Function at 0x10008f14
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071a41
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb6c
push esi
push edi
mov dword [ebp - 0x8f0], 0xda11525
mov dword [ebp - 0x914], 0xffffffff
mov dword [ebp - 0x91c], 0x3c69aed2
push 1
lea ecx, [ebp - 0xa40]
call fcn.100139c6
and dword [ebp - 4], 0
mov dword [ebp - 0x378], 0xfffb
mov dword [ebp - 0x12c], 0
jmp 0x10008f86
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jge 0x10008fa5
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xa40]
call fcn.10013a64
or dword [eax], 0xffffffff
jmp 0x10008f79
mov byte [ebp - 0x6a], 0
movzx eax, byte [ebp - 0x6a]
test eax, eax
je 0x10008fd1
push 0
push 0x2163
push 0x14d8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa40]
call fcn.10013a48
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0x78], 0xcd9d7
mov dword [ebp - 0x700], 0x42573927
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x4c], 0
jmp 0x10009022
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x10009038
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x2c4], 3
jmp 0x1000901b
mov dword [ebp - 0x4c], 0
jmp 0x10009048
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1000905e
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xb08], 0xe31bb000
jmp 0x10009041
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2c4], 8
jb 0x10009079
mov dword [ebp - 0x5c0], 1
jmp 0x10009080
and dword [ebp - 0x5c0], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2c4], 0
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x2c4]
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x2c4]
push 4
pop esi
shl esi, 1
add edx, dword [ebp + esi - 0x2c4]
add ecx, edx
imul eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x2c4]
mov dword [ebp - 0x78], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2c4], 0
je 0x10009108
mov eax, 0xfff9
test eax, eax
je 0x100090f9
cmp dword [ebp - 0xb8], 0
mov eax, 0x9150
neg eax
mov dword [ebp - 0xb8], eax
jne 0x10009121
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2c4], 0
jne 0x10009121
and dword [ebp - 0x5c8], 0
jmp 0x1000912b
mov dword [ebp - 0x5c8], 1
mov eax, dword [ebp - 0x700]
cmp dword [ebp - 0x5c8], eax
jne 0x10009145
mov dword [ebp - 0x264], 1
jmp 0x1000914c
and dword [ebp - 0x264], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x264]
mov dword [ebp + eax - 0xb08], ecx
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x264], eax
jg 0x10009176
mov dword [ebp - 0x650], 1
jmp 0x1000917d
and dword [ebp - 0x650], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2c4]
cmp dword [ebp - 0x650], eax
jl 0x1000919e
mov dword [ebp - 0x5ec], 1
jmp 0x100091a5
and dword [ebp - 0x5ec], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2c4]
cmp dword [ebp - 0x5ec], eax
je 0x100091c6
mov dword [ebp - 0x5b8], 1
jmp 0x100091cd
and dword [ebp - 0x5b8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5b8]
sub ecx, dword [ebp + eax - 0x2c4]
mov dword [ebp - 0x130], ecx
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x78], eax
jl 0x10009221
mov dword [ebp - 0x78], 7
jmp 0x10009200
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 6
jl 0x1000921c
mov byte [ebp - 0x53], 0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x1000921a
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
jmp 0x100091f9
jmp 0x100092ec
mov dword [ebp - 0x28], 0
jmp 0x10009231
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10009247
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7c4], 0xfffffffd
jmp 0x1000922a
mov dword [ebp - 0x28], 0
jmp 0x10009257
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1000926d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x6c4], 0xffffffff
jmp 0x10009250
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2c4], 0
je 0x100092c6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c4]
cmp dword [ebp - 0xb8], eax
jne 0x1000929e
mov dword [ebp - 0x2d4], 1
jmp 0x100092a5
and dword [ebp - 0x2d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c4]
cmp dword [ebp - 0x2d4], eax
jne 0x100092c6
mov dword [ebp - 0x474], 1
jmp 0x100092cd
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x130], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x130]
mov dword [ebp + eax - 0x6c4], ecx
mov dword [ebp - 0x958], 0xda11525
mov dword [ebp - 0x960], 0xffffffff
mov dword [ebp - 0x968], 0x3c69aed2
mov dword [ebp - 0x44], 0x8d327cb3
mov dword [ebp - 0xe8], 0xdb505206
mov dword [ebp - 0x5ac], 0xf6f49c23
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
je 0x10009510
mov dword [ebp - 0x7f4], 0xfffffffa
mov dword [ebp - 0x7f0], 0xfffffffa
mov dword [ebp - 0x7ec], 0xfffffffa
mov dword [ebp - 0x7e8], 0xfffffffa
lea ecx, [ebp - 0x255]
call fcn.10008d63
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x7f4]
push eax
lea ecx, [ebp - 0xb40]
call fcn.10013a73
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x78c]
call fcn.10013a22
mov dword [ebp - 4], 1
push 1
lea ecx, [ebp - 0x78c]
call fcn.10013a64
cmp dword [eax], 1
je 0x100093bd
mov dword [ebp - 0x2dc], 1
jmp 0x100093c4
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x44], eax
je 0x100093df
mov dword [ebp - 0x544], 1
jmp 0x100093e6
and dword [ebp - 0x544], 0
cmp dword [ebp - 0x544], 0xffff
jae 0x100093fe
mov dword [ebp - 0x2e4], 1
jmp 0x10009405
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x2e4]
jne 0x10009428
mov dword [ebp - 0x47c], 1
jmp 0x1000942f
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
sub eax, dword [ebp - 0x44]
cmp eax, 8
jae 0x10009449
mov dword [ebp - 0x2ec], 1
jmp 0x10009450
and dword [ebp - 0x2ec], 0
push 1
lea ecx, [ebp - 0x78c]
call fcn.10013a64
mov ecx, dword [ebp - 0x2ec]
mov dword [eax], ecx
mov dword [ebp - 0x44], 0
jmp 0x10009475
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xe
jl 0x100094ff
push 1
lea ecx, [ebp - 0x818]
call fcn.100139c6
mov byte [ebp - 4], 2
mov dword [ebp - 0x1e0], 0
jmp 0x100094a9
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x100094cb
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x818]
call fcn.10013a64
mov dword [eax], 1
jmp 0x1000949c
push 1
lea ecx, [ebp - 0x78c]
call fcn.10013a64
mov esi, eax
push 0
lea ecx, [ebp - 0x818]
call fcn.10013a64
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x818]
call fcn.10013a48
jmp 0x1000946e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78c]
call fcn.10013a48
jmp 0x10009532
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x10009532
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0xe8]
sub eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x5ac], eax
push 1
lea ecx, [ebp - 0xa50]
call fcn.100139c6
mov dword [ebp - 4], 3
mov dword [ebp - 0x334], 0xfffb
mov dword [ebp - 0x110], 0xcea5d6c0
mov dword [ebp - 0x6cc], 0xfffffffa
mov dword [ebp - 0x110], 0xfffffffd
jmp 0x1000958f
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jl 0x100095c3
mov byte [ebp - 0x57], 0
movzx eax, byte [ebp - 0x57]
test eax, eax
je 0x100095c1
push 0
push 0x63
push 0x7f7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x10009582
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x6cc], eax
mov dword [ebp - 0x138], 0
jmp 0x100095e8
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 1
jge 0x10009607
push dword [ebp - 0x138]
lea ecx, [ebp - 0xa50]
call fcn.10013a64
or dword [eax], 0xffffffff
jmp 0x100095db
mov dword [ebp - 0x3c], 0x3f0b
mov dword [ebp - 0xf0], 0x7ecc2443
mov dword [ebp - 0x24], 0xdcd16652
push 2
lea ecx, [ebp - 0x5d8]
call fcn.100139c6
mov byte [ebp - 4], 4
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x80], 0x36c745d0
mov dword [ebp - 0x6e4], 0xfffffff9
mov dword [ebp - 0x238], 0
jmp 0x10009664
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x10009686
push dword [ebp - 0x238]
lea ecx, [ebp - 0x5d8]
call fcn.10013a64
mov dword [eax], 0xbdbdf7cd
jmp 0x10009657
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x6d4], eax
push 0
lea ecx, [ebp - 0x5d8]
call fcn.10013a64
mov ecx, dword [ebp - 0x6d4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xf0], eax
jle 0x100096e2
mov dword [ebp - 0x2f4], 1
jmp 0x100096e9
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2f4], eax
jle 0x10009700
mov dword [ebp - 0x484], 1
jmp 0x10009707
and dword [ebp - 0x484], 0
push 0
lea ecx, [ebp - 0x5d8]
call fcn.10013a64
mov esi, dword [ebp - 0x484]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x5d8]
call fcn.10013a64
cmp esi, dword [eax]
jl 0x10009739
mov dword [ebp - 0x6dc], 1
jmp 0x10009740
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x978], eax
imul eax, dword [ebp - 0x3c], 0xffff
mov esi, dword [ebp - 0x3c]
push 0
lea ecx, [ebp - 0x5d8]
call fcn.10013a64
imul esi, dword [eax]
mov dword [ebp - 0x2fc], esi
push 1
lea ecx, [ebp - 0x5d8]
call fcn.10013a64
mov ecx, dword [ebp - 0x2fc]
mov dword [eax], ecx
cmp dword [ebp - 0x2fc], 0
jne 0x10009799
cmp dword [ebp - 0xf0], 0
jne 0x10009799
and dword [ebp - 0x54c], 0
jmp 0x100097a3
mov dword [ebp - 0x54c], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x54c], eax
jle 0x100097ba
mov dword [ebp - 0x304], 1
jmp 0x100097c1
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x304], eax
jle 0x100097d9
mov eax, 0xfffc
test eax, eax
je 0x100097d9
cmp dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x80]
test eax, eax
je 0x1000980b
push 1
lea ecx, [ebp - 0x5d8]
call fcn.10013a64
cmp dword [eax], 0
je 0x1000980b
mov dword [ebp - 0x48c], 1
jmp 0x10009812
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x48c], eax
jl 0x10009829
mov dword [ebp - 0x30c], 1
jmp 0x10009830
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
sub eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x80]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x80], eax
jne 0x10009854
mov dword [ebp - 0x63c], 1
jmp 0x1000985b
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x63c], eax
jl 0x10009872
mov dword [ebp - 0x314], 1
jmp 0x10009879
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x314], eax
jg 0x10009890
mov dword [ebp - 0x494], 1
jmp 0x10009897
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x494], eax
jle 0x100098ae
mov dword [ebp - 0x31c], 1
jmp 0x100098b5
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x31c], eax
jle 0x100098d5
mov eax, 0xeb1f0cf
test eax, eax
jne 0x100098d5
and dword [ebp - 0x554], 0
jmp 0x100098df
mov dword [ebp - 0x554], 1
cmp dword [ebp - 0x554], 0xbacd6bce
jae 0x100098f7
mov dword [ebp - 0x324], 1
jmp 0x100098fe
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x324]
test eax, eax
jne 0x1000991b
cmp dword [ebp - 0x24], 0
jne 0x1000991b
and dword [ebp - 0x49c], 0
jmp 0x10009925
mov dword [ebp - 0x49c], 1
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x49c], eax
jl 0x1000993f
mov dword [ebp - 0x32c], 1
jmp 0x10009946
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 0x2c21
jge 0x1000995e
mov dword [ebp - 0x5b4], 1
jmp 0x10009965
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x6e4], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5d8]
call fcn.10013a48
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x100099ac
push 0
push 0x2163
push 0x14d8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa50]
call fcn.10013a48
mov dword [ebp - 0x980], 0
mov byte [ebp - 0x5b], 0
movzx eax, byte [ebp - 0x5b]
test eax, eax
je 0x100099f7
push 0x1d7e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x10009a17
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
mov dword [ebp - 0x988], 0xda11525
mov dword [ebp - 0x990], 0xffffffff
mov dword [ebp - 0x4a4], 2
mov dword [ebp - 0xcc], 0xd0b5486b
mov dword [ebp - 0x2c], 1
mov byte [ebp - 0x5f], 0
movzx eax, byte [ebp - 0x5f]
test eax, eax
je 0x10009a6b
push 0xcce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
cmp dword [ebp - 0x4a4], 0
je 0x10009b7e
mov dword [ebp - 0x6ec], 0
xor eax, eax
je 0x10009b6c
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x1e8], 0
jmp 0x10009aad
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 3
jge 0x10009ac9
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0xb14], 0xfffffffe
jmp 0x10009aa0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4a4]
cmp dword [ebp + eax - 0xb14], ecx
je 0x10009aea
mov dword [ebp - 0x33c], 1
jmp 0x10009af1
and dword [ebp - 0x33c], 0
cmp dword [ebp - 0x33c], 0xa3cfce2
je 0x10009b09
mov dword [ebp - 0x55c], 1
jmp 0x10009b10
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 1
je 0x10009b25
mov dword [ebp - 0x344], 1
jmp 0x10009b2c
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0xfffffff9
jl 0x10009b4d
mov dword [ebp - 0x34c], 1
jmp 0x10009b54
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xcc], 0
jmp 0x10009b79
imul eax, dword [ebp - 0x2c], 0x9fa8
mov dword [ebp - 0x6ec], eax
jmp 0x10009c10
mov dword [ebp - 0x6fc], 0x5fb2
mov dword [ebp - 0xcc], 0xffffffea
jmp 0x10009ba1
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffe8
jge 0x10009bd8
mov dword [ebp - 0x2c], 0
jmp 0x10009bba
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff6
je 0x10009bd6
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x10009bd4
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x10009bb3
jmp 0x10009b94
mov dword [ebp - 0x2c], 0
jmp 0x10009be8
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x10
jle 0x10009c10
mov dword [ebp - 0x6f4], 0xfffffff9
cmp dword [ebp - 0x6f4], 0
je 0x10009c03
jmp 0x10009c10
cmp dword [ebp - 0x6fc], 0
je 0x10009c0e
jmp 0x10009c10
jmp 0x10009be1
mov dword [ebp - 0x998], 0x3c69aed2
mov dword [ebp - 0x9a0], 0x8c6a53d0
mov dword [ebp - 0x9a8], 8
mov dword [ebp - 0x9b0], 0
mov dword [ebp - 0x9b8], 0xfffffffa
mov dword [ebp - 0x9c0], 0xffffffff
mov dword [ebp - 0x9c8], 1
mov dword [ebp - 0x9d0], 0x21dfe4b2
push 3
lea ecx, [ebp - 0xa60]
call fcn.100139c6
mov dword [ebp - 4], 5
mov dword [ebp - 0x5fc], 0x2250db85
mov dword [ebp - 0x148], 0
jmp 0x10009c97
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jge 0x10009cb6
push dword [ebp - 0x148]
lea ecx, [ebp - 0xa60]
call fcn.10013a64
and dword [eax], 0
jmp 0x10009c8a
mov eax, dword [ebp - 0x5fc]
dec eax
mov dword [ebp - 0x5fc], eax
mov byte [ebp - 0x63], 0
movzx eax, byte [ebp - 0x63]
test eax, eax
je 0x10009cec
push 0
push 0
push 0
push 0
push 0x1a1c
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa60]
call fcn.10013a48
push 1
lea ecx, [ebp - 0xa80]
call fcn.100139c6
mov dword [ebp - 4], 6
push 1
lea ecx, [ebp - 0x2a4]
call fcn.100139c6
mov byte [ebp - 4], 7
mov dword [ebp - 0x70c], 0
mov dword [ebp - 0xc4], 0x1ce3cb5a
mov dword [ebp - 0x660], 0x1932e3ca
mov dword [ebp - 0x220], 0
jmp 0x10009d57
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x10009d79
push dword [ebp - 0x220]
lea ecx, [ebp - 0x2a4]
call fcn.10013a64
mov dword [eax], 0xb8f5
jmp 0x10009d4a
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10013a64
mov esi, eax
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10013a64
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x10009da7
mov dword [ebp - 0x4b4], 1
jmp 0x10009dae
and dword [ebp - 0x4b4], 0
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10013a64
cmp dword [eax], 0
je 0x10009dcc
mov dword [ebp - 0x354], 1
jmp 0x10009dd3
and dword [ebp - 0x354], 0
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10013a64
mov ecx, dword [ebp - 0x354]
cmp ecx, dword [eax]
je 0x10009df6
mov dword [ebp - 0x704], 1
jmp 0x10009dfd
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x9d8], eax
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10013a64
mov esi, dword [ebp - 0x4b4]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10013a64
cmp esi, dword [eax]
jg 0x10009e3b
mov dword [ebp - 0x35c], 1
jmp 0x10009e42
and dword [ebp - 0x35c], 0
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10013a64
mov ecx, dword [ebp - 0x35c]
cmp ecx, dword [eax]
jg 0x10009e65
mov dword [ebp - 0x6b8], 1
jmp 0x10009e6c
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x660], eax
mov dword [ebp - 0xc4], 0
jmp 0x10009e91
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x10009eb0
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x2a4]
call fcn.10013a64
or dword [eax], 0xffffffff
jmp 0x10009e84
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2a4]
call fcn.10013a48
mov dword [ebp - 0x3cc], 0xfffb
push 1
lea ecx, [ebp - 0xa70]
call fcn.100139c6
mov byte [ebp - 4], 8
mov dword [ebp - 0x1f0], 0x4f833fcb
mov dword [ebp - 0x150], 0
jmp 0x10009efd
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 1
jge 0x10009f1c
push dword [ebp - 0x150]
lea ecx, [ebp - 0xa70]
call fcn.10013a64
and dword [eax], 0
jmp 0x10009ef0
mov dword [ebp - 0x1f0], 0
jmp 0x10009f35
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jl 0x10009f94
mov dword [ebp - 0x158], 3
mov dword [ebp - 0x158], 0
jmp 0x10009f61
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jg 0x10009f92
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x10009f90
push 0x26ad
push 0x2407
push 0x2103
push 0xb38
call dword [sym.imp.GDI32.dll_CreateRectRgn]
jmp 0x10009f54
jmp 0x10009f28
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa70]
call fcn.10013a48
push 1
lea ecx, [ebp - 0x830]
call fcn.100139c6
mov byte [ebp - 4], 9
mov dword [ebp - 0x108], 0xffffffff
mov dword [ebp - 0x248], 0
jmp 0x10009fd7
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x10009ff9
push dword [ebp - 0x248]
lea ecx, [ebp - 0x830]
call fcn.10013a64
mov dword [eax], 0xec2e
jmp 0x10009fca
mov byte [ebp - 0x67], 0
movzx eax, byte [ebp - 0x67]
test eax, eax
je 0x1000a019
push 0x2430
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 0x108], 0
jmp 0x1000a032
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jg 0x1000a083
mov dword [ebp - 0x160], 0x3d9532bb
mov dword [ebp - 0x160], 0
jmp 0x1000a05e
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jl 0x1000a081
push dword [ebp - 0x108]
lea ecx, [ebp - 0x830]
call fcn.10013a64
cmp dword [eax], 0
je 0x1000a07f
jmp 0x1000a081
jmp 0x1000a051
jmp 0x1000a025
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x830]
call fcn.10013a48
mov dword [ebp - 0x1f8], 0
jmp 0x1000a0ab
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jge 0x1000a0ca
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xa80]
call fcn.10013a64
or dword [eax], 0xffffffff
jmp 0x1000a09e
mov byte [ebp - 0x6b], 0
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0x88], 0xcd9d7
mov dword [ebp - 0x6ac], 0x42573927
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x30], 0
jmp 0x1000a106
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1000a11c
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x2b4], 3
jmp 0x1000a0ff
mov dword [ebp - 0x30], 0
jmp 0x1000a12c
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1000a142
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xb20], 0xe31bb000
jmp 0x1000a125
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2b4], 8
jb 0x1000a15d
mov dword [ebp - 0x564], 1
jmp 0x1000a164
and dword [ebp - 0x564], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2b4], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x2b4]
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x2b4]
push 4
pop esi
shl esi, 1
add edx, dword [ebp + esi - 0x2b4]
add ecx, edx
imul eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x2b4]
mov dword [ebp - 0x88], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2b4], 0
je 0x1000a1ef
mov eax, 0xfff9
test eax, eax
je 0x1000a1e0
cmp dword [ebp - 0xd4], 0
mov eax, 0x9150
neg eax
mov dword [ebp - 0xd4], eax
jne 0x1000a208
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2b4], 0
jne 0x1000a208
and dword [ebp - 0x364], 0
jmp 0x1000a212
mov dword [ebp - 0x364], 1
mov eax, dword [ebp - 0x6ac]
cmp dword [ebp - 0x364], eax
jne 0x1000a22c
mov dword [ebp - 0x268], 1
jmp 0x1000a233
and dword [ebp - 0x268], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x268]
mov dword [ebp + eax - 0xb20], ecx
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x268], eax
jg 0x1000a260
mov dword [ebp - 0x4bc], 1
jmp 0x1000a267
and dword [ebp - 0x4bc], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2b4]
cmp dword [ebp - 0x4bc], eax
jl 0x1000a288
mov dword [ebp - 0x36c], 1
jmp 0x1000a28f
and dword [ebp - 0x36c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2b4]
cmp dword [ebp - 0x36c], eax
je 0x1000a2b0
mov dword [ebp - 0x5bc], 1
jmp 0x1000a2b7
and dword [ebp - 0x5bc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5bc]
sub ecx, dword [ebp + eax - 0x2b4]
mov dword [ebp - 0x168], ecx
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x88], eax
jl 0x1000a31a
mov dword [ebp - 0x88], 7
jmp 0x1000a2f6
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 6
jl 0x1000a315
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1000a313
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
jmp 0x1000a2e9
jmp 0x1000a3e5
mov dword [ebp - 0x38], 0
jmp 0x1000a32a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1000a340
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x7cc], 0xfffffffd
jmp 0x1000a323
mov dword [ebp - 0x38], 0
jmp 0x1000a350
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000a366
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x67c], 0xffffffff
jmp 0x1000a349
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2b4], 0
je 0x1000a3bf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7cc]
cmp dword [ebp - 0xd4], eax
jne 0x1000a397
mov dword [ebp - 0x374], 1
jmp 0x1000a39e
and dword [ebp - 0x374], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7cc]
cmp dword [ebp - 0x374], eax
jne 0x1000a3bf
mov dword [ebp - 0x4c4], 1
jmp 0x1000a3c6
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x168], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x168]
mov dword [ebp + eax - 0x67c], ecx
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x1000a40d
push 0
push 0x2163
push 0x14d8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov dword [ebp - 0x14], 0xb036
mov dword [ebp - 0x18], 0x13717be9
mov dword [ebp - 0xbc], 0xffffffff
mov dword [ebp - 0x3bc], 0xae734f1
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x228], 0
jmp 0x1000a452
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x1000a46e
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x928], 0x697
jmp 0x1000a445
cmp dword [ebp - 0x14], 0x1f78
jle 0x1000a4df
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x18], eax
jg 0x1000a4b2
cmp dword [ebp - 0x14], 0
jne 0x1000a49a
cmp dword [ebp - 0x18], 0
jne 0x1000a49a
and dword [ebp - 0x37c], 0
jmp 0x1000a4a4
mov dword [ebp - 0x37c], 1
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x37c]
mov dword [ebp - 0x18], eax
je 0x1000a4c4
cmp dword [ebp - 0x14], 0
je 0x1000a4c4
mov dword [ebp - 0x56c], 1
jmp 0x1000a4cb
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x56c], eax
jle 0x1000a4df
and dword [ebp - 0x384], 0
jmp 0x1000a4e9
mov dword [ebp - 0x384], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x384], eax
jge 0x1000a500
mov dword [ebp - 0x4cc], 1
jmp 0x1000a507
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
add eax, 0xffff
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x9e0], eax
mov eax, 0x644bb323
test eax, eax
je 0x1000a540
cmp dword [ebp - 0x18], 0
je 0x1000a540
mov dword [ebp - 0x38c], 1
jmp 0x1000a547
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x38c], eax
jle 0x1000a55e
mov dword [ebp - 0x62c], 1
jmp 0x1000a565
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 0xeb945924
ja 0x1000a57d
mov dword [ebp - 0x394], 1
jmp 0x1000a584
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x394], eax
je 0x1000a59e
mov dword [ebp - 0x4d4], 1
jmp 0x1000a5a5
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4d4], eax
jl 0x1000a5bc
mov dword [ebp - 0x6e8], 1
jmp 0x1000a5c3
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x9f0], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x18], eax
jl 0x1000a5ef
mov dword [ebp - 0x39c], 1
jmp 0x1000a5f6
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x39c], eax
jge 0x1000a60d
mov dword [ebp - 0x574], 1
jmp 0x1000a614
and dword [ebp - 0x574], 0
imul eax, dword [ebp - 0x574], 0xfffd
sub eax, 0x397bde51
sub eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
jge 0x1000a637
mov dword [ebp - 0x3a4], 1
jmp 0x1000a63e
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x3a4], eax
jne 0x1000a658
cmp dword [ebp - 0x18], 0
jne 0x1000a658
and dword [ebp - 0x4dc], 0
jmp 0x1000a662
mov dword [ebp - 0x4dc], 1
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jne 0x1000a686
cmp dword [ebp - 0x18], 0
jne 0x1000a686
and dword [ebp - 0x3ac], 0
jmp 0x1000a690
mov dword [ebp - 0x3ac], 1
cmp dword [ebp - 0x3ac], 0xffffffff
jg 0x1000a6a5
mov dword [ebp - 0x5c4], 1
jmp 0x1000a6ac
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x5c4]
cmp eax, dword [ebp - 0x14]
jle 0x1000a6c7
mov dword [ebp - 0x3b4], 1
jmp 0x1000a6ce
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x3b4], eax
jg 0x1000a6e5
mov dword [ebp - 0x4e4], 1
jmp 0x1000a6ec
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
neg eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 0xa9025b0d
jae 0x1000a718
mov dword [ebp - 0x57c], 1
jmp 0x1000a71f
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x57c], eax
jg 0x1000a736
mov dword [ebp - 0x3c4], 1
jmp 0x1000a73d
and dword [ebp - 0x3c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x928]
cmp dword [ebp - 0x3c4], eax
jg 0x1000a75e
mov dword [ebp - 0x4ec], 1
jmp 0x1000a765
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa80]
call fcn.10013a48
mov dword [ebp - 0x280], 0x1e87df2f
mov dword [ebp - 0x270], 0x56890c54
mov dword [ebp - 0x3fc], 1
mov dword [ebp - 0x6f0], 0x7d24b5e4
mov dword [ebp - 0x4fc], 0xe360de57
mov dword [ebp - 0x288], 6
mov dword [ebp - 0x200], 0xffffffff
mov dword [ebp - 0x3ec], 0x61e33ecd
mov dword [ebp - 0x9f8], 2
mov dword [ebp - 0x58c], 0x14ff6a91
mov dword [ebp - 0x170], 0
jmp 0x1000a80a
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x1000a826
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x178], 0
jmp 0x1000a7fd
cmp dword [ebp - 0x280], 0
je 0x1000aa0f
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
je 0x1000a951
mov eax, dword [ebp - 0x4fc]
cmp dword [ebp - 0x200], eax
jg 0x1000a868
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x178], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x740]
cmp eax, dword [ebp - 0x670]
jg 0x1000a8a7
mov dword [ebp - 0x60c], 1
jmp 0x1000a8ae
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x60c], eax
je 0x1000a8c8
mov dword [ebp - 0x3d4], 1
jmp 0x1000a8cf
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x3d4], 0x9e149cf
jl 0x1000a8e7
mov dword [ebp - 0x4f4], 1
jmp 0x1000a8ee
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x4f4], eax
jne 0x1000a908
mov dword [ebp - 0x3dc], 1
jmp 0x1000a90f
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x3dc], eax
jl 0x1000a929
mov dword [ebp - 0x584], 1
jmp 0x1000a930
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
je 0x1000a951
mov dword [ebp - 0x3e4], 1
jmp 0x1000a958
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
sub eax, 0xfff7
imul eax, eax, 0xf7a0
imul eax, dword [ebp - 0x6f0]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x178]
cmp eax, 0xb4b1
jge 0x1000a990
mov dword [ebp - 0x678], 1
jmp 0x1000a997
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0xa00], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
imul eax, dword [ebp - 0x4fc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x178]
jl 0x1000a9d2
mov dword [ebp - 0x5cc], 1
jmp 0x1000a9d9
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x5cc], eax
jge 0x1000a9f3
mov dword [ebp - 0x3f4], 1
jmp 0x1000a9fa
and dword [ebp - 0x3f4], 0
cmp dword [ebp - 0x3f4], 0
je 0x1000aa0f
mov dword [ebp - 0x504], 1
jmp 0x1000aa16
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x58c]
dec eax
mov dword [ebp - 0x58c], eax
mov dword [ebp - 0xa08], 0
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x1000aa5e
push 0x1d7e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x1000aa7e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
mov dword [ebp - 0x180], 9
mov dword [ebp - 0x404], 0xfff6
mov dword [ebp - 0x240], 0
jmp 0x1000aaab
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
jge 0x1000aac7
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xb78], 0xc64a6847
jmp 0x1000aa9e
mov dword [ebp - 0x180], 0
jmp 0x1000aae0
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jg 0x1000ab02
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1000ab00
push 0x47e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1000aad3
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
push 2
lea ecx, [ebp - 0x7b0]
call fcn.100139c6
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x208], 0
jmp 0x1000ab46
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x1000ab68
push dword [ebp - 0x208]
lea ecx, [ebp - 0x7b0]
call fcn.10013a64
mov dword [eax], 0x204e
jmp 0x1000ab39
mov dword [ebp - 0x118], 0
jmp 0x1000ab81
cmp dword [ebp - 0x118], 1
jg 0x1000adc0
push 2
lea ecx, [ebp - 0x71c]
call fcn.100139c6
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x77c], 9
mov dword [ebp - 0x188], 0
jmp 0x1000abc2
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x1000ade0