Function at 0x10009609
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1108
call fcn.10069430
push esi
push edi
mov dword [ebp - 0xcc], 0x2ee76f50
mov dword [ebp - 0x334], 0x5e314a5e
mov dword [ebp - 0x54], 0
jmp 0x1000963c
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x10009652
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x388], 1
jmp 0x10009635
mov dword [ebp - 0x54], 0
jmp 0x10009662
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x10009678
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xbc4], 0
jmp 0x1000965b
mov dword [ebp - 0xcc], 0
jmp 0x10009691
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jg 0x100099df
mov dword [ebp - 0x3f8], 0xfab8c3ad
mov dword [ebp - 0x3f4], 0xfab8c3ad
mov dword [ebp - 0x3f0], 0xfab8c3ad
mov dword [ebp - 0x3ec], 0xfab8c3ad
mov dword [ebp - 0x158], 0x19e9
mov dword [ebp - 0x194], 0xffffffff
mov dword [ebp - 0x984], 0
mov dword [ebp - 0xb4c], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3f8], 1
jmp 0x1000971c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3f8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3f8], 0
jl 0x10009820
mov dword [ebp - 0x5a4], 0xbdfadf62
cmp dword [ebp - 0xcc], 0
jne 0x100097bc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x5a4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov eax, dword [ebp + eax*4 - 0x388]
cmp dword [ebp - 0x5a4], eax
jle 0x1000978a
mov dword [ebp - 0x944], 1
jmp 0x10009791
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x944]
mov dword [ebp - 0x194], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x388]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0xe1c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov eax, dword [ebp + eax*4 - 0x388]
imul eax, dword [ebp - 0x194]
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x158], 1
jmp 0x100097f6
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x1000981b
mov byte [ebp - 0x153], 0
movzx eax, byte [ebp - 0x153]
test eax, eax
je 0x10009819
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
jmp 0x100097e9
jmp 0x10009701
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x388]
cmp dword [ebp - 0xcc], eax
je 0x10009841
mov dword [ebp - 0x94c], 1
jmp 0x10009848
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
imul eax, dword [ebp - 0x194]
mov dword [ebp - 0x954], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x954]
mov dword [ebp + eax - 0x3f8], ecx
cmp dword [ebp - 0x954], 0
je 0x10009893
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x388], 0
je 0x10009893
mov dword [ebp - 0x95c], 1
jmp 0x1000989a
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xe24], eax
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0xe2c], eax
mov eax, 0xdfa9
test eax, eax
je 0x100098ee
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3f8], 0
je 0x100098ee
mov dword [ebp - 0x964], 1
jmp 0x100098f5
and dword [ebp - 0x964], 0
cmp dword [ebp - 0x964], 0
jbe 0x1000990a
mov dword [ebp - 0x96c], 1
jmp 0x10009911
and dword [ebp - 0x96c], 0
cmp dword [ebp - 0x96c], 0x8f7cf8fb
je 0x10009929
mov dword [ebp - 0x33c], 1
jmp 0x10009930
and dword [ebp - 0x33c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x33c]
mov dword [ebp + eax - 0xbc4], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x388]
cmp dword [ebp - 0x33c], eax
jne 0x10009964
mov dword [ebp - 0x974], 1
jmp 0x1000996b
and dword [ebp - 0x974], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x388]
cmp eax, dword [ebp - 0x974]
jg 0x1000998c
mov dword [ebp - 0x97c], 1
jmp 0x10009993
and dword [ebp - 0x97c], 0
cmp dword [ebp - 0x97c], 0xfffffffa
ja 0x100099a8
mov dword [ebp - 0xb44], 1
jmp 0x100099af
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xe34], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0x984], eax
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0xb4c], eax
jmp 0x10009684
mov dword [ebp - 0xe4], 0x2ee76f50
mov dword [ebp - 0x344], 0x5e314a5e
mov dword [ebp - 0xa4], 0
jmp 0x10009a0c
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x10009a28
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x394], 1
jmp 0x100099ff
mov dword [ebp - 0xa4], 0
jmp 0x10009a41
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x10009a5d
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xb54], 0
jmp 0x10009a34
mov dword [ebp - 0xe4], 0
jmp 0x10009a76
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jg 0x10009dc4
mov dword [ebp - 0x3d8], 0xfab8c3ad
mov dword [ebp - 0x3d4], 0xfab8c3ad
mov dword [ebp - 0x3d0], 0xfab8c3ad
mov dword [ebp - 0x3cc], 0xfab8c3ad
mov dword [ebp - 0x19c], 0x19e9
mov dword [ebp - 0x160], 0xffffffff
mov dword [ebp - 0x93c], 0
mov dword [ebp - 0xb64], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3d8], 1
jmp 0x10009b01
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3d8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d8], 0
jl 0x10009c05
mov dword [ebp - 0x98c], 0xbdfadf62
cmp dword [ebp - 0xe4], 0
jne 0x10009ba1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3d8]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x98c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d8]
mov eax, dword [ebp + eax*4 - 0x394]
cmp dword [ebp - 0x98c], eax
jle 0x10009b6f
mov dword [ebp - 0x994], 1
jmp 0x10009b76
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x160], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0xe3c], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xe44], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d8]
mov eax, dword [ebp + eax*4 - 0x394]
imul eax, dword [ebp - 0x160]
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x19c], 1
jmp 0x10009bdb
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jl 0x10009c00
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x10009bfe
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
jmp 0x10009bce
jmp 0x10009ae6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x394]
cmp dword [ebp - 0xe4], eax
je 0x10009c26
mov dword [ebp - 0x9bc], 1
jmp 0x10009c2d
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x9bc]
imul eax, dword [ebp - 0x160]
mov dword [ebp - 0x9c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9c4]
mov dword [ebp + eax - 0x3d8], ecx
cmp dword [ebp - 0x9c4], 0
je 0x10009c78
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x394], 0
je 0x10009c78
mov dword [ebp - 0x9cc], 1
jmp 0x10009c7f
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe4c], eax
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0xe54], eax
mov eax, 0xdfa9
test eax, eax
je 0x10009cd3
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3d8], 0
je 0x10009cd3
mov dword [ebp - 0x9d4], 1
jmp 0x10009cda
and dword [ebp - 0x9d4], 0
cmp dword [ebp - 0x9d4], 0
jbe 0x10009cef
mov dword [ebp - 0x9dc], 1
jmp 0x10009cf6
and dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x9dc], 0x8f7cf8fb
je 0x10009d0e
mov dword [ebp - 0x34c], 1
jmp 0x10009d15
and dword [ebp - 0x34c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x34c]
mov dword [ebp + eax - 0xb54], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x394]
cmp dword [ebp - 0x34c], eax
jne 0x10009d49
mov dword [ebp - 0x9a0], 1
jmp 0x10009d50
and dword [ebp - 0x9a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x394]
cmp eax, dword [ebp - 0x9a0]
jg 0x10009d71
mov dword [ebp - 0x998], 1
jmp 0x10009d78
and dword [ebp - 0x998], 0
cmp dword [ebp - 0x998], 0xfffffffa
ja 0x10009d8d
mov dword [ebp - 0xb5c], 1
jmp 0x10009d94
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe5c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d8]
mov dword [ebp - 0x93c], eax
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0xb64], eax
jmp 0x10009a69
mov dword [ebp - 0x180], 0xca4f833f
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x5c], 0
jmp 0x10009de8
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10009dfe
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xc0c], 2
jmp 0x10009de1
mov dword [ebp - 0x5c], 0
jmp 0x10009e0e
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x10009e24
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x720], 6
jmp 0x10009e07
mov dword [ebp - 0x180], 0
jmp 0x10009e3d
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jg 0x1000a104
mov dword [ebp - 0xb7c], 1
mov dword [ebp - 0x44], 0
jmp 0x10009e64
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10009e7a
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x2e0], 0x77dd6887
jmp 0x10009e5d
mov dword [ebp - 0x44], 0
jmp 0x10009e8a
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10009ea0
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x10d8], 7
jmp 0x10009e83
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2e0], 2
jmp 0x10009ece
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2e0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2e0], 0
jl 0x1000a0ff
mov dword [ebp - 0x438], 0xffffffff
mov dword [ebp - 0xe64], 0xfffffffa
mov dword [ebp - 0xc0], 0
jmp 0x10009f0f
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x10009f2b
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0xb74], 0x302aff63
jmp 0x10009f02
mov dword [ebp - 0xc0], 0
jmp 0x10009f44
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x10009f60
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0xec0], 1
jmp 0x10009f37
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e0]
cmp dword [ebp + eax*4 - 0xc0c], 0
jne 0x1000a093
xor eax, eax
jne 0x10009f9b
mov dword [ebp - 0x438], 0x8694a219
cmp dword [ebp - 0x438], 0
jne 0x10009f9b
and dword [ebp - 0x718], 0
jmp 0x10009fa5
mov dword [ebp - 0x718], 1
cmp dword [ebp - 0x718], 2
jne 0x10009fba
mov dword [ebp - 0xb6c], 1
jmp 0x10009fc1
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0x354]
dec eax
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0xe6c], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp + eax*4 - 0xc0c]
mov dword [ebp - 0xe74], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2e0]
mov dword [ebp - 0xe7c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x180]
cmp dword [ebp + eax - 0x2e0], ecx
jle 0x1000a021
mov dword [ebp - 0x440], 1
jmp 0x1000a028
and dword [ebp - 0x440], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xec0]
imul eax, dword [ebp - 0x440]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xb74]
jle 0x1000a057
mov dword [ebp - 0x888], 1
jmp 0x1000a05e
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0xb7c]
cmp dword [ebp - 0x888], eax
jle 0x1000a081
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e0]
cmp dword [ebp + eax*4 - 0xc0c], 0
mov eax, 0x3c94681c
test eax, eax
jne 0x1000a093
and dword [ebp - 0x448], 0
jmp 0x1000a09d
mov dword [ebp - 0x448], 1
cmp dword [ebp - 0x448], 0x6b471dfd
jl 0x1000a0b5
mov dword [ebp - 0xb84], 1
jmp 0x1000a0bc
and dword [ebp - 0xb84], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x720]
mov dword [ebp - 0xe84], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e0]
mov eax, dword [ebp + eax*4 - 0xc0c]
mov dword [ebp - 0xe8c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x720], 0x57a8360e
jmp 0x10009eb3
jmp 0x10009e30
mov byte [ebp - 0x14f], 0
movzx eax, byte [ebp - 0x14f]
test eax, eax
je 0x1000a129
push 0
push 0
push 0xc1b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xe94], 0xffffffff
mov dword [ebp - 0x64], 0
jmp 0x1000a143
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1000a159
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xac], 1
jmp 0x1000a13c
mov dword [ebp - 0x64], 0
jmp 0x1000a169
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1000a17f
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xb94], 3
jmp 0x1000a162
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xac], 0
jmp 0x1000a1ad
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac], 8
jl 0x1000a41d
mov dword [ebp - 0x168], 0x4768c0aa
mov dword [ebp - 0x890], 0xfffffffe
mov dword [ebp - 0x2c4], 0
jmp 0x1000a1ee
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 4
jge 0x1000a20a
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0x1090], 1
jmp 0x1000a1e1
mov dword [ebp - 0x168], 3
jmp 0x1000a223
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x1000a418
mov dword [ebp - 0x728], 0xfffffffe
mov dword [ebp - 0xb8c], 0x9953
mov dword [ebp - 0x2cc], 0
jmp 0x1000a25d
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 1
jge 0x1000a279
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0x2d4], 3
jmp 0x1000a250
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1000a2a4
push 0x1ed0
push 0x25f8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac], 0
je 0x1000a341
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac], 0
jl 0x1000a2d4
mov dword [ebp - 0x450], 1
jmp 0x1000a2db
and dword [ebp - 0x450], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d4]
cmp dword [ebp - 0x450], eax
jne 0x1000a2fc
mov dword [ebp - 0x940], 1
jmp 0x1000a303
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x728]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xac]
cmp eax, dword [ebp - 0x940]
jne 0x1000a337
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2d4], 0
jne 0x1000a337
and dword [ebp - 0x458], 0
jmp 0x1000a341
mov dword [ebp - 0x458], 1
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0xe9c], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp + eax*4 - 0x1090]
mov dword [ebp - 0xea4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d4]
mov dword [ebp - 0xeac], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp + eax*4 - 0x1090]
mov dword [ebp - 0xeb4], eax
cmp dword [ebp - 0x728], 0
jne 0x1000a39b
mov dword [ebp - 0x460], 1
jmp 0x1000a3a2
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0xf88], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac]
mov dword [ebp - 0xf90], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2d4], 0
jne 0x1000a3f6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac], 0
jne 0x1000a3f6
and dword [ebp - 0x468], 0
jmp 0x1000a400
mov dword [ebp - 0x468], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x468]
mov dword [ebp + eax - 0xb94], ecx
jmp 0x1000a216
jmp 0x1000a192
mov dword [ebp - 0xb9c], 0xfffffff7
mov dword [ebp - 0x6c], 0xada439be
mov dword [ebp - 0x480], 6
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0x16
jmp 0x1000a451
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xfffffff2
jl 0x1000a59b
mov dword [ebp - 0x2f0], 0x80444555
mov dword [ebp - 0x730], 0xf3faa32f
mov dword [ebp - 0xba4], 0x1a05132d
mov dword [ebp - 0xbac], 1
cmp dword [ebp - 0x2f0], 0
je 0x1000a49e
cmp dword [ebp - 0x6c], 0
je 0x1000a49e
mov dword [ebp - 0x898], 1
jmp 0x1000a4a5
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0xf98], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x730], eax
mov eax, dword [ebp - 0x730]
imul eax, dword [ebp - 0x2f0]
cmp eax, 0xffffffff
je 0x1000a4d8
mov dword [ebp - 0x470], 1
jmp 0x1000a4df
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x470], eax
jg 0x1000a4f6
mov dword [ebp - 0x9ac], 1
jmp 0x1000a4fd
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0xba4]
cmp dword [ebp - 0x9ac], eax
jl 0x1000a51d
cmp dword [ebp - 0x6c], 0
je 0x1000a51d
mov dword [ebp - 0x478], 1
jmp 0x1000a524
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 0xdae974ca
jne 0x1000a53c
mov dword [ebp - 0x738], 1
jmp 0x1000a543
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x898], eax
jg 0x1000a569
mov dword [ebp - 0x488], 1
jmp 0x1000a570
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0xbac], eax
mov byte [ebp - 0x142], 0
movzx eax, byte [ebp - 0x142]
test eax, eax
je 0x1000a596
push 0
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x1000a44a
mov dword [ebp - 0xd0], 0x2ee76f50
mov dword [ebp - 0x38c], 0x5e314a5e
mov dword [ebp - 0x10c], 0xfffffffc
mov dword [ebp - 0x2f8], 0xfffffff9
mov dword [ebp - 0x4a0], 0x33ee6768
mov dword [ebp - 0x2bc], 0
jmp 0x1000a5e6
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 2
jge 0x1000a602
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0xecc], 0xffffffff
jmp 0x1000a5d9
mov dword [ebp - 0x10c], 0xfffffffd
jmp 0x1000a61b
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x17
je 0x1000a7bc
mov dword [ebp - 0x190], 0xa654
mov dword [ebp - 0xdc], 2
mov dword [ebp - 0xbb4], 0xc0a9c5a7
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xff0], eax
mov eax, 0xc25fcc58
test eax, eax
je 0x1000a757
cmp dword [ebp - 0x2f8], 0
jne 0x1000a6fa
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xff8], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x1000], eax
mov eax, 0x92978d8e
cmp eax, 0xffffffff
ja 0x1000a69a
mov dword [ebp - 0x740], 1
jmp 0x1000a6a1
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x740], eax
je 0x1000a6bb
mov dword [ebp - 0x490], 1
jmp 0x1000a6c2
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x490]
inc eax
je 0x1000a6d7
mov dword [ebp - 0x948], 1
jmp 0x1000a6de
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x948], eax
jge 0x1000a6f1
xor eax, eax
inc eax
jne 0x1000a6fa
and dword [ebp - 0x498], 0
jmp 0x1000a704
mov dword [ebp - 0x498], 1
mov eax, dword [ebp - 0x190]
add eax, dword [ebp - 0x498]
cmp eax, 0xc312fbb6
je 0x1000a729
cmp dword [ebp - 0x2f8], 0
jne 0x1000a729
and dword [ebp - 0x748], 0
jmp 0x1000a733
mov dword [ebp - 0x748], 1
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0xdc], eax
cmp dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x1010], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0xdc], 0
jmp 0x1000a79b
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x1000a7b7
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0xecc], 1
jmp 0x1000a78e
jmp 0x1000a60e
mov dword [ebp - 0x208], 0x1f2c29a3
mov dword [ebp - 0x1018], 0xbe76d238
mov dword [ebp - 0x1020], 0xffffffff
mov dword [ebp - 0x1028], 0x3cc25429
mov dword [ebp - 0x1030], 0xef068cd5
mov dword [ebp - 0x1038], 6
mov dword [ebp - 0x1040], 0xfffffff6
mov dword [ebp - 0x1048], 0xe6fc2e60
mov dword [ebp - 0x1050], 0xfffffff7
mov dword [ebp - 0x1058], 0x2e6c0b33
mov dword [ebp - 0x1060], 0x3f6a0837
mov dword [ebp - 0x1068], 0x3cef3392
mov dword [ebp - 0x1070], 0x56e623b2
mov dword [ebp - 0xf54], 0x8993dd61
mov dword [ebp - 0xcf8], 7
mov dword [ebp - 0x105c], 0xb4b26d8f
mov dword [ebp - 0xd00], 0xffffffff
mov dword [ebp - 0xea8], 0xffffffff
mov dword [ebp - 0xd08], 5
mov dword [ebp - 0xfbc], 0xffffffff
mov dword [ebp - 0xd10], 0
mov dword [ebp - 0xeb0], 0
mov dword [ebp - 0xd18], 0xfffffff8
mov dword [ebp - 0x1024], 0xffffffff
mov dword [ebp - 0xd20], 5
mov dword [ebp - 0xeb8], 0x890ba5fc
mov dword [ebp - 0xd28], 0xfffffffb
mov dword [ebp - 0x8a0], 6
mov dword [ebp - 0x2d8], 0
jmp 0x1000a8ed
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jge 0x1000a909
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0xfcc], 0xfffa
jmp 0x1000a8e0
mov dword [ebp - 0x208], 0
jmp 0x1000a922
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jg 0x1000a96c
mov dword [ebp - 0xbbc], 0xdb785b64
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x1000a954
push 0xfbf
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0xbbc], 0xd1a4e665
jmp 0x1000a915
mov eax, dword [ebp - 0x8a0]
dec eax
mov dword [ebp - 0x8a0], eax
mov dword [ebp - 0xc8], 0
jmp 0x1000a992
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x1000a9ae
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x3a0], 1
jmp 0x1000a985
mov dword [ebp - 0xc8], 0
jmp 0x1000a9c7
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1000a9e3
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0xa30], 0
jmp 0x1000a9ba
mov dword [ebp - 0xd0], 0
jmp 0x1000a9fc
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jg 0x1000b8c8
mov dword [ebp - 0x3e8], 0
mov dword [ebp - 0x3e4], 0
mov dword [ebp - 0x3e0], 0
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0x8b0], 0xfc3c737e
mov dword [ebp - 0xbf8], 0xa391de2f
mov dword [ebp - 0x228], 0
jmp 0x1000aa5e
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x1000aa7a
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x138], 0x8261
jmp 0x1000aa51
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3e8], 1
jmp 0x1000aaa8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3e8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e8], 0
jl 0x1000ad9e
mov dword [ebp - 0xbe8], 0xfffffffd
mov dword [ebp - 0x288], 0
jmp 0x1000aadf
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jge 0x1000aafb
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0xec], 0
jmp 0x1000aad2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xec], 0
jmp 0x1000ab29
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 1
jg 0x1000ad99
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x74], 1
jmp 0x1000ab54
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x1000ad94
mov dword [ebp - 0x30], 1
mov dword [ebp - 0xa10], 1
mov dword [ebp - 0x30], 1
jmp 0x1000ab7f
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1000abb0
mov byte [ebp - 0x152], 0
movzx eax, byte [ebp - 0x152]
test eax, eax
je 0x1000abae
push 0x241c
push 0x1aba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
jmp 0x1000ab78
mov dword [ebp - 0x30], 1
jmp 0x1000abc0
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1000ad8f
mov dword [ebp - 0x35c], 0x5493e623
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xec4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3e8], 0
je 0x1000acd9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 0
je 0x1000ac32
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 0
je 0x1000ac32
mov dword [ebp - 0x4a8], 1
jmp 0x1000ac39
and dword [ebp - 0x4a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e8]
imul eax, dword [ebp - 0x4a8]
test eax, eax
je 0x1000ac6a
mov eax, dword [ebp - 0x74]
cmp dword [ebp + eax*4 - 0x138], 0
je 0x1000ac6a
mov dword [ebp - 0x750], 1
jmp 0x1000ac71
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x750], eax
jl 0x1000ac88
mov dword [ebp - 0x4b0], 1
jmp 0x1000ac8f
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x4b0]
je 0x1000acb5
cmp dword [ebp - 0xa10], 0
je 0x1000acb5
cmp dword [ebp - 0x74], 0
je 0x1000acb5
mov dword [ebp - 0x9b4], 1
jmp 0x1000acbc
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x9b4]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x35c]
jg 0x1000acd9
mov dword [ebp - 0x4b8], 1
jmp 0x1000ace0
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0x138]
mov ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x4b8]
add eax, ecx
cmp eax, 1
jne 0x1000ad07
mov dword [ebp - 0x758], 1
jmp 0x1000ad0e
and dword [ebp - 0x758], 0
cmp dword [ebp - 0x758], 0x4f20077f
jge 0x1000ad26
mov dword [ebp - 0xbe0], 1
jmp 0x1000ad2d
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xd38], eax
push 8
pop eax
cmp eax, 0xfffffff7
jg 0x1000ad4a
mov dword [ebp - 0x4c0], 1
jmp 0x1000ad51
and dword [ebp - 0x4c0], 0
cmp dword [ebp - 0x4c0], 0xc0a1033
je 0x1000ad69
mov dword [ebp - 0x8a8], 1
jmp 0x1000ad70
and dword [ebp - 0x8a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
imul eax, dword [ebp - 0x8a8]
mov dword [ebp - 0xbe8], eax
jmp 0x1000abb9
jmp 0x1000ab4d
jmp 0x1000ab0e
jmp 0x1000aa8d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
mov dword [ebp - 0x104c], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3e8]
cmp dword [ebp + eax - 0x138], ecx
jne 0x1000add9
mov dword [ebp - 0x4c8], 1
jmp 0x1000ade0
and dword [ebp - 0x4c8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4c8]
sub ecx, dword [ebp + eax - 0x3e8]
cmp ecx, 1
jl 0x1000ae04
mov dword [ebp - 0x300], 1
jmp 0x1000ae0b
and dword [ebp - 0x300], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x300]
mov dword [ebp + eax - 0x3e8], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
cmp dword [ebp - 0x300], eax
jge 0x1000ae3f
mov dword [ebp - 0x760], 1
jmp 0x1000ae46
and dword [ebp - 0x760], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
cmp eax, dword [ebp - 0x760]
jge 0x1000ae67
mov dword [ebp - 0x4d0], 1
jmp 0x1000ae6e
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
cmp dword [ebp - 0x4d0], eax
jle 0x1000ae8f
mov dword [ebp - 0x950], 1
jmp 0x1000ae96
and dword [ebp - 0x950], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x138]
cmp dword [ebp - 0x950], eax
je 0x1000aeb7
mov dword [ebp - 0x4d8], 1
jmp 0x1000aebe
and dword [ebp - 0x4d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
cmp dword [ebp - 0x4d8], eax
jl 0x1000aeec
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x138], 0
jne 0x1000aeec
and dword [ebp - 0x768], 0
jmp 0x1000aef6
mov dword [ebp - 0x768], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x138]
cmp dword [ebp - 0x768], eax
jge 0x1000af17
mov dword [ebp - 0x4e0], 1
jmp 0x1000af1e
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0xd40], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3e8]
mov dword [ebp - 0xed0], eax
mov eax, 0x67d3
add eax, 0xdb2edd43
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x138]
jg 0x1000af73
mov eax, 0x5de30ea3
test eax, eax
jne 0x1000af73
and dword [ebp - 0xbf0], 0
jmp 0x1000af7d
mov dword [ebp - 0xbf0], 1
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x138]
cmp dword [ebp + eax - 0x138], ecx
jg 0x1000afa5
mov dword [ebp - 0x4e8], 1
jmp 0x1000afac
and dword [ebp - 0x4e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
cmp dword [ebp - 0x4e8], eax
jne 0x1000afcd
mov dword [ebp - 0x770], 1
jmp 0x1000afd4
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0xbf8], eax
mov dword [ebp - 0x408], 0xfab8c3ad
mov dword [ebp - 0x404], 0xfab8c3ad
mov dword [ebp - 0x400], 0xfab8c3ad
mov dword [ebp - 0x3fc], 0xfab8c3ad
mov dword [ebp - 0x2b8], 0xb1cecb45
mov dword [ebp - 0xc00], 0x2abb
mov dword [ebp - 0xbf4], 1
mov dword [ebp - 0xb18], 0xf2fdad5
mov dword [ebp - 0xa20], 0x79b69b2e
mov dword [ebp - 0xd48], 0x17473468
mov dword [ebp - 0x308], 6
mov dword [ebp - 0xc5c], 4
mov dword [ebp - 0xc58], 4
mov dword [ebp - 0xc54], 4
mov dword [ebp - 0xc50], 4
mov dword [ebp - 0xb3c], 0x4b67
mov dword [ebp - 0x37c], 1
mov dword [ebp - 0x230], 0
jmp 0x1000b0a3
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x1000b0bf
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x10e4], 0xfffffff7
jmp 0x1000b096
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0xfdc], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0xbf4], eax
mov eax, dword [ebp - 0xa20]
cmp dword [ebp - 0xb3c], eax
jg 0x1000b106
cmp dword [ebp - 0x308], 0
je 0x1000b106
mov dword [ebp - 0x4f0], 1
jmp 0x1000b10d
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0x37c]
dec eax
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0xa4c]
cmp eax, dword [ebp - 0xa2c]
jne 0x1000b14c
mov dword [ebp - 0x9c0], 1
jmp 0x1000b153
and dword [ebp - 0x9c0], 0
cmp dword [ebp - 0x9c0], 0x7b332e0c
jg 0x1000b16b
mov dword [ebp - 0x4f8], 1
jmp 0x1000b172
and dword [ebp - 0x4f8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc5c]
cmp dword [ebp - 0x4f8], eax
jl 0x1000b193
mov dword [ebp - 0x778], 1
jmp 0x1000b19a
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0xd50], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc5c]
cmp dword [ebp - 0x2b8], eax
jne 0x1000b1d3
mov dword [ebp - 0x500], 1
jmp 0x1000b1da
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0x170], 0x19e9
mov dword [ebp - 0x1dc], 0xada439be
mov dword [ebp - 0xbd8], 0xfffffffa
mov dword [ebp - 0x238], 0
jmp 0x1000b21d
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 4
jge 0x1000b239
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xcbc], 0xbbca
jmp 0x1000b210
mov dword [ebp - 0x1dc], 3
jmp 0x1000b252
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jl 0x1000b5b9
mov dword [ebp - 0x28], 0x4cdb8faa
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x1000b282
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 0x28], 3
jmp 0x1000b292
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1000b2c2
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x1000b2c0
push 0
push 0x23f9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x1000b28b
mov dword [ebp - 0x28], 3
jmp 0x1000b2d2
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1000b5b4
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0xa28], 4
mov dword [ebp - 0x18], 3
jmp 0x1000b2fd
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1000b589
mov dword [ebp - 0x1a0], 0x8d3a18e4
mov dword [ebp - 0x310], 0xca779041
mov dword [ebp - 0x508], 0xe07ea4c5
mov dword [ebp - 0x1a0], 3
jmp 0x1000b33e
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jl 0x1000b584
mov dword [ebp - 0x210], 0x17c10977
mov dword [ebp - 0x788], 0xd058bbe5
mov dword [ebp - 0x290], 0
jmp 0x1000b378
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 2
jge 0x1000b394
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xed8], 0
jmp 0x1000b36b
mov dword [ebp - 0x210], 0
jmp 0x1000b3ad
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jg 0x1000b57f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xcbc]
mov dword [ebp - 0xedc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xd58], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x310], eax
mov eax, 0x94ff5452
cmp eax, 0x14b11f38
jb 0x1000b3f4
mov dword [ebp - 0x8b8], 1
jmp 0x1000b3fb
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xcbc]
mov dword [ebp - 0x102c], eax
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0xd60], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xee8], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xcbc], 0xf15cc7c4
jbe 0x1000b448
mov dword [ebp - 0x780], 1
jmp 0x1000b44f
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x780], eax
jge 0x1000b562
mov dword [ebp - 0x374], 3
mov dword [ebp - 0x528], 0x4c3f121f
cmp dword [ebp - 0x28], 0
je 0x1000b49e
mov eax, dword [ebp - 0x374]
mov ecx, dword [ebp - 0x374]
dec ecx
mov dword [ebp - 0x374], ecx
test eax, eax
je 0x1000b49e
mov dword [ebp - 0x518], 1
jmp 0x1000b4a5
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x18], 0xff93
jg 0x1000b4ba
mov dword [ebp - 0x510], 1
jmp 0x1000b4c1
and dword [ebp - 0x510], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xed8]
imul eax, dword [ebp - 0x510]
cmp dword [ebp - 0x28], eax
jle 0x1000b4e6
mov dword [ebp - 0x958], 1
jmp 0x1000b4ed
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
sub eax, dword [ebp - 0x528]
sub eax, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x518]
sub ecx, eax
mov dword [ebp - 0xa28], ecx
mov eax, dword [ebp - 0x788]
sub eax, 0x7a5e1371
cmp dword [ebp - 0x28], eax
jle 0x1000b529
mov dword [ebp - 0x520], 1
jmp 0x1000b530
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x520], eax
jl 0x1000b547
mov dword [ebp - 0x8c0], 1
jmp 0x1000b54e
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
sub eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x528], eax
jmp 0x1000b57a
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0xbd8], eax
jmp 0x1000b3a0
jmp 0x1000b331
jmp 0x1000b2f6
mov dword [ebp - 0x18], 0
jmp 0x1000b599
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1000b5af
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcbc], 0x3b7d
jmp 0x1000b592
jmp 0x1000b2cb
jmp 0x1000b245
mov dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 0x550], 0
mov dword [ebp - 0xa38], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x408], 1
jmp 0x1000b605
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x408]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x408], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x408], 0
jl 0x1000b709
mov dword [ebp - 0x790], 0xbdfadf62
cmp dword [ebp - 0xd0], 0
jne 0x1000b6a5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x408]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x790], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x408]
mov eax, dword [ebp + eax*4 - 0x3a0]
cmp dword [ebp - 0x790], eax
jle 0x1000b673
mov dword [ebp - 0x530], 1
jmp 0x1000b67a
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x188], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a0]
mov dword [ebp - 0xd68], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xfec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x408]
mov eax, dword [ebp + eax*4 - 0x3a0]
imul eax, dword [ebp - 0x188]
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x170], 1
jmp 0x1000b6df
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jl 0x1000b704
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x1000b702
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
jmp 0x1000b6d2
jmp 0x1000b5ea
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a0]
cmp dword [ebp - 0xd0], eax
je 0x1000b72a
mov dword [ebp - 0x9a8], 1
jmp 0x1000b731
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x9a8]
imul eax, dword [ebp - 0x188]
mov dword [ebp - 0x538], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x538]
mov dword [ebp + eax - 0x408], ecx
cmp dword [ebp - 0x538], 0
je 0x1000b77c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a0], 0
je 0x1000b77c
mov dword [ebp - 0x798], 1
jmp 0x1000b783
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0xef4], eax
mov eax, 0xdfa9
test eax, eax
je 0x1000b7d7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x408], 0
je 0x1000b7d7
mov dword [ebp - 0x540], 1
jmp 0x1000b7de
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x540], 0
jbe 0x1000b7f3
mov dword [ebp - 0x8c8], 1
jmp 0x1000b7fa
and dword [ebp - 0x8c8], 0
cmp dword [ebp - 0x8c8], 0x8f7cf8fb
je 0x1000b812
mov dword [ebp - 0x318], 1
jmp 0x1000b819
and dword [ebp - 0x318], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x318]
mov dword [ebp + eax - 0xa30], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a0]
cmp dword [ebp - 0x318], eax
jne 0x1000b84d
mov dword [ebp - 0x548], 1
jmp 0x1000b854
and dword [ebp - 0x548], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a0]
cmp eax, dword [ebp - 0x548]
jg 0x1000b875
mov dword [ebp - 0x7a0], 1
jmp 0x1000b87c
and dword [ebp - 0x7a0], 0
cmp dword [ebp - 0x7a0], 0xfffffffa
ja 0x1000b891
mov dword [ebp - 0xb20], 1
jmp 0x1000b898
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xd78], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x408]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0xa38], eax
jmp 0x1000a9ef
mov dword [ebp - 0x178], 0xca4f833f
mov dword [ebp - 0x370], 0
mov dword [ebp - 0xb4], 0
jmp 0x1000b8f5
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1000b911
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0xc18], 2
jmp 0x1000b8e8
mov dword [ebp - 0xb4], 0
jmp 0x1000b92a
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1000b946
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x568], 6
jmp 0x1000b91d
mov dword [ebp - 0x178], 0
jmp 0x1000b95f
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jg 0x1000bc08
mov dword [ebp - 0xb28], 1
mov dword [ebp - 0x7c], 0
jmp 0x1000b986
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1000b99c
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x2ec], 0x77dd6887
jmp 0x1000b97f
mov dword [ebp - 0x7c], 0
jmp 0x1000b9ac
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000b9c2
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x10f0], 7
jmp 0x1000b9a5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2ec], 2
jmp 0x1000b9f0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2ec], 0
jl 0x1000bc03
mov dword [ebp - 0x960], 0xffffffff
mov dword [ebp - 0x106c], 0xfffffffa
mov dword [ebp - 0x48], 0
jmp 0x1000ba28
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1000ba3e
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xa40], 0x302aff63
jmp 0x1000ba21
mov dword [ebp - 0x48], 0
jmp 0x1000ba4e
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1000ba64
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xee4], 1
jmp 0x1000ba47
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
cmp dword [ebp + eax*4 - 0xc18], 0
jne 0x1000bb97
xor eax, eax
jne 0x1000ba9f
mov dword [ebp - 0x960], 0x8694a219
cmp dword [ebp - 0x960], 0
jne 0x1000ba9f
and dword [ebp - 0x558], 0
jmp 0x1000baa9
mov dword [ebp - 0x558], 1
cmp dword [ebp - 0x558], 2
jne 0x1000babe
mov dword [ebp - 0xb98], 1
jmp 0x1000bac5
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0x370]
dec eax
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xd80], eax
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp + eax*4 - 0xc18]
mov dword [ebp - 0xf00], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2ec]
mov dword [ebp - 0xcf0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x178]
cmp dword [ebp + eax - 0x2ec], ecx
jle 0x1000bb25
mov dword [ebp - 0x7a8], 1
jmp 0x1000bb2c
and dword [ebp - 0x7a8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xee4]
imul eax, dword [ebp - 0x7a8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa40]
jle 0x1000bb5b
mov dword [ebp - 0x560], 1
jmp 0x1000bb62
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0xb28]
cmp dword [ebp - 0x560], eax
jle 0x1000bb85
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
cmp dword [ebp + eax*4 - 0xc18], 0
mov eax, 0x3c94681c
test eax, eax
jne 0x1000bb97
and dword [ebp - 0x8d0], 0
jmp 0x1000bba1
mov dword [ebp - 0x8d0], 1
cmp dword [ebp - 0x8d0], 0x6b471dfd
jl 0x1000bbb9
mov dword [ebp - 0xa48], 1
jmp 0x1000bbc0
and dword [ebp - 0xa48], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x568]
mov dword [ebp - 0xff4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
mov eax, dword [ebp + eax*4 - 0xc18]
mov dword [ebp - 0xd90], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x568], 0x57a8360e
jmp 0x1000b9d5
jmp 0x1000b952
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x1000bc2d
push 0
push 0
push 0xc1b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], 0x2ee6d058
mov dword [ebp - 0x7b0], 0xfffffffc
mov dword [ebp - 0x9d0], 2
mov dword [ebp - 0x588], 0xcc09
mov dword [ebp - 0x7c8], 0xffffffff
mov dword [ebp - 0x9b0], 4
mov dword [ebp - 0x5b8], 0xf7762406
mov dword [ebp - 0xa50], 0xe525036f
mov dword [ebp - 0x240], 0
jmp 0x1000bc93
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x1000bcaf
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xc44], 7
jmp 0x1000bc86
mov eax, dword [ebp - 4]
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x7b0], eax
je 0x1000bccf
mov dword [ebp - 0x570], 1
jmp 0x1000bcd6
and dword [ebp - 0x570], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x570]
mov dword [ebp + eax - 0xc44], ecx
mov dword [ebp - 0x9d0], 1
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x9d0], eax
je 0x1000bd0a
mov dword [ebp - 0x578], 1
jmp 0x1000bd11
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x578], eax
je 0x1000bd28
mov dword [ebp - 0x7b8], 1
jmp 0x1000bd2f
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x7b8]
je 0x1000bd4c
cmp dword [ebp - 4], 0
je 0x1000bd4c
mov dword [ebp - 0x580], 1
jmp 0x1000bd53
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x580]
je 0x1000bd6a
mov dword [ebp - 0x8d8], 1
jmp 0x1000bd71
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 0
je 0x1000bd9b
mov eax, 0x3334
test eax, eax
je 0x1000bd9b
mov dword [ebp - 0x7c0], 1
jmp 0x1000bda2
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x7c0], eax
je 0x1000bdb9
mov dword [ebp - 0x590], 1
jmp 0x1000bdc0
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
jne 0x1000bdda
mov dword [ebp - 0x968], 1
jmp 0x1000bde1
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x968]
je 0x1000be08
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc44], 0
je 0x1000be08
mov dword [ebp - 0x598], 1
jmp 0x1000be0f
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x7c8], eax
jge 0x1000be32
mov dword [ebp - 0x5a0], 1
jmp 0x1000be39
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
sub eax, dword [ebp - 4]
jne 0x1000be52
or eax, 0xffffffff
jne 0x1000be52
and dword [ebp - 0xbd4], 0
jmp 0x1000be5c
mov dword [ebp - 0xbd4], 1
cmp dword [ebp - 4], 0xffffffff
je 0x1000be6e
mov dword [ebp - 0x8e0], 1
jmp 0x1000be75
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x8e0], eax
jne 0x1000be8c
mov dword [ebp - 0x5a8], 1
jmp 0x1000be93
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x5a8]
cmp eax, 0xdfdaf0b5
jne 0x1000beaf
mov dword [ebp - 0x7d0], 1
jmp 0x1000beb6
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x7d0]
jne 0x1000becd
mov dword [ebp - 0x5b0], 1
jmp 0x1000bed4
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x5b8], eax
jne 0x1000bf0a
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1000bf0a
mov dword [ebp - 0x7d8], 1
jmp 0x1000bf11
and dword [ebp - 0x7d8], 0
cmp dword [ebp - 0x7d8], 0xfffb
je 0x1000bf29
mov dword [ebp - 0x5c0], 1
jmp 0x1000bf30
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 0xc7e7
je 0x1000bf48
mov dword [ebp - 0x8e8], 1
jmp 0x1000bf4f
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x8e8], eax
je 0x1000bf66
mov dword [ebp - 0x5c8], 1
jmp 0x1000bf6d
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0xfffffff7
jge 0x1000bf82
mov dword [ebp - 0x7e0], 1
jmp 0x1000bf89
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0xa50], eax
mov dword [ebp - 0x198], 0xca4f833f
mov dword [ebp - 0x320], 0
mov dword [ebp - 0xc4], 0
jmp 0x1000bfc2
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x1000bfde
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0xc24], 2
jmp 0x1000bfb5
mov dword [ebp - 0xc4], 0
jmp 0x1000bff7
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x1000c013
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x8f0], 6
jmp 0x1000bfea
mov dword [ebp - 0x198], 0
jmp 0x1000c02c
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jg 0x1000c311
mov dword [ebp - 0xba0], 1
mov dword [ebp - 0x84], 0
jmp 0x1000c05c
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1000c078
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x220], 0x77dd6887
jmp 0x1000c04f
mov dword [ebp - 0x84], 0
jmp 0x1000c091
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1000c0ad
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x1108], 7
jmp 0x1000c084
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x220], 2
jmp 0x1000c0db
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x220]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x220], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x220], 0
jl 0x1000c30c
mov dword [ebp - 0x5d0], 0xffffffff
mov dword [ebp - 0xf0c], 0xfffffffa
mov dword [ebp - 0xbc], 0
jmp 0x1000c11c
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x1000c138
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0xa58], 0x302aff63
jmp 0x1000c10f
mov dword [ebp - 0xbc], 0
jmp 0x1000c151
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1000c16d
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0xef0], 1
jmp 0x1000c144
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x220]
cmp dword [ebp + eax*4 - 0xc24], 0
jne 0x1000c2a0
xor eax, eax
jne 0x1000c1a8
mov dword [ebp - 0x5d0], 0x8694a219
cmp dword [ebp - 0x5d0], 0
jne 0x1000c1a8
and dword [ebp - 0x970], 0
jmp 0x1000c1b2
mov dword [ebp - 0x970], 1
cmp dword [ebp - 0x970], 2
jne 0x1000c1c7
mov dword [ebp - 0xb30], 1
jmp 0x1000c1ce
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0x320]
dec eax
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0xd98], eax
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp + eax*4 - 0xc24]
mov dword [ebp - 0xf50], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x220]
mov dword [ebp - 0xda0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x198]
cmp dword [ebp + eax - 0x220], ecx
jle 0x1000c22e
mov dword [ebp - 0x5d8], 1
jmp 0x1000c235
and dword [ebp - 0x5d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xef0]
imul eax, dword [ebp - 0x5d8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa58]
jle 0x1000c264
mov dword [ebp - 0x7e8], 1
jmp 0x1000c26b
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0xba0]
cmp dword [ebp - 0x7e8], eax
jle 0x1000c28e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x220]
cmp dword [ebp + eax*4 - 0xc24], 0
mov eax, 0x3c94681c
test eax, eax
jne 0x1000c2a0
and dword [ebp - 0x5e0], 0
jmp 0x1000c2aa
mov dword [ebp - 0x5e0], 1
cmp dword [ebp - 0x5e0], 0x6b471dfd
jl 0x1000c2c2
mov dword [ebp - 0xa60], 1
jmp 0x1000c2c9
and dword [ebp - 0xa60], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8f0]
mov dword [ebp - 0xf18], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x220]
mov eax, dword [ebp + eax*4 - 0xc24]
mov dword [ebp - 0xda8], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8f0], 0x57a8360e
jmp 0x1000c0c0
jmp 0x1000c01f
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x1000c336
push 0
push 0
push 0xc1b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x248], 0xaabecba2
mov dword [ebp - 0x2d0], 0
jmp 0x1000c359
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
jge 0x1000c375
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0x10bc], 2
jmp 0x1000c34c
mov dword [ebp - 0x248], 1
jmp 0x1000c38e
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x1000c3b1
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x1000c3af
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x1000c381
mov dword [ebp - 0xc], 0x2ee6d058
mov dword [ebp - 0x5e8], 0xfffffffc
mov dword [ebp - 0x5f0], 2
mov dword [ebp - 0x8f8], 0xcc09
mov dword [ebp - 0x618], 0xffffffff
mov dword [ebp - 0x630], 4
mov dword [ebp - 0x9b8], 0xf7762406
mov dword [ebp - 0xa68], 0xe525036f
mov dword [ebp - 0x298], 0
jmp 0x1000c417
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 2
jge 0x1000c433
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0xc4c], 7
jmp 0x1000c40a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x5e8], eax
je 0x1000c453
mov dword [ebp - 0x7f0], 1
jmp 0x1000c45a
and dword [ebp - 0x7f0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7f0]
mov dword [ebp + eax - 0xc4c], ecx
mov dword [ebp - 0x5f0], 1
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x5f0], eax
je 0x1000c48e
mov dword [ebp - 0x9c8], 1
jmp 0x1000c495
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x9c8], eax
je 0x1000c4ac
mov dword [ebp - 0x5f8], 1
jmp 0x1000c4b3
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x5f8]
je 0x1000c4d0
cmp dword [ebp - 0xc], 0
je 0x1000c4d0
mov dword [ebp - 0x7f8], 1
jmp 0x1000c4d7
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x7f8]
je 0x1000c4ee
mov dword [ebp - 0x600], 1
jmp 0x1000c4f5
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x8f8], 0
je 0x1000c51f
mov eax, 0x3334
test eax, eax
je 0x1000c51f
mov dword [ebp - 0x608], 1
jmp 0x1000c526
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x608], eax
je 0x1000c53d
mov dword [ebp - 0x800], 1
jmp 0x1000c544
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x800]
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0xc]
jne 0x1000c55e
mov dword [ebp - 0x610], 1
jmp 0x1000c565
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x610]
je 0x1000c58c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc4c], 0
je 0x1000c58c
mov dword [ebp - 0x978], 1
jmp 0x1000c593
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x618], eax
jge 0x1000c5b6
mov dword [ebp - 0x808], 1
jmp 0x1000c5bd
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x808]
sub eax, dword [ebp - 0xc]
jne 0x1000c5d6
or eax, 0xffffffff
jne 0x1000c5d6
and dword [ebp - 0xb38], 0
jmp 0x1000c5e0
mov dword [ebp - 0xb38], 1
cmp dword [ebp - 0xc], 0xffffffff
je 0x1000c5f2
mov dword [ebp - 0x620], 1
jmp 0x1000c5f9
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x620], eax
jne 0x1000c610
mov dword [ebp - 0x900], 1
jmp 0x1000c617
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x900]
cmp eax, 0xdfdaf0b5
jne 0x1000c633
mov dword [ebp - 0x628], 1
jmp 0x1000c63a
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x628]
jne 0x1000c651
mov dword [ebp - 0x810], 1
jmp 0x1000c658
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x9b8], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x9b8], eax
jne 0x1000c68e
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1000c68e
mov dword [ebp - 0x638], 1
jmp 0x1000c695
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0xfffb
je 0x1000c6ad
mov dword [ebp - 0x818], 1
jmp 0x1000c6b4
and dword [ebp - 0x818], 0
cmp dword [ebp - 0x818], 0xc7e7
je 0x1000c6cc
mov dword [ebp - 0x640], 1
jmp 0x1000c6d3
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x640], eax
je 0x1000c6ea
mov dword [ebp - 0x908], 1
jmp 0x1000c6f1
and dword [ebp - 0x908], 0
cmp dword [ebp - 0x908], 0xfffffff7
jge 0x1000c706
mov dword [ebp - 0x648], 1
jmp 0x1000c70d
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0xa68], eax
mov dword [ebp - 0x8c], 0
jmp 0x1000c732
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1000c74e
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xf58], 1
jmp 0x1000c725
mov dword [ebp - 0x8c], 0
jmp 0x1000c767
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1000c783
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x9e4], 0xba394643
jmp 0x1000c75a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9e4], 0
jmp 0x1000c7b1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9e4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9e4], 0
jg 0x1000c839
mov dword [ebp - 0x250], 0
mov dword [ebp - 0xa70], 0xb2bc40ed
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x1000c7f2
push 0x127b
call dword [sym.imp.USER32.dll_MessageBeep]
mov dword [ebp - 0x250], 0
jmp 0x1000c80b
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jl 0x1000c834
mov dword [ebp - 0xbec], 0x79e672ca
mov dword [ebp - 0xbec], 0xffffffff
mov dword [ebp - 0xa70], 0xa233712
jmp 0x1000c7fe
jmp 0x1000c796
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x1000c85d
push 0x565
push 0x1cb2
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
mov dword [ebp - 0x258], 0xaabecba2
mov dword [ebp - 0x2c0], 0
jmp 0x1000c880
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jge 0x1000c89c
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x10c4], 2
jmp 0x1000c873
mov dword [ebp - 0x258], 1
jmp 0x1000c8b5
mov eax, dword [ebp - 0x258]
dec eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jl 0x1000c8d8
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x1000c8d6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x1000c8a8
mov dword [ebp - 8], 0x2ee6d058
mov dword [ebp - 0x820], 0xfffffffc
mov dword [ebp - 0x980], 2
mov dword [ebp - 0x668], 0xcc09
mov dword [ebp - 0x838], 0xffffffff
mov dword [ebp - 0x988], 4
mov dword [ebp - 0x698], 0xf7762406
mov dword [ebp - 0xa78], 0xe525036f
mov dword [ebp - 0x2a0], 0
jmp 0x1000c93e
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jge 0x1000c95a
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0xc3c], 7
jmp 0x1000c931
mov eax, dword [ebp - 8]
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x820], eax
je 0x1000c97a
mov dword [ebp - 0x650], 1
jmp 0x1000c981
and dword [ebp - 0x650], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x650]
mov dword [ebp + eax - 0xc3c], ecx
mov dword [ebp - 0x980], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x980], eax
je 0x1000c9b5
mov dword [ebp - 0x658], 1
jmp 0x1000c9bc
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x658], eax
je 0x1000c9d3
mov dword [ebp - 0x828], 1
jmp 0x1000c9da
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x828]
je 0x1000c9f7
cmp dword [ebp - 8], 0
je 0x1000c9f7
mov dword [ebp - 0x660], 1
jmp 0x1000c9fe
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x660]
je 0x1000ca15
mov dword [ebp - 0x910], 1
jmp 0x1000ca1c
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 0
je 0x1000ca46
mov eax, 0x3334
test eax, eax
je 0x1000ca46
mov dword [ebp - 0x830], 1
jmp 0x1000ca4d
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x830], eax
je 0x1000ca64
mov dword [ebp - 0x670], 1
jmp 0x1000ca6b
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 8]
jne 0x1000ca85
mov dword [ebp - 0x9d8], 1
jmp 0x1000ca8c
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x9d8]
je 0x1000cab3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc3c], 0
je 0x1000cab3
mov dword [ebp - 0x678], 1
jmp 0x1000caba
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x838], eax
jge 0x1000cadd
mov dword [ebp - 0x680], 1
jmp 0x1000cae4
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
sub eax, dword [ebp - 8]
jne 0x1000cafd
or eax, 0xffffffff
jne 0x1000cafd
and dword [ebp - 0xb40], 0
jmp 0x1000cb07
mov dword [ebp - 0xb40], 1
cmp dword [ebp - 8], 0xffffffff
je 0x1000cb19
mov dword [ebp - 0x918], 1
jmp 0x1000cb20
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x918], eax
jne 0x1000cb37