Function at 0x1000af15
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088631
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8f4
push esi
push edi
mov dword [ebp - 0x170], 0xfffffffb
mov dword [ebp - 0x5e4], 8
mov dword [ebp - 0x588], 0xffffffff
mov dword [ebp - 0x634], 1
mov dword [ebp - 0x168], 0
jmp 0x1000af76
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x1000af92
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x8ac], 0
jmp 0x1000af69
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1000afb5
push 0x17b3
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x800], eax
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x804], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x818], eax
mov eax, 0x9900
cmp eax, 1
jl 0x1000aff5
cmp dword [ebp - 0x170], 0
jne 0x1000aff5
and dword [ebp - 0x3e4], 0
jmp 0x1000afff
mov dword [ebp - 0x3e4], 1
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x3e4]
jne 0x1000b019
mov dword [ebp - 0x578], 1
jmp 0x1000b020
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0xffff
jne 0x1000b038
mov dword [ebp - 0x580], 1
jmp 0x1000b03f
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x590], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x590]
mov dword [ebp + eax - 0x8ac], ecx
mov eax, dword [ebp - 0x590]
add eax, 0xaee5
mov dword [ebp - 0x634], eax
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000f1b7
push 3
lea ecx, [ebp - 0x1e8]
call fcn.10010227
and dword [ebp - 4], 0
mov dword [ebp - 0xe8], 0xfffffffb
push 2
lea ecx, [ebp - 0x728]
call fcn.10010227
mov byte [ebp - 4], 1
mov dword [ebp - 0xe0], 0x8b922806
mov dword [ebp - 0x8c8], 0xfffffff9
mov dword [ebp - 0x64c], 0xce1a812c
push 2
lea ecx, [ebp - 0x6ac]
call fcn.10010227
mov byte [ebp - 4], 2
mov dword [ebp - 0x174], 0x26243a5d
mov dword [ebp - 0x28], 0
jmp 0x1000b0fc
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000b115
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1e8]
call fcn.1001026e
and dword [eax], 0
jmp 0x1000b0f5
mov dword [ebp - 0x28], 0
jmp 0x1000b125
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000b141
push dword [ebp - 0x28]
lea ecx, [ebp - 0x728]
call fcn.1001026e
mov dword [eax], 1
jmp 0x1000b11e
mov dword [ebp - 0x28], 0
jmp 0x1000b151
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000b16a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x6ac]
call fcn.1001026e
and dword [eax], 0
jmp 0x1000b14a
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1001026e
cmp dword [eax], 0xfbd3aeb5
jne 0x1000b18b
mov dword [ebp - 0x598], 1
jmp 0x1000b192
and dword [ebp - 0x598], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1001026e
mov eax, dword [eax]
imul eax, dword [ebp - 0x598]
sub eax, 6
mov dword [ebp - 0x58c], 1
jmp 0x1000b1be
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1001026e
mov ecx, dword [ebp - 0x58c]
cmp ecx, dword [eax]
jle 0x1000b1e1
mov dword [ebp - 0x560], 1
jmp 0x1000b1e8
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
sub eax, 0x27f7
cmp eax, 0xffffffff
jl 0x1000b204
mov dword [ebp - 0x200], 1
jmp 0x1000b20b
and dword [ebp - 0x200], 0
cmp dword [ebp - 0x200], 1
jl 0x1000b220
mov dword [ebp - 0x420], 1
jmp 0x1000b227
and dword [ebp - 0x420], 0
cmp dword [ebp - 0x420], 2
je 0x1000b23c
mov dword [ebp - 0x208], 1
jmp 0x1000b243
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x208], eax
jne 0x1000b25d
mov dword [ebp - 0x428], 1
jmp 0x1000b264
and dword [ebp - 0x428], 0
push 1
lea ecx, [ebp - 0x1e8]
call fcn.1001026e
mov ecx, dword [ebp - 0x428]
cmp ecx, dword [eax]
jl 0x1000b296
push 0
lea ecx, [ebp - 0x728]
call fcn.1001026e
cmp dword [eax], 0
jne 0x1000b296
and dword [ebp - 0x210], 0
jmp 0x1000b2a0
mov dword [ebp - 0x210], 1
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xe0], 6
jmp 0x1000b2c5
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 4
jle 0x1000b6f7
mov dword [ebp - 0x6c], 0x9968cb66
mov dword [ebp - 0x700], 0xfffffffc
mov dword [ebp - 0x6fc], 0xfffffffc
mov dword [ebp - 0x6f8], 0xfffffffc
mov dword [ebp - 0x6f4], 0xfffffffc
cmp dword [ebp - 0x6c], 0
je 0x1000b4be
push 0
lea ecx, [ebp - 0x728]
call fcn.1001026e
cmp dword [eax], 0
je 0x1000b3a5
cmp dword [ebp - 0x6c], 0xfffffff7
jge 0x1000b333
mov dword [ebp - 0x430], 1
jmp 0x1000b33a
and dword [ebp - 0x430], 0
push 1
lea ecx, [ebp - 0x6ac]
call fcn.1001026e
mov esi, dword [ebp - 0x430]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1001026e
cmp esi, dword [eax]
jg 0x1000b37e
push 1
lea ecx, [ebp - 0x6ac]
call fcn.1001026e
cmp dword [eax], 0
je 0x1000b37e
mov dword [ebp - 0x63c], 1
jmp 0x1000b385
and dword [ebp - 0x63c], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1001026e
mov ecx, dword [ebp - 0x6c]
cmp dword [eax], ecx
jl 0x1000b3a5
mov dword [ebp - 0x644], 1
jmp 0x1000b3ac
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x218], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x218]
mov dword [ebp + eax - 0x700], ecx
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x218], eax
jg 0x1000b3ef
mov dword [ebp - 0x438], 1
jmp 0x1000b3f6
and dword [ebp - 0x438], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1001026e
mov ecx, dword [ebp - 0x438]
cmp ecx, dword [eax]
jg 0x1000b419
mov dword [ebp - 0x220], 1
jmp 0x1000b420
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x220]
jle 0x1000b437
mov dword [ebp - 0x440], 1
jmp 0x1000b43e
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 2
jge 0x1000b453
mov dword [ebp - 0x228], 1
jmp 0x1000b45a
and dword [ebp - 0x228], 0
push 1
lea ecx, [ebp - 0x6ac]
call fcn.1001026e
mov ecx, dword [ebp - 0x228]
add ecx, dword [eax]
je 0x1000b4be
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1000b4b9
push 0x10e9
push 0
push 0xb36
push 0x1038
push 0x723
push 0
push 0x25ac
push 0x2577
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
jmp 0x1000b6cf
mov dword [ebp - 0x460], 0xfffffff8
mov dword [ebp - 0x164], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x700], 0xfff6
jb 0x1000b4f1
mov dword [ebp - 0x240], 1
jmp 0x1000b4f8
and dword [ebp - 0x240], 0
imul eax, dword [ebp - 0x64c], 0x5453
imul eax, dword [ebp - 0x6c]
cmp eax, 0xf849ec59
ja 0x1000b519
mov dword [ebp - 0x448], 1
jmp 0x1000b520
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x448], eax
jl 0x1000b53a
mov dword [ebp - 0x230], 1
jmp 0x1000b541
and dword [ebp - 0x230], 0
cmp dword [ebp - 0x230], 0x53575542
jge 0x1000b559
mov dword [ebp - 0x450], 1
jmp 0x1000b560
and dword [ebp - 0x450], 0
cmp dword [ebp - 0x450], 0xaec2c04d
jb 0x1000b578
mov dword [ebp - 0x238], 1
jmp 0x1000b57f
and dword [ebp - 0x238], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x700]
cmp dword [ebp - 0x238], eax
jle 0x1000b5a0
mov dword [ebp - 0x458], 1
jmp 0x1000b5a7
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 0x9b6a
jle 0x1000b5bf
mov dword [ebp - 0x654], 1
jmp 0x1000b5c6
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x820], eax
push 2
lea ecx, [ebp - 0x1e8]
call fcn.1001026e
or ecx, 0xffffffff
sub ecx, dword [ebp - 0x164]
cmp dword [eax], ecx
jle 0x1000b5ff
cmp dword [ebp - 0x164], 0
cmp dword [ebp - 0x6c], 0
je 0x1000b618
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1000b618
mov dword [ebp - 0x1b8], 1
jmp 0x1000b61f
and dword [ebp - 0x1b8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b8]
mov dword [ebp + eax - 0x700], ecx
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x1b8], eax
jle 0x1000b649
mov dword [ebp - 0x65c], 1
jmp 0x1000b650
and dword [ebp - 0x65c], 0
mov dword [ebp - 0x164], 0
mov dword [ebp - 0xe8], 0
jmp 0x1000b673
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 8
jne 0x1000b6cf
mov dword [ebp - 0x248], 5
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x1000b6cd
push 0x1d5f
push 0x64f
push 0x6b8
push 0x1442
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x1000b666
mov byte [ebp - 0xa3], 0
movzx eax, byte [ebp - 0xa3]
test eax, eax
je 0x1000b6f2
push 0x17b3
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
jmp 0x1000b2b8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6ac]
call fcn.10010269
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x728]
call fcn.10010269
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e8]
call fcn.10010269
push 4
lea ecx, [ebp - 0x68]
call fcn.10010227
mov dword [ebp - 4], 3
mov dword [ebp - 0x14], 0xc7e43439
mov dword [ebp - 0x1a4], 0xaeda1e1c
mov dword [ebp - 0x664], 0x1ca98231
mov dword [ebp - 0x140], 0
jmp 0x1000b769
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x1000b788
push dword [ebp - 0x140]
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov dword [eax], 0x149f
jmp 0x1000b75c
push 2
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov esi, eax
push 3
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x1000b7b0
mov dword [ebp - 0x468], 1
jmp 0x1000b7b7
and dword [ebp - 0x468], 0
push 3
lea ecx, [ebp - 0x68]
call fcn.1001026e
push 3
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov esi, dword [ebp - 0x468]
neg esi
push 3
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov edi, eax
push 0
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov ecx, 0x79b69b2e
sub ecx, dword [eax]
mov eax, dword [edi]
add eax, ecx
sub esi, eax
cmp esi, 1
jg 0x1000b807
mov dword [ebp - 0x250], 1
jmp 0x1000b80e
and dword [ebp - 0x250], 0
cmp dword [ebp - 0x250], 0x52065c82
jl 0x1000b826
mov dword [ebp - 0x470], 1
jmp 0x1000b82d
and dword [ebp - 0x470], 0
push 3
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x470]
je 0x1000b853
mov eax, 0xea0c8d46
test eax, eax
jne 0x1000b853
and dword [ebp - 0x258], 0
jmp 0x1000b85d
mov dword [ebp - 0x258], 1
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 3
jmp 0x1000b876
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1000bdcd
mov dword [ebp - 0x30], 0x96f8f9ed
mov dword [ebp - 0x1ac], 2
mov dword [ebp - 0x67c], 0x280eff2b
mov dword [ebp - 0x684], 0xec891f7d
mov dword [ebp - 0x30], 3
jmp 0x1000b8b5
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1000b8cf
push dword [ebp - 0x30]
lea ecx, [ebp - 0x68]
call fcn.1001026e
cmp dword [eax], 0
je 0x1000b8cd
jmp 0x1000b8cf
jmp 0x1000b8ae
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x884], eax
push 3
lea ecx, [ebp - 0x68]
call fcn.1001026e
cmp dword [eax], 1
je 0x1000b8f3
mov dword [ebp - 0x478], 1
jmp 0x1000b8fa
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x828], eax
push 2
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov eax, dword [eax]
dec eax
cmp eax, dword [ebp - 0x14]
jg 0x1000b92d
mov dword [ebp - 0x260], 1
jmp 0x1000b934
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x260], eax
jle 0x1000b94b
mov dword [ebp - 0x480], 1
jmp 0x1000b952
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0x46ac
jle 0x1000b96a
mov dword [ebp - 0x268], 1
jmp 0x1000b971
and dword [ebp - 0x268], 0
push 1
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov esi, dword [ebp - 0x268]
imul esi, dword [eax]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x68]
call fcn.1001026e
sub esi, dword [eax]
je 0x1000b9a3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x68]
call fcn.1001026e
cmp dword [eax], 0
jne 0x1000b9b0
xor eax, eax
jne 0x1000b9b0
and dword [ebp - 0x488], 0
jmp 0x1000b9ba
mov dword [ebp - 0x488], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x488], eax
jne 0x1000b9d1
mov dword [ebp - 0x270], 1
jmp 0x1000b9d8
and dword [ebp - 0x270], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x270]
jge 0x1000b9f9
mov dword [ebp - 0x490], 1
jmp 0x1000ba00
and dword [ebp - 0x490], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov ecx, dword [ebp - 0x490]
cmp ecx, dword [eax]
je 0x1000ba21
mov dword [ebp - 0x278], 1
jmp 0x1000ba28
and dword [ebp - 0x278], 0
push 3
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov ecx, dword [ebp - 0x278]
cmp ecx, dword [eax]
jge 0x1000ba48
mov dword [ebp - 0x498], 1
jmp 0x1000ba4f
and dword [ebp - 0x498], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov ecx, dword [ebp - 0x498]
cmp ecx, dword [eax]
jne 0x1000ba70
mov dword [ebp - 0x280], 1
jmp 0x1000ba77
and dword [ebp - 0x280], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x280]
jle 0x1000ba98
mov dword [ebp - 0x4a0], 1
jmp 0x1000ba9f
and dword [ebp - 0x4a0], 0
push 3
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov ecx, dword [ebp - 0x4a0]
cmp ecx, dword [eax]
jl 0x1000babf
mov dword [ebp - 0x288], 1
jmp 0x1000bac6
and dword [ebp - 0x288], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov ecx, dword [ebp - 0x288]
cmp ecx, dword [eax]
jne 0x1000bae7
mov dword [ebp - 0x4a8], 1
jmp 0x1000baee
and dword [ebp - 0x4a8], 0
imul esi, dword [ebp - 0x4a8], 0x8a66
neg esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x68]
call fcn.1001026e
add esi, dword [eax]
jne 0x1000bb1b
cmp dword [ebp - 0x1a4], 0
jne 0x1000bb1b
and dword [ebp - 0x290], 0
jmp 0x1000bb25
mov dword [ebp - 0x290], 1
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x290], eax
jle 0x1000bb3c
cmp dword [ebp - 0x1ac], 0
jne 0x1000bb46
cmp dword [ebp - 0x14], 0
je 0x1000bd9f
mov dword [ebp - 0x48], 0
jmp 0x1000bb56
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1000bb6c
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x85c], 0xfffffffe
jmp 0x1000bb4f
mov dword [ebp - 0x48], 0
jmp 0x1000bb7c
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1000bb92
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x770], 0xe27a8d2c
jmp 0x1000bb75
push 3
lea ecx, [ebp - 0x68]
call fcn.1001026e
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x85c], 0
push 4
pop eax
shl eax, 1
push 0xfffffffffffffffc
pop ecx
sub ecx, dword [ebp + eax - 0x770]
je 0x1000bbd3
xor eax, eax
inc eax
je 0x1000bbd3
xor eax, eax
je 0x1000bbd3
mov dword [ebp - 0x4b0], 1
jmp 0x1000bbda
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0x7a89a43d
jl 0x1000bbf2
mov dword [ebp - 0x298], 1
jmp 0x1000bbf9
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x664]
cmp dword [ebp - 0x298], eax
jl 0x1000bc13
mov dword [ebp - 0x66c], 1
jmp 0x1000bc1a
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x898], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x770]
cmp dword [ebp + eax - 0x770], ecx
jl 0x1000bc49
mov dword [ebp - 0x4b8], 1
jmp 0x1000bc50
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 0xffff
je 0x1000bc68
mov dword [ebp - 0x674], 1
jmp 0x1000bc6f
and dword [ebp - 0x674], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + eax - 0x85c], ecx
je 0x1000bc8c
mov dword [ebp - 0x2a0], 1
jmp 0x1000bc93
and dword [ebp - 0x2a0], 0
push 3
lea ecx, [ebp - 0x68]
call fcn.1001026e
mov ecx, dword [ebp - 0x2a0]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x67c]
jg 0x1000bcba
mov dword [ebp - 0x4c0], 1
jmp 0x1000bcc1
and dword [ebp - 0x4c0], 0
cmp dword [ebp - 0x4c0], 0xfffffffe
jb 0x1000bcd6
mov dword [ebp - 0x2a8], 1
jmp 0x1000bcdd
and dword [ebp - 0x2a8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x770]
cmp dword [ebp - 0x2a8], eax
jg 0x1000bcfd
mov dword [ebp - 0x4c8], 1
jmp 0x1000bd04
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x1ac]
sub eax, dword [ebp - 0x4c8]
cmp dword [ebp - 0x1a4], eax
jg 0x1000bd24
mov dword [ebp - 0x2b0], 1
jmp 0x1000bd2b
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x684]
imul eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 3
jmp 0x1000bd4b
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1000bd9d
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1000bd7a
push 0x1316
push 0x1cb7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1000bd9b
push 0
push 0
push 0x16ad
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x1000bd44
jmp 0x1000bdc8
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x1000bdb7
call dword [sym.imp.KERNEL32.dll_GetACP]
push 3
lea ecx, [ebp - 0x68]
call fcn.1001026e
cmp dword [eax], 0
je 0x1000bdc8
jmp 0x1000bdcd
jmp 0x1000b86f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10010269
mov dword [ebp - 0x98], 5
mov dword [ebp - 0x1b4], 0x2c5b641b
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x830], 0x23ed15de
mov dword [ebp - 0xf8], 0
jmp 0x1000be1a
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 4
jge 0x1000be36
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x8f0], 0xffffffff
jmp 0x1000be0d
mov dword [ebp - 0x148], 4
jmp 0x1000be4f
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x18
jl 0x1000be99
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0xcc], 0
jmp 0x1000be7b
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 4
jge 0x1000be97
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x8f0], 0x5816210b
jmp 0x1000be6e
jmp 0x1000be42
mov dword [ebp - 0x500], 0xffffffff
mov dword [ebp - 0x510], 0x6de6
push 2
lea ecx, [ebp - 0x7a0]
call fcn.10010227
mov dword [ebp - 4], 4
mov dword [ebp - 0x5c], 0
jmp 0x1000bed1
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1000bee7
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x100], 0xffffffff
jmp 0x1000beca
mov dword [ebp - 0x5c], 0
jmp 0x1000bef7
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1000bf13
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x7a0]
call fcn.1001026e
mov dword [eax], 0xfffffffb
jmp 0x1000bef0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x100], 0
jmp 0x1000bf41
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x100], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x100], 0xd
jne 0x1000bfce
mov dword [ebp - 0x150], 0x457102d1
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1000bf75
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [ebp - 0x150], 0xffffffe3
jmp 0x1000bf8e
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 1
jge 0x1000bfc9
push 0
lea ecx, [ebp - 0x7a0]
call fcn.1001026e
mov dword [eax], 0x33c63384
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1000bfc7
push 0x1e40
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x1000bf81
jmp 0x1000bf26
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7a0]
call fcn.10010269
mov dword [ebp - 0x508], 0xe50714ba
mov dword [ebp - 0x6e0], 0x6d56a426
mov dword [ebp - 0x518], 0x971cf717
mov dword [ebp - 0x108], 0
jmp 0x1000c014
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x1000c030
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x764], 3
jmp 0x1000c007
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x764], 0
jmp 0x1000c05e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x764]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x764], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x764], 0xfffffff8
jg 0x1000c14a
push 1
lea ecx, [ebp - 0x86c]
call fcn.10010227
mov dword [ebp - 4], 5
mov dword [ebp - 0x160], 8
mov dword [ebp - 0x158], 0
jmp 0x1000c0a9
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x1000c0cb
push dword [ebp - 0x158]
lea ecx, [ebp - 0x86c]
call fcn.1001026e
mov dword [eax], 0x683c8fc5
jmp 0x1000c09c
mov dword [ebp - 0x160], 0
jmp 0x1000c0e4
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jl 0x1000c136
mov byte [ebp - 0xa7], 0
movzx eax, byte [ebp - 0xa7]
test eax, eax
je 0x1000c107
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1000c134
push 0
push 0x1339
push 0
push 0
push 0x1850
push 0x1f45
call dword [sym.imp.USER32.dll_ToAsciiEx]
jmp 0x1000c0d7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x86c]
call fcn.10010269
jmp 0x1000c043
mov dword [ebp - 0x600], 0xffffffff
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0x4d0], 0xfffffffd
mov dword [ebp - 0xc0], 0xfffffff6
mov dword [ebp - 0x2b8], 7
mov dword [ebp - 0xb0], 0xe7374489
mov dword [ebp - 0x4f0], 5
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x114], 0
jmp 0x1000c1b3
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x1000c1cf
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x8e0], 0xfffffff6
jmp 0x1000c1a6
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x1000c1eb
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0xc0], 1
jne 0x1000c230
mov dword [ebp - 0x69c], 1
jmp 0x1000c237
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x7d8], eax
mov eax, 0x2b948214
test eax, eax
jne 0x1000c27c
mov dword [ebp - 0x4d8], 1
jmp 0x1000c283
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 4
jl 0x1000c298
mov dword [ebp - 0x71c], 1
jmp 0x1000c29f
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xb0]
jne 0x1000c2bf
mov dword [ebp - 0x2c0], 1
jmp 0x1000c2c6
and dword [ebp - 0x2c0], 0
cmp dword [ebp - 0x2c0], 0xffff
jbe 0x1000c2e7
cmp dword [ebp - 0xc0], 0
je 0x1000c2e7
mov dword [ebp - 0x4e0], 1
jmp 0x1000c2ee
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x4e0], eax
jg 0x1000c308
mov dword [ebp - 0x2c8], 1
jmp 0x1000c30f
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xb0], eax
jl 0x1000c335
mov dword [ebp - 0x180], 1
jmp 0x1000c33c
and dword [ebp - 0x180], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x180]
mov dword [ebp + eax - 0x8e0], ecx
mov eax, dword [ebp - 0xc0]
add eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0xb8]
jne 0x1000c36f
mov dword [ebp - 0x4e8], 1
jmp 0x1000c376
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0xaee51190
jbe 0x1000c38e
mov dword [ebp - 0x2d0], 1
jmp 0x1000c395
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x4f0], eax
mov eax, 0x12b57e8b
sub eax, dword [ebp - 0x4f0]
imul eax, dword [ebp - 0xc0]
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x144], 0
jmp 0x1000c3d2
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jge 0x1000c3ee
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x1d0], 0x83bc1b0f
jmp 0x1000c3c5
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d0]
cmp dword [ebp - 0x98], eax
jge 0x1000c40e
mov dword [ebp - 0x2d8], 1
jmp 0x1000c415
and dword [ebp - 0x2d8], 0
mov dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x2d8]
jge 0x1000c439
mov dword [ebp - 0x4f8], 1
jmp 0x1000c440
and dword [ebp - 0x4f8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d0]
mov dword [ebp - 0x7e0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4f8]
sub ecx, dword [ebp + eax - 0x1d0]
cmp ecx, dword [ebp - 0x98]
jl 0x1000c478
mov dword [ebp - 0x2e0], 1
jmp 0x1000c47f
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x2e0]
neg eax
mov dword [ebp - 0x500], eax
jne 0x1000c4b7
mov eax, 0x1b7e280b
test eax, eax
jne 0x1000c4b7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1d0], 0
jne 0x1000c4b7
and dword [ebp - 0x5f0], 0
jmp 0x1000c4c1
mov dword [ebp - 0x5f0], 1
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x7e8], eax
cmp dword [ebp - 0x510], 0
je 0x1000c4eb
cmp dword [ebp - 0x98], 0
je 0x1000c4eb
mov dword [ebp - 0x688], 1
jmp 0x1000c4f2
and dword [ebp - 0x688], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x1d0], 0xffff
test eax, eax
je 0x1000c522
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1d0], 0
je 0x1000c522
mov dword [ebp - 0x2e8], 1
jmp 0x1000c529
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x508], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d0]
cmp dword [ebp - 0x508], eax
jl 0x1000c555
mov dword [ebp - 0x2f0], 1
jmp 0x1000c55c
and dword [ebp - 0x2f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d0]
cmp dword [ebp - 0x2f0], eax
jle 0x1000c57d
mov dword [ebp - 0x5f8], 1
jmp 0x1000c584
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x1b4]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x1d0]
cmp eax, dword [ebp - 0x510]
jle 0x1000c5ab
mov dword [ebp - 0x2f8], 1
jmp 0x1000c5b2
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 0x518], 1
cmp dword [ebp - 0x518], 0
je 0x1000c5e6
cmp dword [ebp - 0x98], 0
je 0x1000c5e6
mov dword [ebp - 0x300], 1
jmp 0x1000c5ed
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x300]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1d0]
lea eax, [eax + ecx - 0x1904]
mov dword [ebp - 0x600], eax
push 2
lea ecx, [ebp - 0x77c]
call fcn.10010227
mov dword [ebp - 4], 6
mov dword [ebp - 0x50], 0
jmp 0x1000c636
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x1000c64c
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x11c], 0xffffffff
jmp 0x1000c62f
mov dword [ebp - 0x50], 0
jmp 0x1000c65c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1000c678
push dword [ebp - 0x50]
lea ecx, [ebp - 0x77c]
call fcn.1001026e
mov dword [eax], 0xfffffffb
jmp 0x1000c655
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x11c], 0
jmp 0x1000c6a6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x11c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x11c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x11c], 0xd
jne 0x1000c72d
mov dword [ebp - 0x15c], 0x457102d1
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1000c6da
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [ebp - 0x15c], 0xffffffe3
jmp 0x1000c6f3
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x1000c728
push 0
lea ecx, [ebp - 0x77c]
call fcn.1001026e
mov dword [eax], 0x33c63384
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x1000c726
push 0x1e40
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x1000c6e6
jmp 0x1000c68b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x77c]
call fcn.10010269
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x3c], 0xffffffed
jmp 0x1000c753
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffffb
jg 0x1000c91a
mov dword [ebp - 0xbc], 0xfffffffa
mov dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xbc], eax
jl 0x1000c791
mov dword [ebp - 0x520], 1
jmp 0x1000c798
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xa82a
jge 0x1000c7bc
mov dword [ebp - 0x308], 1
jmp 0x1000c7c3
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x308]
jge 0x1000c7da
mov dword [ebp - 0x528], 1
jmp 0x1000c7e1
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x528], eax
jg 0x1000c7fb
mov dword [ebp - 0x310], 1
jmp 0x1000c802
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x310], eax
jle 0x1000c81c
mov dword [ebp - 0x530], 1
jmp 0x1000c823
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x530], eax
je 0x1000c846
mov eax, 0x421e
test eax, eax
je 0x1000c846
mov dword [ebp - 0x318], 1
jmp 0x1000c84d
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x318]
jne 0x1000c86a
cmp dword [ebp - 0xbc], 0
jne 0x1000c86a
and dword [ebp - 0x6a0], 0
jmp 0x1000c874
mov dword [ebp - 0x6a0], 1
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0x3c], 0
je 0x1000c8c7
cmp dword [ebp - 0x188], 0
je 0x1000c8c7
mov dword [ebp - 0x608], 0x62f63069
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x1000c8b7
push 0x24fb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp dword [ebp - 0x608], 0
je 0x1000c8c5
jmp 0x1000c74c
jmp 0x1000c915
mov byte [ebp - 0x82], 0
movzx eax, byte [ebp - 0x82]
test eax, eax
je 0x1000c8ed
push 0
push 0x1829
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov byte [ebp - 0x84], 0
movzx eax, byte [ebp - 0x84]
test eax, eax
je 0x1000c915
push 0
push 0
push 0x1586
push 0x23c
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x1000c74c
mov dword [ebp - 0x14c], 0xdfe4d9ed
mov dword [ebp - 0xb4], 0x1289
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x474], 0x7f4a1d2d
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0xc4], 0xb281
mov dword [ebp - 0x610], 0xffffffff
mov dword [ebp - 0x6b0], 1
mov dword [ebp - 0x618], 0xffff
mov dword [ebp - 0x394], 0x48fb8aaa
mov dword [ebp - 0x18], 0
jmp 0x1000c98e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1000c9a4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c0], 0xbf58
jmp 0x1000c987
mov dword [ebp - 0x18], 0
jmp 0x1000c9b4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1000c9ca
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c8], 0xc44d9964
jmp 0x1000c9ad
mov dword [ebp - 0x18], 0
jmp 0x1000c9da
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1000c9f0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x190], 0xffffffff
jmp 0x1000c9d3
mov eax, 0x8a527335
test eax, eax
je 0x1000cb73
mov eax, dword [ebp - 0xb4]
add eax, 0xdfddae9
mov dword [ebp - 0x124], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c0]
cmp dword [ebp - 0x124], eax
jg 0x1000ca2f
mov dword [ebp - 0x538], 1
jmp 0x1000ca36
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
inc eax
cmp eax, dword [ebp - 0xb4]
jg 0x1000ca51
mov dword [ebp - 0x320], 1
jmp 0x1000ca58
and dword [ebp - 0x320], 0
imul eax, dword [ebp - 0x320], 0xfffffff8
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x5c0]
jne 0x1000ca7a
mov dword [ebp - 0x19c], 1
jmp 0x1000ca81
and dword [ebp - 0x19c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x19c]
mov dword [ebp + eax - 0x7c8], ecx
cmp dword [ebp - 0x19c], 0xfffffff8
jne 0x1000caa9
mov dword [ebp - 0x540], 1
jmp 0x1000cab0
and dword [ebp - 0x540], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c0]
cmp dword [ebp - 0x540], eax
jle 0x1000cad1
mov dword [ebp - 0x328], 1
jmp 0x1000cad8
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x328], eax
jne 0x1000caf2
mov dword [ebp - 0x548], 1
jmp 0x1000caf9
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 0xfffffff6
je 0x1000cb0e
mov dword [ebp - 0x550], 1
jmp 0x1000cb15
and dword [ebp - 0x550], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x550]
sub ecx, dword [ebp + eax - 0x5c0]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x5c0]
jne 0x1000cb48
cmp dword [ebp - 0x14c], 0
jne 0x1000cb48
and dword [ebp - 0x334], 0
jmp 0x1000cb52
mov dword [ebp - 0x334], 1
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x1000cb73
mov dword [ebp - 0x33c], 1
jmp 0x1000cb7a
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xa963
jl 0x1000cb9e
mov dword [ebp - 0x6e8], 1
jmp 0x1000cba5
and dword [ebp - 0x6e8], 0
cmp dword [ebp - 0x124], 0
jne 0x1000cbb5
cmp dword [ebp - 0x124], 0
cmp dword [ebp - 0xb4], 0x839bf5bf
je 0x1000cbcd
mov dword [ebp - 0x514], 1
jmp 0x1000cbd4
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0x14c]
jle 0x1000cbf4
mov dword [ebp - 0x344], 1
jmp 0x1000cbfb
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x344], eax
jg 0x1000cc15
mov dword [ebp - 0x47c], 1
jmp 0x1000cc1c
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x610], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x190], 0xf58a
jl 0x1000cc47
mov dword [ebp - 0x34c], 1
jmp 0x1000cc4e
and dword [ebp - 0x34c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp eax, dword [ebp - 0x34c]
jge 0x1000cc6f
mov dword [ebp - 0x564], 1
jmp 0x1000cc76
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
inc eax
cmp eax, 0x7e942faf
je 0x1000cc9d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c8], 0
jne 0x1000cc9d
and dword [ebp - 0x354], 0
jmp 0x1000cca7
mov dword [ebp - 0x354], 1
cmp dword [ebp - 0x354], 0x230b
jl 0x1000ccbf
mov dword [ebp - 0x484], 1
jmp 0x1000ccc6
and dword [ebp - 0x484], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c0]
cmp eax, dword [ebp - 0x484]
jne 0x1000cceb
xor eax, eax
je 0x1000cceb
mov dword [ebp - 0x35c], 1
jmp 0x1000ccf2
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 3
jbe 0x1000cd07
mov dword [ebp - 0x51c], 1
jmp 0x1000cd0e
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0
jne 0x1000cd23
mov dword [ebp - 0x364], 1
jmp 0x1000cd2a
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
sub eax, 8
je 0x1000cf50
mov dword [ebp - 0x37c], 0x58b0
mov dword [ebp - 0x38], 0xffffffff
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1000cd64
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x38]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x190]
jne 0x1000cd95
cmp dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x618]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x5c0]
jge 0x1000cdb9
mov dword [ebp - 0x48c], 1
jmp 0x1000cdc0
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x48c], eax
jge 0x1000cdda
mov dword [ebp - 0x36c], 1
jmp 0x1000cde1
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x36c], eax
je 0x1000cdf8
mov dword [ebp - 0x568], 1
jmp 0x1000cdff
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x568], eax
jl 0x1000ce16
mov dword [ebp - 0x374], 1
jmp 0x1000ce1d
and dword [ebp - 0x374], 0
cmp dword [ebp - 0x374], 0x50ed
jl 0x1000ce35
mov dword [ebp - 0x494], 1
jmp 0x1000ce3c
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x494]
sub eax, dword [ebp - 0x394]
cmp eax, dword [ebp - 0x38]
jne 0x1000ce5d
mov dword [ebp - 0x524], 1
jmp 0x1000ce64
and dword [ebp - 0x524], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c8]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
cmp eax, dword [ebp - 0x524]
jle 0x1000ce91
mov dword [ebp - 0x384], 1
jmp 0x1000ce98
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x384], eax
jne 0x1000ceaf
mov dword [ebp - 0x49c], 1
jmp 0x1000ceb6
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x49c], eax
je 0x1000cecd
mov dword [ebp - 0x38c], 1
jmp 0x1000ced4
and dword [ebp - 0x38c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c8]
cmp dword [ebp - 0x38c], eax
jg 0x1000cef5
mov dword [ebp - 0x56c], 1
jmp 0x1000cefc
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
add eax, 7
je 0x1000cf1c
cmp dword [ebp - 0x394], 0
je 0x1000cf1c
mov dword [ebp - 0x6f0], 1
jmp 0x1000cf23
and dword [ebp - 0x6f0], 0
cmp dword [ebp - 0x1a0], 0
jne 0x1000cf3b
cmp dword [ebp - 0x38], 0
jne 0x1000cf3b
and dword [ebp - 0x4a4], 0
jmp 0x1000cf45
mov dword [ebp - 0x4a4], 1
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x38], eax
jmp 0x1000cf95
mov dword [ebp - 0xc4], 0
jmp 0x1000cf69
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jg 0x1000cf95
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x1000cf93
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x1000cf5c
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x620], 4
mov dword [ebp - 0x52c], 1
mov dword [ebp - 0x704], 0x88f4f368
mov dword [ebp - 0x814], 0xfffffff6
mov dword [ebp - 0x12c], 0
jmp 0x1000cfe0
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x1000cffc
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x880], 0x2bd7b1c2
jmp 0x1000cfd3
cmp dword [ebp - 0xdc], 0
je 0x1000d01a
cmp dword [ebp - 0xdc], 0
je 0x1000d01a
mov dword [ebp - 0x39c], 1
jmp 0x1000d021
and dword [ebp - 0x39c], 0
cmp dword [ebp - 0x39c], 0
je 0x1000d03e
mov eax, dword [ebp - 0xdc]
imul eax, dword [ebp - 0xdc]
imul eax, dword [ebp - 0x620]
mov eax, dword [ebp - 0x52c]
cmp dword [ebp - 0x52c], eax
jl 0x1000d058
mov dword [ebp - 0x6c0], 1
jmp 0x1000d05f
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x628], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x628]
mov dword [ebp + eax - 0x880], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x880]
mov dword [ebp - 0x704], eax
mov dword [ebp - 0x3b4], 0xc6578637
mov dword [ebp - 0x630], 4
mov dword [ebp - 0x40], 0
jmp 0x1000d0b5
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1000d0cb
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1dc], 0
jmp 0x1000d0ae
mov dword [ebp - 0x40], 0
jmp 0x1000d0db
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1000d0f1
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x5d4], 0xffffffff
jmp 0x1000d0d4
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1dc]
mov dword [ebp - 0x81c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1dc]
mov dword [ebp - 0x824], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1dc]
cmp dword [ebp + eax - 0x1dc], ecx
jne 0x1000d13b
mov dword [ebp - 0x3a4], 1
jmp 0x1000d142
and dword [ebp - 0x3a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5d4]
imul eax, dword [ebp - 0x3a4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x5d4]
jg 0x1000d171
mov dword [ebp - 0x4ac], 1
jmp 0x1000d178
and dword [ebp - 0x4ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d4]
cmp dword [ebp - 0x4ac], eax
je 0x1000d199
mov dword [ebp - 0x3ac], 1
jmp 0x1000d1a0
and dword [ebp - 0x3ac], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1dc]
add eax, dword [ebp - 0x3ac]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x1dc]
cmp eax, 0x816f93bd
jae 0x1000d1d1
mov dword [ebp - 0x584], 1
jmp 0x1000d1d8
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x82c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1dc]
mov dword [ebp - 0x834], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d4]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x1dc]
sub eax, 6
cmp eax, dword [ebp - 0x630]
jg 0x1000d233
mov dword [ebp - 0x4b4], 1
jmp 0x1000d23a
and dword [ebp - 0x4b4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1dc]
cmp eax, dword [ebp - 0x4b4]
je 0x1000d25a
mov dword [ebp - 0x3bc], 1
jmp 0x1000d261
and dword [ebp - 0x3bc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp + eax - 0x1dc], ecx
mov dword [ebp - 0xd4], 0xfe0a8eac
push 1
lea ecx, [ebp - 0x5cc]
call fcn.10010227
mov dword [ebp - 4], 7
mov dword [ebp - 0x3cc], 0x6cc9ca31
mov dword [ebp - 0x534], 0x6c8cac31
mov dword [ebp - 0x1f8], 0x59f451db
mov dword [ebp - 0x16c], 0
jmp 0x1000d2c8
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x1000d2ea
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x5cc]
call fcn.1001026e
mov dword [eax], 0x1fe77dd6
jmp 0x1000d2bb
mov dword [ebp - 0xd4], 0
jmp 0x1000d303
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x15
jl 0x1000d53a
mov dword [ebp - 0x5a8], 0x1e948708
mov dword [ebp - 0x5a4], 0x1e948708
mov dword [ebp - 0x5a0], 0x1e948708
mov dword [ebp - 0x59c], 0x1e948708
mov dword [ebp - 0x3dc], 1
mov dword [ebp - 0x6d0], 0x2a1efe0c
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x5a8], 0
jmp 0x1000d37a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x5a8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5a8], 0
jl 0x1000d535
mov dword [ebp - 0x4cc], 0x7535
mov dword [ebp - 0x3c4], 0xed7c3b7c
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1000d3c6
push 0x143c
push 0x137
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x5a8]
lea ecx, [ebp - 0x5cc]
call fcn.1001026e
mov ecx, dword [ebp - 0x4cc]
cmp dword [eax], ecx
jge 0x1000d3f4
mov dword [ebp - 0x4bc], 1
jmp 0x1000d3fb
and dword [ebp - 0x4bc], 0
push 0
lea ecx, [ebp - 0x5cc]
call fcn.1001026e
mov eax, dword [eax]
add eax, 0x43cc
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x83c], eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x5a8]
lea ecx, [ebp - 0x5cc]
call fcn.1001026e
mov dword [ebp - 0x3c4], 0
mov esi, dword [ebp - 0x3c4]
push 0
lea ecx, [ebp - 0x5cc]
call fcn.1001026e
cmp esi, dword [eax]
je 0x1000d466
mov dword [ebp - 0x574], 1
jmp 0x1000d46d
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3cc]
add eax, dword [ebp - 0xd4]
imul ecx, dword [ebp - 0x574], 0x3132
imul ecx, ecx, 0x83a7
sub ecx, 8
cmp eax, ecx
jl 0x1000d4a8
mov dword [ebp - 0x3d4], 1
jmp 0x1000d4af
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x3d4], 6
ja 0x1000d4c4
mov dword [ebp - 0x4c4], 1
jmp 0x1000d4cb
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x3dc], eax
mov esi, dword [ebp - 0x3dc]
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x5a8]
lea ecx, [ebp - 0x5cc]
call fcn.1001026e
cmp dword [eax], esi
jge 0x1000d505
mov dword [ebp - 0x53c], 1
jmp 0x1000d50c
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
sub eax, 0xd793
imul eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x6d0], eax
jmp 0x1000d35f
jmp 0x1000d2f6
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x1000d55b
push 0
push 0x1894
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5cc]
call fcn.10010269
mov dword [ebp - 0xa0], 5
mov dword [ebp - 0x17c], 0x2c5b641b
mov dword [ebp - 0x3f0], 0xffffffff
mov dword [ebp - 0x410], 0x6de6
mov dword [ebp - 0x134], 0x40d7f825
mov dword [ebp - 0x638], 0x772304b2
mov dword [ebp - 0x134], 0xffffffe5
jmp 0x1000d5bf
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xfffffffc
jge 0x1000d65d
push 4
lea ecx, [ebp - 0x7b8]
call fcn.10010227
mov dword [ebp - 4], 8
mov dword [ebp - 0x154], 0
jmp 0x1000d5f9
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 4
jge 0x1000d61b
push dword [ebp - 0x154]
lea ecx, [ebp - 0x7b8]
call fcn.1001026e
mov dword [eax], 0x3ff8
jmp 0x1000d5ec
push 0
lea ecx, [ebp - 0x7b8]
call fcn.1001026e
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3ec]
mov dword [ecx], eax
mov dword [ebp - 0x638], 0x59951ea6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b8]
call fcn.10010269
jmp 0x1000d5b2
mov dword [ebp - 0x400], 0xe50714ba
mov dword [ebp - 0x678], 0x6d56a426
push 1
lea ecx, [ebp - 0x794]
call fcn.10010227
mov dword [ebp - 4], 9
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x13c], 0
jmp 0x1000d6a5
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x1000d6c7
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x794]
call fcn.1001026e
mov dword [eax], 4
jmp 0x1000d698
mov dword [ebp - 0x44], 0
jmp 0x1000d6d7
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1000d6f7
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x1000d6f5
call dword [sym.imp.GDI32.dll_GdiFlush]
jmp 0x1000d6d0
mov dword [ebp - 0x44], 0
jmp 0x1000d707
cmp dword [ebp - 0x44], 0
jl 0x1000d807
push 4
lea ecx, [ebp - 0x5e0]
call fcn.10010227
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x10c], 0
jmp 0x1000d73b
cmp dword [ebp - 0x10c], 4
jge 0x1000d75d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x794]
call fcn.10010269
mov dword [ebp - 0x1fc], 0x971cf717
mov dword [ebp - 0x118], 0xfffffffb
mov dword [ebp - 0x70c], 8
mov dword [ebp - 0x544], 0xffffffff
mov dword [ebp - 0x640], 1
mov dword [ebp - 0x110], 0
jmp 0x1000d861
cmp dword [ebp - 0x110], 2
jge 0x1000d87d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x61c], eax
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x860], 0x23ed15de
mov dword [ebp - 0xf0], 0
jmp 0x1000f1f6
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 4
jge 0x1000f212
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x900], 0xffffffff
jmp 0x1000f1e9
mov dword [ebp - 0xf4], 4
jmp 0x1000f22b
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x18
jl 0x1000f275
mov dword [ebp - 0xd0], 0xffffffff
mov dword [ebp - 0xd0], 0
jmp 0x1000f257
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 4
jge 0x1000f273
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x900], 0x5816210b
jmp 0x1000f24a
jmp 0x1000f21e
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x624], eax
push 2
lea ecx, [ebp - 0x788]
call fcn.10010227
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x58], 0
jmp 0x1000f2b1
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1000f2c7
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xfc], 0xffffffff
jmp 0x1000f2aa
mov dword [ebp - 0x58], 0
jmp 0x1000f2d7
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1000f2f3
push dword [ebp - 0x58]
lea ecx, [ebp - 0x788]
call fcn.1001026e
mov dword [eax], 0xfffffffb
jmp 0x1000f2d0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xfc], 0
jmp 0x1000f321
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xfc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xfc], 0xd
jne 0x1000f3a8
mov dword [ebp - 0x104], 0x457102d1
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1000f34f
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [ebp - 0x104], 0xffffffe3
jmp 0x1000f368
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x1000f3a3
push 0
lea ecx, [ebp - 0x788]
call fcn.1001026e
mov dword [eax], 0x33c63384
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1000f3a1
push 0x1e40
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x1000f35b
jmp 0x1000f306
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x788]
call fcn.10010269
mov eax, dword [ebp - 0xd8]
mov dword [eax], 0
jmp 0x1000f3d6
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xd8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xd8]
cmp dword [eax], 4
jge 0x1000f3fc
mov eax, dword [ebp - 0xd8]
push dword [eax]
mov ecx, dword [ebp - 0x624]
call fcn.1001026e
mov dword [eax], 0xfffffffc
jmp 0x1000f3c5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret