Function at 0x100090c9
Capabilities:
Check os version
Compare security identifiers
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008a65c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1194
call fcn.100867e0
push esi
push edi
mov dword [ebp - 0x58], 0xfb871c7b
mov dword [ebp - 0x244], 4
mov dword [ebp - 0x118], 0xd66c4a87
mov dword [ebp - 0x374], 0
jmp 0x10009121
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 1
jge 0x1000913d
mov eax, dword [ebp - 0x374]
mov dword [ebp + eax*4 - 0x1bc], 0x4a6847df
jmp 0x10009114
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1000915e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov dword [ebp - 0x58], 0
jmp 0x1000916e
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jg 0x100093cd
mov dword [ebp - 0x1e8], 0x99244325
mov dword [ebp - 0x10bc], 1
mov dword [ebp - 0xa34], 1
mov dword [ebp - 0x1e8], 0
jmp 0x100091af
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jg 0x100093ba
mov dword [ebp - 0x180], 5
or eax, 0xffffffff
je 0x10009210
mov dword [ebp - 0xb80], 0xfffffff6
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x1078], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x1000920b
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x100092d1
mov dword [ebp - 0x740], 0x976d9935
mov dword [ebp - 0x118], 0
jmp 0x10009233
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xfffffffb
jg 0x1000924e
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov dword [ebp - 0x180], eax
jmp 0x10009226
mov dword [ebp - 0x244], 0
jmp 0x10009267
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jg 0x100092d1
mov dword [ebp - 0x180], 0
jmp 0x10009289
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jg 0x100092c0
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x100092b1
push 0x1f26
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebp - 0x740]
inc eax
mov dword [ebp - 0x740], eax
jmp 0x1000927c
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x1bc], 0
je 0x100092cf
jmp 0x1000925a
jmp 0x1000925a
cmp dword [ebp - 0x58], 0
jne 0x100092f0
mov eax, dword [ebp - 0x118]
add eax, 0xd4db
cmp eax, 1
jle 0x100092f0
and dword [ebp - 0xa24], 0
jmp 0x100092fa
mov dword [ebp - 0xa24], 1
mov eax, dword [ebp - 0x180]
imul eax, dword [ebp - 0xa24]
test eax, eax
je 0x10009320
mov eax, 0x4f2ca125
test eax, eax
je 0x10009320
mov dword [ebp - 0xcdc], 1
jmp 0x10009327
and dword [ebp - 0xcdc], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov dword [ebp - 0xf40], eax
cmp dword [ebp - 0x58], 0xce2e7c52
jne 0x10009356
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x1bc], 0
jne 0x10009356
and dword [ebp - 0xa2c], 0
jmp 0x10009360
mov dword [ebp - 0xa2c], 1
mov eax, dword [ebp - 0xa34]
cmp dword [ebp - 0xa2c], eax
jle 0x1000937a
mov dword [ebp - 0xa54], 1
jmp 0x10009381
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0xa34]
cmp dword [ebp - 0xa54], eax
jle 0x1000939b
mov dword [ebp - 0xa5c], 1
jmp 0x100093a2
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0xa5c]
mov dword [ebp + eax*4 - 0x1bc], ecx
jmp 0x100091a2
cmp dword [ebp - 0x118], 0
je 0x100093c8
jmp 0x10009167
jmp 0x10009167
mov dword [ebp - 0x60], 0xfb871c7b
mov dword [ebp - 0x24c], 4
mov dword [ebp - 0x120], 0xd66c4a87
mov dword [ebp - 0x2f4], 0
jmp 0x10009401
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 1
jge 0x1000941d
mov eax, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0x1c4], 0x4a6847df
jmp 0x100093f4
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x1000943e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov dword [ebp - 0x60], 0
jmp 0x1000944e
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jg 0x100096ad
mov dword [ebp - 0x210], 0x99244325
mov dword [ebp - 0x1030], 1
mov dword [ebp - 0xb24], 1
mov dword [ebp - 0x210], 0
jmp 0x1000948f
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jg 0x1000969a
mov dword [ebp - 0x188], 5
or eax, 0xffffffff
je 0x100094f0
mov dword [ebp - 0xc84], 0xfffffff6
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0xf48], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x1c4]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x100094eb
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x100095b1
mov dword [ebp - 0xa64], 0x976d9935
mov dword [ebp - 0x120], 0
jmp 0x10009513
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xfffffffb
jg 0x1000952e
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x1c4]
mov dword [ebp - 0x188], eax
jmp 0x10009506
mov dword [ebp - 0x24c], 0
jmp 0x10009547
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jg 0x100095b1
mov dword [ebp - 0x188], 0
jmp 0x10009569
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jg 0x100095a0
mov byte [ebp - 0x110], 0
movzx eax, byte [ebp - 0x110]
test eax, eax
je 0x10009591
push 0x1f26
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebp - 0xa64]
inc eax
mov dword [ebp - 0xa64], eax
jmp 0x1000955c
mov eax, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0x1c4], 0
je 0x100095af
jmp 0x1000953a
jmp 0x1000953a
cmp dword [ebp - 0x60], 0
jne 0x100095d0
mov eax, dword [ebp - 0x120]
add eax, 0xd4db
cmp eax, 1
jle 0x100095d0
and dword [ebp - 0xa6c], 0
jmp 0x100095da
mov dword [ebp - 0xa6c], 1
mov eax, dword [ebp - 0x188]
imul eax, dword [ebp - 0xa6c]
test eax, eax
je 0x10009600
mov eax, 0x4f2ca125
test eax, eax
je 0x10009600
mov dword [ebp - 0xce4], 1
jmp 0x10009607
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x1c4]
mov dword [ebp - 0x10a0], eax
cmp dword [ebp - 0x60], 0xce2e7c52
jne 0x10009636
mov eax, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0x1c4], 0
jne 0x10009636
and dword [ebp - 0xb28], 0
jmp 0x10009640
mov dword [ebp - 0xb28], 1
mov eax, dword [ebp - 0xb24]
cmp dword [ebp - 0xb28], eax
jle 0x1000965a
mov dword [ebp - 0x9d8], 1
jmp 0x10009661
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0xb24]
cmp dword [ebp - 0x9d8], eax
jle 0x1000967b
mov dword [ebp - 0x80c], 1
jmp 0x10009682
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x80c]
mov dword [ebp + eax*4 - 0x1c4], ecx
jmp 0x10009482
cmp dword [ebp - 0x120], 0
je 0x100096a8
jmp 0x10009447
jmp 0x10009447
mov dword [ebp - 0xf50], 0xef20fe6e
mov dword [ebp - 0x1038], 0xbeccce1e
mov dword [ebp - 0xf58], 2
mov dword [ebp - 0x1080], 0xe923e64f
mov dword [ebp - 0xf8c], 0xfffffff9
mov dword [ebp - 0x1040], 0x68029989
mov dword [ebp - 0xf98], 1
mov dword [ebp - 0x10b0], 0x6985
mov dword [ebp - 0x47c], 0xe6b99bf0
mov dword [ebp - 0x2c], 0
jmp 0x10009717
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000972d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x117c], 1
jmp 0x10009710
mov dword [ebp - 0x2c], 0
jmp 0x1000973d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10009753
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xfa0], 0xfffffff6
jmp 0x10009736
mov dword [ebp - 0x2c], 0
jmp 0x10009763
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10009779
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1048], 0
jmp 0x1000975c
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x54], 0xfb871c7b
and dword [ebp - 0xe58], 0
and dword [ebp - 0xe54], 0
and dword [ebp - 0xe50], 0
and dword [ebp - 0xe4c], 0
lea ecx, [ebp - 0x3ad]
call fcn.10008e83
push eax
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0xe58]
push eax
lea ecx, [ebp - 0x10e4]
call fcn.10018524
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x40c]
call fcn.100184d3
and dword [ebp - 4], 0
mov dword [ebp - 0x40], 0xecb302af
mov dword [ebp - 0xc0], 6
mov dword [ebp - 0x49c], 0xffffffff
mov dword [ebp - 0x1cc], 0x625c2a3d
mov dword [ebp - 0x85c], 0xec3a435f
push 3
lea ecx, [ebp - 0x40c]
call fcn.10018515
push 3
lea ecx, [ebp - 0x40c]
call fcn.10018515
cmp dword [eax], 1
je 0x1000983c
mov dword [ebp - 0x814], 1
jmp 0x10009843
and dword [ebp - 0x814], 0
push 3
lea ecx, [ebp - 0x40c]
call fcn.10018515
mov ecx, dword [ebp - 0x814]
cmp ecx, dword [eax]
jge 0x10009866
mov dword [ebp - 0x484], 1
jmp 0x1000986d
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 4
je 0x1000988b
mov eax, 0x4e80
test eax, eax
je 0x1000988b
mov dword [ebp - 0x81c], 1
jmp 0x10009892
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 1
je 0x100098a7
mov dword [ebp - 0x48c], 1
jmp 0x100098ae
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x40], eax
mov esi, dword [ebp - 0x40]
push 3
lea ecx, [ebp - 0x40c]
call fcn.10018515
sub esi, dword [eax]
push 3
lea ecx, [ebp - 0x40c]
call fcn.10018515
add esi, dword [eax]
push 3
lea ecx, [ebp - 0x40c]
call fcn.10018515
cmp esi, dword [eax]
jl 0x100098f5
mov dword [ebp - 0x824], 1
jmp 0x100098fc
and dword [ebp - 0x824], 0
push 3
lea ecx, [ebp - 0x40c]
call fcn.10018515
mov eax, dword [eax]
cmp eax, dword [ebp - 0x824]
je 0x1000991f
mov dword [ebp - 0x494], 1
jmp 0x10009926
and dword [ebp - 0x494], 0
push 3
lea ecx, [ebp - 0x40c]
call fcn.10018515
mov eax, dword [eax]
sub eax, dword [ebp - 0x494]
cmp eax, 0x6684
jge 0x1000994e
mov dword [ebp - 0xc94], 1
jmp 0x10009955
and dword [ebp - 0xc94], 0
push 0
lea ecx, [ebp - 0x40c]
call fcn.10018515
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc0], 0xf
jmp 0x10009984
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffe8
jle 0x10009d21
mov dword [ebp - 0x2fc], 0x459f451d
push 4
lea ecx, [ebp - 0xddc]
call fcn.10018477
mov byte [ebp - 4], 1
mov dword [ebp - 0x34c], 0
jmp 0x100099c5
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 4
jge 0x100099e7
push dword [ebp - 0x34c]
lea ecx, [ebp - 0xddc]
call fcn.10018515
mov dword [eax], 0xe87bb6ab
jmp 0x100099b8
mov dword [ebp - 0x40], 0
jmp 0x100099f7
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 7
jge 0x10009c66
mov dword [ebp - 0x190], 1
push 1
lea ecx, [ebp - 0xec8]
call fcn.10018477
mov byte [ebp - 4], 2
mov dword [ebp - 0x254], 0
jmp 0x10009a35
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 1
jge 0x10009a57
push dword [ebp - 0x254]
lea ecx, [ebp - 0xec8]
call fcn.10018515
mov dword [eax], 0x87e17710
jmp 0x10009a28
cmp dword [ebp - 0x2fc], 0
jne 0x10009c27
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x10009a80
cmp dword [ebp - 0x2fc], 0
je 0x10009a80
mov dword [ebp - 0xcec], 1
jmp 0x10009a87
and dword [ebp - 0xcec], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xfa8], eax
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0xc0], eax
jl 0x10009aad
mov dword [ebp - 0x82c], 1
jmp 0x10009ab4
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x82c]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
mov ecx, dword [ebp - 0x190]
lea eax, [eax + ecx - 0x6bc9]
test eax, eax
jle 0x10009ae7
mov dword [ebp - 0x834], 1
jmp 0x10009aee
and dword [ebp - 0x834], 0
cmp dword [ebp - 0x834], 0xad446302
jae 0x10009b06
mov dword [ebp - 0x4a4], 1
jmp 0x10009b0d
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x4a4], eax
jle 0x10009b27
mov dword [ebp - 0x83c], 1
jmp 0x10009b2e
and dword [ebp - 0x83c], 0
cmp dword [ebp - 0x83c], 0x58d3b3e2
jge 0x10009b46
mov dword [ebp - 0x4ac], 1
jmp 0x10009b4d
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0xfffffffb
je 0x10009b62
mov dword [ebp - 0x844], 1
jmp 0x10009b69
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x844], eax
jne 0x10009b83
mov dword [ebp - 0x4b4], 1
jmp 0x10009b8a
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x4b4], eax
jle 0x10009ba4
mov dword [ebp - 0x84c], 1
jmp 0x10009bab
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x84c]
cmp eax, 0x63b8
je 0x10009bca
mov dword [ebp - 0x4bc], 1
jmp 0x10009bd1
and dword [ebp - 0x4bc], 0
cmp dword [ebp - 0x4bc], 0xf2b6367a
ja 0x10009bf2
cmp dword [ebp - 0x190], 0
je 0x10009bf2
mov dword [ebp - 0x854], 1
jmp 0x10009bf9
and dword [ebp - 0x854], 0
push 3
lea ecx, [ebp - 0x40c]
call fcn.10018515
mov ecx, dword [ebp - 0x854]
cmp ecx, dword [eax]
je 0x10009c27
or eax, 0xffffffff
jne 0x10009c27
cmp dword [ebp - 0x190], 0
jne 0x10009c27
and dword [ebp - 0x4c4], 0
jmp 0x10009c31
mov dword [ebp - 0x4c4], 1
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x1cc], eax
mov esi, dword [ebp - 0x1cc]
push 0
lea ecx, [ebp - 0xec8]
call fcn.10018515
mov dword [eax], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xec8]
call fcn.100184f9
jmp 0x100099f0
mov dword [ebp - 0x1cc], 0
jmp 0x10009c7f
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xc
jne 0x10009d0d
mov dword [ebp - 0xccc], 0xffffffff
mov dword [ebp - 0x40], 0xfffffff1
jmp 0x10009ca6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffffb
jne 0x10009cce
push 3
lea ecx, [ebp - 0xddc]
call fcn.10018515
mov dword [eax], 0x2350c165
mov eax, dword [ebp - 0x85c]
dec eax
mov dword [ebp - 0x85c], eax
jmp 0x10009c9f
cmp dword [ebp - 0xccc], 0
je 0x10009cee
mov esi, dword [ebp - 0xc0]
push 3
lea ecx, [ebp - 0xddc]
call fcn.10018515
mov dword [eax], esi
jmp 0x10009d08
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x10009d08
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x10009c72
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xddc]
call fcn.100184f9
jmp 0x10009977
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40c]
call fcn.100184f9
mov dword [ebp - 0x30c], 4
mov dword [ebp - 0x130], 0xd66c4a87
mov dword [ebp - 0x25c], 0xfffffff6
mov dword [ebp - 0x25c], 0
jmp 0x10009d67
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 6
jne 0x10009d8e
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x10009d8c
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x10009d5a
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x10009dee
push 0x9d0
push 0x48b
push 0x26b9
push 0
push 0xa88
push 0xf77
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x6dd
push 0x21a9
push 0xb2c
push 0x2f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 2
lea ecx, [ebp - 0xc00]
call fcn.10018477
mov dword [ebp - 4], 3
push 4
lea ecx, [ebp - 0xb7c]
call fcn.10018477
mov byte [ebp - 4], 4
mov dword [ebp - 0x128], 0xffffffff
mov dword [ebp - 0x1f8], 5
mov dword [ebp - 0x3ec], 8
mov dword [ebp - 0x3c8], 0xffffffff
mov dword [ebp - 0xd5c], 0x1b78
mov dword [ebp - 0x1088], 1
mov dword [ebp - 0x20], 0
jmp 0x10009e5f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10009e7b
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc00]
call fcn.10018515
mov dword [eax], 0xfa5c62e0
jmp 0x10009e58
mov dword [ebp - 0x20], 0
jmp 0x10009e8b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10009ea7
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb7c]
call fcn.10018515
mov dword [eax], 8
jmp 0x10009e84
mov dword [ebp - 0x20], 0
jmp 0x10009eb7
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10009ecd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1134], 0xffffffff
jmp 0x10009eb0
mov esi, dword [ebp - 0x3ec]
push 1
lea ecx, [ebp - 0xc00]
call fcn.10018515
add esi, dword [eax]
mov eax, dword [ebp - 0x3ec]
dec eax
mov dword [ebp - 0x3ec], eax
test esi, esi
je 0x1000a03e
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x10009faf
push 1
lea ecx, [ebp - 0xb7c]
call fcn.10018515
mov eax, dword [eax]
add eax, 0xffff
jne 0x10009f33
push 1
lea ecx, [ebp - 0xc00]
call fcn.10018515
cmp dword [eax], 0
jne 0x10009f33
and dword [ebp - 0x4cc], 0
jmp 0x10009f3d
mov dword [ebp - 0x4cc], 1
push 3
lea ecx, [ebp - 0xb7c]
call fcn.10018515
mov ecx, dword [ebp - 0x4cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x864], eax
push 1
lea ecx, [ebp - 0xc00]
call fcn.10018515
mov ecx, dword [ebp - 0x864]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x864], eax
jl 0x10009f8e
mov dword [ebp - 0x4d4], 1
jmp 0x10009f95
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x4d4], eax
jne 0x10009faf
mov dword [ebp - 0x86c], 1
jmp 0x10009fb6
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x86c]
add eax, 9
cmp eax, 0x2c298c24
jg 0x10009fd2
mov dword [ebp - 0x4dc], 1
jmp 0x10009fd9
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x4dc], eax
jl 0x10009ff3
mov dword [ebp - 0x874], 1
jmp 0x10009ffa
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x874], eax
je 0x1000a014
mov dword [ebp - 0xcb0], 1
jmp 0x1000a01b
and dword [ebp - 0xcb0], 0
push 1
lea ecx, [ebp - 0xb7c]
call fcn.10018515
mov ecx, dword [ebp - 0x128]
cmp dword [eax], ecx
jne 0x1000a03e
mov dword [ebp - 0x4e4], 1
jmp 0x1000a045
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x4e4], eax
jge 0x1000a068
cmp dword [ebp - 0xd5c], 0
je 0x1000a068
mov dword [ebp - 0x87c], 1
jmp 0x1000a06f
and dword [ebp - 0x87c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x87c]
mov dword [ebp + eax - 0x1134], ecx
mov dword [ebp - 0x1f8], 0
jmp 0x1000a09b
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0xffffffeb
jle 0x1000a27c
mov dword [ebp - 0x38c], 0
jmp 0x1000a0c1
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 2
jge 0x1000a0dd
mov eax, dword [ebp - 0x38c]
mov dword [ebp + eax*4 - 0xa40], 4
jmp 0x1000a0b4
mov dword [ebp - 0x128], 0
jmp 0x1000a0f6
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xf
jge 0x1000a277
mov dword [ebp - 0x884], 0xffff
mov dword [ebp - 0xcb8], 7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa40]
mov dword [ebp - 0xfb0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa40], 0
jne 0x1000a14c
cmp dword [ebp - 0x884], 0
jne 0x1000a14c
and dword [ebp - 0x4ec], 0
jmp 0x1000a156
mov dword [ebp - 0x4ec], 1
cmp dword [ebp - 0x4ec], 0
je 0x1000a187
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x1000a182
push 0
push 0
push 0x1d53
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
jmp 0x1000a272
mov dword [ebp - 0x264], 0
jmp 0x1000a1a0
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 4
jge 0x1000a1bc
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0x10cc], 0x1939efd9
jmp 0x1000a193
cmp dword [ebp - 0x884], 0
je 0x1000a260
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa40], 0
jne 0x1000a22e
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xa40]
push 4
pop eax
imul eax, eax, 0
mov edi, dword [ebp + eax - 0x10cc]
push 1
lea ecx, [ebp - 0xb7c]
call fcn.10018515
add edi, dword [eax]
cmp esi, edi
jg 0x1000a212
mov dword [ebp - 0x4f4], 1
jmp 0x1000a219
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0x237ddc4e
jg 0x1000a22e
and dword [ebp - 0x88c], 0
jmp 0x1000a238
mov dword [ebp - 0x88c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa40]
cmp dword [ebp - 0x88c], eax
jle 0x1000a259
mov dword [ebp - 0x4fc], 1
jmp 0x1000a260
and dword [ebp - 0x4fc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x10cc]
mov dword [ebp - 0xcb8], eax
jmp 0x1000a0e9
jmp 0x1000a08e
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb7c]
call fcn.100184f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc00]
call fcn.100184f9
mov dword [ebp - 0x304], 0
jmp 0x1000a2b3
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jge 0x1000a2cf
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x1a0], 0x4a6847df
jmp 0x1000a2a6
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1000a2f0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov dword [ebp - 0x26c], 0
push 1
lea ecx, [ebp - 0xfec]
call fcn.10018477
mov dword [ebp - 4], 5
mov dword [ebp - 0xac], 0
jmp 0x1000a327
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 4
jge 0x1000a343
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0xdb8], 0xffff
jmp 0x1000a31a
mov dword [ebp - 0xac], 0
jmp 0x1000a35c
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x1000a37e
push dword [ebp - 0xac]
lea ecx, [ebp - 0xfec]
call fcn.10018515
mov dword [eax], 0x46552ded
jmp 0x1000a34f
mov dword [ebp - 0x26c], 0xffffffec
jmp 0x1000a397
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x1c
jl 0x1000a7e7
mov dword [ebp - 0x70], 0x8d581621
mov dword [ebp - 0x70], 0
jmp 0x1000a3bb
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jg 0x1000a7e2
mov dword [ebp - 0x220], 0
push 1
lea ecx, [ebp - 0xc10]
call fcn.10018477
mov byte [ebp - 4], 6
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x354], 0
jmp 0x1000a403
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 1
jge 0x1000a425
push dword [ebp - 0x354]
lea ecx, [ebp - 0xc10]
call fcn.10018515
mov dword [eax], 0x8fa8f90a
jmp 0x1000a3f6
mov dword [ebp - 0x220], 0
jmp 0x1000a43e
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jg 0x1000a731
mov dword [ebp - 0x94], 0xfffffffc
mov dword [ebp - 0x1050], 0xfffffff8
mov dword [ebp - 0xfb8], 1
mov dword [ebp - 0x108c], 0xfffffffc
mov dword [ebp - 0x94], 3
jmp 0x1000a48c
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1000a4d5
push 0
lea ecx, [ebp - 0xc10]
call fcn.10018515
mov dword [eax], 0x545ee28f
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1000a4d3
push 0x10e7
push 0x1e67
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
jmp 0x1000a47f
mov dword [ebp - 0x94], 0
jmp 0x1000a4ee
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jg 0x1000a72c
push 2
lea ecx, [ebp - 0x46c]
call fcn.10018477
mov byte [ebp - 4], 7
mov dword [ebp - 0x274], 0
jmp 0x1000a525
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jge 0x1000a547
push dword [ebp - 0x274]
lea ecx, [ebp - 0x46c]
call fcn.10018515
mov dword [eax], 0x9e9d60a2
jmp 0x1000a518
push 1
lea ecx, [ebp - 0x46c]
call fcn.10018515
and dword [eax], 0
jmp 0x1000a57d
push 1
lea ecx, [ebp - 0x46c]
call fcn.10018515
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x894]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x894]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x46c]
call fcn.10018515
cmp dword [eax], 3
jg 0x1000a70b
push 1
lea ecx, [ebp - 0x46c]
call fcn.10018515
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xdb8], 0
je 0x1000a6e6
cmp dword [ebp - 0x220], 0x26c4
jl 0x1000a5c8
mov dword [ebp - 0x504], 1
jmp 0x1000a5cf
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x504], eax
jg 0x1000a5e9
mov dword [ebp - 0x3dc], 1
jmp 0x1000a5f0
and dword [ebp - 0x3dc], 0
push 0
lea ecx, [ebp - 0xc10]
call fcn.10018515
mov ecx, dword [ebp - 0x3dc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x3dc]
jne 0x1000a634
push 0
lea ecx, [ebp - 0xc10]
call fcn.10018515
cmp dword [eax], 0
jne 0x1000a634
mov eax, 0xa12a
test eax, eax
jne 0x1000a634
and dword [ebp - 0x89c], 0
jmp 0x1000a63e
mov dword [ebp - 0x89c], 1
push 1
lea ecx, [ebp - 0x46c]
call fcn.10018515
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xdb8]
cmp dword [ebp - 0x89c], eax
jne 0x1000a668
mov dword [ebp - 0x50c], 1
jmp 0x1000a66f
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 0xffffffff
jne 0x1000a684
mov dword [ebp - 0x8a4], 1
jmp 0x1000a68b
and dword [ebp - 0x8a4], 0
push 1
lea ecx, [ebp - 0x46c]
call fcn.10018515
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8a4]
je 0x1000a6ae
mov dword [ebp - 0x514], 1
jmp 0x1000a6b5
and dword [ebp - 0x514], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdb8]
cmp dword [ebp - 0x514], eax
je 0x1000a6d6
mov dword [ebp - 0x8ac], 1
jmp 0x1000a6dd
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
sub eax, dword [ebp - 0x70]
push 1
lea ecx, [ebp - 0x46c]
call fcn.10018515
mov eax, dword [eax]
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0xdb8]
mov dword [ebp + ecx*4 - 0xdb8], eax
jmp 0x1000a559
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x46c]
call fcn.100184f9
jmp 0x1000a4e1
jmp 0x1000a431
mov dword [ebp - 0x198], 0
jmp 0x1000a74a
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jg 0x1000a7ce
mov dword [ebp - 0xd1c], 0xa2c0
mov eax, dword [ebp - 0x70]
cmp dword [ebp + eax*4 - 0xdb8], 0
jne 0x1000a77c
cmp dword [ebp - 0x70], 1
jg 0x1000a77c
mov dword [ebp - 0x51c], 1
jmp 0x1000a783
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 1
je 0x1000a798
mov dword [ebp - 0x8b4], 1
jmp 0x1000a79f
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x8b4], eax
jge 0x1000a7b6
mov dword [ebp - 0x524], 1
jmp 0x1000a7bd
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0xd1c], eax
jmp 0x1000a73d
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc10]
call fcn.100184f9
jmp 0x1000a3b4
jmp 0x1000a38a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfec]
call fcn.100184f9
mov dword [ebp - 0x54], 0
jmp 0x1000a806
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jg 0x1000aa65
mov dword [ebp - 0x200], 0x99244325
mov dword [ebp - 0xfc0], 1
mov dword [ebp - 0x534], 1
mov dword [ebp - 0x200], 0
jmp 0x1000a847
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
jg 0x1000aa52
mov dword [ebp - 0x1d4], 5
or eax, 0xffffffff
je 0x1000a8a8
mov dword [ebp - 0xb84], 0xfffffff6
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0x1058], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1000a8a3
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x1000a969
mov dword [ebp - 0x8bc], 0x976d9935
mov dword [ebp - 0x130], 0
jmp 0x1000a8cb
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffffb
jg 0x1000a8e6
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov dword [ebp - 0x1d4], eax
jmp 0x1000a8be
mov dword [ebp - 0x30c], 0
jmp 0x1000a8ff
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
jg 0x1000a969
mov dword [ebp - 0x1d4], 0
jmp 0x1000a921
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jg 0x1000a958
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x1000a949
push 0x1f26
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebp - 0x8bc]
inc eax
mov dword [ebp - 0x8bc], eax
jmp 0x1000a914
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x1a0], 0
je 0x1000a967
jmp 0x1000a8f2
jmp 0x1000a8f2
cmp dword [ebp - 0x54], 0
jne 0x1000a988
mov eax, dword [ebp - 0x130]
add eax, 0xd4db
cmp eax, 1
jle 0x1000a988
and dword [ebp - 0x52c], 0
jmp 0x1000a992
mov dword [ebp - 0x52c], 1
mov eax, dword [ebp - 0x1d4]
imul eax, dword [ebp - 0x52c]
test eax, eax
je 0x1000a9b8
mov eax, 0x4f2ca125
test eax, eax
je 0x1000a9b8
mov dword [ebp - 0xb88], 1
jmp 0x1000a9bf
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov dword [ebp - 0xfc8], eax
cmp dword [ebp - 0x54], 0xce2e7c52
jne 0x1000a9ee
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x1a0], 0
jne 0x1000a9ee
and dword [ebp - 0x8c4], 0
jmp 0x1000a9f8
mov dword [ebp - 0x8c4], 1
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x8c4], eax
jle 0x1000aa12
mov dword [ebp - 0x8cc], 1
jmp 0x1000aa19
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x8cc], eax
jle 0x1000aa33
mov dword [ebp - 0x53c], 1
jmp 0x1000aa3a
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x200]
mov ecx, dword [ebp - 0x53c]
mov dword [ebp + eax*4 - 0x1a0], ecx
jmp 0x1000a83a
cmp dword [ebp - 0x130], 0
je 0x1000aa60
jmp 0x1000a7ff
jmp 0x1000a7ff
push 2
lea ecx, [ebp - 0xa7c]
call fcn.10018477
mov dword [ebp - 4], 8
mov dword [ebp - 0xb4], 0x667a876e
mov dword [ebp - 0x27c], 0
jmp 0x1000aa9c
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x1000aabe
push dword [ebp - 0x27c]
lea ecx, [ebp - 0xa7c]
call fcn.10018515
mov dword [eax], 0xdf99ff60
jmp 0x1000aa8f
mov dword [ebp - 0xb4], 0
jmp 0x1000aad7
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jg 0x1000ac08
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xa7c]
call fcn.10018515
imul eax, dword [eax], 0x5eb2
cmp eax, 0x734f
je 0x1000ab0e
mov dword [ebp - 0x544], 1
jmp 0x1000ab15
and dword [ebp - 0x544], 0
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xa7c]
call fcn.10018515
push 0
lea ecx, [ebp - 0xa7c]
call fcn.10018515
push 0xfffffffffffffff9
pop eax
cmp eax, 7
jle 0x1000ab47
mov dword [ebp - 0x8d4], 1
jmp 0x1000ab4e
and dword [ebp - 0x8d4], 0
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xa7c]
call fcn.10018515
mov ecx, dword [ebp - 0x8d4]
cmp ecx, dword [eax]
jne 0x1000ab75
mov dword [ebp - 0x8dc], 1
jmp 0x1000ab7c
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x544]
cmp eax, dword [ebp - 0x8dc]
jg 0x1000ab96
mov dword [ebp - 0x54c], 1
jmp 0x1000ab9d
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0xa21e
jne 0x1000abb5
mov dword [ebp - 0x8e4], 1
jmp 0x1000abbc
and dword [ebp - 0x8e4], 0
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xa7c]
call fcn.10018515
mov ecx, dword [ebp - 0x8e4]
cmp ecx, dword [eax]
jg 0x1000abe3
mov dword [ebp - 0x554], 1
jmp 0x1000abea
and dword [ebp - 0x554], 0
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xa7c]
call fcn.10018515
mov ecx, dword [ebp - 0x554]
mov dword [eax], ecx
jmp 0x1000aaca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa7c]
call fcn.100184f9
push 2
lea ecx, [ebp - 0xa8c]
call fcn.10018477
mov dword [ebp - 4], 9
mov dword [ebp - 0x9c], 0x667a876e
mov dword [ebp - 0x37c], 0
jmp 0x1000ac4e
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 2
jge 0x1000ac70
push dword [ebp - 0x37c]
lea ecx, [ebp - 0xa8c]
call fcn.10018515
mov dword [eax], 0xdf99ff60
jmp 0x1000ac41
mov dword [ebp - 0x9c], 0
jmp 0x1000ac89
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jg 0x1000adba
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xa8c]
call fcn.10018515
imul eax, dword [eax], 0x5eb2
cmp eax, 0x734f
je 0x1000acc0
mov dword [ebp - 0x55c], 1
jmp 0x1000acc7
and dword [ebp - 0x55c], 0
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xa8c]
call fcn.10018515
push 0
lea ecx, [ebp - 0xa8c]
call fcn.10018515
push 0xfffffffffffffff9
pop eax
cmp eax, 7
jle 0x1000acf9
mov dword [ebp - 0x8ec], 1
jmp 0x1000ad00
and dword [ebp - 0x8ec], 0
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xa8c]
call fcn.10018515
mov ecx, dword [ebp - 0x8ec]
cmp ecx, dword [eax]
jne 0x1000ad27
mov dword [ebp - 0x8f4], 1
jmp 0x1000ad2e
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x55c]
cmp eax, dword [ebp - 0x8f4]
jg 0x1000ad48
mov dword [ebp - 0x564], 1
jmp 0x1000ad4f
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0xa21e
jne 0x1000ad67
mov dword [ebp - 0x8fc], 1
jmp 0x1000ad6e
and dword [ebp - 0x8fc], 0
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xa8c]
call fcn.10018515
mov ecx, dword [ebp - 0x8fc]
cmp ecx, dword [eax]
jg 0x1000ad95
mov dword [ebp - 0x56c], 1
jmp 0x1000ad9c
and dword [ebp - 0x56c], 0
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xa8c]
call fcn.10018515
mov ecx, dword [ebp - 0x56c]
mov dword [eax], ecx
jmp 0x1000ac7c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8c]
call fcn.100184f9
push 2
lea ecx, [ebp - 0xa9c]
call fcn.10018477
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xbc], 0x667a876e
mov dword [ebp - 0x284], 0
jmp 0x1000ae00
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jge 0x1000ae22
push dword [ebp - 0x284]
lea ecx, [ebp - 0xa9c]
call fcn.10018515
mov dword [eax], 0xdf99ff60
jmp 0x1000adf3
mov dword [ebp - 0xbc], 0
jmp 0x1000ae3b
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jg 0x1000af6c
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xa9c]
call fcn.10018515
imul eax, dword [eax], 0x5eb2
cmp eax, 0x734f
je 0x1000ae72
mov dword [ebp - 0x574], 1
jmp 0x1000ae79
and dword [ebp - 0x574], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xa9c]
call fcn.10018515
push 0
lea ecx, [ebp - 0xa9c]
call fcn.10018515
push 0xfffffffffffffff9
pop eax
cmp eax, 7
jle 0x1000aeab
mov dword [ebp - 0x904], 1
jmp 0x1000aeb2
and dword [ebp - 0x904], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xa9c]
call fcn.10018515
mov ecx, dword [ebp - 0x904]
cmp ecx, dword [eax]
jne 0x1000aed9
mov dword [ebp - 0x90c], 1
jmp 0x1000aee0
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x574]
cmp eax, dword [ebp - 0x90c]
jg 0x1000aefa
mov dword [ebp - 0x57c], 1
jmp 0x1000af01
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 0xa21e
jne 0x1000af19
mov dword [ebp - 0x914], 1
jmp 0x1000af20
and dword [ebp - 0x914], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xa9c]
call fcn.10018515
mov ecx, dword [ebp - 0x914]
cmp ecx, dword [eax]
jg 0x1000af47
mov dword [ebp - 0x584], 1
jmp 0x1000af4e
and dword [ebp - 0x584], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xa9c]
call fcn.10018515
mov ecx, dword [ebp - 0x584]
mov dword [eax], ecx
jmp 0x1000ae2e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa9c]
call fcn.100184f9
mov dword [ebp - 0x1dc], 0x90c4d8e5
mov dword [ebp - 0xb90], 1
mov dword [ebp - 0x314], 0
jmp 0x1000afa8
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 2
jge 0x1000afc4
mov eax, dword [ebp - 0x314]
mov dword [ebp + eax*4 - 0xe20], 0x3df7
jmp 0x1000af9b
mov dword [ebp - 0x1dc], 0
jmp 0x1000afdd
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jg 0x1000b01a
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp + eax*4 - 0xe20]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0x1dc]
mov ecx, dword [ebp - 0x91c]
mov dword [ebp + eax*4 - 0xe20], ecx
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0xb90], eax
jmp 0x1000afd0
mov dword [ebp - 0x138], 0x2c7c
mov dword [ebp - 0xe6c], 1
mov dword [ebp - 0xe68], 1
mov dword [ebp - 0xe64], 1
mov dword [ebp - 0xe60], 1
lea ecx, [ebp - 0x3a1]
call fcn.10008e83
push eax
lea eax, [ebp - 0xe5c]
push eax
lea eax, [ebp - 0xe6c]
push eax
lea ecx, [ebp - 0x114c]
call fcn.10018524
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xaac]
call fcn.100184d3
mov dword [ebp - 4], 0xb
push 2
lea ecx, [ebp - 0xc20]
call fcn.10018477
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0xcc], 0x6896e60b
push 1
lea ecx, [ebp - 0xb70]
call fcn.10018477
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xba8], 0xffff
mov dword [ebp - 0x38], 0
jmp 0x1000b0e2
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1000b0fe
push dword [ebp - 0x38]
lea ecx, [ebp - 0xc20]
call fcn.10018515
mov dword [eax], 0x81f3403c
jmp 0x1000b0db
mov dword [ebp - 0x38], 0
jmp 0x1000b10e
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1000b124
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x444], 0xffffffff
jmp 0x1000b107
mov dword [ebp - 0x38], 0
jmp 0x1000b134
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000b150
push dword [ebp - 0x38]
lea ecx, [ebp - 0xb70]
call fcn.10018515
mov dword [eax], 0xa81d5f49
jmp 0x1000b12d
cmp dword [ebp - 0x138], 0
jne 0x1000b314
push 3
lea ecx, [ebp - 0xaac]
call fcn.10018515
cmp dword [eax], 0
jne 0x1000b2a2
push 0
lea ecx, [ebp - 0xc20]
call fcn.10018515
mov dword [eax], 5
push 5
pop eax
test eax, eax
ja 0x1000b199
mov dword [ebp - 0x58c], 1
jmp 0x1000b1a0
and dword [ebp - 0x58c], 0
push 3
lea ecx, [ebp - 0xaac]
call fcn.10018515
mov ecx, dword [ebp - 0x58c]
sub ecx, dword [eax]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x444], ecx
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xd8d92426
je 0x1000b1e6
mov dword [ebp - 0x924], 1
jmp 0x1000b1ed
and dword [ebp - 0x924], 0
push 3
lea ecx, [ebp - 0xaac]
call fcn.10018515
mov ecx, dword [ebp - 0x924]
cmp ecx, dword [eax]
jge 0x1000b210
mov dword [ebp - 0x594], 1
jmp 0x1000b217
and dword [ebp - 0x594], 0
push 3
lea ecx, [ebp - 0xaac]
call fcn.10018515
mov ecx, dword [ebp - 0x594]
add ecx, dword [eax]
je 0x1000b24c
push 0
lea ecx, [ebp - 0xc20]
call fcn.10018515
cmp dword [eax], 0
je 0x1000b24c
mov dword [ebp - 0x92c], 1
jmp 0x1000b253
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x92c], eax
jl 0x1000b26d
mov dword [ebp - 0x59c], 1
jmp 0x1000b274
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jne 0x1000b2a2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x444], 0
jne 0x1000b2a2
and dword [ebp - 0x934], 0
jmp 0x1000b2ac
mov dword [ebp - 0x934], 1
mov esi, dword [ebp - 0x138]
imul esi, dword [ebp - 0x934]
push 3
lea ecx, [ebp - 0xaac]
call fcn.10018515
cmp esi, dword [eax]
jle 0x1000b2d6
mov dword [ebp - 0x5a4], 1
jmp 0x1000b2dd
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 0xfffffff9
jbe 0x1000b2f2
mov dword [ebp - 0x93c], 1
jmp 0x1000b2f9
and dword [ebp - 0x93c], 0
imul esi, dword [ebp - 0x93c], 0x25fa
push 2
lea ecx, [ebp - 0xaac]
call fcn.10018515
sub esi, dword [eax]
je 0x1000b329
cmp dword [ebp - 0xcc], 0
je 0x1000b329
mov dword [ebp - 0x3d0], 1
jmp 0x1000b330
and dword [ebp - 0x3d0], 0
push 0
lea ecx, [ebp - 0xb70]
call fcn.10018515
mov ecx, dword [ebp - 0x3d0]
mov dword [eax], ecx
cmp dword [ebp - 0x3d0], 0x74fd
jl 0x1000b55b
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0xb98], 0x4cb070fc
mov dword [ebp - 0x94c], 0
mov dword [ebp - 0x138], 0
jmp 0x1000b389
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xffffffef
jl 0x1000b43b
mov dword [ebp - 0xdc], 4
jmp 0x1000b3af
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jl 0x1000b404
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x444], 1
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x5c], 0
jmp 0x1000b3e0
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffff8
jle 0x1000b402
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x1000b400
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x1000b3d9
jmp 0x1000b3a2
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1000b436
push 0
push 0x1af8
push 0x529
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x1000b37c
push 3
lea ecx, [ebp - 0xaac]
call fcn.10018515
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1094], eax
cmp dword [ebp - 0x5c], 0
je 0x1000b45b
cmp dword [ebp - 0x5c], 0
push 1
lea ecx, [ebp - 0xc20]
call fcn.10018515
cmp dword [eax], 1
jle 0x1000b479
mov dword [ebp - 0x5ac], 1
jmp 0x1000b480
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x5ac], eax
jge 0x1000b497
mov dword [ebp - 0x944], 1
jmp 0x1000b49e
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0xb98]
cmp dword [ebp - 0x944], eax
jge 0x1000b4b8
mov dword [ebp - 0xba0], 1
jmp 0x1000b4bf
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xfd0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x444]
dec eax
cmp eax, 0x2b42
jl 0x1000b4e9
mov dword [ebp - 0x5b4], 1
jmp 0x1000b4f0
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x94c], eax
cmp dword [ebp - 0x94c], 0
jne 0x1000b514
cmp dword [ebp - 0x5c], 0
jne 0x1000b514
and dword [ebp - 0x5bc], 0
jmp 0x1000b51e
mov dword [ebp - 0x5bc], 1
mov eax, 0xbbfe
sub eax, dword [ebp - 0x5bc]
cmp eax, 1
je 0x1000b53a
mov dword [ebp - 0x954], 1
jmp 0x1000b541
and dword [ebp - 0x954], 0
push 0
lea ecx, [ebp - 0xb70]
call fcn.10018515
mov ecx, dword [ebp - 0x954]
mov dword [eax], ecx
jmp 0x1000b790
mov dword [ebp - 0x28c], 1
mov dword [ebp - 0xbb0], 0x1aff6713
mov dword [ebp - 0xcc], 0
jmp 0x1000b588
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jg 0x1000b650
cmp dword [ebp - 0xcc], 0x9428
jne 0x1000b5ad
mov dword [ebp - 0x5c4], 1
jmp 0x1000b5b4
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x5c4], 0xbafc
jl 0x1000b5d2
cmp dword [ebp - 0x1a8], 0
jne 0x1000b5d2
and dword [ebp - 0x95c], 0
jmp 0x1000b5dc
mov dword [ebp - 0x95c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x444]
cmp dword [ebp - 0x95c], eax
jle 0x1000b5fd
mov dword [ebp - 0x5cc], 1
jmp 0x1000b604
and dword [ebp - 0x5cc], 0
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xb70]
call fcn.10018515
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5cc]
jge 0x1000b62b
mov dword [ebp - 0x964], 1
jmp 0x1000b632
and dword [ebp - 0x964], 0
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xb70]
call fcn.10018515
mov ecx, dword [ebp - 0x964]
mov dword [eax], ecx
jmp 0x1000b57b
cmp dword [ebp - 0x1a8], 0x9839
jg 0x1000b668
mov dword [ebp - 0x5d4], 1
jmp 0x1000b66f
and dword [ebp - 0x5d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x444]
cmp dword [ebp - 0x5d4], eax
jg 0x1000b696
mov eax, 0xaac82c1b
test eax, eax
jne 0x1000b696
and dword [ebp - 0x96c], 0
jmp 0x1000b6a0
mov dword [ebp - 0x96c], 1
cmp dword [ebp - 0x96c], 0x4fe9
jg 0x1000b6b8
mov dword [ebp - 0x5dc], 1
jmp 0x1000b6bf
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0xba8]
sub eax, dword [ebp - 0x28c]
mov ecx, dword [ebp - 0x28c]
sub ecx, dword [ebp - 0x5dc]
cmp eax, ecx
jg 0x1000b6e7
mov dword [ebp - 0x974], 1
jmp 0x1000b6ee
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x974]
add eax, 0x6d1266b8
cmp eax, dword [ebp - 0x28c]
jg 0x1000b70d
mov dword [ebp - 0x5e4], 1
jmp 0x1000b714
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x5e4]
sub eax, 4
cmp eax, dword [ebp - 0xdc]
je 0x1000b731
mov dword [ebp - 0x97c], 1
jmp 0x1000b738
and dword [ebp - 0x97c], 0
cmp dword [ebp - 0x97c], 0x1dee1550
jg 0x1000b750
mov dword [ebp - 0x5ec], 1
jmp 0x1000b757
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x28c]
cmp dword [ebp - 0x5ec], eax
jg 0x1000b771
mov dword [ebp - 0x984], 1
jmp 0x1000b778
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xbb0], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xb70]
call fcn.100184f9
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xc20]
call fcn.100184f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaac]
call fcn.100184f9
movzx eax, byte [0x1067ede0]
test eax, eax
je 0x1000b7db
mov esi, 0x100925b0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10011d1b
mov dword [ebp - 0x1e4], 0x90c4d8e5
mov dword [ebp - 0xbb8], 1
mov dword [ebp - 0x35c], 0
jmp 0x1000b808
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 2
jge 0x1000b824
mov eax, dword [ebp - 0x35c]
mov dword [ebp + eax*4 - 0xe30], 0x3df7
jmp 0x1000b7fb
mov dword [ebp - 0x1e4], 0
jmp 0x1000b83d
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jg 0x1000b87a
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp + eax*4 - 0xe30]
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x1e4]
mov ecx, dword [ebp - 0x5f4]
mov dword [ebp + eax*4 - 0xe30], ecx
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0xbb8], eax
jmp 0x1000b830
mov dword [ebp - 0x294], 9
mov dword [ebp - 0x294], 0xffffffe5
jmp 0x1000b89d
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x13
jg 0x1000b91e
mov dword [ebp - 0x31c], 0x506d4441
mov dword [ebp - 0xbc0], 0
mov dword [ebp - 0x31c], 0
jmp 0x1000b8d3
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jg 0x1000b919
mov dword [ebp - 0xef4], 0x9949
mov dword [ebp - 0xef0], 0x9949
mov dword [ebp - 0xeec], 0x9949
mov dword [ebp - 0xee8], 0x9949
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xef4]
mov dword [ebp - 0xbc0], eax
jmp 0x1000b8c6
jmp 0x1000b890
mov dword [ebp - 0x1b0], 0x90c4d8e5
mov dword [ebp - 0xbc8], 1
mov dword [ebp - 0x29c], 0
jmp 0x1000b94b
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 2
jge 0x1000b967
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0xe28], 0x3df7
jmp 0x1000b93e
mov dword [ebp - 0x1b0], 0
jmp 0x1000b980
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 1
jg 0x1000b9bd
mov eax, dword [ebp - 0x1b0]
mov eax, dword [ebp + eax*4 - 0xe28]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x98c]
mov dword [ebp + eax*4 - 0xe28], ecx
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0xbc8], eax
jmp 0x1000b973
mov dword [ebp - 0x39c], 0xfffffffa
mov dword [ebp - 0x218], 0xffff
mov dword [ebp - 0x60c], 0xfffffff6
push 3
lea ecx, [ebp - 0xc30]
call fcn.10018477
mov dword [ebp - 4], 0xe
push 2
lea ecx, [ebp - 0xe0c]
call fcn.10018477
mov byte [ebp - 4], 0xf
mov dword [ebp - 0xbd8], 0xc6daafd5
mov dword [ebp - 0xbe0], 0xfffffff6
mov dword [ebp - 0x28], 0
jmp 0x1000ba24
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000ba3a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf7c], 0xffffffff
jmp 0x1000ba1d
mov dword [ebp - 0x28], 0
jmp 0x1000ba4a
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000ba66
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc30]
call fcn.10018515
mov dword [eax], 0x5004286a
jmp 0x1000ba43
mov dword [ebp - 0x28], 0
jmp 0x1000ba76
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000ba92
push dword [ebp - 0x28]
lea ecx, [ebp - 0xe0c]
call fcn.10018515
mov dword [eax], 0x69ff9e6b
jmp 0x1000ba6f
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x1060], eax
cmp dword [ebp - 0x39c], 1
jle 0x1000bab3
mov dword [ebp - 0x5fc], 1
jmp 0x1000baba
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 0
jge 0x1000bacf
mov dword [ebp - 0x994], 1
jmp 0x1000bad6
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x39c], eax
je 0x1000bafc
mov dword [ebp - 0xbd0], 1
jmp 0x1000bb03
and dword [ebp - 0xbd0], 0
mov eax, 0xc6c8951b
cmp eax, 0xb6890635
jne 0x1000bb1b
mov dword [ebp - 0x604], 1
jmp 0x1000bb22
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x218]
add eax, dword [ebp - 0x604]
cmp eax, 0x547507a
jne 0x1000bb41
mov dword [ebp - 0x99c], 1
jmp 0x1000bb48
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
sub eax, dword [ebp - 0x218]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x60c]
sub eax, 0x985b
mov dword [ebp - 0x9a4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9a4]
mov dword [ebp + eax - 0xf7c], ecx
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x9a4], eax
jl 0x1000bb98
mov dword [ebp - 0x614], 1
jmp 0x1000bb9f
and dword [ebp - 0x614], 0
push 0
lea ecx, [ebp - 0xc30]
call fcn.10018515
mov ecx, dword [ebp - 0x614]
cmp ecx, dword [eax]
jl 0x1000bbc2
mov dword [ebp - 0x9ac], 1
jmp 0x1000bbc9
and dword [ebp - 0x9ac], 0
push 0
lea ecx, [ebp - 0xc30]
call fcn.10018515
mov ecx, dword [ebp - 0x9ac]
sub ecx, dword [eax]
mov dword [ebp - 0x61c], ecx
push 0
lea ecx, [ebp - 0xe0c]
call fcn.10018515
mov ecx, dword [ebp - 0x61c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x61c], eax
jge 0x1000bc13
mov dword [ebp - 0x9b4], 1
jmp 0x1000bc1a
and dword [ebp - 0x9b4], 0
push 2
lea ecx, [ebp - 0xc30]
call fcn.10018515
mov ecx, dword [ebp - 0x9b4]
cmp ecx, dword [eax]
jle 0x1000bc4f
push 0
lea ecx, [ebp - 0xe0c]
call fcn.10018515
cmp dword [eax], 0
je 0x1000bc4f
mov dword [ebp - 0x624], 1
jmp 0x1000bc56
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
add eax, 7
imul eax, eax, 0xfffd
mov dword [ebp - 0xbd8], eax
mov dword [ebp - 0xbe0], 0xe9843c6b
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xe0c]
call fcn.100184f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc30]
call fcn.100184f9
mov dword [ebp - 0x140], 0x2c7c
mov dword [ebp - 0xe94], 1
mov dword [ebp - 0xe90], 1
mov dword [ebp - 0xe8c], 1
mov dword [ebp - 0xe88], 1
lea ecx, [ebp - 0x3fd]
call fcn.10008e83
push eax
lea eax, [ebp - 0xe84]
push eax
lea eax, [ebp - 0xe94]
push eax
lea ecx, [ebp - 0x1144]
call fcn.10018524
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xabc]
call fcn.100184d3
mov dword [ebp - 4], 0x10
push 2
lea ecx, [ebp - 0xc40]
call fcn.10018477
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0x1d8], 0xffffffff
mov dword [ebp - 0xd4], 0x6896e60b
push 1
lea ecx, [ebp - 0xb64]
call fcn.10018477
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xd60], 0xffff
mov dword [ebp - 0x3c], 0
jmp 0x1000bd5b
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1000bd77
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xc40]
call fcn.10018515
mov dword [eax], 0x81f3403c
jmp 0x1000bd54
mov dword [ebp - 0x3c], 0
jmp 0x1000bd87
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1000bd9d
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x454], 0xffffffff
jmp 0x1000bd80
mov dword [ebp - 0x3c], 0
jmp 0x1000bdad
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1000bdc9
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xb64]
call fcn.10018515
mov dword [eax], 0xa81d5f49
jmp 0x1000bda6
cmp dword [ebp - 0x140], 0
jne 0x1000bf8d
push 3
lea ecx, [ebp - 0xabc]
call fcn.10018515
cmp dword [eax], 0
jne 0x1000bf1b
push 0
lea ecx, [ebp - 0xc40]
call fcn.10018515
mov dword [eax], 5
push 5
pop eax
test eax, eax
ja 0x1000be12
mov dword [ebp - 0x9bc], 1
jmp 0x1000be19
and dword [ebp - 0x9bc], 0
push 3
lea ecx, [ebp - 0xabc]
call fcn.10018515
mov ecx, dword [ebp - 0x9bc]
sub ecx, dword [eax]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x454], ecx
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xd8d92426
je 0x1000be5f
mov dword [ebp - 0x62c], 1
jmp 0x1000be66
and dword [ebp - 0x62c], 0
push 3
lea ecx, [ebp - 0xabc]
call fcn.10018515
mov ecx, dword [ebp - 0x62c]
cmp ecx, dword [eax]
jge 0x1000be89
mov dword [ebp - 0x9c4], 1
jmp 0x1000be90
and dword [ebp - 0x9c4], 0
push 3
lea ecx, [ebp - 0xabc]
call fcn.10018515
mov ecx, dword [ebp - 0x9c4]
add ecx, dword [eax]
je 0x1000bec5
push 0
lea ecx, [ebp - 0xc40]
call fcn.10018515
cmp dword [eax], 0
je 0x1000bec5
mov dword [ebp - 0x634], 1
jmp 0x1000becc
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x634], eax
jl 0x1000bee6
mov dword [ebp - 0x9cc], 1
jmp 0x1000beed
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
jne 0x1000bf1b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x454], 0
jne 0x1000bf1b
and dword [ebp - 0x63c], 0
jmp 0x1000bf25
mov dword [ebp - 0x63c], 1
mov esi, dword [ebp - 0x140]
imul esi, dword [ebp - 0x63c]
push 3
lea ecx, [ebp - 0xabc]
call fcn.10018515
cmp esi, dword [eax]
jle 0x1000bf4f
mov dword [ebp - 0x9d4], 1
jmp 0x1000bf56
and dword [ebp - 0x9d4], 0
cmp dword [ebp - 0x9d4], 0xfffffff9
jbe 0x1000bf6b
mov dword [ebp - 0x644], 1
jmp 0x1000bf72
and dword [ebp - 0x644], 0
imul esi, dword [ebp - 0x644], 0x25fa
push 2
lea ecx, [ebp - 0xabc]
call fcn.10018515
sub esi, dword [eax]
je 0x1000bfa2
cmp dword [ebp - 0xd4], 0
je 0x1000bfa2
mov dword [ebp - 0x3e0], 1
jmp 0x1000bfa9
and dword [ebp - 0x3e0], 0
push 0
lea ecx, [ebp - 0xb64]
call fcn.10018515
mov ecx, dword [ebp - 0x3e0]
mov dword [eax], ecx
cmp dword [ebp - 0x3e0], 0x74fd
jl 0x1000c1d4
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0xbe8], 0x4cb070fc
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x140], 0
jmp 0x1000c002
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffef
jl 0x1000c0b4
mov dword [ebp - 0xc4], 4
jmp 0x1000c028
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jl 0x1000c07d
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x454], 1
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x64], 0
jmp 0x1000c059
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffff8
jle 0x1000c07b
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x1000c079
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x1000c052
jmp 0x1000c01b
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1000c0af
push 0
push 0x1af8
push 0x529
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x1000bff5
push 3
lea ecx, [ebp - 0xabc]
call fcn.10018515
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xfd8], eax
cmp dword [ebp - 0x64], 0
je 0x1000c0d4
cmp dword [ebp - 0x64], 0
push 1
lea ecx, [ebp - 0xc40]
call fcn.10018515
cmp dword [eax], 1
jle 0x1000c0f2
mov dword [ebp - 0x9dc], 1
jmp 0x1000c0f9
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x9dc], eax
jge 0x1000c110
mov dword [ebp - 0x64c], 1
jmp 0x1000c117
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0xbe8]
cmp dword [ebp - 0x64c], eax
jge 0x1000c131
mov dword [ebp - 0xbf0], 1
jmp 0x1000c138
and dword [ebp - 0xbf0], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x10a8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x454]
dec eax
cmp eax, 0x2b42
jl 0x1000c162
mov dword [ebp - 0x9e4], 1
jmp 0x1000c169
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 0
jne 0x1000c18d
cmp dword [ebp - 0x64], 0
jne 0x1000c18d
and dword [ebp - 0x9ec], 0
jmp 0x1000c197
mov dword [ebp - 0x9ec], 1
mov eax, 0xbbfe
sub eax, dword [ebp - 0x9ec]
cmp eax, 1
je 0x1000c1b3
mov dword [ebp - 0x65c], 1
jmp 0x1000c1ba
and dword [ebp - 0x65c], 0
push 0
lea ecx, [ebp - 0xb64]
call fcn.10018515
mov ecx, dword [ebp - 0x65c]
mov dword [eax], ecx
jmp 0x1000c409
mov dword [ebp - 0x2a4], 1
mov dword [ebp - 0xd68], 0x1aff6713
mov dword [ebp - 0xd4], 0
jmp 0x1000c201
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jg 0x1000c2c9
cmp dword [ebp - 0xd4], 0x9428
jne 0x1000c226
mov dword [ebp - 0x9f4], 1
jmp 0x1000c22d
and dword [ebp - 0x9f4], 0
cmp dword [ebp - 0x9f4], 0xbafc
jl 0x1000c24b
cmp dword [ebp - 0x1d8], 0
jne 0x1000c24b
and dword [ebp - 0x664], 0
jmp 0x1000c255
mov dword [ebp - 0x664], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x454]
cmp dword [ebp - 0x664], eax
jle 0x1000c276
mov dword [ebp - 0x9fc], 1
jmp 0x1000c27d
and dword [ebp - 0x9fc], 0
push dword [ebp - 0xd4]
lea ecx, [ebp - 0xb64]
call fcn.10018515
mov eax, dword [eax]
cmp eax, dword [ebp - 0x9fc]
jge 0x1000c2a4
mov dword [ebp - 0x66c], 1
jmp 0x1000c2ab
and dword [ebp - 0x66c], 0
push dword [ebp - 0xd4]
lea ecx, [ebp - 0xb64]
call fcn.10018515
mov ecx, dword [ebp - 0x66c]
mov dword [eax], ecx
jmp 0x1000c1f4
cmp dword [ebp - 0x1d8], 0x9839
jg 0x1000c2e1
mov dword [ebp - 0xa04], 1
jmp 0x1000c2e8
and dword [ebp - 0xa04], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x454]
cmp dword [ebp - 0xa04], eax
jg 0x1000c30f
mov eax, 0xaac82c1b
test eax, eax
jne 0x1000c30f
and dword [ebp - 0x674], 0
jmp 0x1000c319
mov dword [ebp - 0x674], 1
cmp dword [ebp - 0x674], 0x4fe9
jg 0x1000c331
mov dword [ebp - 0xa0c], 1
jmp 0x1000c338
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xd60]
sub eax, dword [ebp - 0x2a4]
mov ecx, dword [ebp - 0x2a4]
sub ecx, dword [ebp - 0xa0c]
cmp eax, ecx
jg 0x1000c360
mov dword [ebp - 0x67c], 1
jmp 0x1000c367
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
add eax, 0x6d1266b8
cmp eax, dword [ebp - 0x2a4]
jg 0x1000c386
mov dword [ebp - 0xa14], 1
jmp 0x1000c38d
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0xa14]
sub eax, 4
cmp eax, dword [ebp - 0xc4]
je 0x1000c3aa
mov dword [ebp - 0xa1c], 1
jmp 0x1000c3b1
and dword [ebp - 0xa1c], 0
cmp dword [ebp - 0xa1c], 0x1dee1550
jg 0x1000c3c9
mov dword [ebp - 0x688], 1
jmp 0x1000c3d0
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x688], eax
jg 0x1000c3ea
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret