Function at 0x10008c39
Capabilities:
Extract resource via kernel32 functions
Get common file path
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e025
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1238
call fcn.1007a290
push esi
push edi
mov dword [ebp - 0x1c], 0x53606de7
push 1
lea ecx, [ebp - 0xd18]
call fcn.10016cb0
and dword [ebp - 4], 0
mov dword [ebp - 0x998], 0x6fc33146
mov dword [ebp - 0xbe0], 0xaa4807c1
mov dword [ebp - 0x88], 0
jmp 0x10008ca2
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x10008cbb
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x60], 0xe3556834
jmp 0x10008c95
mov dword [ebp - 0x88], 0
jmp 0x10008cd4
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x10008cf6
push dword [ebp - 0x88]
lea ecx, [ebp - 0xd18]
call fcn.10016d1d
mov dword [eax], 0xd09eb818
jmp 0x10008cc7
mov dword [ebp - 0x88], 0
jmp 0x10008d0f
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x10008d2b
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x1164], 0x2c3978d1
jmp 0x10008d02
mov dword [ebp - 0x1c], 0
jmp 0x10008d3b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10008d4e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x60], 1
jmp 0x10008d34
mov dword [ebp - 0x1c], 0
jmp 0x10008d5e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x10009115
mov dword [ebp - 0xa8c], 0xdd711a53
mov dword [ebp - 0x320], 0xfffffff6
mov dword [ebp - 0x8c4], 0xb3b3333d
mov byte [ebp - 0x112], 0
movzx eax, byte [ebp - 0x112]
test eax, eax
je 0x10008da5
push 0x13ff
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x60]
cmp dword [ebp + eax - 0x60], ecx
jle 0x10008dc4
mov dword [ebp - 0x958], 1
jmp 0x10008dcb
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x60]
cmp dword [ebp - 0x958], eax
jge 0x10008de6
mov dword [ebp - 0xa84], 1
jmp 0x10008ded
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0xa84]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0xa94], eax
push 0
lea ecx, [ebp - 0xd18]
call fcn.10016d1d
mov ecx, dword [ebp - 0xa94]
mov dword [eax], ecx
cmp dword [ebp - 0xa94], 0x76c
je 0x10008e32
mov dword [ebp - 0xa9c], 1
jmp 0x10008e39
and dword [ebp - 0xa9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
add eax, dword [ebp - 0xa9c]
add eax, dword [ebp - 0x1c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x60]
jl 0x10008e64
mov dword [ebp - 0xaa4], 1
jmp 0x10008e6b
and dword [ebp - 0xaa4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0xaa4], eax
jl 0x10008e89
mov dword [ebp - 0xaac], 1
jmp 0x10008e90
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xaac]
sub ecx, dword [ebp + eax*4 - 0x60]
cmp ecx, 0x260e2efe
jle 0x10008eb1
mov dword [ebp - 0xab4], 1
jmp 0x10008eb8
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x60]
cmp dword [ebp - 0xab4], eax
jl 0x10008ed3
mov dword [ebp - 0xabc], 1
jmp 0x10008eda
and dword [ebp - 0xabc], 0
cmp dword [ebp - 0xabc], 9
je 0x10008eef
mov dword [ebp - 0xac4], 1
jmp 0x10008ef6
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0xac4]
cmp eax, dword [ebp - 0x1c]
jge 0x10008f11
mov dword [ebp - 0xacc], 1
jmp 0x10008f18
and dword [ebp - 0xacc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
add eax, dword [ebp - 0xacc]
mov ecx, dword [ebp - 0x1c]
cmp eax, dword [ebp + ecx*4 - 0x60]
jge 0x10008f3d
mov dword [ebp - 0xad4], 1
jmp 0x10008f44
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x60]
cmp eax, dword [ebp - 0xad4]
je 0x10008f5f
mov dword [ebp - 0xadc], 1
jmp 0x10008f66
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x60]
cmp dword [ebp - 0x998], eax
jg 0x10008f94
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x60], 0
jne 0x10008f94
and dword [ebp - 0x8ac], 0
jmp 0x10008f9e
mov dword [ebp - 0x8ac], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x8ac], eax
jg 0x10008fb5
mov dword [ebp - 0x3fc], 1
jmp 0x10008fbc
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x10d8], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x60]
cmp dword [ebp - 0x320], eax
jle 0x10008fef
mov dword [ebp - 0x8b4], 1
jmp 0x10008ff6
and dword [ebp - 0x8b4], 0
cmp dword [ebp - 0x8b4], 0xbe945d44
jne 0x1000900e
mov dword [ebp - 0x404], 1
jmp 0x10009015
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0
ja 0x1000902a
mov dword [ebp - 0x8bc], 1
jmp 0x10009031
and dword [ebp - 0x8bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x8bc], eax
je 0x1000904f
mov dword [ebp - 0x40c], 1
jmp 0x10009056
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 0xfb64730e
jae 0x1000907a
mov dword [ebp - 0x414], 1
jmp 0x10009081
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 0
jae 0x10009096
mov dword [ebp - 0xb80], 1
jmp 0x1000909d
and dword [ebp - 0xb80], 0
push 0
lea ecx, [ebp - 0xd18]
call fcn.10016d1d
push 0
lea ecx, [ebp - 0xd18]
call fcn.10016d1d
cmp dword [eax], 0
jne 0x100090ce
mov eax, 0xc85691f3
test eax, eax
jne 0x100090ce
and dword [ebp - 0x8cc], 0
jmp 0x100090d8
mov dword [ebp - 0x8cc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1164]
imul eax, dword [ebp - 0x8cc]
cmp eax, dword [ebp - 0x1c]
jne 0x100090fd
mov dword [ebp - 0x41c], 1
jmp 0x10009104
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0xbe0], eax
jmp 0x10008d57
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd18]
call fcn.10016d18
push 3
lea ecx, [ebp - 0xd28]
call fcn.10016cb0
mov dword [ebp - 4], 1
mov dword [ebp - 0x24c], 0xf251d69f
mov dword [ebp - 0x274], 0
jmp 0x1000915b
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jge 0x1000917d
push dword [ebp - 0x274]
lea ecx, [ebp - 0xd28]
call fcn.10016d1d
mov dword [eax], 0xc6a53d06
jmp 0x1000914e
mov dword [ebp - 0x24c], 0
jmp 0x10009196
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jg 0x100092f4
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xbe8], 0xffffffff
mov dword [ebp - 0xec], 2
jmp 0x100091d0
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x100092ef
mov dword [ebp - 0x424], 0x644bb323
mov dword [ebp - 0x434], 0x5477a75e
push dword [ebp - 0xec]
lea ecx, [ebp - 0xd28]
call fcn.10016d1d
cmp dword [eax], 0
je 0x100092af
push dword [ebp - 0xec]
lea ecx, [ebp - 0xd28]
call fcn.10016d1d
or ecx, 0xffffffff
sub ecx, dword [eax]
cmp ecx, 0xe055a24b
jbe 0x10009235
mov dword [ebp - 0x8d4], 1
jmp 0x1000923c
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xdfee
jle 0x10009260
mov dword [ebp - 0x8dc], 1
jmp 0x10009267
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x8dc], eax
jle 0x10009281
mov dword [ebp - 0x42c], 1
jmp 0x10009288
and dword [ebp - 0x42c], 0
push dword [ebp - 0xec]
lea ecx, [ebp - 0xd28]
call fcn.10016d1d
mov ecx, dword [ebp - 0x42c]
cmp ecx, dword [eax]
jne 0x100092af
mov dword [ebp - 0x8e4], 1
jmp 0x100092b6
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 1
je 0x100092d7
mov dword [ebp - 0x8ec], 1
jmp 0x100092de
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0xbe8], eax
jmp 0x100091c3
jmp 0x10009189
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd28]
call fcn.10016d18
mov dword [ebp - 0x20], 0x53606de7
push 1
lea ecx, [ebp - 0xd38]
call fcn.10016cb0
mov dword [ebp - 4], 2
mov dword [ebp - 0x924], 0x6fc33146
mov dword [ebp - 0xbf8], 0xaa4807c1
mov dword [ebp - 0x8c], 0
jmp 0x1000934b
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x10009364
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x64], 0xe3556834
jmp 0x1000933e
mov dword [ebp - 0x8c], 0
jmp 0x1000937d
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1000939f
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xd38]
call fcn.10016d1d
mov dword [eax], 0xd09eb818
jmp 0x10009370
mov dword [ebp - 0x8c], 0
jmp 0x100093b8
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x100093d4
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x1170], 0x2c3978d1
jmp 0x100093ab
mov dword [ebp - 0x20], 0
jmp 0x100093e4
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x100093f7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x64], 1
jmp 0x100093dd
mov dword [ebp - 0x20], 0
jmp 0x10009407
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x100097be
mov dword [ebp - 0x444], 0xdd711a53
mov dword [ebp - 0x348], 0xfffffff6
mov dword [ebp - 0x48c], 0xb3b3333d
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1000944e
push 0x13ff
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x64]
cmp dword [ebp + eax - 0x64], ecx
jle 0x1000946d
mov dword [ebp - 0x43c], 1
jmp 0x10009474
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x64]
cmp dword [ebp - 0x43c], eax
jge 0x1000948f
mov dword [ebp - 0x8f4], 1
jmp 0x10009496
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x8fc], eax
push 0
lea ecx, [ebp - 0xd38]
call fcn.10016d1d
mov ecx, dword [ebp - 0x8fc]
mov dword [eax], ecx
cmp dword [ebp - 0x8fc], 0x76c
je 0x100094db
mov dword [ebp - 0x44c], 1
jmp 0x100094e2
and dword [ebp - 0x44c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
add eax, dword [ebp - 0x44c]
add eax, dword [ebp - 0x20]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x64]
jl 0x1000950d
mov dword [ebp - 0x904], 1
jmp 0x10009514
and dword [ebp - 0x904], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
cmp dword [ebp - 0x904], eax
jl 0x10009532
mov dword [ebp - 0x454], 1
jmp 0x10009539
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x454]
sub ecx, dword [ebp + eax*4 - 0x64]
cmp ecx, 0x260e2efe
jle 0x1000955a
mov dword [ebp - 0x90c], 1
jmp 0x10009561
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x64]
cmp dword [ebp - 0x90c], eax
jl 0x1000957c
mov dword [ebp - 0x45c], 1
jmp 0x10009583
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 9
je 0x10009598
mov dword [ebp - 0x914], 1
jmp 0x1000959f
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x914]
cmp eax, dword [ebp - 0x20]
jge 0x100095ba
mov dword [ebp - 0x464], 1
jmp 0x100095c1
and dword [ebp - 0x464], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
add eax, dword [ebp - 0x464]
mov ecx, dword [ebp - 0x20]
cmp eax, dword [ebp + ecx*4 - 0x64]
jge 0x100095e6
mov dword [ebp - 0x91c], 1
jmp 0x100095ed
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x64]
cmp eax, dword [ebp - 0x91c]
je 0x10009608
mov dword [ebp - 0x46c], 1
jmp 0x1000960f
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x64]
cmp dword [ebp - 0x924], eax
jg 0x1000963d
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x64], 0
jne 0x1000963d
and dword [ebp - 0x474], 0
jmp 0x10009647
mov dword [ebp - 0x474], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x474], eax
jg 0x1000965e
mov dword [ebp - 0x92c], 1
jmp 0x10009665
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0xfa0], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x64]
cmp dword [ebp - 0x348], eax
jle 0x10009698
mov dword [ebp - 0x47c], 1
jmp 0x1000969f
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0xbe945d44
jne 0x100096b7
mov dword [ebp - 0x934], 1
jmp 0x100096be
and dword [ebp - 0x934], 0
cmp dword [ebp - 0x934], 0
ja 0x100096d3
mov dword [ebp - 0x484], 1
jmp 0x100096da
and dword [ebp - 0x484], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
cmp dword [ebp - 0x484], eax
je 0x100096f8
mov dword [ebp - 0x93c], 1
jmp 0x100096ff
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0xfb64730e
jae 0x10009723
mov dword [ebp - 0x944], 1
jmp 0x1000972a
and dword [ebp - 0x944], 0
cmp dword [ebp - 0x944], 0
jae 0x1000973f
mov dword [ebp - 0xbf0], 1
jmp 0x10009746
and dword [ebp - 0xbf0], 0
push 0
lea ecx, [ebp - 0xd38]
call fcn.10016d1d
push 0
lea ecx, [ebp - 0xd38]
call fcn.10016d1d
cmp dword [eax], 0
jne 0x10009777
mov eax, 0xc85691f3
test eax, eax
jne 0x10009777
and dword [ebp - 0x494], 0
jmp 0x10009781
mov dword [ebp - 0x494], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1170]
imul eax, dword [ebp - 0x494]
cmp eax, dword [ebp - 0x20]
jne 0x100097a6
mov dword [ebp - 0x94c], 1
jmp 0x100097ad
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0xbf8], eax
jmp 0x10009400
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd38]
call fcn.10016d18
mov dword [ebp - 0xc4], 0xfffffff6
mov dword [ebp - 0x90], 0xa6c65b0b
mov dword [ebp - 0x4cc], 0x3fa8726a
mov dword [ebp - 0xc4], 2
jmp 0x10009804
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xffffffe6
jne 0x100098f0
mov dword [ebp - 0x198], 0xf390197f
mov dword [ebp - 0x200], 0
jmp 0x10009834
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 4
jge 0x10009850
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x1224], 0xfffffffc
jmp 0x10009827
mov dword [ebp - 0x198], 3
jmp 0x10009869
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x10009892
mov dword [ebp - 0x10bc], 0xffffffff
mov dword [ebp - 0xc00], 0x753e1e01
mov dword [ebp - 0xc00], 0
jmp 0x1000985c
cmp dword [ebp - 0x198], 0
jne 0x100098b4
push 4
pop eax
test eax, eax
je 0x100098ab
cmp dword [ebp - 0x198], 0
jne 0x100098b4
and dword [ebp - 0x49c], 0
jmp 0x100098be
mov dword [ebp - 0x49c], 1
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x49c]
jg 0x100098d8
mov dword [ebp - 0x954], 1
jmp 0x100098df
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0x90], eax
jmp 0x100097f7
cmp dword [ebp - 0x90], 0
je 0x10009ab1
mov dword [ebp - 0x328], 0x389f
mov dword [ebp - 0x964], 0x317d239f
mov dword [ebp - 0x90], 0
jmp 0x1000992a
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xffffffff
jge 0x10009aac
mov dword [ebp - 0xb8], 7
mov dword [ebp - 0x4ac], 0x34ab462a
mov dword [ebp - 0x288], 0
jmp 0x10009964
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 4
jge 0x10009980
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0xed0], 1
jmp 0x10009957
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0xb8], 0
jmp 0x100099a5
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jg 0x10009aa7
mov dword [ebp - 0x328], 0xff2fd6b2
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0xfa8], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xc4]
cmp dword [ebp + eax*4 - 0xed0], ecx
jg 0x10009a36
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ebp + ecx*4 - 0xed0]
cmp dword [ebp + eax*4 - 0xed0], ecx
jg 0x10009a05
mov dword [ebp - 0x4a4], 1
jmp 0x10009a0c
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x4a4], eax
jne 0x10009a36
mov eax, dword [ebp - 0xb8]
cmp dword [ebp + eax*4 - 0xed0], 0
je 0x10009a36
mov dword [ebp - 0x95c], 1
jmp 0x10009a3d
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x964]
cmp dword [ebp - 0x95c], eax
je 0x10009a57
mov dword [ebp - 0xc08], 1
jmp 0x10009a5e
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x10dc], eax
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x964], eax
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x10009aa2
push 0
push 0x4e2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
jmp 0x10009998
jmp 0x1000991d
jmp 0x10009cb3
mov dword [ebp - 0x974], 0x675f713e
mov dword [ebp - 0x208], 0
jmp 0x10009ad4
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x10009af0
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0xb10], 3
jmp 0x10009ac7
cmp dword [ebp - 0x90], 0
jne 0x10009bc2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
mov dword [ebp - 0xfb0], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x10cc], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xfb8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb10], 0x9c78
jl 0x10009b47
mov dword [ebp - 0x4b4], 1
jmp 0x10009b4e
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 1
je 0x10009b6c
cmp dword [ebp - 0x90], 0
je 0x10009b6c
mov dword [ebp - 0xc10], 1
jmp 0x10009b73
and dword [ebp - 0xc10], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x10e4], eax
mov eax, 0x446b
sub eax, 0xfffa
cmp eax, dword [ebp - 0x4cc]
jle 0x10009b9d
mov dword [ebp - 0x96c], 1
jmp 0x10009ba4
and dword [ebp - 0x96c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
cmp dword [ebp - 0x96c], eax
je 0x10009bc2
and dword [ebp - 0x4bc], 0
jmp 0x10009bcc
mov dword [ebp - 0x4bc], 1
mov eax, dword [ebp - 0x974]
cmp dword [ebp - 0x4bc], eax
jl 0x10009be6
mov dword [ebp - 0x4c4], 1
jmp 0x10009bed
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x974]
cmp dword [ebp - 0x4c4], eax
jg 0x10009c07
mov dword [ebp - 0x97c], 1
jmp 0x10009c0e
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x97c], eax
jge 0x10009c28
mov dword [ebp - 0x984], 1
jmp 0x10009c2f
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x4cc]
add eax, dword [ebp - 0x984]
cmp eax, 0xadd7081d
jb 0x10009c4e
mov dword [ebp - 0x4d4], 1
jmp 0x10009c55
and dword [ebp - 0x4d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
cmp dword [ebp - 0x4d4], eax
jg 0x10009c76
mov dword [ebp - 0x98c], 1
jmp 0x10009c7d
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x98c], eax
jle 0x10009c9d
mov eax, 0x399d6db7
test eax, eax
jne 0x10009c9d
and dword [ebp - 0x4dc], 0
jmp 0x10009ca7
mov dword [ebp - 0x4dc], 1
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xfc0], 3
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x10009cd7
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov byte [ebp - 0x117], 0
movzx eax, byte [ebp - 0x117]
test eax, eax
je 0x10009cef
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [ebp - 0x18], 0x53606de7
push 1
lea ecx, [ebp - 0xd68]
call fcn.10016cb0
mov dword [ebp - 4], 3
mov dword [ebp - 0x5d8], 0x6fc33146
mov dword [ebp - 0xb0], 0x7bf48c44
mov dword [ebp - 0x994], 0xd7cbae8b
mov dword [ebp - 0x368], 0x2c02a306
mov dword [ebp - 0x330], 0x3063
mov dword [ebp - 0x4f4], 0xfffffff8
push 3
lea ecx, [ebp - 0xd48]
call fcn.10016cb0
mov byte [ebp - 4], 4
mov dword [ebp - 0xc18], 0xeb81
mov dword [ebp - 0xc28], 0xd786ff52
mov dword [ebp - 0x308], 0
jmp 0x10009d84
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 3
jge 0x10009da6
push dword [ebp - 0x308]
lea ecx, [ebp - 0xd48]
call fcn.10016d1d
mov dword [eax], 1
jmp 0x10009d77
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x10ec], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xfc8], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x1000], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xfd0], eax
imul eax, dword [ebp - 0xb0], 0x1c23
mov dword [ebp - 0x994], eax
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0
jne 0x10009e1a
cmp dword [ebp - 0x330], 0
jne 0x10009e1a
and dword [ebp - 0x4e4], 0
jmp 0x10009e24
mov dword [ebp - 0x4e4], 1
mov eax, dword [ebp - 0x330]
cmp dword [ebp - 0x4e4], eax
jge 0x10009e3e
mov dword [ebp - 0x99c], 1
jmp 0x10009e45
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x99c], eax
jg 0x10009e5f
mov dword [ebp - 0x4ec], 1
jmp 0x10009e66
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x4ec]
je 0x10009e86
mov eax, 0x4c7ba3f3
test eax, eax
jne 0x10009e86
and dword [ebp - 0x9a4], 0
jmp 0x10009e90
mov dword [ebp - 0x9a4], 1
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xfd8], eax
push 2
lea ecx, [ebp - 0xd48]
call fcn.10016d1d
mov esi, dword [ebp - 0xc18]
push 0
lea ecx, [ebp - 0xd48]
call fcn.10016d1d
sub esi, dword [eax]
dec esi
jne 0x10009eeb
cmp dword [ebp - 0x368], 0
jne 0x10009eeb
and dword [ebp - 0x9ac], 0
jmp 0x10009ef5
mov dword [ebp - 0x9ac], 1
cmp dword [ebp - 0x9ac], 0x473e
jg 0x10009f0d
mov dword [ebp - 0xc20], 1
jmp 0x10009f14
and dword [ebp - 0xc20], 0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x1010], eax
push 2
lea ecx, [ebp - 0xd48]
call fcn.10016d1d
mov eax, dword [eax]
dec eax
mov dword [ebp - 0xc28], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd48]
call fcn.10016d18
mov dword [ebp - 0x1b0], 0xfb0b0297
mov dword [ebp - 0x9cc], 0xf4caa5d7
mov dword [ebp - 0x524], 5
mov dword [ebp - 0xfe0], 0xfffffff6
mov dword [ebp - 0x210], 0
jmp 0x10009f86
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x10009fa2
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x117c], 0xfffffffb
jmp 0x10009f79
mov dword [ebp - 0x1b0], 2
jmp 0x10009fbb
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jl 0x1000a1b6
mov dword [ebp - 0x70], 1
mov dword [ebp - 0xc38], 0x8f492357
mov dword [ebp - 0x70], 2
jmp 0x10009fe9
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x1000a1b1
mov dword [ebp - 0x120], 0xffffffff
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1018], eax
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x120], eax
jge 0x1000a01d
mov dword [ebp - 0x504], 1
jmp 0x1000a024
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x120], 0
ja 0x1000a039
mov dword [ebp - 0x4fc], 1
jmp 0x1000a040
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x4fc], eax
jne 0x1000a057
mov dword [ebp - 0x9b4], 1
jmp 0x1000a05e
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x9b4], eax
jl 0x1000a078
mov dword [ebp - 0x9bc], 1
jmp 0x1000a07f
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0x9bc]
jl 0x1000a099
mov dword [ebp - 0x50c], 1
jmp 0x1000a0a0
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x50c], eax
je 0x1000a0c0
cmp dword [ebp - 0x120], 0
je 0x1000a0c0
mov dword [ebp - 0x9c4], 1
jmp 0x1000a0c7
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x9c4]
jge 0x1000a0e1
mov dword [ebp - 0x514], 1
jmp 0x1000a0e8
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x9cc], eax
cmp dword [ebp - 0x9cc], 0
jne 0x1000a10b
or eax, 0xffffffff
jne 0x1000a10b
and dword [ebp - 0xc30], 0
jmp 0x1000a115
mov dword [ebp - 0xc30], 1
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xff0], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xed8], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xedc], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xee4], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xeec], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xef4], eax
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x120], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x117c]
cmp dword [ebp - 0x70], eax
jne 0x1000a178
mov dword [ebp - 0x51c], 1
jmp 0x1000a17f
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x51c], eax
jge 0x1000a199
mov dword [ebp - 0x9d4], 1
jmp 0x1000a1a0
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x9d4]
mov dword [ebp - 0xc38], eax
jmp 0x10009fe2
jmp 0x10009fae
mov eax, dword [ebp - 0x524]
dec eax
mov dword [ebp - 0x524], eax
mov dword [ebp - 0xccc], 0xaa4807c1
mov dword [ebp - 0x84], 0
jmp 0x1000a1e6
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1000a1ff
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x6c], 0xe3556834
jmp 0x1000a1d9
mov dword [ebp - 0x84], 0
jmp 0x1000a218
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1000a23a
push dword [ebp - 0x84]
lea ecx, [ebp - 0xd68]
call fcn.10016d1d
mov dword [eax], 0xd09eb818
jmp 0x1000a20b
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x218], 0xfffffffd
push 2
lea ecx, [ebp - 0xb70]
call fcn.10016cb0
mov byte [ebp - 4], 5
mov dword [ebp - 0xc8c], 0xfffffffd
mov dword [ebp - 0x38], 0
jmp 0x1000a276
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1000a28c
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x3ec], 1
jmp 0x1000a26f
mov dword [ebp - 0x38], 0
jmp 0x1000a29c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1000a2b8
push dword [ebp - 0x38]
lea ecx, [ebp - 0xb70]
call fcn.10016d1d
mov dword [eax], 0xfffffffd
jmp 0x1000a295
mov dword [ebp - 0x38], 0
jmp 0x1000a2c8
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000a2de
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xc7c], 0xba16
jmp 0x1000a2c1
mov dword [ebp - 0x38], 0
jmp 0x1000a2ee
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1000a304
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xfec], 0x461d
jmp 0x1000a2e7
mov dword [ebp - 0x4c], 1
jmp 0x1000a314
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1000a446
mov dword [ebp - 0xc84], 8
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1000a342
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x3ec]
neg eax
cmp eax, 0x693009c
jle 0x1000a361
mov dword [ebp - 0x534], 1
jmp 0x1000a368
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
add eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4c]
jg 0x1000a38b
mov dword [ebp - 0x9dc], 1
jmp 0x1000a392
and dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x9dc], 0x7563ffaf
jl 0x1000a3aa
mov dword [ebp - 0x52c], 1
jmp 0x1000a3b1
and dword [ebp - 0x52c], 0
push 0
lea ecx, [ebp - 0xb70]
call fcn.10016d1d
mov ecx, dword [ebp - 0x52c]
cmp ecx, dword [eax]
jl 0x1000a3d4
mov dword [ebp - 0x9e4], 1
jmp 0x1000a3db
and dword [ebp - 0x9e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc7c]
cmp dword [ebp - 0x9e4], eax
jge 0x1000a3fc
mov dword [ebp - 0x9ec], 1
jmp 0x1000a403
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x534]
cmp eax, dword [ebp - 0x9ec]
jne 0x1000a41d
mov dword [ebp - 0x53c], 1
jmp 0x1000a424
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x53c]
sub ecx, dword [ebp + eax*4 - 0x3ec]
imul eax, ecx, 0x38ab
inc eax
mov dword [ebp - 0xc84], eax
jmp 0x1000a30d
mov dword [ebp - 0x4c], 0
jmp 0x1000a456
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x1000a643
mov dword [ebp - 0xc94], 0xfffffffa
mov dword [ebp - 0x290], 0
jmp 0x1000a483
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 2
jge 0x1000a49f
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xe14], 0x5659
jmp 0x1000a476
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x3ec], 0
jne 0x1000a4b8
mov dword [ebp - 0x9fc], 1
jmp 0x1000a4bf
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp + ecx*4 - 0x3ec]
cmp dword [ebp + eax*4 - 0x3ec], ecx
jge 0x1000a4e1
mov dword [ebp - 0x9f4], 1
jmp 0x1000a4e8
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x3ec]
cmp dword [ebp - 0x218], eax
jg 0x1000a512
mov dword [ebp - 0x544], 1
jmp 0x1000a519
and dword [ebp - 0x544], 0
imul esi, dword [ebp - 0x544], 0xe71c
push 0
lea ecx, [ebp - 0xb70]
call fcn.10016d1d
add esi, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp esi, dword [ebp + eax - 0xe14]
je 0x1000a54d
mov dword [ebp - 0x54c], 1
jmp 0x1000a554
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x9fc]
add eax, dword [ebp - 0x54c]
imul eax, eax, 0xa6d7
cmp eax, 2
jle 0x1000a577
mov dword [ebp - 0xa04], 1
jmp 0x1000a57e
and dword [ebp - 0xa04], 0
imul eax, dword [ebp - 0xa04], 0x3e99
cmp eax, 0x5291260e
jge 0x1000a59b
mov dword [ebp - 0x554], 1
jmp 0x1000a5a2
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0xc8c]
imul eax, dword [ebp - 0x554]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xe14]
je 0x1000a5d5
push 0
lea ecx, [ebp - 0xb70]
call fcn.10016d1d
mov eax, dword [eax]
mov dword [ebp - 0xc94], eax
jmp 0x1000a623
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1000a60f
push 0xaad
push 0x1662
push 0xd8d
push 0x89c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0
lea ecx, [ebp - 0xb70]
call fcn.10016d1d
cmp dword [eax], 0
je 0x1000a623
jmp 0x1000a643
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xfec]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xfec], eax
jmp 0x1000a44f
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb70]
call fcn.10016d18
mov dword [ebp - 0x84], 0
jmp 0x1000a66b
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1000a687
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x1194], 0x2c3978d1
jmp 0x1000a65e
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x220], 0xfffffffd
push 2
lea ecx, [ebp - 0xb58]
call fcn.10016cb0
mov byte [ebp - 4], 6
mov dword [ebp - 0xcac], 0xfffffffd
mov dword [ebp - 0x24], 0
jmp 0x1000a6c3
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1000a6d9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3d4], 1
jmp 0x1000a6bc
mov dword [ebp - 0x24], 0
jmp 0x1000a6e9
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1000a705
push dword [ebp - 0x24]
lea ecx, [ebp - 0xb58]
call fcn.10016d1d
mov dword [eax], 0xfffffffd
jmp 0x1000a6e2
mov dword [ebp - 0x24], 0
jmp 0x1000a715
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000a72b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc9c], 0xba16
jmp 0x1000a70e
mov dword [ebp - 0x24], 0
jmp 0x1000a73b
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000a751
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xffc], 0x461d
jmp 0x1000a734
mov dword [ebp - 0x44], 1
jmp 0x1000a761
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1000a893
mov dword [ebp - 0xca4], 8
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x1000a78f
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x3d4]
neg eax
cmp eax, 0x693009c
jle 0x1000a7ae
mov dword [ebp - 0x564], 1
jmp 0x1000a7b5
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
add eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x44]
jg 0x1000a7d8
mov dword [ebp - 0xa0c], 1
jmp 0x1000a7df
and dword [ebp - 0xa0c], 0
cmp dword [ebp - 0xa0c], 0x7563ffaf
jl 0x1000a7f7
mov dword [ebp - 0x55c], 1
jmp 0x1000a7fe
and dword [ebp - 0x55c], 0
push 0
lea ecx, [ebp - 0xb58]
call fcn.10016d1d
mov ecx, dword [ebp - 0x55c]
cmp ecx, dword [eax]
jl 0x1000a821
mov dword [ebp - 0xa14], 1
jmp 0x1000a828
and dword [ebp - 0xa14], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc9c]
cmp dword [ebp - 0xa14], eax
jge 0x1000a849
mov dword [ebp - 0xa1c], 1
jmp 0x1000a850
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x564]
cmp eax, dword [ebp - 0xa1c]
jne 0x1000a86a
mov dword [ebp - 0x56c], 1
jmp 0x1000a871
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x56c]
sub ecx, dword [ebp + eax*4 - 0x3d4]
imul eax, ecx, 0x38ab
inc eax
mov dword [ebp - 0xca4], eax
jmp 0x1000a75a
mov dword [ebp - 0x44], 0
jmp 0x1000a8a3
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x1000aa90
mov dword [ebp - 0xcb4], 0xfffffffa
mov dword [ebp - 0x2d0], 0
jmp 0x1000a8d0
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
jge 0x1000a8ec
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0xe5c], 0x5659
jmp 0x1000a8c3
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x3d4], 0
jne 0x1000a905
mov dword [ebp - 0xa2c], 1
jmp 0x1000a90c
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp + ecx*4 - 0x3d4]
cmp dword [ebp + eax*4 - 0x3d4], ecx
jge 0x1000a92e
mov dword [ebp - 0xa24], 1
jmp 0x1000a935
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x3d4]
cmp dword [ebp - 0x220], eax
jg 0x1000a95f
mov dword [ebp - 0x574], 1
jmp 0x1000a966
and dword [ebp - 0x574], 0
imul esi, dword [ebp - 0x574], 0xe71c
push 0
lea ecx, [ebp - 0xb58]
call fcn.10016d1d
add esi, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp esi, dword [ebp + eax - 0xe5c]
je 0x1000a99a
mov dword [ebp - 0x57c], 1
jmp 0x1000a9a1
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0xa2c]
add eax, dword [ebp - 0x57c]
imul eax, eax, 0xa6d7
cmp eax, 2
jle 0x1000a9c4
mov dword [ebp - 0xa34], 1
jmp 0x1000a9cb
and dword [ebp - 0xa34], 0
imul eax, dword [ebp - 0xa34], 0x3e99
cmp eax, 0x5291260e
jge 0x1000a9e8
mov dword [ebp - 0x584], 1
jmp 0x1000a9ef
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0xcac]
imul eax, dword [ebp - 0x584]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xe5c]
je 0x1000aa22
push 0
lea ecx, [ebp - 0xb58]
call fcn.10016d1d
mov eax, dword [eax]
mov dword [ebp - 0xcb4], eax
jmp 0x1000aa70
mov byte [ebp - 0x11b], 0
movzx eax, byte [ebp - 0x11b]
test eax, eax
je 0x1000aa5c
push 0xaad
push 0x1662
push 0xd8d
push 0x89c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0
lea ecx, [ebp - 0xb58]
call fcn.10016d1d
cmp dword [eax], 0
je 0x1000aa70
jmp 0x1000aa90
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xffc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xffc], eax
jmp 0x1000a89c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb58]
call fcn.10016d18
mov dword [ebp - 0x18], 0
jmp 0x1000aaaf
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1000aca5
push 3
lea ecx, [ebp - 0xd58]
call fcn.10016cb0
mov byte [ebp - 4], 7
mov dword [ebp - 0x228], 0xf251d69f
mov dword [ebp - 0x298], 0
jmp 0x1000aaed
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 3
jge 0x1000ab0f
push dword [ebp - 0x298]
lea ecx, [ebp - 0xd58]
call fcn.10016d1d
mov dword [eax], 0xc6a53d06
jmp 0x1000aae0
mov dword [ebp - 0x228], 0
jmp 0x1000ab28
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jg 0x1000ac86
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xcbc], 0xffffffff
mov dword [ebp - 0xfc], 2
jmp 0x1000ab62
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x1000ac81
mov dword [ebp - 0x58c], 0x644bb323
mov dword [ebp - 0x59c], 0x5477a75e
push dword [ebp - 0xfc]
lea ecx, [ebp - 0xd58]
call fcn.10016d1d
cmp dword [eax], 0
je 0x1000ac41
push dword [ebp - 0xfc]
lea ecx, [ebp - 0xd58]
call fcn.10016d1d
or ecx, 0xffffffff
sub ecx, dword [eax]
cmp ecx, 0xe055a24b
jbe 0x1000abc7
mov dword [ebp - 0xa3c], 1
jmp 0x1000abce
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 0xdfee
jle 0x1000abf2
mov dword [ebp - 0xa44], 1
jmp 0x1000abf9
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xa44], eax
jle 0x1000ac13
mov dword [ebp - 0x594], 1
jmp 0x1000ac1a
and dword [ebp - 0x594], 0
push dword [ebp - 0xfc]
lea ecx, [ebp - 0xd58]
call fcn.10016d1d
mov ecx, dword [ebp - 0x594]
cmp ecx, dword [eax]
jne 0x1000ac41
mov dword [ebp - 0xa4c], 1
jmp 0x1000ac48
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 1
je 0x1000ac69
mov dword [ebp - 0xa54], 1
jmp 0x1000ac70
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xcbc], eax
jmp 0x1000ab55
jmp 0x1000ab1b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd58]
call fcn.10016d18
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c], 1
jmp 0x1000aaa8
mov dword [ebp - 0x18], 0
jmp 0x1000acb5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x1000b06c
mov dword [ebp - 0x5ac], 0xdd711a53
mov dword [ebp - 0x350], 0xfffffff6
mov dword [ebp - 0x868], 0xb3b3333d
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1000acfc
push 0x13ff
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x6c]
cmp dword [ebp + eax - 0x6c], ecx
jle 0x1000ad1b
mov dword [ebp - 0x5a4], 1
jmp 0x1000ad22
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0x5a4], eax
jge 0x1000ad3d
mov dword [ebp - 0xa5c], 1
jmp 0x1000ad44
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0xa5c]
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0xa64], eax
push 0
lea ecx, [ebp - 0xd68]
call fcn.10016d1d
mov ecx, dword [ebp - 0xa64]
mov dword [eax], ecx
cmp dword [ebp - 0xa64], 0x76c
je 0x1000ad89
mov dword [ebp - 0x5b4], 1
jmp 0x1000ad90
and dword [ebp - 0x5b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
add eax, dword [ebp - 0x5b4]
add eax, dword [ebp - 0x18]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x6c]
jl 0x1000adbb
mov dword [ebp - 0xa6c], 1
jmp 0x1000adc2
and dword [ebp - 0xa6c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
cmp dword [ebp - 0xa6c], eax
jl 0x1000ade0
mov dword [ebp - 0x5bc], 1
jmp 0x1000ade7
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x5bc]
sub ecx, dword [ebp + eax*4 - 0x6c]
cmp ecx, 0x260e2efe
jle 0x1000ae08
mov dword [ebp - 0xa74], 1
jmp 0x1000ae0f
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0xa74], eax
jl 0x1000ae2a
mov dword [ebp - 0xa7c], 1
jmp 0x1000ae31
and dword [ebp - 0xa7c], 0
cmp dword [ebp - 0xa7c], 9
je 0x1000ae46
mov dword [ebp - 0x5fc], 1
jmp 0x1000ae4d
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x5fc]
cmp eax, dword [ebp - 0x18]
jge 0x1000ae68
mov dword [ebp - 0x5e4], 1
jmp 0x1000ae6f
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
add eax, dword [ebp - 0x5e4]
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ebp + ecx*4 - 0x6c]
jge 0x1000ae94
mov dword [ebp - 0x5d0], 1
jmp 0x1000ae9b
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp eax, dword [ebp - 0x5d0]
je 0x1000aeb6
mov dword [ebp - 0x858], 1
jmp 0x1000aebd
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0x5d8], eax
jg 0x1000aeeb
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x6c], 0
jne 0x1000aeeb
and dword [ebp - 0xac8], 0
jmp 0x1000aef5
mov dword [ebp - 0xac8], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xac8], eax
jg 0x1000af0c
mov dword [ebp - 0x5e0], 1
jmp 0x1000af13
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0xefc], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0x350], eax
jle 0x1000af46
mov dword [ebp - 0x860], 1
jmp 0x1000af4d
and dword [ebp - 0x860], 0
cmp dword [ebp - 0x860], 0xbe945d44
jne 0x1000af65
mov dword [ebp - 0x5e8], 1
jmp 0x1000af6c
and dword [ebp - 0x5e8], 0
cmp dword [ebp - 0x5e8], 0
ja 0x1000af81
mov dword [ebp - 0x9a0], 1
jmp 0x1000af88
and dword [ebp - 0x9a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
cmp dword [ebp - 0x9a0], eax
je 0x1000afa6
mov dword [ebp - 0x5f0], 1
jmp 0x1000afad
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 0xfb64730e
jae 0x1000afd1
mov dword [ebp - 0x5f8], 1
jmp 0x1000afd8
and dword [ebp - 0x5f8], 0
cmp dword [ebp - 0x5f8], 0
jae 0x1000afed
mov dword [ebp - 0xcc4], 1
jmp 0x1000aff4
and dword [ebp - 0xcc4], 0
push 0
lea ecx, [ebp - 0xd68]
call fcn.10016d1d
push 0
lea ecx, [ebp - 0xd68]
call fcn.10016d1d
cmp dword [eax], 0
jne 0x1000b025
mov eax, 0xc85691f3
test eax, eax
jne 0x1000b025
and dword [ebp - 0xa40], 0
jmp 0x1000b02f
mov dword [ebp - 0xa40], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1194]
imul eax, dword [ebp - 0xa40]
cmp eax, dword [ebp - 0x18]
jne 0x1000b054
mov dword [ebp - 0x600], 1
jmp 0x1000b05b
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0xccc], eax
jmp 0x1000acae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd68]
call fcn.10016d18
push 1
lea ecx, [ebp - 0x3a8]
call fcn.10016cb0
mov dword [ebp - 4], 8
mov dword [ebp - 0x2f0], 0x1fbb9cf7
mov dword [ebp - 0x74], 0
jmp 0x1000b0a9
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x1000b0bf
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x1128], 1
jmp 0x1000b0a2
mov dword [ebp - 0x74], 0
jmp 0x1000b0cf
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1000b0eb
push dword [ebp - 0x74]
lea ecx, [ebp - 0x3a8]
call fcn.10016d1d
mov dword [eax], 0xa32b1cec
jmp 0x1000b0c8
mov dword [ebp - 0x74], 0
jmp 0x1000b0fb
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1000b111
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xb20], 0
jmp 0x1000b0f4
push 0
lea ecx, [ebp - 0x3a8]
call fcn.10016d1d
and dword [eax], 0
jmp 0x1000b147
push 0
lea ecx, [ebp - 0x3a8]
call fcn.10016d1d
mov dword [ebp - 0x870], eax
mov eax, dword [ebp - 0x870]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x870]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3a8]
call fcn.10016d1d
cmp dword [eax], 3
jg 0x1000b311
mov dword [ebp - 0x338], 0x3a34c865
mov dword [ebp - 0x610], 0xea0c8d4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb20], 0xfffffff8
push 0xfffffffffffffff8
pop eax
cmp eax, 1
jne 0x1000b196
mov dword [ebp - 0x608], 1
jmp 0x1000b19d
and dword [ebp - 0x608], 0
push 0
lea ecx, [ebp - 0x3a8]
call fcn.10016d1d
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x1128]
push 0
lea ecx, [ebp - 0x3a8]
call fcn.10016d1d
imul esi, dword [eax]
cmp dword [ebp - 0x608], esi
jle 0x1000b1d7
mov dword [ebp - 0x9a8], 1
jmp 0x1000b1de
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x338], eax
or eax, 0xffffffff
je 0x1000b2a0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb20]
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 0
je 0x1000b269
push 0
lea ecx, [ebp - 0x3a8]
call fcn.10016d1d
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1128]
mov dword [ebp - 0xf04], eax
push 0
lea ecx, [ebp - 0x3a8]
call fcn.10016d1d
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1128]
mov dword [ebp - 0xf0c], eax
push 0
lea ecx, [ebp - 0x3a8]
call fcn.10016d1d
cmp dword [ebp - 0x2f0], 0
je 0x1000b269
mov dword [ebp - 0x878], 1
jmp 0x1000b270
and dword [ebp - 0x878], 0
mov dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2f0]
cmp dword [ebp - 0x338], eax
jne 0x1000b2a0
mov dword [ebp - 0x618], 1
jmp 0x1000b2a7
and dword [ebp - 0x618], 0
imul eax, dword [ebp - 0x618], 0x5d08
test eax, eax
jne 0x1000b2c7
cmp dword [ebp - 0x2f0], 0
jne 0x1000b2c7
and dword [ebp - 0xa90], 0
jmp 0x1000b2d1
mov dword [ebp - 0xa90], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb20]
cmp dword [ebp - 0xa90], eax
jge 0x1000b2f2
mov dword [ebp - 0x620], 1
jmp 0x1000b2f9
and dword [ebp - 0x620], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x620]
mov dword [ebp + eax - 0xb20], ecx
jmp 0x1000b123
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a8]
call fcn.10016d18
push 1
lea ecx, [ebp - 0x384]
call fcn.10016cb0
mov dword [ebp - 4], 9
mov dword [ebp - 0x230], 0x1fbb9cf7
mov dword [ebp - 0x78], 0
jmp 0x1000b34e
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x1000b364
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x113c], 1
jmp 0x1000b347
mov dword [ebp - 0x78], 0
jmp 0x1000b374
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1000b390
push dword [ebp - 0x78]
lea ecx, [ebp - 0x384]
call fcn.10016d1d
mov dword [eax], 0xa32b1cec
jmp 0x1000b36d
mov dword [ebp - 0x78], 0
jmp 0x1000b3a0
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1000b3b6
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xb18], 0
jmp 0x1000b399
push 0
lea ecx, [ebp - 0x384]
call fcn.10016d1d
and dword [eax], 0
jmp 0x1000b3ec
push 0
lea ecx, [ebp - 0x384]
call fcn.10016d1d
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x880]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x880]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x384]
call fcn.10016d1d
cmp dword [eax], 3
jg 0x1000b5b6
mov dword [ebp - 0x360], 0x3a34c865
mov dword [ebp - 0x630], 0xea0c8d4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb18], 0xfffffff8
push 0xfffffffffffffff8
pop eax
cmp eax, 1
jne 0x1000b43b
mov dword [ebp - 0x628], 1
jmp 0x1000b442
and dword [ebp - 0x628], 0
push 0
lea ecx, [ebp - 0x384]
call fcn.10016d1d
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x113c]
push 0
lea ecx, [ebp - 0x384]
call fcn.10016d1d
imul esi, dword [eax]
cmp dword [ebp - 0x628], esi
jle 0x1000b47c
mov dword [ebp - 0x9b0], 1
jmp 0x1000b483
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x360], eax
or eax, 0xffffffff
je 0x1000b545
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb18]
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
je 0x1000b50e
push 0
lea ecx, [ebp - 0x384]
call fcn.10016d1d
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x113c]
mov dword [ebp - 0xf14], eax
push 0
lea ecx, [ebp - 0x384]
call fcn.10016d1d
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x113c]
mov dword [ebp - 0xf1c], eax
push 0
lea ecx, [ebp - 0x384]
call fcn.10016d1d
cmp dword [ebp - 0x230], 0
je 0x1000b50e
mov dword [ebp - 0x888], 1
jmp 0x1000b515
and dword [ebp - 0x888], 0
mov dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x360], eax
jne 0x1000b545
mov dword [ebp - 0x638], 1
jmp 0x1000b54c
and dword [ebp - 0x638], 0
imul eax, dword [ebp - 0x638], 0x5d08
test eax, eax
jne 0x1000b56c
cmp dword [ebp - 0x230], 0
jne 0x1000b56c
and dword [ebp - 0xa48], 0
jmp 0x1000b576
mov dword [ebp - 0xa48], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb18]
cmp dword [ebp - 0xa48], eax
jge 0x1000b597
mov dword [ebp - 0x640], 1
jmp 0x1000b59e
and dword [ebp - 0x640], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x640]
mov dword [ebp + eax - 0xb18], ecx
jmp 0x1000b3c8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x384]
call fcn.10016d18
push 1
lea ecx, [ebp - 0x39c]
call fcn.10016cb0
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x2a0], 0x1fbb9cf7
mov dword [ebp - 0x80], 0
jmp 0x1000b5f3
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x1000b609
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1150], 1
jmp 0x1000b5ec
mov dword [ebp - 0x80], 0
jmp 0x1000b619
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1000b635
push dword [ebp - 0x80]
lea ecx, [ebp - 0x39c]
call fcn.10016d1d
mov dword [eax], 0xa32b1cec
jmp 0x1000b612
mov dword [ebp - 0x80], 0
jmp 0x1000b645
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1000b65b
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xb28], 0
jmp 0x1000b63e
push 0
lea ecx, [ebp - 0x39c]
call fcn.10016d1d
and dword [eax], 0
jmp 0x1000b691
push 0
lea ecx, [ebp - 0x39c]
call fcn.10016d1d
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x890]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x890]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x39c]
call fcn.10016d1d
cmp dword [eax], 3
jg 0x1000b85b
mov dword [ebp - 0x340], 0x3a34c865
mov dword [ebp - 0x650], 0xea0c8d4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb28], 0xfffffff8
push 0xfffffffffffffff8
pop eax
cmp eax, 1
jne 0x1000b6e0
mov dword [ebp - 0x648], 1
jmp 0x1000b6e7
and dword [ebp - 0x648], 0
push 0
lea ecx, [ebp - 0x39c]
call fcn.10016d1d
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x1150]
push 0
lea ecx, [ebp - 0x39c]
call fcn.10016d1d
imul esi, dword [eax]
cmp dword [ebp - 0x648], esi
jle 0x1000b721
mov dword [ebp - 0x9b8], 1
jmp 0x1000b728
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0x340], eax
or eax, 0xffffffff
je 0x1000b7ea
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb28]
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 0
je 0x1000b7b3
push 0
lea ecx, [ebp - 0x39c]
call fcn.10016d1d
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1150]
mov dword [ebp - 0xf24], eax
push 0
lea ecx, [ebp - 0x39c]
call fcn.10016d1d
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1150]
mov dword [ebp - 0xf2c], eax
push 0
lea ecx, [ebp - 0x39c]
call fcn.10016d1d
cmp dword [ebp - 0x2a0], 0
je 0x1000b7b3
mov dword [ebp - 0x898], 1
jmp 0x1000b7ba
and dword [ebp - 0x898], 0
mov dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0x340], eax
jne 0x1000b7ea
mov dword [ebp - 0x658], 1
jmp 0x1000b7f1
and dword [ebp - 0x658], 0
imul eax, dword [ebp - 0x658], 0x5d08
test eax, eax
jne 0x1000b811
cmp dword [ebp - 0x2a0], 0
jne 0x1000b811
and dword [ebp - 0xab8], 0
jmp 0x1000b81b
mov dword [ebp - 0xab8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb28]
cmp dword [ebp - 0xab8], eax
jge 0x1000b83c
mov dword [ebp - 0x660], 1
jmp 0x1000b843
and dword [ebp - 0x660], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x660]
mov dword [ebp + eax - 0xb28], ecx
jmp 0x1000b66d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x39c]
call fcn.10016d18
mov dword [ebp - 0x8a0], 0xb7c7ce53
mov dword [ebp - 0x1a0], 0xfffffffa
mov dword [ebp - 0x1b8], 0xc5534bf8
push 2
lea ecx, [ebp - 0x1028]
call fcn.10016cb0
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x238], 0
jmp 0x1000b8b5
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x1000b8d7
push dword [ebp - 0x238]
lea ecx, [ebp - 0x1028]
call fcn.10016d1d
mov dword [eax], 0x6f7fbf21
jmp 0x1000b8a8
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0xf34], eax
cmp dword [ebp - 0x8a0], 2
jbe 0x1000b8f8
mov dword [ebp - 0x668], 1
jmp 0x1000b8ff
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1a0], 1
jmp 0x1000b930
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jl 0x1000b99f
mov dword [ebp - 0xcd4], 0x32cf415d
mov dword [ebp - 0xcdc], 0xed6b6572
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0xcdc], eax
mov dword [ebp - 0x1b8], 1
jmp 0x1000b972
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x1000b99d
mov dword [ebp - 0xcf8], 0x3bd
cmp dword [ebp - 0x1b8], 0
je 0x1000b990
jmp 0x1000b99d
cmp dword [ebp - 0xcf8], 0
je 0x1000b99b
jmp 0x1000b965
jmp 0x1000b965
jmp 0x1000b923
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1028]
call fcn.10016d18
mov dword [ebp - 0xe4], 0
jmp 0x1000b9c7
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x1000b9e3
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0xf3c], 0x55bb
jmp 0x1000b9ba
mov dword [ebp - 0xe4], 0
jmp 0x1000b9fc
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jge 0x1000ba18
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0xe00], 0xfe223643
jmp 0x1000b9ef
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe00], 0
jmp 0x1000ba46
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe00]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe00], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe00], 0
jg 0x1000baa0
mov dword [ebp - 0xd00], 0
mov dword [ebp - 0xd08], 0xd672a835
mov eax, dword [ebp - 0xd00]
mov dword [ebp - 0xd08], eax
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x1000ba9e
push 0
push 0
push 0x1dd1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1000ba2b
mov dword [ebp - 0x9c0], 0xb7c7ce53
mov dword [ebp - 0x1a8], 0xfffffffa
mov dword [ebp - 0x1c0], 0xc5534bf8
push 2
lea ecx, [ebp - 0x1038]
call fcn.10016cb0
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x2d8], 0
jmp 0x1000baeb
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 2
jge 0x1000bb0d
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0x1038]
call fcn.10016d1d
mov dword [eax], 0x6f7fbf21
jmp 0x1000bade
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0xf44], eax
cmp dword [ebp - 0x9c0], 2
jbe 0x1000bb2e
mov dword [ebp - 0x670], 1
jmp 0x1000bb35
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1a8], 1
jmp 0x1000bb66
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jl 0x1000bbd5
mov dword [ebp - 0xbd8], 0x32cf415d
mov dword [ebp - 0xb8c], 0xed6b6572
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0x1c0], 1
jmp 0x1000bba8
cmp dword [ebp - 0x1c0], 0
jl 0x1000bbd3
mov dword [ebp - 0xca0], 0x3bd
cmp dword [ebp - 0x1c0], 0
je 0x1000bbc6
jmp 0x1000bbd3
cmp dword [ebp - 0xca0], 0
je 0x1000bbd1
jmp 0x1000bb9b
jmp 0x1000bb9b
jmp 0x1000bb59
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1038]
call fcn.10016d18
mov dword [ebp - 0x8a8], 0xb7c7ce53
mov dword [ebp - 0x18c], 0xfffffffa
mov dword [ebp - 0x1bc], 0xc5534bf8
push 2
lea ecx, [ebp - 0x1048]
call fcn.10016cb0
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x240], 0
jmp 0x1000bc2f
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x1000bc51
push dword [ebp - 0x240]
lea ecx, [ebp - 0x1048]
call fcn.10016d1d
mov dword [eax], 0x6f7fbf21
jmp 0x1000bc22
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0xf4c], eax
cmp dword [ebp - 0x8a8], 2
jbe 0x1000bc72
mov dword [ebp - 0x678], 1
jmp 0x1000bc79
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x18c], 1
jmp 0x1000bcaa
cmp dword [ebp - 0x18c], 0
jl 0x1000bd19