Function at 0x10008ac4
Capabilities:
Connect pipe
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10079bd6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x10fc
call fcn.10075e80
push esi
push edi
mov dword [ebp - 0x4ec], 0xffffffff
mov dword [ebp - 0x184], 1
mov dword [ebp - 0x2e4], 4
mov dword [ebp - 0x1d0], 0x39523dd9
mov dword [ebp - 0xa50], 0xffffffff
mov dword [ebp - 0x2c0], 0
jmp 0x10008b33
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 4
jge 0x10008b4f
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x1108], 0xee91
jmp 0x10008b26
mov dword [ebp - 0x4ec], 2
cmp dword [ebp - 0x4ec], 0xfffffffd
jg 0x10008b6e
mov dword [ebp - 0x8c4], 1
jmp 0x10008b75
and dword [ebp - 0x8c4], 0
cmp dword [ebp - 0x184], 1
cmp dword [ebp - 0x184], 1
jne 0x10008b9c
mov eax, 0xf7919adb
test eax, eax
jne 0x10008b9c
xor eax, eax
inc eax
jne 0x10008b9c
and dword [ebp - 0x8b4], 0
jmp 0x10008ba6
mov dword [ebp - 0x8b4], 1
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x8b4], eax
jne 0x10008bc7
push 4
pop eax
test eax, eax
jne 0x10008bc7
mov dword [ebp - 0x8bc], 1
jmp 0x10008bce
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
add eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
sub eax, dword [ebp - 0x1d0]
imul eax, dword [ebp - 0x8c4]
cmp eax, dword [ebp - 0x1d0]
jg 0x10008c13
mov dword [ebp - 0x8d4], 1
jmp 0x10008c1a
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0x9a8551b3
jae 0x10008c3e
mov dword [ebp - 0x8dc], 1
jmp 0x10008c45
and dword [ebp - 0x8dc], 0
imul eax, dword [ebp - 0x8dc], 0xffffffff
mov dword [ebp - 0xa50], eax
mov dword [ebp - 0x8e4], 0xffffffff
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x2f0], 4
mov dword [ebp - 0x1d8], 0x39523dd9
mov dword [ebp - 0xa0c], 0xffffffff
mov dword [ebp - 0x2c8], 0
jmp 0x10008c9d
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 4
jge 0x10008cb9
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0x10e8], 0xee91
jmp 0x10008c90
mov dword [ebp - 0x8e4], 2
cmp dword [ebp - 0x8e4], 0xfffffffd
jg 0x10008cd8
mov dword [ebp - 0x8fc], 1
jmp 0x10008cdf
and dword [ebp - 0x8fc], 0
cmp dword [ebp - 0x180], 1
cmp dword [ebp - 0x180], 1
jne 0x10008d06
mov eax, 0xf7919adb
test eax, eax
jne 0x10008d06
xor eax, eax
inc eax
jne 0x10008d06
and dword [ebp - 0x8ec], 0
jmp 0x10008d10
mov dword [ebp - 0x8ec], 1
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x8ec], eax
jne 0x10008d31
push 4
pop eax
test eax, eax
jne 0x10008d31
mov dword [ebp - 0x8f4], 1
jmp 0x10008d38
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
add eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2f0]
sub eax, dword [ebp - 0x1d8]
imul eax, dword [ebp - 0x8fc]
cmp eax, dword [ebp - 0x1d8]
jg 0x10008d7d
mov dword [ebp - 0x904], 1
jmp 0x10008d84
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x9a8551b3
jae 0x10008da8
mov dword [ebp - 0x90c], 1
jmp 0x10008daf
and dword [ebp - 0x90c], 0
imul eax, dword [ebp - 0x90c], 0xffffffff
mov dword [ebp - 0xa0c], eax
mov dword [ebp - 0x914], 0xffffffff
mov dword [ebp - 0xdf0], 0xfffffffd
push 4
lea ecx, [ebp - 0xd38]
call fcn.10016f3c
and dword [ebp - 4], 0
mov dword [ebp - 0xa14], 0xf7f3e76e
mov dword [ebp - 0x2c], 0
jmp 0x10008dfb
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10008e11
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xbbc], 0x77dd6887
jmp 0x10008df4
mov dword [ebp - 0x2c], 0
jmp 0x10008e21
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10008e37
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x10c0], 4
jmp 0x10008e1a
mov dword [ebp - 0x2c], 0
jmp 0x10008e47
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10008e60
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd38]
call fcn.10016fad
or dword [eax], 0xffffffff
jmp 0x10008e40
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x10008e84
push 0xeb4
push 0x61f
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
push 2
lea ecx, [ebp - 0xd38]
call fcn.10016fad
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x368]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x368]
mov dword [edx], ecx
test eax, eax
je 0x10008f09
cmp dword [ebp - 0x914], 0
je 0x10008ed9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbbc], 0
je 0x10008ed9
mov dword [ebp - 0x2f8], 1
jmp 0x10008ee0
and dword [ebp - 0x2f8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2f8]
mov dword [ebp + eax - 0xbbc], ecx
mov eax, dword [ebp - 0x2f8]
neg eax
je 0x10008f09
mov dword [ebp - 0x91c], 1
jmp 0x10008f10
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x914]
add eax, dword [ebp - 0x91c]
mov dword [ebp - 0xa14], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd38]
call fcn.10016fa8
mov dword [ebp - 0x10], 0x643cdf98
mov dword [ebp - 0x300], 0x59ec1348
mov dword [ebp - 0x374], 0xfffffffd
mov dword [ebp - 0xa38], 0
mov dword [ebp - 0xd9c], 1
mov dword [ebp - 0xda4], 0xffffffff
mov dword [ebp - 0xdac], 0x1993e367
mov dword [ebp - 0xd6c], 0x6842a457
mov dword [ebp - 0x438], 0xfc58ac37
mov dword [ebp - 0x2d0], 0
jmp 0x10008fa1
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 3
jge 0x10008fbd
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0x3cc], 0xc93b4e1a
jmp 0x10008f94
mov dword [ebp - 0x10], 2
jmp 0x10008fcd
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10009320
mov dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0xd74], 0x5c2da50e
mov dword [ebp - 0xd7c], 0
mov dword [ebp - 0xde4], 1
mov dword [ebp - 0xdec], 0x9369e1d6
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jne 0x10009024
mov dword [ebp - 0x924], 1
jmp 0x1000902b
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3cc]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x3cc]
add ecx, dword [ebp - 0x924]
lea eax, [eax + ecx + 0x255d]
cmp eax, 1
jne 0x10009069
mov dword [ebp - 0x92c], 1
jmp 0x10009070
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3cc]
add eax, dword [ebp - 0x92c]
cmp eax, 0xfffffff9
je 0x10009091
mov dword [ebp - 0xa1c], 1
jmp 0x10009098
and dword [ebp - 0xa1c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3cc]
mov dword [ebp - 0xdf4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3cc]
mov dword [ebp - 0xdfc], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x3cc], 1
jne 0x100090d6
mov dword [ebp - 0x8ac], 1
jmp 0x100090dd
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3cc]
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x8ac]
imul ecx, dword [ebp - 0x10]
sub eax, ecx
cmp eax, 0xe00457a2
jbe 0x1000910a
mov dword [ebp - 0x418], 1
jmp 0x10009111
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x3cc]
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0xffffffff
jg 0x1000914c
mov dword [ebp - 0x6c8], 1
jmp 0x10009153
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x6c8]
cmp eax, dword [ebp - 0xa38]
jge 0x10009171
mov dword [ebp - 0x420], 1
jmp 0x10009178
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x420], eax
je 0x1000918f
mov dword [ebp - 0x9d4], 1
jmp 0x10009196
and dword [ebp - 0x9d4], 0
cmp dword [ebp - 0x3c], 0x8deb
jne 0x100091ab
mov dword [ebp - 0x820], 1
jmp 0x100091b2
and dword [ebp - 0x820], 0
cmp dword [ebp - 0x820], 0xd219
je 0x100091ca
mov dword [ebp - 0xa48], 1
jmp 0x100091d1
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe04], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe0c], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xe14], eax
cmp dword [ebp - 0x374], 7
jle 0x10009204
mov dword [ebp - 0x428], 1
jmp 0x1000920b
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x3c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3cc]
cmp dword [ebp - 0x188], eax
jle 0x10009235
mov dword [ebp - 0x430], 1
jmp 0x1000923c
and dword [ebp - 0x430], 0
cmp dword [ebp - 0x3c], 0
jne 0x10009249
cmp dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x3cc], 0xffffffff
jle 0x10009262
mov dword [ebp - 0x6d0], 1
jmp 0x10009269
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x3c], 8
jle 0x10009287
mov dword [ebp - 0x8cc], 1
jmp 0x1000928e
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x430]
cmp eax, dword [ebp - 0x8cc]
jg 0x100092dc
mov dword [ebp - 0x3c], 0
jmp 0x100092ac
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xc
jge 0x100092da
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x100092d8
push 0
push 0x1425
push 0
push 0x772
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
jmp 0x100092a5
jmp 0x1000931b
mov dword [ebp - 0xe1c], 0x75d1
mov dword [ebp - 0xe24], 0
mov dword [ebp - 0xe2c], 0xffffffff
mov dword [ebp - 0xe34], 1
mov dword [ebp - 0xe3c], 0xffffffff
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
jmp 0x10008fc6
mov dword [ebp - 0x110], 0
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x10009344
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x110], 3
jmp 0x1000935d
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xfffffff8
jge 0x10009443
mov dword [ebp - 0x9d0], 0
mov dword [ebp - 0xc58], 0x34eea2a3
mov dword [ebp - 0xc54], 0x34eea2a3
mov dword [ebp - 0xc50], 0x34eea2a3
mov dword [ebp - 0xc4c], 0x34eea2a3
lea ecx, [ebp - 0x3a1]
call fcn.10008913
push eax
lea eax, [ebp - 0xc48]
push eax
lea eax, [ebp - 0xc58]
push eax
lea ecx, [ebp - 0x105c]
call fcn.10016fbc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf84]
call fcn.10016f7e
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x9d0]
cmp dword [ebp - 0x110], eax
je 0x100093f2
mov dword [ebp - 0x6d8], 1
jmp 0x100093f9
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x6d8]
jge 0x10009413
mov dword [ebp - 0x440], 1
jmp 0x1000941a
and dword [ebp - 0x440], 0
push 1
lea ecx, [ebp - 0xf84]
call fcn.10016fad
mov ecx, dword [ebp - 0x440]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf84]
call fcn.10016fa8
jmp 0x10009350
mov dword [ebp - 0x6f0], 0xffffffff
mov dword [ebp - 0x1e0], 0
jmp 0x10009466
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 4
jge 0x10009482
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0xd54], 0xc85f70ad
jmp 0x10009459
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xd54], 0x18
jmp 0x100094ad
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd54]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xd54], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd54], 9
jg 0x100094d8
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x100094d6
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x10009494
mov dword [ebp - 0x15c], 1
mov dword [ebp - 0x370], 4
push 2
lea ecx, [ebp - 0x14c]
call fcn.10016f3c
mov dword [ebp - 4], 2
mov dword [ebp - 0x1e8], 0x21dfe4b2
mov dword [ebp - 0x18c], 0x64d9248e
mov dword [ebp - 0x1c4], 0
jmp 0x1000952d
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jge 0x1000954f
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x14c]
call fcn.10016fad
mov dword [eax], 0xfffb
jmp 0x10009520
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
cmp dword [eax], 0
je 0x10009612
push 0
lea ecx, [ebp - 0x14c]
call fcn.10016fad
mov esi, eax
push 0
lea ecx, [ebp - 0x14c]
call fcn.10016fad
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x100095a0
mov dword [ebp - 0x828], 1
jmp 0x100095a7
and dword [ebp - 0x828], 0
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
mov eax, dword [eax]
cmp eax, dword [ebp - 0x828]
jle 0x100095ca
mov dword [ebp - 0x448], 1
jmp 0x100095d1
and dword [ebp - 0x448], 0
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
mov esi, dword [ebp - 0x448]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
cmp esi, dword [eax]
jle 0x10009612
mov dword [ebp - 0x6e0], 1
jmp 0x10009619
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x6e0]
sub eax, 8
cmp eax, 0x80997408
ja 0x10009635
mov dword [ebp - 0x450], 1
jmp 0x1000963c
and dword [ebp - 0x450], 0
push 0
lea ecx, [ebp - 0x14c]
call fcn.10016fad
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [eax]
jl 0x1000965f
mov dword [ebp - 0xa58], 1
jmp 0x10009666
and dword [ebp - 0xa58], 0
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
push 0
lea ecx, [ebp - 0x14c]
call fcn.10016fad
mov eax, dword [eax]
neg eax
cmp eax, 0x467b
jg 0x10009697
mov dword [ebp - 0xa60], 1
jmp 0x1000969e
and dword [ebp - 0xa60], 0
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
mov esi, eax
push 0
lea ecx, [ebp - 0x14c]
call fcn.10016fad
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, 7
jae 0x100096e9
mov dword [ebp - 0x8d0], 1
jmp 0x100096f0
and dword [ebp - 0x8d0], 0
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
mov eax, dword [eax]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
cmp eax, dword [ebp - 0x8d0]
jg 0x10009731
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016fad
cmp dword [eax], 0
je 0x10009731
mov dword [ebp - 0x458], 1
jmp 0x10009738
and dword [ebp - 0x458], 0
push 0
lea ecx, [ebp - 0x14c]
call fcn.10016fad
mov eax, dword [eax]
mov ecx, dword [ebp - 0x458]
lea eax, [ecx + eax - 0x53d2ae45]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x18c], 0
jmp 0x10009773
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xfffffff0
jne 0x10009818
mov dword [ebp - 0xa68], 0xa9c1c73b
cmp dword [ebp - 0xa68], 0
je 0x100097a4
xor eax, eax
inc eax
je 0x100097a4
mov dword [ebp - 0x6e8], 1
jmp 0x100097ab
and dword [ebp - 0x6e8], 0
cmp dword [ebp - 0x1e8], 0xffff
jbe 0x100097c3
mov dword [ebp - 0x460], 1
jmp 0x100097ca
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x6e8]
cmp eax, dword [ebp - 0x460]
jl 0x100097e4
mov dword [ebp - 0x830], 1
jmp 0x100097eb
and dword [ebp - 0x830], 0
cmp dword [ebp - 0x830], 1
jge 0x10009800
mov dword [ebp - 0x468], 1
jmp 0x10009807
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x1e8], eax
jmp 0x10009766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.10016fa8
mov dword [ebp - 0x1f0], 0x39523dd9
mov dword [ebp - 0xa70], 0xffffffff
mov dword [ebp - 0x2d8], 0
jmp 0x10009854
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 4
jge 0x10009870
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0x10f8], 0xee91
jmp 0x10009847
mov dword [ebp - 0x6f0], 2
cmp dword [ebp - 0x6f0], 0xfffffffd
jg 0x1000988f
mov dword [ebp - 0x478], 1
jmp 0x10009896
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x15c], 1
cmp dword [ebp - 0x15c], 1
jne 0x100098bd
mov eax, 0xf7919adb
test eax, eax
jne 0x100098bd
xor eax, eax
inc eax
jne 0x100098bd
and dword [ebp - 0x470], 0
jmp 0x100098c7
mov dword [ebp - 0x470], 1
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x470], eax
jne 0x100098e8
push 4
pop eax
test eax, eax
jne 0x100098e8
mov dword [ebp - 0x920], 1
jmp 0x100098ef
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
add eax, dword [ebp - 0x370]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x370]
sub eax, dword [ebp - 0x1f0]
imul eax, dword [ebp - 0x478]
cmp eax, dword [ebp - 0x1f0]
jg 0x10009934
mov dword [ebp - 0x6f8], 1
jmp 0x1000993b
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x9a8551b3
jae 0x1000995f
mov dword [ebp - 0x480], 1
jmp 0x10009966
and dword [ebp - 0x480], 0
imul eax, dword [ebp - 0x480], 0xffffffff
mov dword [ebp - 0xa70], eax
mov dword [ebp - 0x838], 0xffffffff
mov dword [ebp - 0xe44], 0xfffffffd
push 4
lea ecx, [ebp - 0xcf0]
call fcn.10016f3c
mov dword [ebp - 4], 3
mov dword [ebp - 0xa78], 0xf7f3e76e
mov dword [ebp - 0x24], 0
jmp 0x100099b5
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100099cb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xbcc], 0x77dd6887
jmp 0x100099ae
mov dword [ebp - 0x24], 0
jmp 0x100099db
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x100099f1
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x10cc], 4
jmp 0x100099d4
mov dword [ebp - 0x24], 0
jmp 0x10009a01
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10009a1a
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcf0]
call fcn.10016fad
or dword [eax], 0xffffffff
jmp 0x100099fa
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10009a3e
push 0xeb4
push 0x61f
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
push 2
lea ecx, [ebp - 0xcf0]
call fcn.10016fad
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x308]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x308]
mov dword [edx], ecx
test eax, eax
je 0x10009ac3
cmp dword [ebp - 0x838], 0
je 0x10009a93
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbcc], 0
je 0x10009a93
mov dword [ebp - 0x384], 1
jmp 0x10009a9a
and dword [ebp - 0x384], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x384]
mov dword [ebp + eax - 0xbcc], ecx
mov eax, dword [ebp - 0x384]
neg eax
je 0x10009ac3
mov dword [ebp - 0x488], 1
jmp 0x10009aca
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x838]
add eax, dword [ebp - 0x488]
mov dword [ebp - 0xa78], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf0]
call fcn.10016fa8
mov dword [ebp - 0xc30], 0xf99ff606
mov dword [ebp - 0xc2c], 0xf99ff606
mov dword [ebp - 0xc28], 0xf99ff606
mov dword [ebp - 0xc24], 0xf99ff606
lea ecx, [ebp - 0x3a9]
call fcn.10008913
push eax
lea eax, [ebp - 0xc20]
push eax
lea eax, [ebp - 0xc30]
push eax
lea ecx, [ebp - 0x10ac]
call fcn.10016fbc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x103c]
call fcn.10016f7e
mov dword [ebp - 4], 4
mov dword [ebp - 0x26c], 1
mov dword [ebp - 0xe4c], 0xbf25cbd9
mov dword [ebp - 0xe54], 0xf1813f1a
mov dword [ebp - 0xe5c], 0xb2006887
mov dword [ebp - 0xe64], 0x15aa961
mov dword [ebp - 0xe6c], 0
mov dword [ebp - 0xe74], 0
mov dword [ebp - 0xe7c], 0xd82c32b9
mov dword [ebp - 0xe84], 0xffffffff
mov dword [ebp - 0xe8c], 0x378f1e0c
push 4
lea ecx, [ebp - 0xc84]
call fcn.10016f3c
mov byte [ebp - 4], 5
mov dword [ebp - 0x2e0], 0
jmp 0x10009bdd
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 4
jge 0x10009bff
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xc84]
call fcn.10016fad
mov dword [eax], 3
jmp 0x10009bd0
mov dword [ebp - 0x26c], 3
jmp 0x10009c18
mov eax, dword [ebp - 0x26c]
dec eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jl 0x10009c6f
mov dword [ebp - 0xe94], 0xffffffff
mov dword [ebp - 0xe9c], 0x946507e6
mov dword [ebp - 0xea4], 0xe66c619a
mov dword [ebp - 0xeac], 0xa4df6f97
push 0
lea ecx, [ebp - 0xc84]
call fcn.10016fad
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x700]
mov dword [ecx], eax
jmp 0x10009c0b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xc84]
call fcn.10016fa8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x103c]
call fcn.10016fa8
mov dword [ebp - 0x150], 5
push 4
lea ecx, [ebp - 0x93c]
call fcn.10016f3c
mov dword [ebp - 4], 6
mov dword [ebp - 0x1fc], 0
jmp 0x10009cc4
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 4
jge 0x10009ce6
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x93c]
call fcn.10016fad
mov dword [eax], 0xf2121f90
jmp 0x10009cb7
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x10009d0e
push 0
push 0
push 0x20ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0xa80], 0x5a9c4c8d
jle 0x10009d3f
mov dword [ebp - 0xa88], 1
jmp 0x10009d46
and dword [ebp - 0xa88], 0
push 3
lea ecx, [ebp - 0x93c]
call fcn.10016fad
push 1
lea ecx, [ebp - 0x93c]
call fcn.10016fad
mov esi, dword [ebp - 0x150]
imul esi, dword [eax]
push 3
lea ecx, [ebp - 0x93c]
call fcn.10016fad
cmp esi, dword [eax]
jge 0x10009d86
mov dword [ebp - 0x490], 1
jmp 0x10009d8d
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 0
jle 0x10009da2
mov dword [ebp - 0x8d8], 1
jmp 0x10009da9
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x8d8]
jge 0x10009dc3
mov dword [ebp - 0x498], 1
jmp 0x10009dca
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 6
jb 0x10009ddf
mov dword [ebp - 0x708], 1
jmp 0x10009de6
and dword [ebp - 0x708], 0
push 3
lea ecx, [ebp - 0x93c]
call fcn.10016fad
mov ecx, dword [ebp - 0x708]
cmp ecx, dword [eax]
jne 0x10009e09
mov dword [ebp - 0x4a0], 1
jmp 0x10009e10
and dword [ebp - 0x4a0], 0
imul esi, dword [ebp - 0x4a0], 0x1085
push 1
lea ecx, [ebp - 0x93c]
call fcn.10016fad
imul esi, dword [eax]
push 3
lea ecx, [ebp - 0x93c]
call fcn.10016fad
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x93c]
call fcn.10016fa8
mov dword [ebp - 0x840], 0xffffffff
mov dword [ebp - 0xeb4], 0xfffffffd
push 4
lea ecx, [ebp - 0xd08]
call fcn.10016f3c
mov dword [ebp - 4], 7
mov dword [ebp - 0xa90], 0xf7f3e76e
mov dword [ebp - 0x20], 0
jmp 0x10009e8a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10009ea0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbc4], 0x77dd6887
jmp 0x10009e83
mov dword [ebp - 0x20], 0
jmp 0x10009eb0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10009ec6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x10d8], 4
jmp 0x10009ea9
mov dword [ebp - 0x20], 0
jmp 0x10009ed6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10009eef
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd08]
call fcn.10016fad
or dword [eax], 0xffffffff
jmp 0x10009ecf
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10009f13
push 0xeb4
push 0x61f
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
push 2
lea ecx, [ebp - 0xd08]
call fcn.10016fad
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x310]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x310]
mov dword [edx], ecx
test eax, eax
je 0x10009f98
cmp dword [ebp - 0x840], 0
je 0x10009f68
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc4], 0
je 0x10009f68
mov dword [ebp - 0x38c], 1
jmp 0x10009f6f
and dword [ebp - 0x38c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x38c]
mov dword [ebp + eax - 0xbc4], ecx
mov eax, dword [ebp - 0x38c]
neg eax
je 0x10009f98
mov dword [ebp - 0x4a8], 1
jmp 0x10009f9f
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x840]
add eax, dword [ebp - 0x4a8]
mov dword [ebp - 0xa90], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd08]
call fcn.10016fa8
mov dword [ebp - 0xebc], 0xfffffffe
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x10009fe6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1000a005
push 0x12b1
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov dword [ebp - 0xbf4], 0xf99ff606
mov dword [ebp - 0xbf0], 0xf99ff606
mov dword [ebp - 0xbec], 0xf99ff606
mov dword [ebp - 0xbe8], 0xf99ff606
lea ecx, [ebp - 0x3b1]
call fcn.10008913
push eax
lea eax, [ebp - 0xbe4]
push eax
lea eax, [ebp - 0xbf4]
push eax
lea ecx, [ebp - 0x1064]
call fcn.10016fbc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1048]
call fcn.10016f7e
mov dword [ebp - 4], 8
mov dword [ebp - 0x204], 1
mov dword [ebp - 0xec4], 0xbf25cbd9
mov dword [ebp - 0xecc], 0xf1813f1a
mov dword [ebp - 0xed4], 0xb2006887
mov dword [ebp - 0xedc], 0x15aa961
mov dword [ebp - 0xee4], 0
mov dword [ebp - 0xeec], 0
mov dword [ebp - 0xef4], 0xd82c32b9
mov dword [ebp - 0xefc], 0xffffffff
mov dword [ebp - 0xf04], 0x378f1e0c
push 4
lea ecx, [ebp - 0xccc]
call fcn.10016f3c
mov byte [ebp - 4], 9
mov dword [ebp - 0x2c4], 0
jmp 0x1000a0f7
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 4
jge 0x1000a119
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0xccc]
call fcn.10016fad
mov dword [eax], 3
jmp 0x1000a0ea
mov dword [ebp - 0x204], 3
jmp 0x1000a132
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jl 0x1000a189
mov dword [ebp - 0xf0c], 0xffffffff
mov dword [ebp - 0xf14], 0x946507e6
mov dword [ebp - 0xf1c], 0xe66c619a
mov dword [ebp - 0xf24], 0xa4df6f97
push 0
lea ecx, [ebp - 0xccc]
call fcn.10016fad
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 0x710]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x710]
mov dword [ecx], eax
jmp 0x1000a125
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xccc]
call fcn.10016fa8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1048]
call fcn.10016fa8
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0x37c], 0xfadacd7d
mov dword [ebp - 0x274], 0
jmp 0x1000a1d4
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jge 0x1000a1f0
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0xf94], 0
jmp 0x1000a1c7
mov dword [ebp - 0x9c], 0
jmp 0x1000a209
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xffffffec
jle 0x1000a3d4
mov dword [ebp - 0x13c], 1
push 3
lea ecx, [ebp - 0xce4]
call fcn.10016f3c
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x20c], 0
jmp 0x1000a24d
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jge 0x1000a26c
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xce4]
call fcn.10016fad
or dword [eax], 0xffffffff
jmp 0x1000a240
cmp dword [ebp - 0x9c], 0
jne 0x1000a2eb
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0xf2c], eax
cmp dword [ebp - 0x37c], 9
je 0x1000a296
mov dword [ebp - 0x4b0], 1
jmp 0x1000a29d
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x4b0], eax
jle 0x1000a2b7
mov dword [ebp - 0x318], 1
jmp 0x1000a2be
and dword [ebp - 0x318], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x318]
mov dword [ebp + eax - 0xf94], ecx
mov eax, dword [ebp - 0x13c]
imul eax, dword [ebp - 0x318]
test eax, eax
jne 0x1000a2eb
and dword [ebp - 0x960], 0
jmp 0x1000a2f5
mov dword [ebp - 0x960], 1
mov eax, dword [ebp - 0x960]
sub eax, dword [ebp - 0x37c]
sub eax, dword [ebp - 0x13c]
je 0x1000a31e
cmp dword [ebp - 0x13c], 0
je 0x1000a31e
mov dword [ebp - 0xab8], 1
jmp 0x1000a325
and dword [ebp - 0xab8], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xf34], eax
mov eax, 0x29c4ddb8
test eax, eax
je 0x1000a341
cmp dword [ebp - 0x13c], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xf94], 0x59229a27
jle 0x1000a35f
mov dword [ebp - 0x4b8], 1
jmp 0x1000a366
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x4b8], eax
je 0x1000a380
mov dword [ebp - 0x718], 1
jmp 0x1000a387
and dword [ebp - 0x718], 0
push 8
pop eax
sub eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x718]
je 0x1000a3a4
mov dword [ebp - 0x4c0], 1
jmp 0x1000a3ab
and dword [ebp - 0x4c0], 0
push 2
lea ecx, [ebp - 0xce4]
call fcn.10016fad
mov ecx, dword [ebp - 0x4c0]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xce4]
call fcn.10016fa8
jmp 0x1000a1fc
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x1000a3f1
push 0x1867
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x164], 5
push 4
lea ecx, [ebp - 0x94c]
call fcn.10016f3c
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x2ac], 0
jmp 0x1000a428
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 4
jge 0x1000a44a
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0x94c]
call fcn.10016fad
mov dword [eax], 0xf2121f90
jmp 0x1000a41b
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1000a472
push 0
push 0
push 0x20ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0xac0], 0x5a9c4c8d
jle 0x1000a4a3
mov dword [ebp - 0xac8], 1
jmp 0x1000a4aa
and dword [ebp - 0xac8], 0
push 3
lea ecx, [ebp - 0x94c]
call fcn.10016fad
push 1
lea ecx, [ebp - 0x94c]
call fcn.10016fad
mov esi, dword [ebp - 0x164]
imul esi, dword [eax]
push 3
lea ecx, [ebp - 0x94c]
call fcn.10016fad
cmp esi, dword [eax]
jge 0x1000a4ea
mov dword [ebp - 0x848], 1
jmp 0x1000a4f1
and dword [ebp - 0x848], 0
cmp dword [ebp - 0x848], 0
jle 0x1000a506
mov dword [ebp - 0x4c8], 1
jmp 0x1000a50d
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x4c8]
jge 0x1000a527
mov dword [ebp - 0x720], 1
jmp 0x1000a52e
and dword [ebp - 0x720], 0
cmp dword [ebp - 0x720], 6
jb 0x1000a543
mov dword [ebp - 0x4d0], 1
jmp 0x1000a54a
and dword [ebp - 0x4d0], 0
push 3
lea ecx, [ebp - 0x94c]
call fcn.10016fad
mov ecx, dword [ebp - 0x4d0]
cmp ecx, dword [eax]
jne 0x1000a56d
mov dword [ebp - 0x8e0], 1
jmp 0x1000a574
and dword [ebp - 0x8e0], 0
imul esi, dword [ebp - 0x8e0], 0x1085
push 1
lea ecx, [ebp - 0x94c]
call fcn.10016fad
imul esi, dword [eax]
push 3
lea ecx, [ebp - 0x94c]
call fcn.10016fad
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94c]
call fcn.10016fa8
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0xb50], 0x1f6f0842
mov dword [ebp - 0xb4c], 0x1f6f0842
mov dword [ebp - 0xb48], 0x1f6f0842
mov dword [ebp - 0xb44], 0x1f6f0842
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jge 0x1000a5ef
mov dword [ebp - 0xad0], 1
jmp 0x1000a5f6
and dword [ebp - 0xad0], 0
cmp dword [ebp - 0x40], 0
jne 0x1000a60b
cmp dword [ebp - 0x40], 0
je 0x1000a606
cmp dword [ebp - 0x40], 0
or eax, 0xffffffff
je 0x1000a61d
cmp dword [ebp - 0x40], 0
je 0x1000a61d
mov dword [ebp - 0xad8], 1
jmp 0x1000a624
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xf3c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb50]
mov dword [ebp - 0xf44], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0xb50]
mov dword [ebp + ecx - 0xb50], eax
mov dword [ebp - 0x40], 0xa
jmp 0x1000a669
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x11
je 0x1000a68d
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1000a68b
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x1000a662
mov dword [ebp - 0xc1c], 0xf99ff606
mov dword [ebp - 0xc18], 0xf99ff606
mov dword [ebp - 0xc14], 0xf99ff606
mov dword [ebp - 0xc10], 0xf99ff606
lea ecx, [ebp - 0x3b3]
call fcn.10008913
push eax
lea eax, [ebp - 0xc0c]
push eax
lea eax, [ebp - 0xc1c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.10016fbc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1054]
call fcn.10016f7e
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x27c], 1
mov dword [ebp - 0xf4c], 0xbf25cbd9
mov dword [ebp - 0xf54], 0xf1813f1a
mov dword [ebp - 0xf5c], 0xb2006887
mov dword [ebp - 0xf64], 0x15aa961
mov dword [ebp - 0xf6c], 0
mov dword [ebp - 0xf74], 0
mov dword [ebp - 0xfe0], 0xd82c32b9
mov dword [ebp - 0xfe8], 0xffffffff
mov dword [ebp - 0xff0], 0x378f1e0c
push 4
lea ecx, [ebp - 0xcfc]
call fcn.10016f3c
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x214], 0
jmp 0x1000a77f
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 4
jge 0x1000a7a1
push dword [ebp - 0x214]
lea ecx, [ebp - 0xcfc]
call fcn.10016fad
mov dword [eax], 3
jmp 0x1000a772
mov dword [ebp - 0x27c], 3
jmp 0x1000a7ba
mov eax, dword [ebp - 0x27c]
dec eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jl 0x1000a811
mov dword [ebp - 0xff8], 0xffffffff
mov dword [ebp - 0x1000], 0x946507e6
mov dword [ebp - 0x1008], 0xe66c619a
mov dword [ebp - 0x1010], 0xa4df6f97
push 0
lea ecx, [ebp - 0xcfc]
call fcn.10016fad
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x4d8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4d8]
mov dword [ecx], eax
jmp 0x1000a7ad
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xcfc]
call fcn.10016fa8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1054]
call fcn.10016fa8
mov dword [ebp - 0x1018], 0xfffffffe
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1000a855
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x1000a874
push 0x12b1
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov dword [ebp - 0x168], 5
push 4
lea ecx, [ebp - 0x95c]
call fcn.10016f3c
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x21c], 0
jmp 0x1000a8ab
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 4
jge 0x1000a8cd
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x95c]
call fcn.10016fad
mov dword [eax], 0xf2121f90
jmp 0x1000a89e
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1000a8f5
push 0
push 0
push 0x20ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0xae0], 0x5a9c4c8d
jle 0x1000a926
mov dword [ebp - 0xae8], 1
jmp 0x1000a92d
and dword [ebp - 0xae8], 0
push 3
lea ecx, [ebp - 0x95c]
call fcn.10016fad
push 1
lea ecx, [ebp - 0x95c]
call fcn.10016fad
mov esi, dword [ebp - 0x168]
imul esi, dword [eax]
push 3
lea ecx, [ebp - 0x95c]
call fcn.10016fad
cmp esi, dword [eax]
jge 0x1000a96d
mov dword [ebp - 0x728], 1
jmp 0x1000a974
and dword [ebp - 0x728], 0
cmp dword [ebp - 0x728], 0
jle 0x1000a989
mov dword [ebp - 0x4e0], 1
jmp 0x1000a990
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x4e0]
jge 0x1000a9aa
mov dword [ebp - 0x850], 1
jmp 0x1000a9b1
and dword [ebp - 0x850], 0
cmp dword [ebp - 0x850], 6
jb 0x1000a9c6
mov dword [ebp - 0x4e8], 1
jmp 0x1000a9cd
and dword [ebp - 0x4e8], 0
push 3
lea ecx, [ebp - 0x95c]
call fcn.10016fad
mov ecx, dword [ebp - 0x4e8]
cmp ecx, dword [eax]
jne 0x1000a9f0
mov dword [ebp - 0x730], 1
jmp 0x1000a9f7
and dword [ebp - 0x730], 0
imul esi, dword [ebp - 0x730], 0x1085
push 1
lea ecx, [ebp - 0x95c]
call fcn.10016fad
imul esi, dword [eax]
push 3
lea ecx, [ebp - 0x95c]
call fcn.10016fad
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x95c]
call fcn.10016fa8
push 4
lea ecx, [ebp - 0x198]
call fcn.10016f3c
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x4f0], 0xfffffffe
mov dword [ebp - 0x320], 0x796840eb
push 3
lea ecx, [ebp - 0xb90]
call fcn.10016f3c
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x380], 0xffffffff
mov dword [ebp - 0x8e8], 0x9c5c935c
mov dword [ebp - 0xaf8], 9
mov dword [ebp - 0x1020], 0xfffffffd
mov dword [ebp - 0x78], 0
jmp 0x1000aaa0
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x1000aabc
push dword [ebp - 0x78]
lea ecx, [ebp - 0x198]
call fcn.10016fad
mov dword [eax], 0x4f147909
jmp 0x1000aa99
mov dword [ebp - 0x78], 0
jmp 0x1000aacc
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1000aae5
push dword [ebp - 0x78]
lea ecx, [ebp - 0xb90]
call fcn.10016fad
and dword [eax], 0
jmp 0x1000aac5
mov dword [ebp - 0x4f0], 0xba31e468
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x320], eax
push 0
lea ecx, [ebp - 0x198]
call fcn.10016fad
push 0
lea ecx, [ebp - 0x198]
call fcn.10016fad
mov eax, dword [eax]
sub eax, 0x75fe6ce0
cmp eax, 0x66b7a7b
jg 0x1000ab2f
mov dword [ebp - 0x928], 1
jmp 0x1000ab36
and dword [ebp - 0x928], 0
push 0
lea ecx, [ebp - 0x198]
call fcn.10016fad
mov ecx, dword [ebp - 0x928]
cmp ecx, dword [eax]
jle 0x1000ab59
mov dword [ebp - 0x4f8], 1
jmp 0x1000ab60
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0xfff6
jb 0x1000ab84
mov dword [ebp - 0x738], 1
jmp 0x1000ab8b
and dword [ebp - 0x738], 0
push 2
lea ecx, [ebp - 0x198]
call fcn.10016fad
mov ecx, dword [ebp - 0x738]
cmp ecx, dword [eax]
jl 0x1000abc6
push 0
lea ecx, [ebp - 0x198]
call fcn.10016fad
cmp dword [eax], 0
jne 0x1000abc6
mov eax, 0xe069
test eax, eax
jne 0x1000abc6
mov dword [ebp - 0x500], 1
push 1
lea ecx, [ebp - 0x198]
call fcn.10016fad
mov ecx, dword [ebp - 0x500]
sub ecx, dword [eax]
imul esi, ecx, 0xffff
push 3
lea ecx, [ebp - 0x198]
call fcn.10016fad
cmp esi, dword [eax]
jne 0x1000ac08
mov dword [ebp - 0x858], 1
jmp 0x1000ac0f
and dword [ebp - 0x858], 0
push 3
lea ecx, [ebp - 0x198]
call fcn.10016fad
mov ecx, dword [ebp - 0x858]
sub ecx, dword [eax]
mov dword [ebp - 0x508], ecx
push 2
lea ecx, [ebp - 0xb90]
call fcn.10016fad
mov ecx, dword [ebp - 0x508]
mov dword [eax], ecx
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x380], eax
mov esi, dword [ebp - 0x380]
sub esi, 9
push 2
lea ecx, [ebp - 0x198]
call fcn.10016fad
cmp esi, dword [eax]
jg 0x1000ac71