Function at 0x10010917
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088875
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x11a4
call fcn.10084160
push esi
push edi
mov dword [ebp - 0x308], 5
mov dword [ebp - 0x278], 0
jmp 0x1001095e
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jge 0x1001097a
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xe0c], 3
jmp 0x10010951
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xe0c], 0
jmp 0x100109a8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe0c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xe0c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe0c], 0xfffffff8
jg 0x10010a91
push 1
lea ecx, [ebp - 0x109c]
call fcn.10010227
and dword [ebp - 4], 0
mov dword [ebp - 0x21c], 8
mov dword [ebp - 0x280], 0
jmp 0x100109f0
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 1
jge 0x10010a12
push dword [ebp - 0x280]
lea ecx, [ebp - 0x109c]
call fcn.1001026e
mov dword [eax], 0x683c8fc5
jmp 0x100109e3
mov dword [ebp - 0x21c], 0
jmp 0x10010a2b
mov eax, dword [ebp - 0x21c]
dec eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jl 0x10010a7d
mov byte [ebp - 0x113], 0
movzx eax, byte [ebp - 0x113]
test eax, eax
je 0x10010a4e
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x10010a7b
push 0
push 0x1339
push 0
push 0
push 0x1850
push 0x1f45
call dword [sym.imp.USER32.dll_ToAsciiEx]
jmp 0x10010a1e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x109c]
call fcn.10010269
jmp 0x1001098d
mov dword [ebp - 0x834], 0xffffffff
mov dword [ebp - 0x3fc], 0x44696a48
mov dword [ebp - 0x138], 0xffffffff
mov dword [ebp - 0x790], 0xfffffffd
mov dword [ebp - 0x140], 0xfffffff6
mov dword [ebp - 0xa98], 7
mov dword [ebp - 0x118], 0xe7374489
mov dword [ebp - 0xad0], 5
mov dword [ebp - 0xc4c], 0
mov dword [ebp - 0x240], 0
jmp 0x10010b04
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x10010b20
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x1184], 0xfffffff6
jmp 0x10010af7
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x10010b3c
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x1000], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0x1090], eax
cmp dword [ebp - 0x140], 1
jne 0x10010b81
mov dword [ebp - 0xbb0], 1
jmp 0x10010b88
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xfe4], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1168], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1010], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x1150], eax
mov eax, 0x2b948214
test eax, eax
jne 0x10010bcd
mov dword [ebp - 0xaa0], 1
jmp 0x10010bd4
and dword [ebp - 0xaa0], 0
cmp dword [ebp - 0xaa0], 4
jl 0x10010be9
mov dword [ebp - 0xc44], 1
jmp 0x10010bf0
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x118]
jne 0x10010c10
mov dword [ebp - 0xaa8], 1
jmp 0x10010c17
and dword [ebp - 0xaa8], 0
cmp dword [ebp - 0xaa8], 0xffff
jbe 0x10010c38
cmp dword [ebp - 0x140], 0
je 0x10010c38
mov dword [ebp - 0xab0], 1
jmp 0x10010c3f
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0xab0], eax
jg 0x10010c59
mov dword [ebp - 0xab8], 1
jmp 0x10010c60
and dword [ebp - 0xab8], 0
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x118], eax
jl 0x10010c86
mov dword [ebp - 0x284], 1
jmp 0x10010c8d
and dword [ebp - 0x284], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x284]
mov dword [ebp + eax - 0x1184], ecx
mov eax, dword [ebp - 0x140]
add eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x138]
jne 0x10010cc0
mov dword [ebp - 0xac0], 1
jmp 0x10010cc7
and dword [ebp - 0xac0], 0
cmp dword [ebp - 0xac0], 0xaee51190
jbe 0x10010cdf
mov dword [ebp - 0xac8], 1
jmp 0x10010ce6
and dword [ebp - 0xac8], 0
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0xad0], eax
mov eax, 0x12b57e8b
sub eax, dword [ebp - 0xad0]
imul eax, dword [ebp - 0x140]
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xcb4], 0xffffffff
mov dword [ebp - 0xccc], 0
push 2
lea ecx, [ebp - 0xf20]
call fcn.10010227
mov dword [ebp - 4], 1
mov dword [ebp - 0x70], 0
jmp 0x10010d42
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x10010d58
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x190], 0xffffffff
jmp 0x10010d3b
mov dword [ebp - 0x70], 0
jmp 0x10010d68
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10010d84
push dword [ebp - 0x70]
lea ecx, [ebp - 0xf20]
call fcn.1001026e
mov dword [eax], 0xfffffffb
jmp 0x10010d61
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x190], 0
jmp 0x10010db2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x190], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x190], 0xd
jne 0x10010e3f
mov dword [ebp - 0x248], 0x457102d1
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x10010de6
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [ebp - 0x248], 0xffffffe3
jmp 0x10010dff
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x10010e3a
push 0
lea ecx, [ebp - 0xf20]
call fcn.1001026e
mov dword [eax], 0x33c63384
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10010e38
push 0x1e40
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x10010df2
jmp 0x10010d97
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf20]
call fcn.10010269
push 4
lea ecx, [ebp - 0xee4]
call fcn.10010227
mov dword [ebp - 4], 2
mov dword [ebp - 0x178], 1
mov dword [ebp - 0xc54], 4
mov dword [ebp - 0xae0], 1
mov dword [ebp - 0xc6c], 0x88f4f368
mov dword [ebp - 0x1018], 0xfffffff6
mov dword [ebp - 0x198], 0
jmp 0x10010ead
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jge 0x10010ec9
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x10b0], 0x2bd7b1c2
jmp 0x10010ea0
cmp dword [ebp - 0x178], 0
je 0x10010ee7
cmp dword [ebp - 0x178], 0
je 0x10010ee7
mov dword [ebp - 0xad8], 1
jmp 0x10010eee
and dword [ebp - 0xad8], 0
cmp dword [ebp - 0xad8], 0
je 0x10010f0b
mov eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0xc54]
mov eax, dword [ebp - 0xae0]
cmp dword [ebp - 0xae0], eax
jl 0x10010f25
mov dword [ebp - 0xc5c], 1
jmp 0x10010f2c
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xc64], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc64]
mov dword [ebp + eax - 0x10b0], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10b0]
mov dword [ebp - 0xc6c], eax
mov dword [ebp - 0xcc4], 0x7e673292
mov dword [ebp - 0x24], 0x5c68ec0a
mov dword [ebp - 0x7f4], 3
mov dword [ebp - 0x30c], 1
mov dword [ebp - 0x250], 0
jmp 0x10010f9c
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 4
jge 0x10010fb8
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x1178], 5
jmp 0x10010f8f
mov dword [ebp - 0x24], 0xffffffe7
jmp 0x10010fc8
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe9
je 0x10011316
push 3
lea ecx, [ebp - 0xb34]
call fcn.10010227
mov byte [ebp - 4], 3
push 1
lea ecx, [ebp - 0xd14]
call fcn.10010227
mov byte [ebp - 4], 4
mov dword [ebp - 0x320], 0xffffffff
push 3
lea ecx, [ebp - 0xe3c]
call fcn.10010227
mov byte [ebp - 4], 5
mov dword [ebp - 0xc84], 0xf5b50694
mov dword [ebp - 0x38], 0
jmp 0x10011029
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10011045
push dword [ebp - 0x38]
lea ecx, [ebp - 0xb34]
call fcn.1001026e
mov dword [eax], 0xe75cb554
jmp 0x10011022
mov dword [ebp - 0x38], 0
jmp 0x10011055
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10011071
push dword [ebp - 0x38]
lea ecx, [ebp - 0xd14]
call fcn.1001026e
mov dword [eax], 0xfffd
jmp 0x1001104e
mov dword [ebp - 0x38], 0
jmp 0x10011081
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1001109d
push dword [ebp - 0x38]
lea ecx, [ebp - 0xe3c]
call fcn.1001026e
mov dword [eax], 1
jmp 0x1001107a
push 2
lea ecx, [ebp - 0xb34]
call fcn.1001026e
mov esi, eax
push 0
lea ecx, [ebp - 0xd14]
call fcn.1001026e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x100110cb
mov dword [ebp - 0x8a4], 1
jmp 0x100110d2
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x8a4], eax
jle 0x100110e9
mov dword [ebp - 0x7c4], 1
jmp 0x100110f0
and dword [ebp - 0x7c4], 0
cmp dword [ebp - 0x7c4], 1
jg 0x10011105
mov dword [ebp - 0x39c], 1
jmp 0x1001110c
and dword [ebp - 0x39c], 0
cmp dword [ebp - 0x39c], 0xffff
ja 0x10011124
mov dword [ebp - 0x7cc], 1
jmp 0x1001112b
and dword [ebp - 0x7cc], 0
push 0
lea ecx, [ebp - 0xb34]
call fcn.1001026e
mov ecx, dword [ebp - 0x7cc]
sub ecx, dword [eax]
je 0x10011160
push 1
lea ecx, [ebp - 0xb34]
call fcn.1001026e
cmp dword [eax], 0
je 0x10011160
mov dword [ebp - 0x3a4], 1
jmp 0x10011167
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x3a4], eax
jg 0x10011187
cmp dword [ebp - 0x24], 0
jne 0x10011187
mov dword [ebp - 0x7d4], 1
jmp 0x1001118e
and dword [ebp - 0x7d4], 0
push 0
lea ecx, [ebp - 0xd14]
call fcn.1001026e
mov ecx, dword [ebp - 0x7d4]
cmp ecx, dword [eax]
jg 0x100111b1
mov dword [ebp - 0xc74], 1
jmp 0x100111b8
and dword [ebp - 0xc74], 0
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x10c8], eax
push 0
lea ecx, [ebp - 0xb34]
call fcn.1001026e
cmp dword [eax], 0xffff
jb 0x100111df
cmp dword [ebp - 0x24], 0
je 0x100111f1
cmp dword [ebp - 0x24], 0
je 0x100111f1
mov dword [ebp - 0x3ac], 1
jmp 0x100111f8
and dword [ebp - 0x3ac], 0
cmp dword [ebp - 0x3ac], 1
jle 0x10011213
cmp dword [ebp - 0x24], 0
je 0x10011213
mov dword [ebp - 0x7dc], 1
jmp 0x1001121a
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x7dc], eax
jge 0x10011234
mov dword [ebp - 0x3b4], 1
jmp 0x1001123b
and dword [ebp - 0x3b4], 0
imul eax, dword [ebp - 0x3b4], 0xa88f
cmp eax, dword [ebp - 0x24]
jne 0x10011256
mov dword [ebp - 0x7e4], 1
jmp 0x1001125d
and dword [ebp - 0x7e4], 0
push 2
lea ecx, [ebp - 0xe3c]
call fcn.1001026e
mov ecx, dword [ebp - 0x7e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1020], eax
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x1138], eax
push 0
lea ecx, [ebp - 0xb34]
call fcn.1001026e
cmp dword [ebp - 0x24], 0xc9d6c840
je 0x100112a9
mov dword [ebp - 0xc7c], 1
jmp 0x100112b0
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1028], eax
push 2
lea ecx, [ebp - 0xe3c]
call fcn.1001026e
mov esi, dword [eax]
push 0
lea ecx, [ebp - 0xd14]
call fcn.1001026e
mov eax, dword [eax]
lea eax, [esi + eax - 0x2c67]
mov dword [ebp - 0xc84], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xe3c]
call fcn.10010269
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd14]
call fcn.10010269
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb34]
call fcn.10010269
jmp 0x10010fc1
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x10d8], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x30c]
cmp dword [ebp + eax - 0x1178], ecx
jge 0x10011343
mov dword [ebp - 0x3bc], 1
jmp 0x1001134a
and dword [ebp - 0x3bc], 0
push 4
pop eax
shl eax, 1
imul ecx, dword [ebp - 0x3bc], 0x1dd6
cmp dword [ebp + eax - 0x1178], ecx
je 0x1001136e
mov dword [ebp - 0xc8c], 1
jmp 0x10011375
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x1030], eax
cmp dword [ebp - 0x24], 0
jne 0x10011393
mov dword [ebp - 0x7ec], 1
jmp 0x1001139a
and dword [ebp - 0x7ec], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7ec]
add ecx, 3
cmp dword [ebp + eax - 0x1178], ecx
jne 0x100113bd
mov dword [ebp - 0x3c4], 1
jmp 0x100113c4
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x7f4], eax
mov dword [ebp - 0x290], 0x9737e0d1
push 3
lea ecx, [ebp - 0xe54]
call fcn.10010227
mov byte [ebp - 4], 6
mov dword [ebp - 0xc94], 0xa4d0
mov dword [ebp - 0x3cc], 0x2a727599
mov dword [ebp - 0xc9c], 0
mov dword [ebp - 0x1a0], 0
jmp 0x10011423
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x10011445
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xe54]
call fcn.1001026e
mov dword [eax], 0xe9d05ba7
jmp 0x10011416
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x10011466
push 0
push 0x1138
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 2
lea ecx, [ebp - 0xe54]
call fcn.1001026e
mov ecx, dword [ebp - 0xc94]
cmp dword [eax], ecx
jge 0x10011489
mov dword [ebp - 0x7fc], 1
jmp 0x10011490
and dword [ebp - 0x7fc], 0
push 2
lea ecx, [ebp - 0xe54]
call fcn.1001026e
mov eax, dword [eax]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3cc]
cmp dword [ebp - 0x7fc], eax
jl 0x100114bf
mov dword [ebp - 0x3d4], 1
jmp 0x100114c6
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xc9c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe54]
call fcn.10010269
mov dword [ebp - 0x94], 0xfffffffd
mov dword [ebp - 0x94], 0xffffffed
jmp 0x10011504
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xfffffffb
jg 0x100116e3
mov dword [ebp - 0x13c], 0xfffffffa
mov dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x13c], eax
jl 0x1001154b
mov dword [ebp - 0x804], 1
jmp 0x10011552
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0xa82a
jge 0x10011576
mov dword [ebp - 0x3dc], 1
jmp 0x1001157d
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x3dc]
jge 0x10011597
mov dword [ebp - 0x80c], 1
jmp 0x1001159e
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x80c], eax
jg 0x100115b8
mov dword [ebp - 0x3e4], 1
jmp 0x100115bf
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x3e4], eax
jle 0x100115d9
mov dword [ebp - 0x814], 1
jmp 0x100115e0
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x814], eax
je 0x10011603
mov eax, 0x421e
test eax, eax
je 0x10011603
mov dword [ebp - 0x3ec], 1
jmp 0x1001160a
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x3ec]
jne 0x1001162a
cmp dword [ebp - 0x13c], 0
jne 0x1001162a
and dword [ebp - 0xca4], 0
jmp 0x10011634
mov dword [ebp - 0xca4], 1
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1038], eax
cmp dword [ebp - 0x94], 0
je 0x10011690
cmp dword [ebp - 0x2e8], 0
je 0x10011690
mov dword [ebp - 0xcac], 0x62f63069
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x10011680
push 0x24fb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp dword [ebp - 0xcac], 0
je 0x1001168e
jmp 0x100114f7
jmp 0x100116de
mov byte [ebp - 0xdb], 0
movzx eax, byte [ebp - 0xdb]
test eax, eax
je 0x100116b6
push 0
push 0x1829
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x100116de
push 0
push 0
push 0x1586
push 0x23c
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x100114f7
mov dword [ebp - 0x258], 0
jmp 0x100116fc
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 4
jge 0x1001171e
push dword [ebp - 0x258]
lea ecx, [ebp - 0xee4]
call fcn.1001026e
mov dword [eax], 0xfffffffc
jmp 0x100116ef
cmp dword [ebp - 0xcb4], 0
jle 0x10011733
mov dword [ebp - 0x81c], 1
jmp 0x1001173a
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 1
jne 0x1001174f
mov dword [ebp - 0x824], 1
jmp 0x10011756
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x3f4], eax
push 1
lea ecx, [ebp - 0xee4]
call fcn.1001026e
mov ecx, dword [ebp - 0x3f4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3f4]
cmp eax, dword [ebp - 0x824]
je 0x10011791
mov dword [ebp - 0xcbc], 1
jmp 0x10011798
and dword [ebp - 0xcbc], 0
mov eax, dword [ebp - 0xcc4]
mov dword [ebp - 0x10e8], eax
mov eax, dword [ebp - 0x834]
cmp dword [ebp - 0xccc], eax
jne 0x100117be
mov dword [ebp - 0x82c], 1
jmp 0x100117c5
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
cmp eax, dword [ebp - 0x82c]
je 0x100117eb
mov dword [ebp - 0x404], 1
jmp 0x100117f2
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0xe4bf748d
jne 0x1001180a
mov dword [ebp - 0xcd4], 1
jmp 0x10011811
and dword [ebp - 0xcd4], 0
mov eax, dword [ebp - 0x290]
dec eax
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x1040], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x834], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee4]
call fcn.10010269
mov dword [ebp - 0x2f0], 5
mov dword [ebp - 0x424], 0xffffffff
mov dword [ebp - 0x844], 0x44696a48
mov dword [ebp - 0xcdc], 0xffffffff
mov dword [ebp - 0xcf4], 0
push 4
lea ecx, [ebp - 0xefc]
call fcn.10010227
mov dword [ebp - 4], 7
mov dword [ebp - 0xcec], 0x7e673292
mov dword [ebp - 0x298], 0x9737e0d1
mov dword [ebp - 0x1a8], 0
jmp 0x100118b8
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 4
jge 0x100118da
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0xefc]
call fcn.1001026e
mov dword [eax], 0xfffffffc
jmp 0x100118ab
cmp dword [ebp - 0xcdc], 0
jle 0x100118ef
mov dword [ebp - 0x40c], 1
jmp 0x100118f6
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 1
jne 0x1001190b
mov dword [ebp - 0x414], 1
jmp 0x10011912
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x83c], eax
push 1
lea ecx, [ebp - 0xefc]
call fcn.1001026e
mov ecx, dword [ebp - 0x83c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x83c]
cmp eax, dword [ebp - 0x414]
je 0x1001194d
mov dword [ebp - 0xce4], 1
jmp 0x10011954
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0xcec]
mov dword [ebp - 0x10fc], eax
mov eax, dword [ebp - 0x424]
cmp dword [ebp - 0xcf4], eax
jne 0x1001197a
mov dword [ebp - 0x41c], 1
jmp 0x10011981
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x41c]
je 0x100119a7
mov dword [ebp - 0x84c], 1
jmp 0x100119ae
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 0xe4bf748d
jne 0x100119c6
mov dword [ebp - 0xcfc], 1
jmp 0x100119cd
and dword [ebp - 0xcfc], 0
mov eax, dword [ebp - 0x298]
dec eax
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x1048], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x424], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xefc]
call fcn.10010269
mov dword [ebp - 0x310], 5
mov dword [ebp - 0x86c], 0xffffffff
mov dword [ebp - 0x434], 0x44696a48
mov dword [ebp - 0xd04], 0xffffffff
mov dword [ebp - 0xdec], 0
push 4
lea ecx, [ebp - 0xf14]
call fcn.10010227
mov dword [ebp - 4], 8
mov dword [ebp - 0xde4], 0x7e673292
mov dword [ebp - 0x2a0], 0x9737e0d1
mov dword [ebp - 0x260], 0
jmp 0x10011a74
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 4
jge 0x10011a96
push dword [ebp - 0x260]
lea ecx, [ebp - 0xf14]
call fcn.1001026e
mov dword [eax], 0xfffffffc
jmp 0x10011a67
cmp dword [ebp - 0xd04], 0
jle 0x10011aab
mov dword [ebp - 0x854], 1
jmp 0x10011ab2
and dword [ebp - 0x854], 0
cmp dword [ebp - 0x854], 1
jne 0x10011ac7
mov dword [ebp - 0x85c], 1
jmp 0x10011ace
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x42c], eax
push 1
lea ecx, [ebp - 0xf14]
call fcn.1001026e
mov ecx, dword [ebp - 0x42c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x85c]
je 0x10011b09
mov dword [ebp - 0xddc], 1
jmp 0x10011b10
and dword [ebp - 0xddc], 0
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0x10f8], eax
mov eax, dword [ebp - 0x86c]
cmp dword [ebp - 0xdec], eax
jne 0x10011b36
mov dword [ebp - 0x864], 1
jmp 0x10011b3d
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
cmp eax, dword [ebp - 0x864]
je 0x10011b63
mov dword [ebp - 0x43c], 1
jmp 0x10011b6a
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0xe4bf748d
jne 0x10011b82
mov dword [ebp - 0xc3c], 1
jmp 0x10011b89
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0x2a0]
dec eax
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x1050], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x86c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf14]
call fcn.10010269
mov dword [ebp - 0xf4], 5
mov dword [ebp - 0x2a8], 0x2c5b641b
mov dword [ebp - 0x87c], 0xffffffff
mov dword [ebp - 0x88c], 0x6de6
mov dword [ebp - 0x884], 0xe50714ba
mov dword [ebp - 0xd00], 0x6d56a426
mov dword [ebp - 0x894], 0x971cf717
mov dword [ebp - 0xbd8], 0xffffffff
mov dword [ebp - 0x1b0], 0
jmp 0x10011c26
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x10011c42
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x368], 0x83bc1b0f
jmp 0x10011c19
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x368]
cmp dword [ebp - 0xf4], eax
jge 0x10011c62
mov dword [ebp - 0x444], 1
jmp 0x10011c69
and dword [ebp - 0x444], 0
mov dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x444]
jge 0x10011c8d
mov dword [ebp - 0x874], 1
jmp 0x10011c94
and dword [ebp - 0x874], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x368]
mov dword [ebp - 0x1110], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x874]
sub ecx, dword [ebp + eax - 0x368]
cmp ecx, dword [ebp - 0xf4]
jl 0x10011ccc
mov dword [ebp - 0x44c], 1
jmp 0x10011cd3
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0xf4]
imul eax, dword [ebp - 0x44c]
neg eax
mov dword [ebp - 0x87c], eax
jne 0x10011d0b
mov eax, 0x1b7e280b
test eax, eax
jne 0x10011d0b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x368], 0
jne 0x10011d0b
and dword [ebp - 0xbcc], 0
jmp 0x10011d15
mov dword [ebp - 0xbcc], 1
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x1058], eax
cmp dword [ebp - 0x88c], 0
je 0x10011d3f
cmp dword [ebp - 0xf4], 0
je 0x10011d3f
mov dword [ebp - 0xd88], 1
jmp 0x10011d46
and dword [ebp - 0xd88], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x368], 0xffff
test eax, eax
je 0x10011d76
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x368], 0
je 0x10011d76
mov dword [ebp - 0x454], 1
jmp 0x10011d7d
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x884], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x368]
cmp dword [ebp - 0x884], eax
jl 0x10011da9
mov dword [ebp - 0x45c], 1
jmp 0x10011db0
and dword [ebp - 0x45c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x368]
cmp dword [ebp - 0x45c], eax
jle 0x10011dd1
mov dword [ebp - 0xbd0], 1
jmp 0x10011dd8
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0x2a8]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x368]
cmp eax, dword [ebp - 0x88c]
jle 0x10011dff
mov dword [ebp - 0x464], 1
jmp 0x10011e06
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0xd00], eax
mov dword [ebp - 0x894], 1
cmp dword [ebp - 0x894], 0
je 0x10011e3a
cmp dword [ebp - 0xf4], 0
je 0x10011e3a
mov dword [ebp - 0x46c], 1
jmp 0x10011e41
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x46c]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x368]
lea eax, [eax + ecx - 0x1904]
mov dword [ebp - 0xbd8], eax
mov dword [ebp - 0xfc], 5
mov dword [ebp - 0x318], 0x2c5b641b
mov dword [ebp - 0x47c], 0xffffffff
mov dword [ebp - 0x48c], 0x6de6
mov dword [ebp - 0x484], 0xe50714ba
mov dword [ebp - 0xbe8], 0x6d56a426
mov dword [ebp - 0x494], 0x971cf717
mov dword [ebp - 0xd98], 0xffffffff
mov dword [ebp - 0x268], 0
jmp 0x10011ecf
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 3
jge 0x10011eeb
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0x350], 0x83bc1b0f
jmp 0x10011ec2
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x350]
cmp dword [ebp - 0xfc], eax
jge 0x10011f0b
mov dword [ebp - 0x89c], 1
jmp 0x10011f12
and dword [ebp - 0x89c], 0
mov dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x318]
cmp eax, dword [ebp - 0x89c]
jge 0x10011f36
mov dword [ebp - 0x474], 1
jmp 0x10011f3d
and dword [ebp - 0x474], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x350]
mov dword [ebp - 0x1118], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x474]
sub ecx, dword [ebp + eax - 0x350]
cmp ecx, dword [ebp - 0xfc]
jl 0x10011f75
mov dword [ebp - 0x8e8], 1
jmp 0x10011f7c
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0xfc]
imul eax, dword [ebp - 0x8e8]
neg eax
mov dword [ebp - 0x47c], eax
jne 0x10011fb4
mov eax, 0x1b7e280b
test eax, eax
jne 0x10011fb4
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x350], 0
jne 0x10011fb4
and dword [ebp - 0xd90], 0
jmp 0x10011fbe
mov dword [ebp - 0xd90], 1
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xf7c], eax
cmp dword [ebp - 0x48c], 0
je 0x10011fe8
cmp dword [ebp - 0xfc], 0
je 0x10011fe8
mov dword [ebp - 0xbe0], 1
jmp 0x10011fef
and dword [ebp - 0xbe0], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x350], 0xffff
test eax, eax
je 0x1001201f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x350], 0
je 0x1001201f
mov dword [ebp - 0x8f0], 1
jmp 0x10012026
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x484], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x350]
cmp dword [ebp - 0x484], eax
jl 0x10012052
mov dword [ebp - 0x8f8], 1
jmp 0x10012059
and dword [ebp - 0x8f8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x350]
cmp dword [ebp - 0x8f8], eax
jle 0x1001207a
mov dword [ebp - 0xd08], 1
jmp 0x10012081
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0x318]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x350]
cmp eax, dword [ebp - 0x48c]
jle 0x100120a8
mov dword [ebp - 0x900], 1
jmp 0x100120af
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0xbe8], eax
mov dword [ebp - 0x494], 1
cmp dword [ebp - 0x494], 0
je 0x100120e3
cmp dword [ebp - 0xfc], 0
je 0x100120e3
mov dword [ebp - 0x908], 1
jmp 0x100120ea
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x908]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x350]
lea eax, [eax + ecx - 0x1904]
mov dword [ebp - 0xd98], eax
mov dword [ebp - 0x1bc], 0xdfe4d9ed
mov dword [ebp - 0x124], 0x1289
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x928], 0x7f4a1d2d
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x180], 0xb281
mov dword [ebp - 0xd18], 0xffffffff
mov dword [ebp - 0xbf8], 1
mov dword [ebp - 0xda0], 0xffff
mov dword [ebp - 0x514], 0x48fb8aaa
mov dword [ebp - 0x3c], 0
jmp 0x10012183
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10012199
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xb58], 0xbf58
jmp 0x1001217c
mov dword [ebp - 0x3c], 0
jmp 0x100121a9
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x100121bf
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xf64], 0xc44d9964
jmp 0x100121a2
mov dword [ebp - 0x3c], 0
jmp 0x100121cf
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x100121e5
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x2fc], 0xffffffff
jmp 0x100121c8
mov eax, 0x8a527335
test eax, eax
je 0x10012368
mov eax, dword [ebp - 0x124]
add eax, 0xdfddae9
mov dword [ebp - 0x270], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb58]
cmp dword [ebp - 0x270], eax
jg 0x10012224
mov dword [ebp - 0x49c], 1
jmp 0x1001222b
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
inc eax
cmp eax, dword [ebp - 0x124]
jg 0x10012246
mov dword [ebp - 0x910], 1
jmp 0x1001224d
and dword [ebp - 0x910], 0
imul eax, dword [ebp - 0x910], 0xfffffff8
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xb58]
jne 0x1001226f
mov dword [ebp - 0x2b0], 1
jmp 0x10012276
and dword [ebp - 0x2b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2b0]
mov dword [ebp + eax - 0xf64], ecx
cmp dword [ebp - 0x2b0], 0xfffffff8
jne 0x1001229e
mov dword [ebp - 0x4a4], 1
jmp 0x100122a5
and dword [ebp - 0x4a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb58]
cmp dword [ebp - 0x4a4], eax
jle 0x100122c6
mov dword [ebp - 0x918], 1
jmp 0x100122cd
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x918], eax
jne 0x100122e7
mov dword [ebp - 0x4ac], 1
jmp 0x100122ee
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0xfffffff6
je 0x10012303
mov dword [ebp - 0x920], 1
jmp 0x1001230a
and dword [ebp - 0x920], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x920]
sub ecx, dword [ebp + eax - 0xb58]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0xb58]
jne 0x1001233d
cmp dword [ebp - 0x1bc], 0
jne 0x1001233d
and dword [ebp - 0x4b4], 0
jmp 0x10012347
mov dword [ebp - 0x4b4], 1
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x928], 0
je 0x10012368
mov dword [ebp - 0x4bc], 1
jmp 0x1001236f
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0xa963
jl 0x10012393
mov dword [ebp - 0xbf0], 1
jmp 0x1001239a
and dword [ebp - 0xbf0], 0
cmp dword [ebp - 0x270], 0
jne 0x100123aa
cmp dword [ebp - 0x270], 0
cmp dword [ebp - 0x124], 0x839bf5bf
je 0x100123c2
mov dword [ebp - 0x930], 1
jmp 0x100123c9
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x180]
add eax, dword [ebp - 0x930]
cmp eax, dword [ebp - 0x1bc]
jle 0x100123e9
mov dword [ebp - 0x4c4], 1
jmp 0x100123f0
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x4c4], eax
jg 0x1001240a
mov dword [ebp - 0x938], 1
jmp 0x10012411
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0xd18], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2fc], 0xf58a
jl 0x1001243c
mov dword [ebp - 0x4cc], 1
jmp 0x10012443
and dword [ebp - 0x4cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2fc]
cmp eax, dword [ebp - 0x4cc]
jge 0x10012464
mov dword [ebp - 0x940], 1
jmp 0x1001246b
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x940]
inc eax
cmp eax, 0x7e942faf
je 0x10012492
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf64], 0
jne 0x10012492
and dword [ebp - 0x4d4], 0
jmp 0x1001249c
mov dword [ebp - 0x4d4], 1
cmp dword [ebp - 0x4d4], 0x230b
jl 0x100124b4
mov dword [ebp - 0x948], 1
jmp 0x100124bb
and dword [ebp - 0x948], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb58]
cmp eax, dword [ebp - 0x948]
jne 0x100124e0
xor eax, eax
je 0x100124e0
mov dword [ebp - 0x4dc], 1
jmp 0x100124e7
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 3
jbe 0x100124fc
mov dword [ebp - 0x950], 1
jmp 0x10012503
and dword [ebp - 0x950], 0
cmp dword [ebp - 0x950], 0
jne 0x10012518
mov dword [ebp - 0x4e4], 1
jmp 0x1001251f
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
sub eax, 8
je 0x10012745
mov dword [ebp - 0x4fc], 0x58b0
mov dword [ebp - 0x5c], 0xffffffff
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x10012559
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0xf80], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0xf88], eax
mov eax, dword [ebp - 0x5c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x2fc]
jne 0x1001258a
cmp dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0xda0]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xb58]
jge 0x100125ae
mov dword [ebp - 0x958], 1
jmp 0x100125b5
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x958], eax
jge 0x100125cf
mov dword [ebp - 0x4ec], 1
jmp 0x100125d6
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x4ec], eax
je 0x100125ed
mov dword [ebp - 0x960], 1
jmp 0x100125f4
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x960], eax
jl 0x1001260b
mov dword [ebp - 0x4f4], 1
jmp 0x10012612
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0x50ed
jl 0x1001262a
mov dword [ebp - 0x968], 1
jmp 0x10012631
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x968]
sub eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0x5c]
jne 0x10012652
mov dword [ebp - 0x970], 1
jmp 0x10012659
and dword [ebp - 0x970], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf64]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
cmp eax, dword [ebp - 0x970]
jle 0x10012686
mov dword [ebp - 0x504], 1
jmp 0x1001268d
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x504], eax
jne 0x100126a4
mov dword [ebp - 0x978], 1
jmp 0x100126ab
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x978], eax
je 0x100126c2
mov dword [ebp - 0x50c], 1
jmp 0x100126c9
and dword [ebp - 0x50c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf64]
cmp dword [ebp - 0x50c], eax
jg 0x100126ea
mov dword [ebp - 0x980], 1
jmp 0x100126f1
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
add eax, 7
je 0x10012711
cmp dword [ebp - 0x514], 0
je 0x10012711
mov dword [ebp - 0xc00], 1
jmp 0x10012718
and dword [ebp - 0xc00], 0
cmp dword [ebp - 0x2b8], 0
jne 0x10012730
cmp dword [ebp - 0x5c], 0
jne 0x10012730
and dword [ebp - 0x988], 0
jmp 0x1001273a
mov dword [ebp - 0x988], 1
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0x5c], eax
jmp 0x1001278a
mov dword [ebp - 0x180], 0
jmp 0x1001275e
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jg 0x1001278a
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x10012788
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x10012751
mov dword [ebp - 0x104], 5
mov dword [ebp - 0x31c], 0x2c5b641b
mov dword [ebp - 0x998], 0xffffffff
mov dword [ebp - 0x9a8], 0x6de6
mov dword [ebp - 0x9a0], 0xe50714ba
mov dword [ebp - 0xc10], 0x6d56a426
mov dword [ebp - 0x9b0], 0x971cf717
mov dword [ebp - 0xd38], 0xffffffff
mov dword [ebp - 0x274], 0
jmp 0x100127f3
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jge 0x1001280f
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0x380], 0x83bc1b0f
jmp 0x100127e6
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x380]
cmp dword [ebp - 0x104], eax
jge 0x1001282f
mov dword [ebp - 0x51c], 1
jmp 0x10012836
and dword [ebp - 0x51c], 0
mov dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
cmp eax, dword [ebp - 0x51c]
jge 0x1001285a
mov dword [ebp - 0x990], 1
jmp 0x10012861
and dword [ebp - 0x990], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x380]
mov dword [ebp - 0xf90], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x990]
sub ecx, dword [ebp + eax - 0x380]
cmp ecx, dword [ebp - 0x104]
jl 0x10012899
mov dword [ebp - 0x524], 1
jmp 0x100128a0
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x104]
imul eax, dword [ebp - 0x524]
neg eax
mov dword [ebp - 0x998], eax
jne 0x100128d8
mov eax, 0x1b7e280b
test eax, eax
jne 0x100128d8
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x380], 0
jne 0x100128d8
and dword [ebp - 0xd28], 0
jmp 0x100128e2
mov dword [ebp - 0xd28], 1
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xf98], eax
cmp dword [ebp - 0x9a8], 0
je 0x1001290c
cmp dword [ebp - 0x104], 0
je 0x1001290c
mov dword [ebp - 0xc08], 1
jmp 0x10012913
and dword [ebp - 0xc08], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x380], 0xffff
test eax, eax
je 0x10012943
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x380], 0
je 0x10012943
mov dword [ebp - 0x52c], 1
jmp 0x1001294a
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x9a0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x380]
cmp dword [ebp - 0x9a0], eax
jl 0x10012976
mov dword [ebp - 0x534], 1
jmp 0x1001297d
and dword [ebp - 0x534], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x380]
cmp dword [ebp - 0x534], eax
jle 0x1001299e
mov dword [ebp - 0xdb4], 1
jmp 0x100129a5
and dword [ebp - 0xdb4], 0
mov eax, dword [ebp - 0x31c]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x380]
cmp eax, dword [ebp - 0x9a8]
jle 0x100129cc
mov dword [ebp - 0x53c], 1
jmp 0x100129d3
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0xc10], eax
mov dword [ebp - 0x9b0], 1
cmp dword [ebp - 0x9b0], 0
je 0x10012a07
cmp dword [ebp - 0x104], 0
je 0x10012a07
mov dword [ebp - 0x544], 1
jmp 0x10012a0e
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0x544]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x380]
lea eax, [eax + ecx - 0x1904]
mov dword [ebp - 0xd38], eax
mov dword [ebp - 0x4c], 0x5595
mov dword [ebp - 0x2c0], 0x40c3f30
mov dword [ebp - 0x9c8], 0xabebf3b8
push 1
lea ecx, [ebp - 0xf2c]
call fcn.10010227
mov dword [ebp - 4], 9
mov dword [ebp - 0x9e8], 0x633933b8
mov dword [ebp - 0x9f8], 0
mov dword [ebp - 0xdbc], 0x121f2059
mov dword [ebp - 0x74], 0
jmp 0x10012a90
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10012aac
push dword [ebp - 0x74]
lea ecx, [ebp - 0xf2c]
call fcn.1001026e
mov dword [eax], 1
jmp 0x10012a89
mov dword [ebp - 0x74], 0
jmp 0x10012abc
cmp dword [ebp - 0x74], 2
jge 0x10012ad2
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xff0], 5
jmp 0x10012ab5
cmp dword [ebp - 0x4c], 0xfff7
jae 0x10012ae7