Function at 0x1001f3d6
Capabilities:
Create pipe
Enumerate pe sections
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10021a2f
mov dword [ebp - 0x20], 0
jmp 0x1001f3fb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1001f411
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x480], 0xffffffff
jmp 0x1001f3f4
mov dword [ebp - 0x20], 0
jmp 0x1001f421
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1001f437
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x34c], 0xfebaeef2
jmp 0x1001f41a
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x34c], 0
jmp 0x1001f462
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x34c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x34c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x34c], 3
jg 0x1001f595
mov dword [ebp - 0x360], 0xfffffff8
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x34c]
cmp dword [ebp + eax*4 - 0x480], 0xffff
ja 0x1001f4a4
mov dword [ebp - 0x23c], 1
jmp 0x1001f4ab
and dword [ebp - 0x23c], 0
cmp dword [ebp - 0x23c], 0x9e923e64
jne 0x1001f4c3
mov dword [ebp - 0x298], 1
jmp 0x1001f4ca
and dword [ebp - 0x298], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x34c]
cmp dword [ebp + eax*4 - 0x480], 0xfffffffb
jne 0x1001f4f3
push 6
pop eax
test eax, eax
je 0x1001f4f3
mov dword [ebp - 0x290], 1
jmp 0x1001f4fa
and dword [ebp - 0x290], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x34c]
mov eax, dword [ebp + eax*4 - 0x480]
cmp dword [ebp - 0x290], eax
je 0x1001f521
mov dword [ebp - 0x140], 1
jmp 0x1001f528
and dword [ebp - 0x140], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x34c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x34c]
add ecx, dword [ebp - 0x140]
cmp dword [ebp + eax*4 - 0x480], ecx
jg 0x1001f55c
mov dword [ebp - 0x148], 1
jmp 0x1001f563
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0x148]
je 0x1001f57d
mov dword [ebp - 0x2a0], 1
jmp 0x1001f584
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x360], eax
jmp 0x1001f449
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x4a4], 0x748f69f7
mov dword [ebp - 0xf4], 0
jmp 0x1001f5c1
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x1001f5dd
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x35c], 6
jmp 0x1001f5b4
mov byte [ebp - 0x5a], 0
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x1001f5f8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x35c], 0xffffffef
jmp 0x1001f626
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x35c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x35c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x35c], 0xfffffff8
je 0x1001f64d
mov dword [ebp - 0x370], 1
cmp dword [ebp - 0x370], 0
je 0x1001f64b
jmp 0x1001f64d
jmp 0x1001f60b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x500], 0
mov dword [ebp - 0x4d0], 0xd5181448
mov dword [ebp - 0x518], 0x13297949
mov dword [ebp - 0x4d8], 0xf39ab1b5
mov dword [ebp - 0x110], 0xfffe
mov dword [ebp - 0x38], 0
jmp 0x1001f6b2
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1001f6c8
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x384], 0x81d4b4ea
jmp 0x1001f6ab
mov dword [ebp - 0x38], 0
jmp 0x1001f6d8
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1001f6ee
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x56c], 0xa6c15a2d
jmp 0x1001f6d1
mov dword [ebp - 0x60], 0
jmp 0x1001f6fe
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jg 0x1001faf3
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x124], 1
mov dword [ebp - 0x2d8], 0x38aa138
mov dword [ebp - 0xac], 0
jmp 0x1001f73c
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x1001f758
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x41c], 0x7f3c88fe
jmp 0x1001f72f
mov dword [ebp - 0x48], 0xffffffee
jmp 0x1001f768
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x19
jne 0x1001fadf
mov dword [ebp - 0x378], 0xfffffff9
mov dword [ebp - 0x508], 0xa4abff1e
mov dword [ebp - 0x3f0], 0x169ff9e
mov dword [ebp - 0x3ec], 0x169ff9e
mov dword [ebp - 0x3e8], 0x169ff9e
mov dword [ebp - 0x3e4], 0x169ff9e
mov dword [ebp - 0x3dc], 0xffffffff
mov dword [ebp - 0x4e0], 0
mov dword [ebp - 0x4a0], 0xc5bb
cmp dword [ebp - 0x48], 0
je 0x1001f9c4
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1001f9c4
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0x110], eax
jge 0x1001f813
mov dword [ebp - 0x150], 1
jmp 0x1001f81a
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x150]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x3f0]
jge 0x1001f842
mov dword [ebp - 0x3b4], 1
jmp 0x1001f849
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x488], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3f0], 0x572dbe42
jle 0x1001f873
mov dword [ebp - 0x2a8], 1
jmp 0x1001f87a
and dword [ebp - 0x2a8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3f0]
cmp dword [ebp - 0x2a8], eax
jl 0x1001f89b
mov dword [ebp - 0x158], 1
jmp 0x1001f8a2
and dword [ebp - 0x158], 0
cmp dword [ebp - 0x158], 0
jge 0x1001f8b2
cmp dword [ebp - 0x2d8], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x41c], 0
je 0x1001f8d6
mov eax, 0xa04a8f9b
test eax, eax
je 0x1001f8d6
mov dword [ebp - 0x2b0], 1
jmp 0x1001f8dd
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2b0], eax
jne 0x1001f8f4
mov dword [ebp - 0x160], 1
jmp 0x1001f8fb
and dword [ebp - 0x160], 0
cmp dword [ebp - 0x160], 1
ja 0x1001f910
mov dword [ebp - 0x2b8], 1
jmp 0x1001f917
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x2b8], eax
jl 0x1001f934
cmp dword [ebp - 0x48], 0
je 0x1001f934
mov dword [ebp - 0x168], 1
jmp 0x1001f93b
and dword [ebp - 0x168], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x41c]
cmp dword [ebp - 0x168], eax
jl 0x1001f95c
mov dword [ebp - 0x2c0], 1
jmp 0x1001f963
and dword [ebp - 0x2c0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2c0]
mov dword [ebp + eax - 0x56c], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3f0]
add eax, dword [ebp - 0x10c]
je 0x1001f997
mov dword [ebp - 0x170], 1
jmp 0x1001f99e
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x170]
add eax, 0x51f5ed1a
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x384]
jne 0x1001f9c4
mov dword [ebp - 0x2c8], 1
jmp 0x1001f9cb
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x2c8], eax
jne 0x1001f9e2
mov dword [ebp - 0x178], 1
jmp 0x1001f9e9
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x178]
jle 0x1001fa03
mov dword [ebp - 0x2d0], 1
jmp 0x1001fa0a
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x384]
cmp dword [ebp - 0x2d0], eax
jge 0x1001fa2b
mov dword [ebp - 0x180], 1
jmp 0x1001fa32
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x180]
sub eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x188], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x188]
mov dword [ebp + eax - 0x41c], ecx
mov eax, dword [ebp - 0x2d8]
imul eax, dword [ebp - 0x188]
neg eax
jne 0x1001fa79
cmp dword [ebp - 0x124], 0
jne 0x1001fa79
and dword [ebp - 0x2e0], 0
jmp 0x1001fa83
mov dword [ebp - 0x2e0], 1
imul eax, dword [ebp - 0x2e0], 0xeb3d
test eax, eax
je 0x1001fab3
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x1001fab1
push 0
push 0x162f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
jmp 0x1001fada
mov byte [ebp - 0x58], 0
movzx eax, byte [ebp - 0x58]
test eax, eax
je 0x1001fac5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x384], 0
je 0x1001fada
jmp 0x1001f761
jmp 0x1001f761
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x48]
mov dword [ebp + eax - 0x41c], ecx
jmp 0x1001f6f7
mov dword [ebp - 0xc], 0x8a137b18
mov dword [ebp - 0x2f8], 0x187110e6
mov dword [ebp - 0xb4], 0x9740826f
mov dword [ebp - 0x28], 0
jmp 0x1001fb1e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1001fb34
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x43c], 0x58900fdb
jmp 0x1001fb17
mov dword [ebp - 0x28], 0
jmp 0x1001fb44
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1001fb5a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x330], 1
jmp 0x1001fb3d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jne 0x1001fb80
mov dword [ebp - 0x198], 1
jmp 0x1001fb87
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0xc]
neg eax
mov dword [ebp - 0x190], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x190]
mov dword [ebp + eax - 0x43c], ecx
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
cmp eax, dword [ebp - 0x198]
je 0x1001fbcb
mov dword [ebp - 0x300], 1
jmp 0x1001fbd2
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 0
jae 0x1001fbe7
mov dword [ebp - 0x1a0], 1
jmp 0x1001fbee
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x1a0], eax
jle 0x1001fc05
mov dword [ebp - 0x308], 1
jmp 0x1001fc0c
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x308]
cmp eax, dword [ebp - 0xb4]
jne 0x1001fc29
mov dword [ebp - 0x1a8], 1
jmp 0x1001fc30
and dword [ebp - 0x1a8], 0
cmp dword [ebp - 0x1a8], 0x4257
jne 0x1001fc48
mov dword [ebp - 0x310], 1
jmp 0x1001fc4f
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x310], eax
jg 0x1001fc69
mov dword [ebp - 0x1b0], 1
jmp 0x1001fc70
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xb4], eax
jg 0x1001fc93
mov dword [ebp - 0x318], 1
jmp 0x1001fc9a
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 0x2e4ed383
jge 0x1001fcb2
mov dword [ebp - 0x1b8], 1
jmp 0x1001fcb9
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x1b8], eax
jg 0x1001fcd0
mov dword [ebp - 0x320], 1
jmp 0x1001fcd7
and dword [ebp - 0x320], 0
imul eax, dword [ebp - 0x320], 0x47e0
test eax, eax
jne 0x1001fcf7
mov eax, 0xa8f1
test eax, eax
jne 0x1001fcf7
and dword [ebp - 0x1c0], 0
jmp 0x1001fd01
mov dword [ebp - 0x1c0], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c0]
jne 0x1001fd18
mov dword [ebp - 0x328], 1
jmp 0x1001fd1f
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
add eax, 0xedb6
cmp eax, dword [ebp - 0xc]
jg 0x1001fd3b
mov dword [ebp - 0x1c8], 1
jmp 0x1001fd42
and dword [ebp - 0x1c8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp + eax - 0x330], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x330]
mov dword [ebp + ecx - 0x43c], eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x31c], 0xfffffff9
mov dword [ebp - 0x100], 0
jmp 0x1001fd99
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x1001fdb5
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x33c], 1
jmp 0x1001fd8c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x33c]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 2
jmp 0x1001fdd4
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x100209dd
mov dword [ebp - 0x84], 0xb8faaaeb
mov dword [ebp - 0x90], 8
mov dword [ebp - 0xbc], 0
jmp 0x1001fe0b
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x1001fe27
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x11c], 1
jmp 0x1001fdfe
mov dword [ebp - 0x90], 0
jmp 0x1001fe40
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x1001fea5
mov dword [ebp - 0x94], 0x8a137b18
mov dword [ebp - 0x94], 0
jmp 0x1001fe6c
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1001fe89
mov eax, dword [ebp - 0x94]
cmp dword [ebp + eax*4 - 0x11c], 0
je 0x1001fe87
jmp 0x1001fe89
jmp 0x1001fe5f
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp + ecx*4 - 0x11c], eax
jmp 0x1001fe33
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x1001feb9
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xf8], 0
jmp 0x1001fed2
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jge 0x1001feee
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x388], 0x2b2faa96
jmp 0x1001fec5
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x33c], 0
je 0x1001ff00
jmp 0x100209dd
mov dword [ebp - 0x84], 2
jmp 0x1001ff19
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x100209d8
mov dword [ebp - 0x10], 0xbe1d925b
mov dword [ebp - 0x12c], 0xfffffffa
mov dword [ebp - 0x2f0], 0x2bf5f40e
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x36c], 1
mov dword [ebp - 0xc4], 0
jmp 0x1001ff6b
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x1001ff87
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x470], 0x77cccaea
jmp 0x1001ff5e
mov dword [ebp - 0x10], 0x8261f9c2
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
je 0x1001ffa2
mov dword [ebp - 0x2ec], 1
jmp 0x1001ffa9
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2ec], eax
jl 0x1001ffc0
mov dword [ebp - 0x1d4], 1
jmp 0x1001ffc7
and dword [ebp - 0x1d4], 0
cmp dword [ebp - 0x1d4], 0xffff
ja 0x1001ffdf
mov dword [ebp - 0x28c], 1
jmp 0x1001ffe6
and dword [ebp - 0x28c], 0
imul eax, dword [ebp - 0x28c], 0xa5ea
cmp eax, dword [ebp - 0x10]
jge 0x10020001
mov dword [ebp - 0x368], 1
jmp 0x10020008
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp - 0x2f0]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x470]
neg eax
cmp eax, dword [ebp - 0x7c]
jg 0x10020046
mov dword [ebp - 0x1dc], 1
jmp 0x1002004d
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x10]
sub eax, 9
cmp eax, dword [ebp - 0x2f0]
je 0x1002006d
mov dword [ebp - 0x1e4], 1
jmp 0x10020074
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x1e4]
add eax, ecx
je 0x10020096
cmp dword [ebp - 0x10], 0
je 0x10020096
mov dword [ebp - 0x294], 1
jmp 0x1002009d
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0x294], eax
jge 0x100200b7
mov dword [ebp - 0x1ec], 1
jmp 0x100200be
and dword [ebp - 0x1ec], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1ec]
sub ecx, dword [ebp + eax - 0x470]
je 0x100200ea
mov dword [ebp - 0x3c0], 0x791f9e6a
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x12c], eax
jmp 0x10020110
mov dword [ebp - 0x7c], 0
jmp 0x100200fa
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x10020110
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x470], 0x4d4e2095
jmp 0x100200f3
mov dword [ebp - 8], 0x55595070
mov dword [ebp - 0x2dc], 0x3b83
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x108], 0
jmp 0x10020144
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x10020160
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x560], 0x48bb
jmp 0x10020137
mov dword [ebp - 0x9c], 0
jmp 0x10020179
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x10020195
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x560], 1
jmp 0x1002016c
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x100201bc
push 0x19d8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov dword [ebp - 0xcc], 0
jmp 0x100201d5
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x100201f1
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x39c], 0xfffffffd
jmp 0x100201c8
mov dword [ebp - 8], 2
jmp 0x10020201
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x100209d3
mov dword [ebp - 0x98], 0
mov dword [ebp - 0xf0], 0xd4e06482
mov dword [ebp - 0x88], 0x116e074f
mov dword [ebp - 0x40], 0
jmp 0x10020239
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1002024f
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x2e8], 0xffffffff
jmp 0x10020232
mov dword [ebp - 0x40], 0
jmp 0x1002025f
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x10020275
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x58c], 0x2e5664dc
jmp 0x10020258
mov dword [ebp - 0xf0], 0
jmp 0x1002028e
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xffffffff
je 0x10020339
mov dword [ebp - 0x4d4], 9
mov dword [ebp - 0x4dc], 0x7cccaea0
mov dword [ebp - 0x544], 4
mov dword [ebp - 0x540], 4
mov dword [ebp - 0x53c], 4
mov dword [ebp - 0x538], 4
mov dword [ebp - 0xd4], 0
jmp 0x100202f0
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jge 0x1002030c
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x4f4], 1
jmp 0x100202e3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2e8], eax
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
jmp 0x10020281
mov dword [ebp - 0x88], 0
jmp 0x10020352
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jg 0x10020374
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x10020372
push 0x20a2
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x10020345
mov dword [ebp - 0x32c], 0x73bf38c0
mov dword [ebp - 0x1f4], 8
mov dword [ebp - 0x20c], 0xfffe
mov dword [ebp - 0x2a4], 0xbffbefa5
mov dword [ebp - 0x114], 0xfffffffb
mov dword [ebp - 0x3d4], 1
mov dword [ebp - 0x30], 0
jmp 0x100203c0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x100203d6
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x428], 1
jmp 0x100203b9
mov dword [ebp - 0x30], 0
jmp 0x100203e6
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x100203fc
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x374], 0xfffffff6
jmp 0x100203df
mov dword [ebp - 0x1f4], 0xb101aae
cmp dword [ebp - 0x1f4], 0
je 0x1002042b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x428], 0
je 0x1002042b
mov dword [ebp - 0x29c], 1
jmp 0x10020432
and dword [ebp - 0x29c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x428]
cmp eax, dword [ebp - 0x29c]
jle 0x10020453
mov dword [ebp - 0x1fc], 1
jmp 0x1002045a
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x1fc], eax
jne 0x10020474
mov dword [ebp - 0x204], 1
jmp 0x1002047b
and dword [ebp - 0x204], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x428]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
sub eax, dword [ebp - 0x204]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x2a4], eax
jle 0x100204ba
mov dword [ebp - 0x2f4], 1
jmp 0x100204c1
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x2f4], eax
jge 0x100204db
mov dword [ebp - 0x214], 1
jmp 0x100204e2
and dword [ebp - 0x214], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x374]
cmp dword [ebp - 0x214], eax
jle 0x10020503
mov dword [ebp - 0x2ac], 1
jmp 0x1002050a
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x1002053b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x428], 0
je 0x1002053b
mov dword [ebp - 0x21c], 1
jmp 0x10020542
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x98], 2
jmp 0x10020567
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x100205d5
mov dword [ebp - 0xa4], 0xfffffffc
mov dword [ebp - 0xa4], 2
jmp 0x10020593
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x100205d3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x33c]
mov dword [ebp + ecx*4 - 0x33c], eax
mov byte [ebp - 0x51], 0
push 0x1049
push 0x682e
push 0x573e
lea eax, [ebp - 0x51]
push eax
push 0
call fcn.10022351
add esp, 0x14
jmp 0x10020586
jmp 0x1002055a
mov dword [ebp - 0x14], 0x8a137b18
mov dword [ebp - 0x224], 0x187110e6
mov dword [ebp - 0xdc], 0x9740826f
mov dword [ebp - 0x18], 0
jmp 0x10020600
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10020616
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x454], 0x58900fdb
jmp 0x100205f9
mov dword [ebp - 0x18], 0
jmp 0x10020626
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1002063c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x25c], 1
jmp 0x1002061f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jne 0x10020662
mov dword [ebp - 0x2b4], 1
jmp 0x10020669
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x14]
neg eax
mov dword [ebp - 0x314], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x314]
mov dword [ebp + eax - 0x454], ecx
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x2b4]
je 0x100206ad
mov dword [ebp - 0x22c], 1
jmp 0x100206b4
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 0
jae 0x100206c9
mov dword [ebp - 0x2fc], 1
jmp 0x100206d0
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2fc], eax
jle 0x100206e7
mov dword [ebp - 0x234], 1
jmp 0x100206ee
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0xdc]
jne 0x1002070b
mov dword [ebp - 0x2bc], 1
jmp 0x10020712
and dword [ebp - 0x2bc], 0
cmp dword [ebp - 0x2bc], 0x4257
jne 0x1002072a
mov dword [ebp - 0x134], 1
jmp 0x10020731
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x134], eax
jg 0x1002074b
mov dword [ebp - 0x324], 1
jmp 0x10020752
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xdc], eax
jg 0x10020775
mov dword [ebp - 0x244], 1
jmp 0x1002077c
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 0x2e4ed383
jge 0x10020794
mov dword [ebp - 0x2c4], 1
jmp 0x1002079b
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2c4], eax
jg 0x100207b2
mov dword [ebp - 0x24c], 1
jmp 0x100207b9
and dword [ebp - 0x24c], 0
imul eax, dword [ebp - 0x24c], 0x47e0
test eax, eax
jne 0x100207d9
mov eax, 0xa8f1
test eax, eax
jne 0x100207d9
and dword [ebp - 0x304], 0
jmp 0x100207e3
mov dword [ebp - 0x304], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x304]
jne 0x100207fa
mov dword [ebp - 0x254], 1
jmp 0x10020801
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x254]
add eax, 0xedb6
cmp eax, dword [ebp - 0x14]
jg 0x1002081d
mov dword [ebp - 0x2cc], 1
jmp 0x10020824
and dword [ebp - 0x2cc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2cc]
mov dword [ebp + eax - 0x25c], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x25c]
mov dword [ebp + ecx - 0x454], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x98]
cmp dword [ebp + eax*4 - 0x33c], ecx
jg 0x1002086f
mov dword [ebp - 0x27c], 1
jmp 0x10020876
and dword [ebp - 0x27c], 0
mov dword [ebp - 0x31c], 0xca77
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x33c]
neg eax
cmp dword [ebp - 0x31c], eax
jle 0x100208a2
mov dword [ebp - 0x26c], 1
jmp 0x100208a9
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x84], 0x31ea
jg 0x100208d3
mov dword [ebp - 0x264], 1
jmp 0x100208da
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x264], eax
jl 0x100208f1
mov dword [ebp - 0x2d4], 1
jmp 0x100208f8
and dword [ebp - 0x2d4], 0
imul eax, dword [ebp - 0x2d4], 0xdd3e
cmp eax, dword [ebp - 8]
jl 0x10020913
mov dword [ebp - 0x30c], 1
jmp 0x1002091a
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x26c]
cmp eax, dword [ebp - 0x30c]
jne 0x10020934
mov dword [ebp - 0x274], 1
jmp 0x1002093b
and dword [ebp - 0x274], 0
cmp dword [ebp - 0x274], 7
jne 0x10020953
cmp dword [ebp - 0x4c], 0
jne 0x10020953
and dword [ebp - 0x37c], 0
jmp 0x1002095d
mov dword [ebp - 0x37c], 1
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x33c]
mov dword [ebp - 0x398], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x398]
mov dword [ebp + eax - 0x388], ecx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0xbf81606d
jb 0x100209ad
mov dword [ebp - 0x2e4], 1
jmp 0x100209b4
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x27c]
imul eax, dword [ebp - 0x2e4]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x39c], eax
jmp 0x100201fa
jmp 0x1001ff0c
jmp 0x1001fdcd
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1d8], 0x44accb24
mov dword [ebp - 0x74], 0xfffe
mov dword [ebp - 0x8c], 0x5a83d87
mov dword [ebp - 0x524], 0x28451d77
mov dword [ebp - 0x1c], 0
jmp 0x10020a21
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10020a37
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x410], 0xaabecba2
jmp 0x10020a1a
mov dword [ebp - 0x1c], 0
jmp 0x10020a47
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10020a5d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x444], 0xd62e
jmp 0x10020a40
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x410], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x410]
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x1d8], 0
jne 0x10020ae7
push 4
pop eax
shl eax, 1
push 3
pop ecx
sub ecx, dword [ebp + eax - 0x410]
mov dword [ebp - 0x284], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x284]
mov dword [ebp + eax - 0x444], ecx
cmp dword [ebp - 0x284], 0
je 0x10020aca
cmp dword [ebp - 0x74], 0
je 0x10020aca
mov dword [ebp - 0x1cc], 1
jmp 0x10020ad1
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
sub eax, 0x7005
jne 0x10020ae7
and dword [ebp - 0x1d0], 0
jmp 0x10020af1
mov dword [ebp - 0x1d0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x410]
imul eax, dword [ebp - 0x1d0]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x410]
jl 0x10020b20
mov dword [ebp - 0x1e0], 1
jmp 0x10020b27
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x1e0], eax
je 0x10020b41
mov dword [ebp - 0x1e8], 1
jmp 0x10020b48
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0x1e8]
test eax, eax
je 0x10020c15
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x410], 0
je 0x10020b95
mov dword [ebp - 0x74], 0
jmp 0x10020b7d
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x10020b93
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x410], 0
jmp 0x10020b76
jmp 0x10020c13
mov dword [ebp - 0x8c], 0
jmp 0x10020bae
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jg 0x10020bdf
mov eax, dword [ebp - 0x8c]
cmp dword [ebp + eax*4 - 0x444], 0
je 0x10020bc9
jmp 0x10020bdf
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x10020bdd
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
jmp 0x10020ba1
mov byte [ebp - 0x53], 0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x10020c13
push 0
push 0x1a0f
push 0x1378
push 0x1b16
push 0xf5a
push 0x26e5
push 0x60e
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x10020c2c
mov dword [ebp - 0x1f0], 0xfcc1
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0xe4], 0x57976326
mov dword [ebp - 0xfc], 0
jmp 0x10020c4f
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x10020c6b
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x580], 0
jmp 0x10020c42
mov dword [ebp - 0xe4], 1
jmp 0x10020c84
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jl 0x10020c9d
push 0x28c6
push 0
call fcn.10022d0f
pop ecx
pop ecx
jmp 0x10020c77
mov dword [ebp - 0x534], 0xf9b3198a
mov dword [ebp - 0x530], 0xf9b3198a
mov dword [ebp - 0x52c], 0xf9b3198a
mov dword [ebp - 0x528], 0xf9b3198a
mov dword [ebp - 0x104], 0xa18885c6
mov dword [ebp - 0x104], 0
jmp 0x10020ce8
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jg 0x10020d1a
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x10020d18
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x10020cdb
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xa8], 0xfe7d8a87
mov dword [ebp - 0x394], 0xffffffff
mov dword [ebp - 0xec], 0
jmp 0x10020d62
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x10020d7e
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x4ec], 0
jmp 0x10020d55
mov dword [ebp - 0xa8], 2
jmp 0x10020d97
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x10020f0a
mov dword [ebp - 0xb0], 0x5b3b9da4
mov dword [ebp - 0xb0], 2
jmp 0x10020dc7
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x10020ee8
mov dword [ebp - 0xa0], 0x1ea66e58
mov dword [ebp - 0xa0], 2
jmp 0x10020df7
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x10020ed9
mov dword [ebp - 0xb8], 0x7b568be1
mov dword [ebp - 0xb8], 2
jmp 0x10020e27
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x10020ebb
mov dword [ebp - 0xc0], 0x9c213245
mov dword [ebp - 0xc0], 2
jmp 0x10020e57
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x10020ea2
mov dword [ebp - 0xc8], 0x4d035725
mov dword [ebp - 0xc8], 2
jmp 0x10020e83
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x10020ea0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp + eax*4 - 0x4ec], 0
je 0x10020e9e
jmp 0x10020ea0
jmp 0x10020e76
jmp 0x10020e4a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4ec], 0
je 0x10020eb6
jmp 0x10020e1a
jmp 0x10020e1a
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x10020ed4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x10020dea
mov dword [ebp - 0x394], 0xc2d621ec
jmp 0x10020dba
mov byte [ebp - 0x5b], 0
movzx eax, byte [ebp - 0x5b]
test eax, eax
je 0x10020f05
push 0x1f28
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x10020d8a
push 0
call fcn.10022ad6
pop ecx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x68], 0xfffffff7
mov dword [ebp - 0x208], 0xc27f355c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x24], 0
jmp 0x10020f40
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x12
jne 0x100211ff
mov dword [ebp - 0x3ac], 0x7eb6652f
mov dword [ebp - 4], 0
jmp 0x10020f64
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x10020f7a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x464], 0x61e3ff14
jmp 0x10020f5d
mov dword [ebp - 4], 0
jmp 0x10020f8a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x10020fa0
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x554], 4
jmp 0x10020f83
mov dword [ebp - 4], 0
jmp 0x10020fb0
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x10020fc6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x494], 0xfffffff9
jmp 0x10020fa9
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x24], 0
je 0x10020ff1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x464], 0
je 0x10020ff1
mov dword [ebp - 0x238], 1
jmp 0x10020ff8
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x68], 0
jne 0x100210fc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x464]
mov dword [ebp - 0x3a4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3a4]
mov dword [ebp + eax - 0x554], ecx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x498], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x554], 0
je 0x10021052
cmp dword [ebp - 0x68], 0
je 0x10021052
mov dword [ebp - 0x1f8], 1
jmp 0x10021059
and dword [ebp - 0x1f8], 0
cmp dword [ebp - 0x1f8], 0x1466ac3a
jge 0x10021071
mov dword [ebp - 0x200], 1
jmp 0x10021078
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x49c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x494]
cmp dword [ebp + eax - 0x464], ecx
jle 0x100210b8
mov dword [ebp - 0x210], 1
jmp 0x100210bf
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0x748bbe26
jne 0x100210d7
mov dword [ebp - 0x218], 1
jmp 0x100210de
and dword [ebp - 0x218], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x218]
sub ecx, dword [ebp + eax - 0x464]
jne 0x100210fc
and dword [ebp - 0x220], 0
jmp 0x10021106
mov dword [ebp - 0x220], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x220], eax
jle 0x1002111d
mov dword [ebp - 0x228], 1
jmp 0x10021124
and dword [ebp - 0x228], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x464]
cmp dword [ebp - 0x228], eax
jne 0x10021145
mov dword [ebp - 0x230], 1
jmp 0x1002114c
and dword [ebp - 0x230], 0
cmp dword [ebp - 0x230], 0x9ef8169c
je 0x10021164
mov dword [ebp - 0x240], 1
jmp 0x1002116b
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x240]
jle 0x10021185
mov dword [ebp - 0x248], 1
jmp 0x1002118c
and dword [ebp - 0x248], 0
cmp dword [ebp - 0x248], 9
jne 0x100211a1
mov dword [ebp - 0x250], 1
jmp 0x100211a8
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x250]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x68], eax
jge 0x100211c8
mov dword [ebp - 0x258], 1
jmp 0x100211cf
and dword [ebp - 0x258], 0
cmp dword [ebp - 0x258], 0xfff7
jae 0x100211e7
mov dword [ebp - 0x260], 1
jmp 0x100211ee
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x3ac], eax
jmp 0x10020f39
and dword [ebp - 0x118], 0
jmp 0x1002121e
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x3c]
add eax, 0x28
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x118], eax
jge 0x10021a2d
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0x10], 0
jne 0x10021920
mov dword [ebp - 0x70], 0
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x4ac], 0xd5181448
mov dword [ebp - 0x4a8], 0x13297949
mov dword [ebp - 0x4f0], 0xf39ab1b5
mov dword [ebp - 0x120], 0xfffe
mov dword [ebp - 0x2c], 0
jmp 0x10021296
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x100212ac
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x390], 0x81d4b4ea
jmp 0x1002128f
mov dword [ebp - 0x2c], 0
jmp 0x100212bc
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x100212d2
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x578], 0xa6c15a2d
jmp 0x100212b5
mov dword [ebp - 0x70], 0
jmp 0x100212e2
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jg 0x100216e0
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x174], 0x38aa138
mov dword [ebp - 0xd8], 0
jmp 0x10021320
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x1002133c
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x434], 0x7f3c88fe
jmp 0x10021313
mov dword [ebp - 0x44], 0xffffffee
jmp 0x1002134c
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x19
jne 0x100216cc
mov dword [ebp - 0x3a0], 0xfffffff9
mov dword [ebp - 0x4b0], 0xa4abff1e
mov dword [ebp - 0x400], 0x169ff9e
mov dword [ebp - 0x3fc], 0x169ff9e
mov dword [ebp - 0x3f8], 0x169ff9e
mov dword [ebp - 0x3f4], 0x169ff9e
mov dword [ebp - 0x3a8], 0xffffffff
mov dword [ebp - 0x510], 0
mov dword [ebp - 0x4b8], 0xc5bb
cmp dword [ebp - 0x44], 0
je 0x100215a8
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
je 0x100215a8
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x3a0]
cmp dword [ebp - 0x120], eax
jge 0x100213f7
mov dword [ebp - 0x268], 1
jmp 0x100213fe
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x128]
imul eax, dword [ebp - 0x268]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x400]
jge 0x10021426
mov dword [ebp - 0x3e0], 1
jmp 0x1002142d
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x4f8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x400], 0x572dbe42
jle 0x10021457
mov dword [ebp - 0x270], 1
jmp 0x1002145e
and dword [ebp - 0x270], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x400]
cmp dword [ebp - 0x270], eax
jl 0x1002147f
mov dword [ebp - 0x278], 1
jmp 0x10021486
and dword [ebp - 0x278], 0
cmp dword [ebp - 0x278], 0
jge 0x10021496
cmp dword [ebp - 0x174], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x434], 0
je 0x100214ba
mov eax, 0xa04a8f9b
test eax, eax
je 0x100214ba
mov dword [ebp - 0x280], 1
jmp 0x100214c1
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x280], eax
jne 0x100214d8
mov dword [ebp - 0x288], 1
jmp 0x100214df
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 1
ja 0x100214f4
mov dword [ebp - 0x138], 1
jmp 0x100214fb
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x138], eax
jl 0x10021518
cmp dword [ebp - 0x44], 0
je 0x10021518
mov dword [ebp - 0x13c], 1
jmp 0x1002151f
and dword [ebp - 0x13c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x434]
cmp dword [ebp - 0x13c], eax
jl 0x10021540
mov dword [ebp - 0x144], 1
jmp 0x10021547
and dword [ebp - 0x144], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x144]
mov dword [ebp + eax - 0x578], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x400]
add eax, dword [ebp - 0xe0]
je 0x1002157b
mov dword [ebp - 0x14c], 1
jmp 0x10021582
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x14c]
add eax, 0x51f5ed1a
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x390]
jne 0x100215a8
mov dword [ebp - 0x154], 1
jmp 0x100215af
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x154], eax
jne 0x100215c6
mov dword [ebp - 0x15c], 1
jmp 0x100215cd
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x15c]
jle 0x100215e7
mov dword [ebp - 0x164], 1
jmp 0x100215ee
and dword [ebp - 0x164], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x390]
cmp dword [ebp - 0x164], eax
jge 0x1002160f
mov dword [ebp - 0x16c], 1
jmp 0x10021616
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x16c]
sub eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x17c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x17c]
mov dword [ebp + eax - 0x434], ecx
mov eax, dword [ebp - 0x174]
imul eax, dword [ebp - 0x17c]
neg eax
jne 0x1002165d
cmp dword [ebp - 0x128], 0
jne 0x1002165d
and dword [ebp - 0x184], 0
jmp 0x10021667
mov dword [ebp - 0x184], 1
imul eax, dword [ebp - 0x184], 0xeb3d
test eax, eax
je 0x10021698
mov byte [ebp - 0x57], 0
push 0
lea eax, [ebp - 0x57]
push eax
push 0x4a1c
push 0x644c
push 0x291
call fcn.1001f3d6
add esp, 0x14
jmp 0x100216c7
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x100216b2
push 0x4627
push 0
call fcn.100223bc
pop ecx
pop ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x390], 0
je 0x100216c7
jmp 0x10021345
jmp 0x10021345
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x44]
mov dword [ebp + eax - 0x434], ecx
jmp 0x100212db
push 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x3d8]
push eax
push 0x5a65
call fcn.100276a5
add esp, 0x18
mov dword [ebp - 0x1a4], 0x44accb24
mov dword [ebp - 0x78], 0xfffe
mov dword [ebp - 0x80], 0x5a83d87
mov dword [ebp - 0x4c0], 0x28451d77
mov dword [ebp - 0x34], 0
jmp 0x1002173a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10021750
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x3d0], 0xaabecba2
jmp 0x10021733
mov dword [ebp - 0x34], 0
jmp 0x10021760
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10021776
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x44c], 0xd62e
jmp 0x10021759
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3d0]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x1a4], 0
jne 0x10021800
push 4
pop eax
shl eax, 1
push 3
pop ecx
sub ecx, dword [ebp + eax - 0x3d0]
mov dword [ebp - 0x18c], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x18c]
mov dword [ebp + eax - 0x44c], ecx
cmp dword [ebp - 0x18c], 0
je 0x100217e3
cmp dword [ebp - 0x78], 0
je 0x100217e3
mov dword [ebp - 0x194], 1
jmp 0x100217ea
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x194]
sub eax, 0x7005
jne 0x10021800
and dword [ebp - 0x19c], 0
jmp 0x1002180a
mov dword [ebp - 0x19c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3d0]
imul eax, dword [ebp - 0x19c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3d0]
jl 0x10021839
mov dword [ebp - 0x1ac], 1
jmp 0x10021840
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x1ac], eax
je 0x1002185a
mov dword [ebp - 0x1b4], 1
jmp 0x10021861
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x1b4]
test eax, eax
je 0x10021904
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3d0], 0
je 0x100218ab
mov dword [ebp - 0x78], 0
jmp 0x10021893
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x100218a9
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x3d0], 0
jmp 0x1002188c
jmp 0x10021902
mov dword [ebp - 0x80], 0
jmp 0x100218bb
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jg 0x100218ee
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x44c], 0
je 0x100218d0
jmp 0x100218ee
mov byte [ebp - 0x50], 0
push 0x7d6a
push 0
push 0x6c3d
lea eax, [ebp - 0x50]
push eax
call fcn.10021abe
add esp, 0x10
jmp 0x100218b4
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x10021902
push 0
call fcn.1002230f
pop ecx
jmp 0x1002191b
mov dword [ebp - 0x1bc], 0xfcc1
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
jmp 0x10021208
push 4
push 0x1000
mov eax, dword [ebp - 0x3c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x1c4]
add ecx, dword [eax + 0xc]
push ecx
push 0x404e
push 0x4432
call fcn.1001e923
pop ecx
pop ecx
call eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x3c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3b0]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x130]
call fcn.1001e9d9
add esp, 0xc
mov dword [ebp - 0x4c8], 0x748f69f7
mov dword [ebp - 0xe8], 0
jmp 0x10021997
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x100219b3
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x354], 6
jmp 0x1002198a
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x100219c7
push 0
call fcn.10022c90
pop ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x354], 0xffffffef
jmp 0x100219f5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x354], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x354], 0xfffffff8
je 0x10021a1c
mov dword [ebp - 0x3bc], 1
cmp dword [ebp - 0x3bc], 0
je 0x10021a1a
jmp 0x10021a1c
jmp 0x100219da
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x130]
mov dword [eax + 8], ecx
jmp 0x10021208
jmp 0x10021a65
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
movzx eax, byte [eax]
test eax, eax
je 0x10021a65
push 0
push 0x162f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov esp, ebp
pop ebp
ret