Function at 0x10009279
Capabilities:
Get graphical window text
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c43e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1430
call fcn.100874f0
push esi
push edi
mov dword [ebp - 0x29c], 1
mov dword [ebp - 0x40], 0x64a53aa9
mov dword [ebp - 0x1b0], 0
jmp 0x100092c7
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jge 0x100092e3
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0xd6c], 0xfffffffb
jmp 0x100092ba
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x1000940f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1234], eax
cmp dword [ebp - 0x29c], 0xffff
ja 0x10009317
mov dword [ebp - 0xb94], 1
jmp 0x1000931e
and dword [ebp - 0xb94], 0
mov eax, dword [ebp - 0x29c]
imul eax, dword [ebp - 0xb94]
test eax, eax
jne 0x1000933e
cmp dword [ebp - 0x40], 0
jne 0x1000933e
and dword [ebp - 0xc7c], 0
jmp 0x10009348
mov dword [ebp - 0xc7c], 1
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0x40], eax
jl 0x1000935f
mov dword [ebp - 0xb78], 1
jmp 0x10009366
and dword [ebp - 0xb78], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb78]
sub ecx, dword [ebp + eax - 0xd6c]
cmp ecx, 0xfffffff7
jl 0x1000938a
mov dword [ebp - 0xb80], 1
jmp 0x10009391
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x100093ac
mov dword [ebp - 0xb88], 1
jmp 0x100093b3
and dword [ebp - 0xb88], 0
imul eax, dword [ebp - 0xb88], 0xd816
test eax, eax
je 0x1000940f
mov dword [ebp - 0x40], 0
jmp 0x100093d1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x100093e7
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xd6c], 0xde1fc657
jmp 0x100093ca
mov dword [ebp - 0x40], 0
jmp 0x100093f7
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1000940d
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xd6c], 0x8bd85027
jmp 0x100093f0
jmp 0x10009430
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x10009430
push 0x97c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x2a4], 1
mov dword [ebp - 0x3c], 0x64a53aa9
mov dword [ebp - 0x1a4], 0
jmp 0x1000945a
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x10009476
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0xd78], 0xfffffffb
jmp 0x1000944d
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x100095a2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x12b0], eax
cmp dword [ebp - 0x2a4], 0xffff
ja 0x100094aa
mov dword [ebp - 0xb90], 1
jmp 0x100094b1
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x2a4]
imul eax, dword [ebp - 0xb90]
test eax, eax
jne 0x100094d1
cmp dword [ebp - 0x3c], 0
jne 0x100094d1
and dword [ebp - 0xd18], 0
jmp 0x100094db
mov dword [ebp - 0xd18], 1
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x3c], eax
jl 0x100094f2
mov dword [ebp - 0xb98], 1
jmp 0x100094f9
and dword [ebp - 0xb98], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb98]
sub ecx, dword [ebp + eax - 0xd78]
cmp ecx, 0xfffffff7
jl 0x1000951d
mov dword [ebp - 0xba0], 1
jmp 0x10009524
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x1000953f
mov dword [ebp - 0xba8], 1
jmp 0x10009546
and dword [ebp - 0xba8], 0
imul eax, dword [ebp - 0xba8], 0xd816
test eax, eax
je 0x100095a2
mov dword [ebp - 0x3c], 0
jmp 0x10009564
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1000957a
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xd78], 0xde1fc657
jmp 0x1000955d
mov dword [ebp - 0x3c], 0
jmp 0x1000958a
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x100095a0
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xd78], 0x8bd85027
jmp 0x10009583
jmp 0x100095c3
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x100095c3
push 0x97c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x134], 0xe2db58e4
cmp dword [ebp - 0x134], 0
je 0x10009607
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x10009605
push 0
push 0x20f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x1000961d
mov dword [ebp - 0xd20], 1
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x134], 0
jmp 0x10009636
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x16
jne 0x1000965e
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000965c
push 0xf6
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x10009629
mov dword [ebp - 0x2c], 0x76820624
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x248], 0
jmp 0x10009685
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 2
jge 0x100096a1
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x1a0], 2
jmp 0x10009678
mov dword [ebp - 0x2c], 0
jmp 0x100096b1
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffffd
je 0x10009e3a
mov dword [ebp - 0xb8], 0x79c4185a
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 0x354], 1
mov dword [ebp - 0x1c8], 0
jmp 0x100096f2
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 2
jge 0x1000970e
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0x2d0], 0xfffffffd
jmp 0x100096e5
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jl 0x10009722
mov dword [ebp - 0xbb0], 1
jmp 0x10009729
and dword [ebp - 0xbb0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2d0]
add eax, dword [ebp - 0xbb0]
cmp eax, 0x9532955f
jne 0x1000974f
mov dword [ebp - 0xd28], 1
jmp 0x10009756
and dword [ebp - 0xd28], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2d0], 0xffffffff
je 0x10009772
mov dword [ebp - 0x8d0], 1
jmp 0x10009779
and dword [ebp - 0x8d0], 0
cmp dword [ebp - 0x8d0], 0xbf0a
jge 0x10009791
mov dword [ebp - 0xd30], 1
jmp 0x10009798
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x11cc], eax
imul eax, dword [ebp - 0x2c], 0xb300
cmp eax, dword [ebp - 0x2c]
jle 0x100097bc
mov dword [ebp - 0x3e4], 1
jmp 0x100097c3
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x3e4]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2d0]
jl 0x100097eb
mov dword [ebp - 0x8d8], 1
jmp 0x100097f2
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x1d0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2d0]
cmp eax, dword [ebp - 0x1d0]
jg 0x1000981f
mov dword [ebp - 0x3ec], 1
jmp 0x10009826
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x3ec]
cmp eax, dword [ebp - 0x2c]
jg 0x10009844
mov dword [ebp - 0x8e0], 1
jmp 0x1000984b
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8e0]
dec eax
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x354], eax
jne 0x10009872
mov dword [ebp - 0x3f4], 1
jmp 0x10009879
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x18], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2d0]
cmp dword [ebp - 0x18], eax
jne 0x100098a7
mov dword [ebp - 0x8e8], 1
jmp 0x100098ae
and dword [ebp - 0x8e8], 0
cmp dword [ebp - 0x8e8], 0xe26a25a9
jbe 0x100098c6
mov dword [ebp - 0xd38], 1
jmp 0x100098cd
and dword [ebp - 0xd38], 0
mov eax, 0x93cb
test eax, eax
je 0x100098e2
mov dword [ebp - 0xd40], 1
jmp 0x100098e9
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1368], eax
xor eax, eax
add eax, 0xfffb
cmp dword [ebp - 0xb8], eax
jl 0x1000990d
mov dword [ebp - 0x3fc], 1
jmp 0x10009914
and dword [ebp - 0x3fc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2d0]
cmp dword [ebp - 0x3fc], eax
jge 0x10009935
mov dword [ebp - 0x8f0], 1
jmp 0x1000993c
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x8f0]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
je 0x10009956
mov dword [ebp - 0x404], 1
jmp 0x1000995d
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x404]
jge 0x10009977
mov dword [ebp - 0x8f8], 1
jmp 0x1000997e
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x8f8]
dec eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2d0]
jle 0x100099a0
mov dword [ebp - 0x40c], 1
jmp 0x100099a7
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
add eax, 0xe341
je 0x10009d6c
mov dword [ebp - 0xe0], 0x774d2ad0
push 2
lea ecx, [ebp - 0xeec]
call fcn.100191fb
and dword [ebp - 4], 0
mov dword [ebp - 0x960], 0xffffffff
mov dword [ebp - 0xd48], 1
mov dword [ebp - 0xd50], 0x22f105ee
mov dword [ebp - 0x950], 0xffffffff
mov dword [ebp - 0x2c8], 0
jmp 0x10009a14
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 2
jge 0x10009a36
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0xeec]
call fcn.10019299
mov dword [eax], 0xeff85a04
jmp 0x10009a07
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x11d4], eax
cmp dword [ebp - 0xe0], 0
je 0x10009b6d
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x12c0], eax
cmp dword [ebp - 0xe0], 0
jne 0x10009ac3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x11dc], eax
mov eax, 0x9b6af4a9
cmp eax, 0xf548f9f0
jne 0x10009a85
mov dword [ebp - 0x3b0], 1
jmp 0x10009a8c
and dword [ebp - 0x3b0], 0
push 1
lea ecx, [ebp - 0xeec]
call fcn.10019299
mov ecx, dword [ebp - 0x3b0]
mov dword [eax], ecx
cmp dword [ebp - 0x3b0], 0
jne 0x10009ac3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2d0], 0
jne 0x10009ac3
and dword [ebp - 0x900], 0
jmp 0x10009acd
mov dword [ebp - 0x900], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x900], eax
jle 0x10009ae4
mov dword [ebp - 0x414], 1
jmp 0x10009aeb
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x414], eax
jl 0x10009b05
mov dword [ebp - 0x908], 1
jmp 0x10009b0c
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x908]
dec eax
cmp eax, dword [ebp - 0xe0]
jle 0x10009b27
mov dword [ebp - 0x41c], 1
jmp 0x10009b2e
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x41c], eax
jg 0x10009b45
mov dword [ebp - 0x910], 1
jmp 0x10009b4c
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0x960], eax
cmp dword [ebp - 0xd48], 0
je 0x10009b6d
mov dword [ebp - 0x424], 1
jmp 0x10009b74
and dword [ebp - 0x424], 0
imul eax, dword [ebp - 0x424], 0x5755
imul eax, dword [ebp - 0x18]
inc eax
inc eax
cmp eax, 0xdaf140b3
jbe 0x10009b97
mov dword [ebp - 0x918], 1
jmp 0x10009b9e
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0xd50], eax
cmp dword [ebp - 0x18], 0
jne 0x10009cfc
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x10009bcd
cmp dword [ebp - 0x2c], 0
je 0x10009bcd
mov dword [ebp - 0xd58], 1
jmp 0x10009bd4
and dword [ebp - 0xd58], 0
cmp dword [ebp - 0x2c], 0xd9d0
je 0x10009be9
mov dword [ebp - 0x42c], 1
jmp 0x10009bf0
and dword [ebp - 0x42c], 0
push 1
lea ecx, [ebp - 0xeec]
call fcn.10019299
mov ecx, dword [ebp - 0x42c]
sub ecx, dword [eax]
cmp ecx, 1
jne 0x10009c16
mov dword [ebp - 0x948], 1
jmp 0x10009c1d
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x948], eax
jl 0x10009c34
mov dword [ebp - 0x434], 1
jmp 0x10009c3b
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x950], eax
jg 0x10009c61
mov dword [ebp - 0x43c], 1
jmp 0x10009c68
and dword [ebp - 0x43c], 0
xor eax, eax
sub eax, dword [ebp - 0x43c]
cmp eax, dword [ebp - 0x18]
jl 0x10009c81
mov dword [ebp - 0x958], 1
jmp 0x10009c88
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x958], eax
jle 0x10009ca2
mov dword [ebp - 0x444], 1
jmp 0x10009ca9
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0
jl 0x10009cbe
mov dword [ebp - 0xd60], 1
jmp 0x10009cc5
and dword [ebp - 0xd60], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2d0]
mov dword [ebp - 0x13a8], eax
cmp dword [ebp - 0x1d0], 0
je 0x10009cf3
mov eax, 0xe65a1b20
test eax, eax
je 0x10009cf3
cmp dword [ebp - 0x960], 0
jne 0x10009cfc
and dword [ebp - 0x44c], 0
jmp 0x10009d06
mov dword [ebp - 0x44c], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x44c], eax
jle 0x10009d1d
mov dword [ebp - 0x968], 1
jmp 0x10009d24
and dword [ebp - 0x968], 0
cmp dword [ebp - 0x968], 0x22ff
jg 0x10009d45
cmp dword [ebp - 0xb8], 0
je 0x10009d45
mov dword [ebp - 0x454], 1
jmp 0x10009d4c
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x354], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeec]
call fcn.1001927d
jmp 0x10009e35
mov dword [ebp - 0xdc4], 0x870af1aa
mov dword [ebp - 0xfec], 0xd5a9c18a
mov dword [ebp - 0xfe8], 0xd5a9c18a
mov dword [ebp - 0xfe4], 0xd5a9c18a
mov dword [ebp - 0xfe0], 0xd5a9c18a
lea ecx, [ebp - 0x3a5]
call fcn.100090c3
push eax
lea eax, [ebp - 0xfdc]
push eax
lea eax, [ebp - 0xfec]
push eax
lea ecx, [ebp - 0x13f4]
call fcn.100192a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x12ac]
call fcn.10019257
mov dword [ebp - 4], 1
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x10009e11
push 0xd4
push 0
push 0x15f3
push 0x251b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov esi, dword [ebp - 0xdc4]
push 0
lea ecx, [ebp - 0x12ac]
call fcn.10019299
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12ac]
call fcn.1001927d
jmp 0x100096aa
mov dword [ebp - 0x18], 0
jmp 0x10009e4a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x1000a046
mov dword [ebp - 0x46c], 0xfcb6e431
mov dword [ebp - 0x998], 0x73e414ce
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x1a0], 0
jne 0x10009fc2
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x11e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a0], 0x6da1
jl 0x10009ea1
mov dword [ebp - 0x970], 1
jmp 0x10009ea8
and dword [ebp - 0x970], 0
cmp dword [ebp - 0x970], 0
jne 0x10009ebd
mov dword [ebp - 0x45c], 1
jmp 0x10009ec4
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov dword [ebp - 0x2c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
add eax, dword [ebp - 0x45c]
cmp dword [ebp - 0x2c], eax
jle 0x10009ef5
mov dword [ebp - 0x978], 1
jmp 0x10009efc
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1a0]
cmp dword [ebp - 0x978], eax
jle 0x10009f1a
mov dword [ebp - 0x464], 1
jmp 0x10009f21
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1a0]
cmp dword [ebp - 0x464], eax
jle 0x10009f3f
mov dword [ebp - 0x980], 1
jmp 0x10009f46
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1a0]
sub eax, dword [ebp - 0x980]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
jg 0x10009f74
mov dword [ebp - 0x988], 1
jmp 0x10009f7b
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x988], eax
jg 0x10009f92
mov dword [ebp - 0xdcc], 1
jmp 0x10009f99
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov dword [ebp - 0x12d0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a0], 0
jne 0x10009fc2
and dword [ebp - 0x474], 0
jmp 0x10009fcc
mov dword [ebp - 0x474], 1
cmp dword [ebp - 0x474], 0x5bf18921
jne 0x10009fee
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x1a0], 0
jne 0x10009fee
and dword [ebp - 0x990], 0
jmp 0x10009ff8
mov dword [ebp - 0x990], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp - 0x990], eax
jg 0x1000a022
mov eax, 0x2ff3
test eax, eax
je 0x1000a022
mov dword [ebp - 0x47c], 1
jmp 0x1000a029
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0x2c], eax
jmp 0x10009e43
mov dword [ebp - 0x260], 1
mov dword [ebp - 0x13c], 7
mov dword [ebp - 0x35c], 0xda8ed40a
push 2
lea ecx, [ebp - 0xbd8]
call fcn.100191fb
mov dword [ebp - 4], 2
mov dword [ebp - 0xdd4], 7
mov dword [ebp - 0xbf8], 0xf213ed4
mov dword [ebp - 0xbf4], 0xf213ed4
mov dword [ebp - 0xbf0], 0xf213ed4
mov dword [ebp - 0xbec], 0xf213ed4
push 4
lea ecx, [ebp - 0x1074]
call fcn.100191fb
mov byte [ebp - 4], 3
push 3
lea ecx, [ebp - 0x105c]
call fcn.100191fb
mov byte [ebp - 4], 4
mov dword [ebp - 0x2f4], 0x75d1b300
mov dword [ebp - 0x14], 0
jmp 0x1000a0e6
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000a0fc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3bc], 0x44cf
jmp 0x1000a0df
mov dword [ebp - 0x14], 0
jmp 0x1000a10c
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000a128
push dword [ebp - 0x14]
lea ecx, [ebp - 0xbd8]
call fcn.10019299
mov dword [eax], 0xfffffff6
jmp 0x1000a105
mov dword [ebp - 0x14], 0
jmp 0x1000a138
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1000a14e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9b8], 0x255d5800
jmp 0x1000a131
mov dword [ebp - 0x14], 0
jmp 0x1000a15e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000a17a
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1074]
call fcn.10019299
mov dword [eax], 0x212aeaf
jmp 0x1000a157
mov dword [ebp - 0x14], 0
jmp 0x1000a18a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000a1a6
push dword [ebp - 0x14]
lea ecx, [ebp - 0x105c]
call fcn.10019299
mov dword [eax], 1
jmp 0x1000a183
mov eax, 0xa6c9cd49
test eax, eax
je 0x1000a1cb
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3bc], 0
je 0x1000a1cb
mov dword [ebp - 0x484], 1
jmp 0x1000a1d2
and dword [ebp - 0x484], 0
mov eax, 0xe012d2c8
sub eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x484]
jge 0x1000a1f1
mov dword [ebp - 0x48c], 1
jmp 0x1000a1f8
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x13c], 0xfffffff9
jb 0x1000a20d
mov dword [ebp - 0x9a0], 1
jmp 0x1000a214
and dword [ebp - 0x9a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3bc]
cmp dword [ebp - 0x9a0], eax
jl 0x1000a235
mov dword [ebp - 0x2e4], 1
jmp 0x1000a23c
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x35c], eax
push 1
lea ecx, [ebp - 0xbd8]
call fcn.10019299
mov ecx, dword [ebp - 0x2e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2e4]
sub eax, 3
cmp dword [ebp - 0x35c], eax
jl 0x1000a27a
mov dword [ebp - 0x9a8], 1
jmp 0x1000a281
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x9a8]
sub eax, dword [ebp - 0x13c]
cmp eax, 0x164
jg 0x1000a2a0
mov dword [ebp - 0x494], 1
jmp 0x1000a2a7
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x494], eax
jge 0x1000a2c1
mov dword [ebp - 0x9b0], 1
jmp 0x1000a2c8
and dword [ebp - 0x9b0], 0
cmp dword [ebp - 0x9b0], 0x47f5
jge 0x1000a2e0
mov dword [ebp - 0x3ac], 1
jmp 0x1000a2e7
and dword [ebp - 0x3ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3ac]
mov dword [ebp + eax - 0x9b8], ecx
mov eax, dword [ebp - 0x13c]
imul eax, dword [ebp - 0x3ac]
mov dword [ebp - 0xdd4], eax
push 1
lea ecx, [ebp - 0xbd8]
call fcn.10019299
xor eax, eax
imul eax, eax, 0xe10a
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x3bc]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3bc]
jge 0x1000a34a
mov dword [ebp - 0x49c], 1
jmp 0x1000a351
and dword [ebp - 0x49c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x49c]
mov dword [ebp + eax - 0xbf8], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3bc]
cmp dword [ebp + eax - 0x9b8], ecx
jge 0x1000a38c
mov dword [ebp - 0x9d0], 1
jmp 0x1000a393
and dword [ebp - 0x9d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbf8]
mov dword [ebp - 0x11ec], eax
push 4
pop eax
imul eax, eax, 0
imul esi, dword [ebp + eax - 0x3bc], 0
imul esi, dword [ebp - 0x13c]
push 2
lea ecx, [ebp - 0x1074]
call fcn.10019299
add esi, dword [eax]
push 4
pop eax
shl eax, 0
cmp esi, dword [ebp + eax - 0x3bc]
jl 0x1000a3e5
mov dword [ebp - 0x2ec], 1
jmp 0x1000a3ec
and dword [ebp - 0x2ec], 0
push 1
lea ecx, [ebp - 0x105c]
call fcn.10019299
mov ecx, dword [ebp - 0x2ec]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbf8]
imul eax, dword [ebp - 0x2ec]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xbf8]
jle 0x1000a42f
mov dword [ebp - 0x4a4], 1
jmp 0x1000a436
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0xfffffff9
jne 0x1000a44b
mov dword [ebp - 0x9c0], 1
jmp 0x1000a452
and dword [ebp - 0x9c0], 0
push 0
lea ecx, [ebp - 0xbd8]
call fcn.10019299
mov ecx, dword [ebp - 0x9c0]
sub ecx, dword [eax]
jne 0x1000a475
mov dword [ebp - 0x4ac], 1
jmp 0x1000a47c
and dword [ebp - 0x4ac], 0
mov esi, dword [ebp - 0x2f4]
add esi, dword [ebp - 0x4ac]
imul esi, dword [ebp - 0x2f4]
push 1
lea ecx, [ebp - 0xbd8]
call fcn.10019299
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0xbd8]
call fcn.10019299
cmp esi, dword [eax]
jge 0x1000a4bc
mov dword [ebp - 0x9c8], 1
jmp 0x1000a4c3
and dword [ebp - 0x9c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbf8]
cmp dword [ebp - 0x9c8], eax
jl 0x1000a4e4
mov dword [ebp - 0x4b4], 1
jmp 0x1000a4eb
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x35c]
mov ecx, dword [ebp - 0x2f4]
add ecx, dword [ebp - 0x4b4]
add eax, ecx
cmp eax, 0xfffffff6
je 0x1000a510
mov dword [ebp - 0x4bc], 1
jmp 0x1000a517
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x9d0]
cmp eax, dword [ebp - 0x4bc]
jge 0x1000a531
mov dword [ebp - 0x9d8], 1
jmp 0x1000a538
and dword [ebp - 0x9d8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9d8]
mov dword [ebp + eax - 0xbf8], ecx
push 1
lea ecx, [ebp - 0xbd8]
call fcn.10019299
mov dword [eax], 0x7941993e
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x105c]
call fcn.1001927d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1074]
call fcn.1001927d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbd8]
call fcn.1001927d
mov dword [ebp - 0x44], 0x64a53aa9
mov dword [ebp - 0x17c], 1
mov dword [ebp - 0x194], 0x44b0bf2
push 1
lea ecx, [ebp - 0xe1c]
call fcn.100191fb
mov dword [ebp - 4], 5
push 2
lea ecx, [ebp - 0xf94]
call fcn.100191fb
mov byte [ebp - 4], 6
mov dword [ebp - 0xa00], 0x9873
mov dword [ebp - 0xddc], 1
mov dword [ebp - 0x8c], 0
jmp 0x1000a5f8
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1000a61a
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xe1c]
call fcn.10019299
mov dword [eax], 0xa421e0be
jmp 0x1000a5eb
mov dword [ebp - 0x8c], 0
jmp 0x1000a633
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1000a652
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xf94]
call fcn.10019299
and dword [eax], 0
jmp 0x1000a626
push 0
lea ecx, [ebp - 0xf94]
call fcn.10019299
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x394]
mov dword [ecx], eax
mov eax, dword [ebp - 0x394]
cmp dword [eax], 0
je 0x1000a692
xor eax, eax
inc eax
je 0x1000a692
mov dword [ebp - 0x4c4], 1
jmp 0x1000a699
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1370], eax
cmp dword [ebp - 0x194], 0
jne 0x1000a6c0
mov eax, 0x5c22c920
test eax, eax
jne 0x1000a6c0
and dword [ebp - 0x9e0], 0
jmp 0x1000a6ca
mov dword [ebp - 0x9e0], 1
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0x9e0]
jl 0x1000a6e4
mov dword [ebp - 0x4cc], 1
jmp 0x1000a6eb
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0x4cc]
jne 0x1000a705
mov dword [ebp - 0x2fc], 1
jmp 0x1000a70c
and dword [ebp - 0x2fc], 0
push 0
lea ecx, [ebp - 0xe1c]
call fcn.10019299
mov ecx, dword [ebp - 0x2fc]
mov dword [eax], ecx
cmp dword [ebp - 0x2fc], 0
jne 0x1000a745
push 0
lea ecx, [ebp - 0xe1c]
call fcn.10019299
cmp dword [eax], 0
jne 0x1000a745
and dword [ebp - 0x9e8], 0
jmp 0x1000a74f
mov dword [ebp - 0x9e8], 1
cmp dword [ebp - 0x9e8], 0xd7582ba8
ja 0x1000a767
mov dword [ebp - 0x4d4], 1
jmp 0x1000a76e
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 0
jbe 0x1000a77e
push 4
pop eax
test eax, eax
je 0x1000a793
cmp dword [ebp - 0x194], 0
je 0x1000a793
mov dword [ebp - 0x9f0], 1
jmp 0x1000a79a
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x9f0], eax
jl 0x1000a7b4
mov dword [ebp - 0x4dc], 1
jmp 0x1000a7bb
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 8
jbe 0x1000a7d0
mov dword [ebp - 0x9f8], 1
jmp 0x1000a7d7
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x9f8]
sub eax, 6
mov dword [ebp - 0x194], eax
je 0x1000a7fd
cmp dword [ebp - 0x194], 0
je 0x1000a7fd
mov dword [ebp - 0x4e4], 1
jmp 0x1000a804
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x17c]
imul eax, dword [ebp - 0x4e4]
imul eax, dword [ebp - 0x17c]
add eax, dword [ebp - 0x17c]
cmp eax, 0x218f
jl 0x1000a872
mov dword [ebp - 0x250], 0
jmp 0x1000a83e
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x1000a85a
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x13c8], 1
jmp 0x1000a831
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x13c8]
mov dword [ebp - 0xa00], eax
jmp 0x1000aa5e
mov dword [ebp - 0x190], 0xfffffffd
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x304], 0xb016fefd
push 1
lea ecx, [ebp - 0x108c]
call fcn.100191fb
mov byte [ebp - 4], 7
mov dword [ebp - 0x1d8], 0
jmp 0x1000a8ba
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x1000a8dc
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x108c]
call fcn.10019299
mov dword [eax], 0x6851cc0d
jmp 0x1000a8ad
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0xa00]
cmp dword [ebp - 0x190], eax
jl 0x1000a90a
mov dword [ebp - 0x364], 0xffff
cmp dword [ebp - 0x364], 0
jne 0x1000a949
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0x364], eax
jge 0x1000a924
mov dword [ebp - 0x4ec], 1
jmp 0x1000a92b
and dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x4ec], 0xf5e2
jle 0x1000a949
mov eax, 0xffff
test eax, eax
jne 0x1000a949
and dword [ebp - 0xa08], 0
jmp 0x1000a953
mov dword [ebp - 0xa08], 1
mov eax, dword [ebp - 0x190]
add eax, dword [ebp - 0xa08]
cmp eax, 0xfffe
jae 0x1000a972
mov dword [ebp - 0x4f4], 1
jmp 0x1000a979
and dword [ebp - 0x4f4], 0
push 0
lea ecx, [ebp - 0xe1c]
call fcn.10019299
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4f4]
jge 0x1000a99c
mov dword [ebp - 0xa10], 1
jmp 0x1000a9a3
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0xa10], eax
jle 0x1000a9bd
mov dword [ebp - 0x4fc], 1
jmp 0x1000a9c4
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0xddc]
imul eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x304]
cmp eax, 0xffffffff
jle 0x1000a9e8
mov dword [ebp - 0xa18], 1
jmp 0x1000a9ef
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0xa18], eax
je 0x1000aa09
mov dword [ebp - 0x504], 1
jmp 0x1000aa10
and dword [ebp - 0x504], 0
push 0
lea ecx, [ebp - 0xf94]
call fcn.10019299
mov ecx, dword [ebp - 0x504]
cmp ecx, dword [eax]
jle 0x1000aa33
mov dword [ebp - 0xa20], 1
jmp 0x1000aa3a
and dword [ebp - 0xa20], 0
push 0
lea ecx, [ebp - 0x108c]
call fcn.10019299
mov ecx, dword [ebp - 0xa20]
mov dword [eax], ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x108c]
call fcn.1001927d
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf94]
call fcn.1001927d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe1c]
call fcn.1001927d
mov dword [ebp - 0x20], 0x365653d4
mov dword [ebp - 0x11f4], 0xe543
mov dword [ebp - 0x290], 0
jmp 0x1000aaa6
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x1000aac2
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xfac], 0x47d228d5
jmp 0x1000aa99
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x12e0], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jge 0x1000aadf
mov dword [ebp - 0x50c], 1
jmp 0x1000aae6
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
sub eax, dword [ebp - 0x20]
sub eax, 0x11cb6a0b
imul eax, dword [ebp - 0x20]
cmp eax, 1
jb 0x1000ab09
mov dword [ebp - 0xde4], 1
jmp 0x1000ab10
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x11fc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1398], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1204], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x12f0], eax
push 0xfffffffffffffffb
pop eax
add eax, 3
add eax, dword [ebp - 0x20]
jne 0x1000ab4e
cmp dword [ebp - 0x20], 0
jne 0x1000ab4e
and dword [ebp - 0xa28], 0
jmp 0x1000ab58
mov dword [ebp - 0xa28], 1
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0x20], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xfac]
cmp dword [ebp - 0x20], eax
jge 0x1000abc5
mov dword [ebp - 0x1e0], 0
jmp 0x1000ab8b
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jge 0x1000aba7
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x1218], 0
jmp 0x1000ab7e
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0x1218]
mov dword [ebp + ecx - 0xfac], eax
jmp 0x1000ad71
mov dword [ebp - 0x144], 0xff4caa5d
mov dword [ebp - 0x144], 0xfffffff7
cmp dword [ebp - 0x144], 0
je 0x1000ac22
mov dword [ebp - 0x514], 0xfffffff7
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x1000ac1d
push 0x148e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x1000ad71
mov dword [ebp - 0x20], 4
jmp 0x1000ac32
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 7
je 0x1000ad12
mov dword [ebp - 0x258], 0x43ec3e1b
cmp dword [ebp - 0x258], 0
jne 0x1000acf0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xfac]
cmp dword [ebp - 0x258], eax
jl 0x1000ac74
mov dword [ebp - 0xa30], 1
jmp 0x1000ac7b
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0xa30]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xfffffff9
ja 0x1000ac9c
mov dword [ebp - 0x51c], 1
jmp 0x1000aca3
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 1
jg 0x1000acb8
mov dword [ebp - 0xa38], 1
jmp 0x1000acbf
and dword [ebp - 0xa38], 0
cmp dword [ebp - 0xa38], 0xf510b816
jne 0x1000acd7
mov dword [ebp - 0x524], 1
jmp 0x1000acde
and dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 0
jb 0x1000acf0
and dword [ebp - 0xa40], 0
jmp 0x1000acfa
mov dword [ebp - 0xa40], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa40]
mov dword [ebp + eax - 0xfac], ecx
jmp 0x1000ac2b
mov dword [ebp - 0x20], 0
jmp 0x1000ad22
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x1000ad71
mov dword [ebp - 0x144], 0
jmp 0x1000ad41
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jg 0x1000ad6f
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1000ad6d
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x1000ad34
jmp 0x1000ad1b
mov dword [ebp - 0x1e8], 0
jmp 0x1000ad8a
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jge 0x1000ada6
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0xd84], 0xfffffffb
jmp 0x1000ad7d
mov dword [ebp - 0x1f0], 0x443250e6
mov dword [ebp - 0x3c0], 0x5d70512a
mov dword [ebp - 0xdec], 0x87e91c17
mov dword [ebp - 0xdf4], 0xebe1552b
mov dword [ebp - 0x2b0], 0
jmp 0x1000ade7
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 2
jge 0x1000ae03
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x3c8], 0xfffffff8
jmp 0x1000adda
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3c8], 5
jbe 0x1000ae25
cmp dword [ebp - 0x1f0], 0
jne 0x1000ae25
and dword [ebp - 0xa48], 0
jmp 0x1000ae2f
mov dword [ebp - 0xa48], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3c8], 1
jne 0x1000ae4b
mov dword [ebp - 0x52c], 1
jmp 0x1000ae52
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x52c], eax
jg 0x1000ae6c
mov dword [ebp - 0x534], 1
jmp 0x1000ae73
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0xa48]
imul eax, dword [ebp - 0x534]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x3c8]
je 0x1000ae9b
mov dword [ebp - 0xa50], 1
jmp 0x1000aea2
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0xa50]
jle 0x1000aebc
mov dword [ebp - 0x53c], 1
jmp 0x1000aec3
and dword [ebp - 0x53c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3c8]
imul eax, dword [ebp - 0x53c]
cmp eax, 0xba13b288
jae 0x1000aeea
mov dword [ebp - 0xa58], 1
jmp 0x1000aef1
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0xa58]
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x1f0], 0xfffffffb
jae 0x1000af12
mov dword [ebp - 0xa60], 1
jmp 0x1000af19
and dword [ebp - 0xa60], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c8], 1
jne 0x1000af35
mov dword [ebp - 0x544], 1
jmp 0x1000af3c
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x3c0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3c8]
cmp eax, dword [ebp - 0x3c0]
jg 0x1000af76
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c8], 0
jne 0x1000af76
and dword [ebp - 0x54c], 0
jmp 0x1000af80
mov dword [ebp - 0x54c], 1
mov eax, dword [ebp - 0xa60]
cmp eax, dword [ebp - 0x54c]
jl 0x1000af9a
mov dword [ebp - 0xa68], 1
jmp 0x1000afa1
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0xa68]
dec eax
jne 0x1000afb8
xor eax, eax
inc eax
jne 0x1000afb8
and dword [ebp - 0x554], 0
jmp 0x1000afc2
mov dword [ebp - 0x554], 1
mov eax, dword [ebp - 0x554]
sub eax, dword [ebp - 0xdec]
mov dword [ebp - 0xdf4], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x1000b2a4
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x120c], eax
cmp dword [ebp - 0x260], 0xffff
ja 0x1000b008
mov dword [ebp - 0xa70], 1
jmp 0x1000b00f
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0x260]
imul eax, dword [ebp - 0xa70]
test eax, eax
jne 0x1000b02f
cmp dword [ebp - 0x44], 0
jne 0x1000b02f
and dword [ebp - 0xdfc], 0
jmp 0x1000b039
mov dword [ebp - 0xdfc], 1
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x44], eax
jl 0x1000b050
mov dword [ebp - 0x55c], 1
jmp 0x1000b057
and dword [ebp - 0x55c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x55c]
sub ecx, dword [ebp + eax - 0xd84]
cmp ecx, 0xfffffff7
jl 0x1000b07b
mov dword [ebp - 0xa78], 1
jmp 0x1000b082
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x1000b09d
mov dword [ebp - 0x564], 1
jmp 0x1000b0a4
and dword [ebp - 0x564], 0
imul eax, dword [ebp - 0x564], 0xd816
test eax, eax
je 0x1000b2a4
mov dword [ebp - 0x44], 0
jmp 0x1000b0c6
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1000b0dc
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xd84], 0xde1fc657
jmp 0x1000b0bf
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x164], 7
mov dword [ebp - 0x1138], 0xcfbce008
mov dword [ebp - 0x1134], 0xcfbce008
mov dword [ebp - 0x1130], 0xcfbce008
mov dword [ebp - 0x112c], 0xcfbce008
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1378], eax
imul eax, dword [ebp - 0x58], 0
test eax, eax
je 0x1000b138
cmp dword [ebp - 0x58], 0
je 0x1000b138
mov dword [ebp - 0xa80], 1
jmp 0x1000b13f
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0xa80]
cmp dword [ebp - 0x58], eax
je 0x1000b15a
mov dword [ebp - 0x56c], 1
jmp 0x1000b161
and dword [ebp - 0x56c], 0
cmp dword [ebp - 0x56c], 0xffffffff
ja 0x1000b176
mov dword [ebp - 0xa88], 1
jmp 0x1000b17d
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0xa88]
test eax, eax
je 0x1000b19d
cmp dword [ebp - 0x58], 0
je 0x1000b19d
mov dword [ebp - 0x574], 1
jmp 0x1000b1a4
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x574], eax
jl 0x1000b1bb
mov dword [ebp - 0xa90], 1
jmp 0x1000b1c2
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0xa90]
sub eax, 0x45c6b9bd
mov dword [ebp - 0x164], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x164]
mov dword [ebp + eax - 0x1138], ecx
cmp dword [ebp - 0x58], 0
je 0x1000b255
mov dword [ebp - 0x58], 4
jmp 0x1000b1fc
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x2a
jle 0x1000b253
mov dword [ebp - 0x164], 6
jmp 0x1000b21b
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0xffffffe8
jl 0x1000b251
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1000b24f
push 0x1119
push 0x245a
push 0
push 0xc2d
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
jmp 0x1000b20e
jmp 0x1000b1f5
jmp 0x1000b27c
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1000b27c
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov dword [ebp - 0x44], 0
jmp 0x1000b28c
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1000b2a2
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xd84], 0x8bd85027
jmp 0x1000b285
jmp 0x1000b2c5
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x1000b2c5
push 0x97c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 3
lea ecx, [ebp - 0xf10]
call fcn.100191fb
mov dword [ebp - 4], 8
mov dword [ebp - 0xe0c], 0xeb77278f
mov dword [ebp - 0x1300], 0
mov dword [ebp - 0xe04], 0xfffffff7
mov dword [ebp - 0xee0], 0
push 1
lea ecx, [ebp - 0xf58]
call fcn.100191fb
mov byte [ebp - 4], 9
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x1230], 1
push 3
lea ecx, [ebp - 0x10a4]
call fcn.100191fb
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xab0], 0xcc8c9f13
mov dword [ebp - 0x30], 0
jmp 0x1000b351
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1000b36a
push dword [ebp - 0x30]
lea ecx, [ebp - 0xf10]
call fcn.10019299
or dword [eax], 0xffffffff
jmp 0x1000b34a
mov dword [ebp - 0x30], 0
jmp 0x1000b37a
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1000b396
push dword [ebp - 0x30]
lea ecx, [ebp - 0xf58]
call fcn.10019299
mov dword [eax], 0xfffffffd
jmp 0x1000b373
mov dword [ebp - 0x30], 0
jmp 0x1000b3a6
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1000b3bc
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xd90], 0xe74b
jmp 0x1000b39f
mov dword [ebp - 0x30], 0
jmp 0x1000b3cc
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1000b3e8
push dword [ebp - 0x30]
lea ecx, [ebp - 0x10a4]
call fcn.10019299
mov dword [eax], 1
jmp 0x1000b3c5
mov byte [ebp - 0x12b], 0
movzx eax, byte [ebp - 0x12b]
test eax, eax
je 0x1000b402
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 2
lea ecx, [ebp - 0xf10]
call fcn.10019299
mov esi, eax
push 1
lea ecx, [ebp - 0xf10]
call fcn.10019299
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1000b430
mov dword [ebp - 0x59c], 1
jmp 0x1000b437
and dword [ebp - 0x59c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd90]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xd90]
dec ecx
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0xd90], ecx
test eax, eax
jne 0x1000b4ea
cmp dword [ebp - 0xe04], 0xccfdef05
je 0x1000b47f
mov dword [ebp - 0xa98], 1
jmp 0x1000b486
and dword [ebp - 0xa98], 0
push 0
lea ecx, [ebp - 0xf58]
call fcn.10019299
mov dword [ebp - 0x57c], eax
push 2
lea ecx, [ebp - 0x10a4]
call fcn.10019299
mov ecx, dword [ebp - 0x57c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x57c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa98]
jge 0x1000b4cc
mov dword [ebp - 0x584], 1
jmp 0x1000b4d3
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0xe0c]
cmp dword [ebp - 0x584], eax
jle 0x1000b4ea
mov eax, 0x3b3b
test eax, eax
je 0x1000b508
push 0
lea ecx, [ebp - 0xf58]
call fcn.10019299
cmp dword [eax], 0
je 0x1000b508
mov dword [ebp - 0xaa0], 1
jmp 0x1000b50f
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0xaa0], eax
jl 0x1000b529
mov dword [ebp - 0x58c], 1
jmp 0x1000b530
and dword [ebp - 0x58c], 0
cmp dword [ebp - 0x58c], 0x160c6370
jne 0x1000b548
mov dword [ebp - 0xaa8], 1
jmp 0x1000b54f
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0xaa8], eax
jg 0x1000b569
mov dword [ebp - 0x594], 1
jmp 0x1000b570
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0xab0]
cmp dword [ebp - 0x59c], eax
jle 0x1000b596
mov dword [ebp - 0xab8], 1
jmp 0x1000b59d
and dword [ebp - 0xab8], 0
mov eax, dword [ebp - 0xee0]
cmp dword [ebp - 0xab8], eax
jl 0x1000b5b7
mov dword [ebp - 0x5a4], 1
jmp 0x1000b5be
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 0xb22c
jle 0x1000b5d6
mov dword [ebp - 0xac0], 1
jmp 0x1000b5dd
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0x30c], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10a4]
call fcn.1001927d
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xf58]
call fcn.1001927d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf10]
call fcn.1001927d
mov dword [ebp - 0x14c], 0xfffffff7
mov dword [ebp - 0xd00], 0xfffffff8
mov dword [ebp - 0x298], 0x8f59172d
mov dword [ebp - 0x200], 0xfffffffd
mov dword [ebp - 0xebc], 0x989265
mov dword [ebp - 0xad8], 1
mov dword [ebp - 0x1f8], 0
jmp 0x1000b66b
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x1000b687
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x12bc], 0x2c6eed1e
jmp 0x1000b65e
xor eax, eax
inc eax
je 0x1000b6a1
cmp dword [ebp - 0x298], 0
je 0x1000b6a1
mov dword [ebp - 0x5ac], 1
jmp 0x1000b6a8
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0xebc]
cmp dword [ebp - 0x5ac], eax
jne 0x1000b6c2
mov dword [ebp - 0xec8], 1
jmp 0x1000b6c9
and dword [ebp - 0xec8], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x13b8], eax
mov eax, dword [ebp - 0xad8]
cmp dword [ebp - 0x298], eax
jle 0x1000b6ef
mov dword [ebp - 0xac8], 1
jmp 0x1000b6f6
and dword [ebp - 0xac8], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0xac8], eax
jne 0x1000b710
mov dword [ebp - 0x5b4], 1
jmp 0x1000b717
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x5b4], eax
jle 0x1000b731
mov dword [ebp - 0xdc8], 1
jmp 0x1000b738
and dword [ebp - 0xdc8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x12bc]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
je 0x1000b76f
mov dword [ebp - 0xd10], 0x748a
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0xd10], eax
jmp 0x1000b8c8
mov dword [ebp - 0x5c4], 1
mov dword [ebp - 0x36c], 0x69a4575f
mov dword [ebp - 0x5d4], 0x299b
cmp dword [ebp - 0x14c], 0xa660
jge 0x1000b7a5
mov dword [ebp - 0xae0], 1
jmp 0x1000b7ac
and dword [ebp - 0xae0], 0
cmp dword [ebp - 0x298], 0
je 0x1000b7ca
cmp dword [ebp - 0xd00], 0
je 0x1000b7ca
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0xad0]
cmp eax, dword [ebp - 0x298]
jl 0x1000b7f1
mov dword [ebp - 0x200], 0x44bf8e16
push 3
lea ecx, [ebp - 0xf28]
call fcn.100191fb
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xc94], 0xeb77278f
mov dword [ebp - 0x1310], 0
mov dword [ebp - 0xed8], 0xfffffff7
mov dword [ebp - 0xdd0], 0
push 1
lea ecx, [ebp - 0xf88]
call fcn.100191fb
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x314], 0
mov dword [ebp - 0x1240], 1
push 3
lea ecx, [ebp - 0x10e0]
call fcn.100191fb
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xb10], 0xcc8c9f13
mov dword [ebp - 0x38], 0
jmp 0x1000b95e
cmp dword [ebp - 0x38], 3
jge 0x1000b977