
push 3
lea ecx, [ebp - 0xbbc]
call fcn.1001810a
mov byte [ebp - 4], 7
mov dword [ebp - 0x74], 0
jmp 0x1000ba5a
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1000ba76
push dword [ebp - 0x74]
lea ecx, [ebp - 0xa7c]
call fcn.10018198
mov dword [eax], 0xba47
jmp 0x1000ba53
mov dword [ebp - 0x74], 0
jmp 0x1000ba86
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1000baa2
push dword [ebp - 0x74]
lea ecx, [ebp - 0xbbc]
call fcn.10018198
mov dword [eax], 1
jmp 0x1000ba7f
mov eax, dword [ebp - 0x3c0]
dec eax
mov dword [ebp - 0x3c0], eax
mov esi, dword [ebp - 0x344]
push 0
lea ecx, [ebp - 0xbbc]
call fcn.10018198
cmp esi, dword [eax]
je 0x1000bad2
mov dword [ebp - 0x880], 1
jmp 0x1000bad9
and dword [ebp - 0x880], 0
cmp dword [ebp - 0xa6c], 0xffffffff
jl 0x1000baee
mov dword [ebp - 0x868], 1
jmp 0x1000baf5
and dword [ebp - 0x868], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
cmp eax, dword [ebp - 0x868]
jle 0x1000bb16
mov dword [ebp - 0x3c8], 1
jmp 0x1000bb1d
and dword [ebp - 0x3c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
cmp dword [ebp - 0x3c8], eax
jge 0x1000bb3e
mov dword [ebp - 0x870], 1
jmp 0x1000bb45
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
shl eax, 3
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x21c]
mov ecx, dword [ebp - 0xec]
cmp eax, dword [ebp + ecx*4 - 0xb44]
jne 0x1000bb76
mov dword [ebp - 0xa1c], 1
jmp 0x1000bb7d
and dword [ebp - 0xa1c], 0
push 1
lea ecx, [ebp - 0xa7c]
call fcn.10018198
push 1
lea ecx, [ebp - 0xa7c]
call fcn.10018198
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xd70], eax
push 1
lea ecx, [ebp - 0xbbc]
call fcn.10018198
cmp dword [eax], 0x3298
jle 0x1000bbca
cmp dword [ebp - 0x400], 0
jne 0x1000bbca
and dword [ebp - 0x3d0], 0
jmp 0x1000bbd4
mov dword [ebp - 0x3d0], 1
push 1
lea ecx, [ebp - 0xa7c]
call fcn.10018198
mov ecx, dword [ebp - 0x3d0]
cmp ecx, dword [eax]
jge 0x1000bbf7
mov dword [ebp - 0x878], 1
jmp 0x1000bbfe
and dword [ebp - 0x878], 0
cmp dword [ebp - 0x878], 0xfffffffc
jae 0x1000bc13
mov dword [ebp - 0x3d8], 1
jmp 0x1000bc1a
and dword [ebp - 0x3d8], 0
imul eax, dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x880], eax
jg 0x1000bc35
mov dword [ebp - 0x3e0], 1
jmp 0x1000bc3c
and dword [ebp - 0x3e0], 0
cmp dword [ebp - 0x3e0], 0x7fad
je 0x1000bc54
mov dword [ebp - 0x888], 1
jmp 0x1000bc5b
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp + eax*4 - 0xb44]
add eax, dword [ebp - 0x888]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x21c]
jge 0x1000bc89
mov dword [ebp - 0x3e8], 1
jmp 0x1000bc90
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 4
jne 0x1000bca5
mov dword [ebp - 0x948], 1
jmp 0x1000bcac
and dword [ebp - 0x948], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8dc], 0xfffffffc
jne 0x1000bcc8
mov dword [ebp - 0x890], 1
jmp 0x1000bccf
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp + eax*4 - 0xb44]
cmp eax, dword [ebp - 0x890]
jne 0x1000bcf0
mov dword [ebp - 0x3f0], 1
jmp 0x1000bcf7
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x344], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xbbc]
call fcn.10018193
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa7c]
call fcn.10018193
jmp 0x1000ba0b
mov dword [ebp - 0x138], 0
jmp 0x1000bd3f
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jg 0x1000bdd6
mov dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp + eax*4 - 0xb44], 0
je 0x1000bd7b
mov eax, 0x77fc3fe7
test eax, eax
je 0x1000bd7b
mov dword [ebp - 0x898], 1
jmp 0x1000bd82
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0x898]
cmp eax, 3
ja 0x1000bd9f
mov dword [ebp - 0x3f8], 1
jmp 0x1000bda6
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 0x4d257e7e
jg 0x1000bdbe
mov dword [ebp - 0x8a0], 1
jmp 0x1000bdc5
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0xa70], eax
jmp 0x1000bd32
jmp 0x1000b8f5
mov eax, dword [ebp - 0x400]
imul eax, dword [ebp - 0x344]
mov dword [ebp - 0x950], eax
mov dword [ebp - 0x25c], 0x7ddc85f7
mov dword [ebp - 0x25c], 0xfffffff4
jmp 0x1000be11
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xf
jge 0x1000bef7
mov dword [ebp - 0xb58], 0x9b546158
mov dword [ebp - 0xb54], 0x9b546158
mov dword [ebp - 0xb50], 0x9b546158
mov dword [ebp - 0xb4c], 0x9b546158
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xb58], 0
jmp 0x1000be74
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb58]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xb58], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb58], 7
jl 0x1000bef2
xor eax, eax
inc eax
je 0x1000bea3
mov byte [ebp - 0x118], 0
movzx eax, byte [ebp - 0x118]
test eax, eax
je 0x1000bea1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1000bebd
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x1000bebd
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x1000beed
push 0x1278
push 0x206e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x1000be59
jmp 0x1000be04
mov dword [ebp - 0x224], 0x7ddc85f7
mov dword [ebp - 0x224], 0xfffffff4
jmp 0x1000bf1a
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xf
jge 0x1000c000
mov dword [ebp - 0xb6c], 0x9b546158
mov dword [ebp - 0xb68], 0x9b546158
mov dword [ebp - 0xb64], 0x9b546158
mov dword [ebp - 0xb60], 0x9b546158
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xb6c], 0
jmp 0x1000bf7d
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb6c]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xb6c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb6c], 7
jl 0x1000bffb
xor eax, eax
inc eax
je 0x1000bfac
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x1000bfaa
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1000bfc6
mov byte [ebp - 0x11a], 0
movzx eax, byte [ebp - 0x11a]
test eax, eax
je 0x1000bfc6
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x1000bff6
push 0x1278
push 0x206e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x1000bf62
jmp 0x1000bf0d
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x54], 0xff14eb4c
mov dword [ebp - 0x30c], 0xe96bb645
mov dword [ebp - 0x2d4], 0x7b4d2c29
push 3
lea ecx, [ebp - 0x92c]
call fcn.1001810a
mov dword [ebp - 4], 8
mov dword [ebp - 0x2cc], 0xedbec151
mov dword [ebp - 0x154], 0x1d4416da
mov dword [ebp - 0xd78], 0x9aae
mov dword [ebp - 0xac], 0
jmp 0x1000c070
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x1000c089
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x10], 0x7c203980
jmp 0x1000c063
mov dword [ebp - 0xac], 0
jmp 0x1000c0a2
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x1000c0c1
push dword [ebp - 0xac]
lea ecx, [ebp - 0x92c]
call fcn.10018198
or dword [eax], 0xffffffff
jmp 0x1000c095
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x10]
inc ecx
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0x10], ecx
test eax, eax
jne 0x1000c101
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1000c0f8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10], 0
jne 0x1000c101
and dword [ebp - 0x408], 0
jmp 0x1000c10b
mov dword [ebp - 0x408], 1
mov dword [ebp - 0xcc], 0x3c39
cmp dword [ebp - 0xcc], 4
jb 0x1000c12a
mov dword [ebp - 0xaf0], 1
jmp 0x1000c131
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
je 0x1000c145
mov dword [ebp - 0x8a8], 1
jmp 0x1000c14c
and dword [ebp - 0x8a8], 0
cmp dword [ebp - 0x8a8], 0xdc5336de
jb 0x1000c164
mov dword [ebp - 0x958], 1
jmp 0x1000c16b
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x408]
sub eax, dword [ebp - 0xcc]
mov dword [ebp - 0x54], eax
je 0x1000c365
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x299fa9ef
jle 0x1000c1aa
mov dword [ebp - 0xa80], 1
jmp 0x1000c1b1
and dword [ebp - 0xa80], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
mov dword [ebp - 0xd80], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
mov dword [ebp - 0xd88], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x54], eax
jl 0x1000c1ec
mov dword [ebp - 0x8b0], 1
jmp 0x1000c1f3
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x30c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x30c], eax
je 0x1000c21d
mov dword [ebp - 0x410], 1
jmp 0x1000c224
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0x2f093d7f
jge 0x1000c23c
mov dword [ebp - 0x8b8], 1
jmp 0x1000c243
and dword [ebp - 0x8b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x8b8], eax
jne 0x1000c261
mov dword [ebp - 0x418], 1
jmp 0x1000c268
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
jne 0x1000c293
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10], 0
jne 0x1000c293
and dword [ebp - 0x960], 0
jmp 0x1000c29d
mov dword [ebp - 0x960], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
mov dword [ebp - 0xd90], eax
xor eax, eax
cmp eax, 2
jb 0x1000c2c0
mov dword [ebp - 0x8c0], 1
jmp 0x1000c2c7
and dword [ebp - 0x8c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
mov dword [ebp - 0xd98], eax
push 0
lea ecx, [ebp - 0x92c]
call fcn.10018198
mov ecx, dword [ebp - 0x8c0]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
mov dword [ebp - 0xda0], eax
mov eax, 0x9c82
sub eax, 0xec53
neg eax
cmp eax, dword [ebp - 0x2cc]
jge 0x1000c31c
mov dword [ebp - 0x420], 1
jmp 0x1000c323
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x420], eax
je 0x1000c365
mov dword [ebp - 0x154], 0
jmp 0x1000c34a
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 9
jg 0x1000c360
cmp dword [ebp - 0x2cc], 0
je 0x1000c35e
jmp 0x1000c360
jmp 0x1000c33d
jmp 0x1000c7fa
mov dword [ebp - 0x2c], 0x3a20
mov dword [ebp - 0x190], 0xdeeaf792
mov dword [ebp - 0x6ac], 0x8c6ec2a3
mov dword [ebp - 0x8e0], 1
mov dword [ebp - 0x27c], 0
jmp 0x1000c3a3
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x1000c3bf
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0xf88], 0xfffffffc
jmp 0x1000c396
cmp dword [ebp - 0x2c], 0x8f5b6ef3
jae 0x1000c3e1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10], 0
je 0x1000c3e1
mov dword [ebp - 0x8c8], 1
jmp 0x1000c3e8
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x8c8], eax
jne 0x1000c3ff
mov dword [ebp - 0xaf8], 1
jmp 0x1000c406
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xda8], eax
push 2
pop eax
test eax, eax
jle 0x1000c422
mov dword [ebp - 0x8d0], 1
jmp 0x1000c429
and dword [ebp - 0x8d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x8d0], eax
jg 0x1000c447
mov dword [ebp - 0x430], 1
jmp 0x1000c44e
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x190], eax
je 0x1000c471
mov dword [ebp - 0x968], 1
jmp 0x1000c478
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xdb0], eax
cmp dword [ebp - 0x2cc], 0
jl 0x1000c496
mov dword [ebp - 0x7cc], 1
jmp 0x1000c49d
and dword [ebp - 0x7cc], 0
cmp dword [ebp - 0x7cc], 0xc9199ed1
jbe 0x1000c4bb
cmp dword [ebp - 0x154], 0
jne 0x1000c4bb
and dword [ebp - 0x434], 0
jmp 0x1000c4c5
mov dword [ebp - 0x434], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x434], eax
jle 0x1000c4e3
mov dword [ebp - 0x69c], 1
jmp 0x1000c4ea
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 0x7b93
jne 0x1000c502
mov dword [ebp - 0x43c], 1
jmp 0x1000c509
and dword [ebp - 0x43c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10], 0
jne 0x1000c522
mov dword [ebp - 0x8b4], 1
jmp 0x1000c529
and dword [ebp - 0x8b4], 0
cmp dword [ebp - 0x8b4], 2
je 0x1000c53e
mov dword [ebp - 0x444], 1
jmp 0x1000c545
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
sub eax, dword [ebp - 0x54]
jne 0x1000c55c
mov dword [ebp - 0x6a4], 1
jmp 0x1000c563
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xdb8], eax
push 0
lea ecx, [ebp - 0x92c]
call fcn.10018198
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0xdc0], eax
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x2c], eax
jl 0x1000c5b1
mov eax, 0xe2d4
test eax, eax
je 0x1000c5b1
mov dword [ebp - 0x44c], 1
jmp 0x1000c5b8
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0x4505af75
jne 0x1000c5d6
cmp dword [ebp - 0xcc], 0
jne 0x1000c5d6
and dword [ebp - 0x7d4], 0
jmp 0x1000c5e0
mov dword [ebp - 0x7d4], 1
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x54], eax
mov eax, 0xfff7
test eax, eax
je 0x1000c64f
cmp dword [ebp - 0x190], 0
jne 0x1000c622
push 0
lea ecx, [ebp - 0x92c]
call fcn.10018198
mov eax, dword [eax]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jne 0x1000c622
and dword [ebp - 0x454], 0
jmp 0x1000c62c
mov dword [ebp - 0x454], 1
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x6ac], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x6ac], eax
je 0x1000c64f
mov dword [ebp - 0x45c], 1
jmp 0x1000c656
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x45c], eax
jle 0x1000c66d
mov dword [ebp - 0x86c], 1
jmp 0x1000c674
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x86c], eax
jg 0x1000c68b
mov dword [ebp - 0x464], 1
jmp 0x1000c692
and dword [ebp - 0x464], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp eax, dword [ebp - 0x464]
jl 0x1000c6b0
mov dword [ebp - 0x6b4], 1
jmp 0x1000c6b7
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0xc3306324
jbe 0x1000c6cf
mov dword [ebp - 0x46c], 1
jmp 0x1000c6d6
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x46c], eax
jg 0x1000c6ed
mov dword [ebp - 0x7dc], 1
jmp 0x1000c6f4
and dword [ebp - 0x7dc], 0
cmp dword [ebp - 0x7dc], 1
jg 0x1000c709
mov dword [ebp - 0x474], 1
jmp 0x1000c710
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x474], eax
jle 0x1000c727
mov dword [ebp - 0x6bc], 1
jmp 0x1000c72e
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x8e0]
cmp dword [ebp - 0x6bc], eax
jg 0x1000c748
mov dword [ebp - 0x47c], 1
jmp 0x1000c74f
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0x198f9f05
jle 0x1000c767
mov dword [ebp - 0x484], 1
jmp 0x1000c76e
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x8e0]
cmp dword [ebp - 0x484], eax
jne 0x1000c788
mov dword [ebp - 0x6c4], 1
jmp 0x1000c78f
and dword [ebp - 0x6c4], 0
push 0
lea ecx, [ebp - 0x92c]
call fcn.10018198
mov esi, dword [ebp - 0x6c4]
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x92c]
call fcn.10018198
cmp esi, dword [eax]
jge 0x1000c7c2
mov dword [ebp - 0x48c], 1
jmp 0x1000c7c9
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x48c], eax
jle 0x1000c7e0
mov dword [ebp - 0x7e4], 1
jmp 0x1000c7e7
and dword [ebp - 0x7e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7e4]
mov dword [ebp + eax - 0xf88], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x92c]
call fcn.10018193
mov dword [ebp - 0xe4], 0xffffffff
mov dword [ebp - 0xd4], 0xfffffff7
mov dword [ebp - 0x48], 0x5b8b78ac
mov dword [ebp - 0x8bc], 0x8b15
mov dword [ebp - 0x6dc], 0xccc0
mov dword [ebp - 0x1d0], 1
mov dword [ebp - 0xdc8], 1
mov dword [ebp - 0x978], 0
mov dword [ebp - 0xaa0], 0xe2efaada
mov dword [ebp - 0xdd0], 9
cmp dword [ebp - 0xe4], 0
jne 0x1000c87f
mov dword [ebp - 0xa90], 1
jmp 0x1000c886
and dword [ebp - 0xa90], 0
cmp dword [ebp - 0xe4], 0
je 0x1000c8de
cmp dword [ebp - 0xe4], 0
jne 0x1000c8aa
mov eax, 0x3de0369b
test eax, eax
jne 0x1000c8aa
and dword [ebp - 0x494], 0
jmp 0x1000c8b4
mov dword [ebp - 0x494], 1
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x1000c8de
mov eax, 0x14a9bacd
test eax, eax
je 0x1000c8de
mov dword [ebp - 0x970], 1
jmp 0x1000c8e5
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xdd8], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xde0], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x8bc], eax
mov eax, 0x64a90c6d
test eax, eax
je 0x1000c921
mov dword [ebp - 0x48], 0x9642e40c
jmp 0x1000c988
mov dword [ebp - 0x22c], 0
jmp 0x1000c93a
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x1000c956
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xff4], 0x64d64ea3
jmp 0x1000c92d
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000c975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe4]
mov dword [ebp + eax - 0xff4], ecx
mov dword [ebp - 0x48], 0x17
jmp 0x1000c998
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffff4
je 0x1000cd0b
mov dword [ebp - 0x194], 0x84cbf776
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x7f4], 0xb53cf54
mov dword [ebp - 0xde8], 1
mov dword [ebp - 0xdf0], 0xffffffff
mov dword [ebp - 0xc34], 0xe410
mov dword [ebp - 0xc30], 0xe410
mov dword [ebp - 0xc2c], 0xe410
mov dword [ebp - 0xc28], 0xe410
lea ecx, [ebp - 0x33d]
call fcn.1000a663
push eax
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0xc34]
push eax
lea ecx, [ebp - 0x1058]
call fcn.100181a7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe20]
call fcn.10018169
mov dword [ebp - 4], 9
mov dword [ebp - 0x264], 0
jmp 0x1000ca51
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jge 0x1000ca6d
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0xfc4], 0xfffffff6
jmp 0x1000ca44
cmp dword [ebp - 0xd4], 0x4595a2e7
je 0x1000ca85
mov dword [ebp - 0x4b4], 1
jmp 0x1000ca8c
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x48], 0
jne 0x1000ca9e
mov dword [ebp - 0x874], 1
jmp 0x1000caa5
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x1d0], eax
jl 0x1000cadd
cmp dword [ebp - 0x1d0], 0
je 0x1000cadd
cmp dword [ebp - 0xd4], 0
je 0x1000cadd
mov dword [ebp - 0x6cc], 1
jmp 0x1000cae4
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x6cc], eax
jl 0x1000cafe
mov dword [ebp - 0x49c], 1
jmp 0x1000cb05
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x49c], eax
jl 0x1000cb1f
mov dword [ebp - 0x4a4], 1
jmp 0x1000cb26
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x874]
imul eax, dword [ebp - 0x4a4]
cmp eax, dword [ebp - 0xe4]
jle 0x1000cb50
mov eax, 0x2cb566e6
test eax, eax
je 0x1000cb50
mov dword [ebp - 0x6d4], 1
jmp 0x1000cb57
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x6d4], eax
jne 0x1000cb71
mov dword [ebp - 0x4ac], 1
jmp 0x1000cb78
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x4ac]
cmp eax, dword [ebp - 0xd4]
jle 0x1000cb99
mov dword [ebp - 0x7ec], 1
jmp 0x1000cba0
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x7ec], eax
jg 0x1000cbba
mov dword [ebp - 0x4bc], 1
jmp 0x1000cbc1
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x6dc]
neg eax
cmp eax, dword [ebp - 0x4bc]
jge 0x1000cbe9
mov dword [ebp - 0xb00], 1
jmp 0x1000cbf0
and dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xdf8], eax
imul eax, dword [ebp - 0x194], 0x3555
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x8bc]
add eax, 0x3b02
cmp dword [ebp - 0x234], eax
jl 0x1000cc31
mov dword [ebp - 0x6e4], 1
jmp 0x1000cc38
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x978]
cmp dword [ebp - 0x7f4], eax
je 0x1000cc52
mov dword [ebp - 0x4c4], 1
jmp 0x1000cc59
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x1d0]
add eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0xaa0]
jne 0x1000cc79
mov dword [ebp - 0x980], 1
jmp 0x1000cc80
and dword [ebp - 0x980], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xfc4]
mov dword [ebp - 0xe00], eax
push 3
lea ecx, [ebp - 0xe20]
call fcn.10018198
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ebp - 0x6e4]
imul edx, dword [ecx]
mov ecx, dword [ebp - 0x32c]
mov ecx, dword [ecx]
dec ecx
mov esi, dword [ebp - 0x32c]
mov dword [esi], ecx
cmp edx, eax
jle 0x1000cce1
mov eax, 0x98b9db5d
test eax, eax
jne 0x1000cce1
and dword [ebp - 0x4cc], 0
jmp 0x1000cceb
mov dword [ebp - 0x4cc], 1
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x7f4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe20]
call fcn.10018193
jmp 0x1000c991
mov dword [ebp - 0xf10], 0x10083834
mov dword [ebp - 0xb80], 0x2d5e48d3
mov dword [ebp - 0xb7c], 0x2d5e48d3
mov dword [ebp - 0xb78], 0x2d5e48d3
mov dword [ebp - 0xb74], 0x2d5e48d3
mov dword [ebp - 0x28c], 7
mov dword [ebp - 0x2dc], 0x6ab2aee5
mov dword [ebp - 0x17c], 6
mov dword [ebp - 0x514], 0x19adb821
mov dword [ebp - 0xb08], 0xffffffff
mov dword [ebp - 0xaac], 0x74d2d97b
mov dword [ebp - 0x28c], 3
jmp 0x1000cd92
mov eax, dword [ebp - 0x28c]
dec eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jl 0x1000d26b
mov dword [ebp - 0xf4], 0xfffffffe
mov dword [ebp - 0xf18], 0x8213af72
mov dword [ebp - 0x4d4], 1
mov dword [ebp - 0x7c], 0
jmp 0x1000cdcd
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1000cde3
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x8e8], 0xfffffff7
jmp 0x1000cdc6
mov dword [ebp - 0x7c], 0
jmp 0x1000cdf3
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1000ce09
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x1dc], 0x66c1932e
jmp 0x1000cdec
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8e8], 3
jmp 0x1000ce37
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8e8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8e8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8e8], 0
jl 0x1000ce71
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x1000ce6f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
jmp 0x1000ce1c
mov dword [ebp - 0xf4], 0
jmp 0x1000ce8a
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 3
jg 0x1000d1b6
push 2
lea ecx, [ebp - 0xa8c]
call fcn.1001810a
mov dword [ebp - 4], 0xa
push 3
lea ecx, [ebp - 0xbe0]
call fcn.1001810a
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xb4], 0
jmp 0x1000ced5
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x1000cef7
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xa8c]
call fcn.10018198
mov dword [eax], 0xba47
jmp 0x1000cec8
mov dword [ebp - 0xb4], 0
jmp 0x1000cf10
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1000cf32
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xbe0]
call fcn.10018198
mov dword [eax], 1
jmp 0x1000cf03
mov eax, dword [ebp - 0x4d4]
dec eax
mov dword [ebp - 0x4d4], eax
mov esi, dword [ebp - 0x2dc]
push 0
lea ecx, [ebp - 0xbe0]
call fcn.10018198
cmp esi, dword [eax]
je 0x1000cf62
mov dword [ebp - 0x7fc], 1
jmp 0x1000cf69
and dword [ebp - 0x7fc], 0
cmp dword [ebp - 0xb08], 0xffffffff
jl 0x1000cf7e
mov dword [ebp - 0x6ec], 1
jmp 0x1000cf85
and dword [ebp - 0x6ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc]
cmp eax, dword [ebp - 0x6ec]
jle 0x1000cfa6
mov dword [ebp - 0x4dc], 1
jmp 0x1000cfad
and dword [ebp - 0x4dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc]
cmp dword [ebp - 0x4dc], eax
jge 0x1000cfce
mov dword [ebp - 0x87c], 1
jmp 0x1000cfd5
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
shl eax, 3
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1dc]
mov ecx, dword [ebp - 0xf4]
cmp eax, dword [ebp + ecx*4 - 0xb80]
jne 0x1000d006
mov dword [ebp - 0x988], 1
jmp 0x1000d00d
and dword [ebp - 0x988], 0
push 1
lea ecx, [ebp - 0xa8c]
call fcn.10018198
push 1
lea ecx, [ebp - 0xa8c]
call fcn.10018198
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf20], eax
push 1
lea ecx, [ebp - 0xbe0]
call fcn.10018198
cmp dword [eax], 0x3298
jle 0x1000d05a
cmp dword [ebp - 0x514], 0
jne 0x1000d05a
and dword [ebp - 0x4e4], 0
jmp 0x1000d064
mov dword [ebp - 0x4e4], 1
push 1
lea ecx, [ebp - 0xa8c]
call fcn.10018198
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [eax]
jge 0x1000d087
mov dword [ebp - 0x6f4], 1
jmp 0x1000d08e
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x6f4], 0xfffffffc
jae 0x1000d0a3
mov dword [ebp - 0x4ec], 1
jmp 0x1000d0aa
and dword [ebp - 0x4ec], 0
imul eax, dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x7fc], eax
jg 0x1000d0c5
mov dword [ebp - 0x4f4], 1
jmp 0x1000d0cc
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0x7fad
je 0x1000d0e4
mov dword [ebp - 0x6fc], 1
jmp 0x1000d0eb
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp + eax*4 - 0xb80]
add eax, dword [ebp - 0x6fc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1dc]
jge 0x1000d119
mov dword [ebp - 0x4fc], 1
jmp 0x1000d120
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 4
jne 0x1000d135
mov dword [ebp - 0xb10], 1
jmp 0x1000d13c
and dword [ebp - 0xb10], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8e8], 0xfffffffc
jne 0x1000d158
mov dword [ebp - 0x910], 1
jmp 0x1000d15f
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp + eax*4 - 0xb80]
cmp eax, dword [ebp - 0x910]
jne 0x1000d180
mov dword [ebp - 0x504], 1
jmp 0x1000d187
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2dc], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xbe0]
call fcn.10018193
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8c]
call fcn.10018193
jmp 0x1000ce7d
mov dword [ebp - 0x17c], 0
jmp 0x1000d1cf
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jg 0x1000d266
mov dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp + eax*4 - 0xb80], 0
je 0x1000d20b
mov eax, 0x77fc3fe7
test eax, eax
je 0x1000d20b
mov dword [ebp - 0x704], 1
jmp 0x1000d212
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x17c]
add eax, dword [ebp - 0x704]
cmp eax, 3
ja 0x1000d22f
mov dword [ebp - 0x50c], 1
jmp 0x1000d236
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 0x4d257e7e
jg 0x1000d24e
mov dword [ebp - 0x804], 1
jmp 0x1000d255
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x990], eax
jmp 0x1000d1c2
jmp 0x1000cd85
mov eax, dword [ebp - 0x514]
imul eax, dword [ebp - 0x2dc]
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x314], 7
mov dword [ebp - 0x2e4], 0x20dd
mov dword [ebp - 0xc5c], 7
mov dword [ebp - 0xc58], 7
mov dword [ebp - 0xc54], 7
mov dword [ebp - 0xc50], 7
lea ecx, [ebp - 0x321]
call fcn.1000a663
push eax
lea eax, [ebp - 0xc4c]
push eax
lea eax, [ebp - 0xc5c]
push eax
lea ecx, [ebp - 0x1038]
call fcn.100181a7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe30]
call fcn.10018169
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x38], 0
jmp 0x1000d30d
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xf
je 0x1000d40e
mov dword [ebp - 0x15c], 4
mov dword [ebp - 0x9a0], 0xffffffff
mov dword [ebp - 0x15c], 0
jmp 0x1000d344
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xfffffffc
jge 0x1000d409
mov dword [ebp - 0xaf4], 0xa9bca7b5
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xf28], eax
cmp dword [ebp - 0x15c], 0
je 0x1000d381
xor eax, eax
inc eax
je 0x1000d381
mov dword [ebp - 0x70c], 1
jmp 0x1000d388
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x70c]
lea eax, [ecx + eax - 0x2eb32b6b]
cmp eax, dword [ebp - 0x314]
jle 0x1000d3ac
mov dword [ebp - 0x51c], 1
jmp 0x1000d3b3
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x51c], eax
jl 0x1000d3ca
mov dword [ebp - 0x884], 1
jmp 0x1000d3d1
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x884], eax
je 0x1000d3e8
mov dword [ebp - 0x998], 1
jmp 0x1000d3ef
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xf30], eax
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0x9a0], eax
jmp 0x1000d337
jmp 0x1000d306
mov dword [ebp - 0x38], 0xffffffe3
jmp 0x1000d41e
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x14
jg 0x1000d52c
mov dword [ebp - 0x19c], 0x8aac1e0f
mov dword [ebp - 0x9a8], 0xa7967268
cmp dword [ebp - 0x2e4], 0
je 0x1000d4f1
cmp dword [ebp - 0x19c], 0
je 0x1000d45b
cmp dword [ebp - 0x314], 0
jne 0x1000d49e
mov eax, 0xa3a6
sub eax, dword [ebp - 0x19c]
mov dword [ebp - 0x524], eax
push 2
lea ecx, [ebp - 0xe30]
call fcn.10018198
mov ecx, dword [ebp - 0x524]
mov dword [eax], ecx
mov eax, dword [ebp - 0x524]
sub eax, dword [ebp - 0x2e4]
cmp eax, dword [ebp - 0x19c]
jg 0x1000d49e
and dword [ebp - 0x714], 0
jmp 0x1000d4a8
mov dword [ebp - 0x714], 1
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x714], eax
jl 0x1000d4c2
mov dword [ebp - 0xab4], 1
jmp 0x1000d4c9
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0xf40], eax
xor eax, eax
je 0x1000d4f1
mov dword [ebp - 0x52c], 1
jmp 0x1000d4f8
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0xffffffff
je 0x1000d50d
mov dword [ebp - 0x80c], 1
jmp 0x1000d514
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x19c]
imul eax, dword [ebp - 0x80c]
mov dword [ebp - 0x9a8], eax
jmp 0x1000d417
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe30]
call fcn.10018193
mov dword [ebp - 0xf48], 0x10083838
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x174], 0xfffffff5
jmp 0x1000d568
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0xffffffe7
jle 0x1000d7a0
mov dword [ebp - 0xa8], 1
cmp dword [ebp - 0x174], 0xea6801fc
jbe 0x1000d597
mov dword [ebp - 0x534], 1
jmp 0x1000d59e
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
inc eax
je 0x1000d702
mov dword [ebp - 0x71c], 0xdbbe5689
push 2
lea ecx, [ebp - 0xbc8]
call fcn.1001810a
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xabc], 0xebbd4856
mov dword [ebp - 0x1e0], 0
jmp 0x1000d5ec
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jge 0x1000d60b
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0xbc8]
call fcn.10018198
or dword [eax], 0xffffffff
jmp 0x1000d5df
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0xf50], eax
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0xb70], eax
push 1
lea ecx, [ebp - 0xbc8]
call fcn.10018198
mov ecx, dword [ebp - 0xb70]
mov dword [eax], ecx
cmp dword [ebp - 0xa8], 0x5714ffd8
je 0x1000d650
mov dword [ebp - 0x9b0], 1
jmp 0x1000d657
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xf58], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xf60], eax
mov esi, dword [ebp - 0xa8]
push 1
lea ecx, [ebp - 0xbc8]
call fcn.10018198
cmp esi, dword [eax]
jne 0x1000d692
mov dword [ebp - 0x53c], 1
jmp 0x1000d699
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x174]
cmp eax, dword [ebp - 0x53c]
jl 0x1000d6b3
mov dword [ebp - 0x8c4], 1
jmp 0x1000d6ba
and dword [ebp - 0x8c4], 0
cmp dword [ebp - 0x8c4], 0xe360
jl 0x1000d6d8
mov eax, 0x4131
test eax, eax
jne 0x1000d6d8
and dword [ebp - 0x544], 0
jmp 0x1000d6e2
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0xabc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc8]
call fcn.10018193
jmp 0x1000d79b
push 2
lea ecx, [ebp - 0xca8]
call fcn.1001810a
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x1e8], 0
jmp 0x1000d72f
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jge 0x1000d751
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0xca8]
call fcn.10018198
mov dword [eax], 0x963ec58f
jmp 0x1000d722
mov dword [ebp - 0xa8], 0
jmp 0x1000d76a
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1000d78c
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xca8]
call fcn.10018198
mov dword [eax], 0x7f39cee2
jmp 0x1000d75d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca8]
call fcn.10018193
jmp 0x1000d55b
mov dword [ebp - 0xbc], 0xffffffff
mov dword [ebp - 0xc0], 0xfffffff7
mov dword [ebp - 0x50], 0x5b8b78ac
mov dword [ebp - 0x574], 0x8b15
mov dword [ebp - 0x56c], 0xccc0
mov dword [ebp - 0x208], 1
mov dword [ebp - 0xf78], 1
mov dword [ebp - 0xac4], 0
mov dword [ebp - 0x9c8], 0xe2efaada
mov dword [ebp - 0xf80], 9
cmp dword [ebp - 0xbc], 0
jne 0x1000d816
mov dword [ebp - 0x9b8], 1
jmp 0x1000d81d
and dword [ebp - 0x9b8], 0
cmp dword [ebp - 0xbc], 0
je 0x1000d875
cmp dword [ebp - 0xbc], 0
jne 0x1000d841
mov eax, 0x3de0369b
test eax, eax
jne 0x1000d841
and dword [ebp - 0x724], 0
jmp 0x1000d84b
mov dword [ebp - 0x724], 1
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
je 0x1000d875
mov eax, 0x14a9bacd
test eax, eax
je 0x1000d875
mov dword [ebp - 0xafc], 1
jmp 0x1000d87c
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xf6c], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x574], eax
mov eax, 0x64a90c6d
test eax, eax
je 0x1000d8b8
mov dword [ebp - 0x50], 0x9642e40c
jmp 0x1000d91f
mov dword [ebp - 0x1f0], 0
jmp 0x1000d8d1
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x1000d8ed
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0xfd0], 0x64d64ea3
jmp 0x1000d8c4
mov byte [ebp - 0x11c], 0
movzx eax, byte [ebp - 0x11c]
test eax, eax
je 0x1000d90c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbc]
mov dword [ebp + eax - 0xfd0], ecx
mov dword [ebp - 0x50], 0x17
jmp 0x1000d92f
cmp dword [ebp - 0x50], 0xfffffff4
je 0x1000dca2
mov dword [ebp - 0x1a4], 0x84cbf776
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x584], 0xb53cf54
mov dword [ebp - 0xf64], 1
mov dword [ebp - 0xf34], 0xffffffff
mov dword [ebp - 0xc84], 0xe410
mov dword [ebp - 0xc80], 0xe410
mov dword [ebp - 0xc7c], 0xe410
mov dword [ebp - 0xc78], 0xe410
lea ecx, [ebp - 0x2a9]
call fcn.1000a663
push eax
lea eax, [ebp - 0xc74]
push eax
lea eax, [ebp - 0xc84]
push eax
lea ecx, [ebp - 0x1050]
call fcn.100181a7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe40]
call fcn.10018169
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x1f8], 0
jmp 0x1000d9e8
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x1000da04
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0xfe8], 0xfffffff6
jmp 0x1000d9db
cmp dword [ebp - 0xc0], 0x4595a2e7
je 0x1000da1c
mov dword [ebp - 0x734], 1
jmp 0x1000da23
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x50], 0
jne 0x1000da35
mov dword [ebp - 0x554], 1
jmp 0x1000da3c
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x208], eax
jl 0x1000da74
cmp dword [ebp - 0x208], 0
je 0x1000da74
cmp dword [ebp - 0xc0], 0
je 0x1000da74
mov dword [ebp - 0x54c], 1
jmp 0x1000da7b
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x54c], eax
jl 0x1000da95
mov dword [ebp - 0x814], 1
jmp 0x1000da9c
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x814], eax
jl 0x1000dab6
mov dword [ebp - 0x72c], 1
jmp 0x1000dabd
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x554]
imul eax, dword [ebp - 0x72c]
cmp eax, dword [ebp - 0xbc]
jle 0x1000dae7
mov eax, 0x2cb566e6
test eax, eax
je 0x1000dae7
mov dword [ebp - 0x55c], 1
jmp 0x1000daee
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x55c], eax
jne 0x1000db08
mov dword [ebp - 0x88c], 1
jmp 0x1000db0f
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x88c]
cmp eax, dword [ebp - 0xc0]
jle 0x1000db30
mov dword [ebp - 0x564], 1
jmp 0x1000db37
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x564], eax
jg 0x1000db51
mov dword [ebp - 0x81c], 1
jmp 0x1000db58
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x56c]
neg eax
cmp eax, dword [ebp - 0x81c]
jge 0x1000db80
mov dword [ebp - 0x9c0], 1
jmp 0x1000db87
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xd30], eax
imul eax, dword [ebp - 0x1a4], 0x3555
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x574]
add eax, 0x3b02
cmp dword [ebp - 0x200], eax
jl 0x1000dbc8
mov dword [ebp - 0x57c], 1
jmp 0x1000dbcf
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0xac4]
cmp dword [ebp - 0x584], eax
je 0x1000dbe9
mov dword [ebp - 0x73c], 1
jmp 0x1000dbf0
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x208]
add eax, dword [ebp - 0x73c]
cmp eax, dword [ebp - 0x9c8]
jne 0x1000dc10
mov dword [ebp - 0xb34], 1
jmp 0x1000dc17
and dword [ebp - 0xb34], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xfe8]
mov dword [ebp - 0xd34], eax
push 3
lea ecx, [ebp - 0xe40]
call fcn.10018198
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x33c]
mov edx, dword [ebp - 0x57c]
imul edx, dword [ecx]
mov ecx, dword [ebp - 0x33c]
mov ecx, dword [ecx]
dec ecx
mov esi, dword [ebp - 0x33c]
mov dword [esi], ecx
cmp edx, eax
jle 0x1000dc78
mov dword [ebp - 0x9d0], 0xfffffffb
mov dword [ebp - 0xc8], 0xffffffff
mov dword [ebp - 0x824], 1
mov dword [ebp - 0x88], 0
jmp 0x1000dcd9
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x1000dcf5
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xd10], 0xa136951a
jmp 0x1000dccc
mov dword [ebp - 0x88], 0
jmp 0x1000dd0e
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1000dd2a
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x1000], 0xd1b9849b
jmp 0x1000dd01
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x1000dd52
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd10], 0
jne 0x1000ddfa
mov eax, dword [ebp - 0x9d0]
mov dword [ebp - 0xc8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd10]
cmp eax, dword [ebp - 0xc8]
jg 0x1000dd93
mov dword [ebp - 0xacc], 1
jmp 0x1000dd9a
and dword [ebp - 0xacc], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xd10]
cmp dword [ebp + eax - 0xd10], ecx
jne 0x1000ddc2
mov dword [ebp - 0x744], 1
jmp 0x1000ddc9
and dword [ebp - 0x744], 0
cmp dword [ebp - 0x744], 0x7d0fa516
jne 0x1000dde1
mov dword [ebp - 0x9d8], 1
jmp 0x1000dde8
and dword [ebp - 0x9d8], 0
cmp dword [ebp - 0xc8], 0
jne 0x1000ddfa
and dword [ebp - 0x58c], 0
jmp 0x1000de04
mov dword [ebp - 0x58c], 1
cmp dword [ebp - 0x58c], 0
je 0x1000de9c
mov dword [ebp - 0xe88], 0xd9cd
mov dword [ebp - 0xd3c], 1
mov dword [ebp - 0xedc], 0x75cb5542
push 3
lea ecx, [ebp - 0xe50]
call fcn.1001810a
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x210], 0
jmp 0x1000de5c
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x1000de7e
push dword [ebp - 0x210]
lea ecx, [ebp - 0xe50]
call fcn.10018198
mov dword [eax], 0x7b445ace
jmp 0x1000de4f
mov eax, dword [ebp - 0x824]
dec eax
mov dword [ebp - 0x824], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe50]
call fcn.10018193
jmp 0x1000def6
mov dword [ebp - 0xc8], 2
jmp 0x1000deb5
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x1000def6
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x1000dee2
push 0xfbc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov eax, dword [ebp - 0xc8]
cmp dword [ebp + eax*4 - 0x1000], 0
je 0x1000def4
jmp 0x1000def6
jmp 0x1000dea8
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0x58], 0xff14eb4c
mov dword [ebp - 0x31c], 0xe96bb645
mov dword [ebp - 0x2f4], 0x7b4d2c29
push 3
lea ecx, [ebp - 0x938]
call fcn.1001810a
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x2ec], 0xedbec151
mov dword [ebp - 0x164], 0x1d4416da
mov dword [ebp - 0xd44], 0x9aae
mov dword [ebp - 0xa0], 0
jmp 0x1000df66
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x1000df7f
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x18], 0x7c203980
jmp 0x1000df59
mov dword [ebp - 0xa0], 0
jmp 0x1000df98
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1000dfb7
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x938]
call fcn.10018198
or dword [eax], 0xffffffff
jmp 0x1000df8b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x18]
inc ecx
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0x18], ecx
test eax, eax
jne 0x1000dff7
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1000dfee
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0
jne 0x1000dff7
and dword [ebp - 0x74c], 0
jmp 0x1000e001
mov dword [ebp - 0x74c], 1
mov dword [ebp - 0xd0], 0x3c39
cmp dword [ebp - 0xd0], 4
jb 0x1000e020
mov dword [ebp - 0xb04], 1
jmp 0x1000e027
and dword [ebp - 0xb04], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
je 0x1000e03b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret