Function at 0x10009769
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c577
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x12f0
call fcn.10088000
push esi
push edi
mov dword [ebp - 0x44], 0x3ed15de0
push 3
lea ecx, [ebp - 0x1c4]
call fcn.10018a69
and dword [ebp - 4], 0
mov dword [ebp - 0x70], 0x720348f4
mov dword [ebp - 0x318], 0
jmp 0x100097c5
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 3
jge 0x100097e7
push dword [ebp - 0x318]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
mov dword [eax], 0xbacc5d9b
jmp 0x100097b8
cmp dword [ebp - 0x44], 0
je 0x10009833
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x307a
jne 0x10009812
mov eax, 0x9ef4a042
test eax, eax
je 0x10009812
mov dword [ebp - 0x568], 1
jmp 0x10009819
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x568]
test eax, eax
je 0x10009833
mov dword [ebp - 0xaf4], 1
jmp 0x1000983a
and dword [ebp - 0xaf4], 0
push 2
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
mov ecx, dword [ebp - 0xaf4]
cmp ecx, dword [eax]
je 0x1000985d
mov dword [ebp - 0xafc], 1
jmp 0x10009864
and dword [ebp - 0xafc], 0
xor eax, eax
sub eax, dword [ebp - 0xafc]
je 0x1000988c
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
cmp dword [eax], 0
je 0x1000988c
mov dword [ebp - 0xb1c], 1
jmp 0x10009893
and dword [ebp - 0xb1c], 0
push 1
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
mov ecx, dword [ebp - 0xb1c]
mov dword [eax], ecx
mov dword [ebp - 0x44], 0
jmp 0x100098b8
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x10009bcf
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x88], 0x90707e29
mov dword [ebp - 0xd0c], 0xffffffff
mov dword [ebp - 0xd14], 0
mov dword [ebp - 0x70], 0
jmp 0x100098fa
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jg 0x10009bca
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
mov eax, dword [eax]
sub eax, 0xf5ec
cmp eax, 0x4015fb26
jne 0x1000992c
mov dword [ebp - 0x324], 1
jmp 0x10009933
and dword [ebp - 0x324], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
mov ecx, dword [ebp - 0x324]
mov dword [eax], ecx
cmp dword [ebp - 0x324], 0
je 0x1000996b
mov eax, dword [ebp - 0x174]
add eax, 0x2db756fd
je 0x1000996b
mov dword [ebp - 0xb24], 1
jmp 0x10009972
and dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x88], 0
jmp 0x10009997
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jg 0x10009bc5
mov dword [ebp - 0xc20], 0xfffffff6
mov dword [ebp - 0xb4c], 0x513e67dc
mov dword [ebp - 0x174], 0
jmp 0x100099d1
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jg 0x10009bc0
mov dword [ebp - 0x320], 0xded1456b
mov dword [ebp - 0x320], 2
jmp 0x10009a01
mov eax, dword [ebp - 0x320]
dec eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
jl 0x10009bbb
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
or eax, 0xffffffff
je 0x10009aec
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x44], eax
jne 0x10009a3c
mov dword [ebp - 0xb2c], 1
jmp 0x10009a43
and dword [ebp - 0xb2c], 0
mov eax, dword [ebp - 0xc20]
imul eax, dword [ebp - 0xb2c]
add eax, dword [ebp - 0x70]
cmp eax, 0xacc8e11f
je 0x10009a66
mov dword [ebp - 0xb34], 1
jmp 0x10009a6d
and dword [ebp - 0xb34], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb34]
lea eax, [ecx + eax - 0x8b31]
test eax, eax
jne 0x10009a9a
mov dword [ebp - 0xb3c], 1
jmp 0x10009aa1
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0xb4c]
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
cmp dword [eax], 0
je 0x10009ace
xor eax, eax
inc eax
je 0x10009ace
mov dword [ebp - 0xb44], 1
jmp 0x10009ad5
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0xb44], eax
jg 0x10009aec
mov dword [ebp - 0xcf4], 1
jmp 0x10009af3
and dword [ebp - 0xcf4], 0
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
push 2
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
cmp dword [eax], 0xffffffff
je 0x10009b22
mov dword [ebp - 0xcfc], 1
jmp 0x10009b29
and dword [ebp - 0xcfc], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
cmp dword [eax], 0x6264a05a
jl 0x10009b6b
push 1
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
cmp dword [eax], 0
jne 0x10009b6b
and dword [ebp - 0xd04], 0
jmp 0x10009b75
mov dword [ebp - 0xd04], 1
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0xfb8], eax
mov dword [ebp - 0xd0c], 0x5f37d796
mov eax, 0xa74db503
cmp eax, 0x5ea0d0a0
je 0x10009ba3
mov dword [ebp - 0xb54], 1
jmp 0x10009baa
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0xd14], eax
jmp 0x100099f4
jmp 0x100099c4
jmp 0x1000998a
jmp 0x100098f3
jmp 0x100098b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c4]
call fcn.10018aee
mov dword [ebp - 0x50], 0x3ed15de0
push 3
lea ecx, [ebp - 0x1d0]
call fcn.10018a69
mov dword [ebp - 4], 1
mov dword [ebp - 0x64], 0x720348f4
mov dword [ebp - 0x234], 0
jmp 0x10009c19
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x10009c3b
push dword [ebp - 0x234]
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
mov dword [eax], 0xbacc5d9b
jmp 0x10009c0c
cmp dword [ebp - 0x50], 0
je 0x10009c87
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x307a
jne 0x10009c66
mov eax, 0x9ef4a042
test eax, eax
je 0x10009c66
mov dword [ebp - 0x9bc], 1
jmp 0x10009c6d
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x9bc]
test eax, eax
je 0x10009c87
mov dword [ebp - 0x440], 1
jmp 0x10009c8e
and dword [ebp - 0x440], 0
push 2
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
mov ecx, dword [ebp - 0x440]
cmp ecx, dword [eax]
je 0x10009cb1
mov dword [ebp - 0x9c4], 1
jmp 0x10009cb8
and dword [ebp - 0x9c4], 0
xor eax, eax
sub eax, dword [ebp - 0x9c4]
je 0x10009ce0
push 0
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
cmp dword [eax], 0
je 0x10009ce0
mov dword [ebp - 0x448], 1
jmp 0x10009ce7
and dword [ebp - 0x448], 0
push 1
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
mov ecx, dword [ebp - 0x448]
mov dword [eax], ecx
mov dword [ebp - 0x50], 0
jmp 0x10009d0c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jg 0x1000a023
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x98], 0x90707e29
mov dword [ebp - 0xd3c], 0xffffffff
mov dword [ebp - 0xd44], 0
mov dword [ebp - 0x64], 0
jmp 0x10009d4e
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jg 0x1000a01e
push dword [ebp - 0x50]
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
mov eax, dword [eax]
sub eax, 0xf5ec
cmp eax, 0x4015fb26
jne 0x10009d80
mov dword [ebp - 0x3ec], 1
jmp 0x10009d87
and dword [ebp - 0x3ec], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
mov ecx, dword [ebp - 0x3ec]
mov dword [eax], ecx
cmp dword [ebp - 0x3ec], 0
je 0x10009dbf
mov eax, dword [ebp - 0x198]
add eax, 0x2db756fd
je 0x10009dbf
mov dword [ebp - 0x9cc], 1
jmp 0x10009dc6
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x98], 0
jmp 0x10009deb
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jg 0x1000a019
mov dword [ebp - 0xd1c], 0xfffffff6
mov dword [ebp - 0x460], 0x513e67dc
mov dword [ebp - 0x198], 0
jmp 0x10009e25
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jg 0x1000a014
mov dword [ebp - 0x1dc], 0xded1456b
mov dword [ebp - 0x1dc], 2
jmp 0x10009e55
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jl 0x1000a00f
push dword [ebp - 0x98]
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
or eax, 0xffffffff
je 0x10009f40
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x50], eax
jne 0x10009e90
mov dword [ebp - 0x450], 1
jmp 0x10009e97
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0xd1c]
imul eax, dword [ebp - 0x450]
add eax, dword [ebp - 0x64]
cmp eax, 0xacc8e11f
je 0x10009eba
mov dword [ebp - 0x9d4], 1
jmp 0x10009ec1
and dword [ebp - 0x9d4], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
mov eax, dword [eax]
mov ecx, dword [ebp - 0x9d4]
lea eax, [ecx + eax - 0x8b31]
test eax, eax
jne 0x10009eee
mov dword [ebp - 0x458], 1
jmp 0x10009ef5
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x460]
push dword [ebp - 0x98]
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
cmp dword [eax], 0
je 0x10009f22
xor eax, eax
inc eax
je 0x10009f22
mov dword [ebp - 0x9dc], 1
jmp 0x10009f29
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x9dc], eax
jg 0x10009f40
mov dword [ebp - 0xd24], 1
jmp 0x10009f47
and dword [ebp - 0xd24], 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
push 2
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
cmp dword [eax], 0xffffffff
je 0x10009f76
mov dword [ebp - 0xd2c], 1
jmp 0x10009f7d
and dword [ebp - 0xd2c], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
push dword [ebp - 0x98]
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
cmp dword [eax], 0x6264a05a
jl 0x10009fbf
push 1
lea ecx, [ebp - 0x1d0]
call fcn.10018b0a
cmp dword [eax], 0
jne 0x10009fbf
and dword [ebp - 0xd34], 0
jmp 0x10009fc9
mov dword [ebp - 0xd34], 1
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0xfe4], eax
mov dword [ebp - 0xd3c], 0x5f37d796
mov eax, 0xa74db503
cmp eax, 0x5ea0d0a0
je 0x10009ff7
mov dword [ebp - 0x9e4], 1
jmp 0x10009ffe
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0xd44], eax
jmp 0x10009e48
jmp 0x10009e18
jmp 0x10009dde
jmp 0x10009d47
jmp 0x10009d05
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d0]
call fcn.10018aee
mov dword [ebp - 0x48], 0x3ed15de0
push 3
lea ecx, [ebp - 0x1b8]
call fcn.10018a69
mov dword [ebp - 4], 2
mov dword [ebp - 0x60], 0x720348f4
mov dword [ebp - 0xa0], 0xffffffff
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xa0], 0
jmp 0x1000a081
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xfffffff2
jle 0x1000a387
mov dword [ebp - 0x470], 0xc86695cd
mov dword [ebp - 0x9f4], 0x1f06e85f
mov dword [ebp - 0xa04], 0xaba9a984
mov dword [ebp - 0xd70], 0
mov dword [ebp - 0x2c0], 0
jmp 0x1000a0cf
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jge 0x1000a0eb
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x1ac], 0x4b25b3b
jmp 0x1000a0c2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ac]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x1ac]
mov dword [ebp - 0xe0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ac]
mov dword [ebp - 0xfec], eax
cmp dword [ebp - 0xa0], 0x39d2
jle 0x1000a137
mov dword [ebp - 0x468], 1
jmp 0x1000a13e
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x468], eax
jg 0x1000a158
mov dword [ebp - 0x9ec], 1
jmp 0x1000a15f
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x9f4], eax
cmp dword [ebp - 0x9f4], 0xfffffffa
jb 0x1000a18c
mov dword [ebp - 0x478], 1
jmp 0x1000a193
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
inc eax
cmp eax, dword [ebp - 0xa0]
jl 0x1000a1ae
mov dword [ebp - 0x9fc], 1
jmp 0x1000a1b5
and dword [ebp - 0x9fc], 0
cmp dword [ebp - 0x9fc], 0xffffffff
jg 0x1000a1ca
mov dword [ebp - 0x480], 1
jmp 0x1000a1d1
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0xa04], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ac]
cmp dword [ebp - 0xa04], eax
jl 0x1000a1fe
mov dword [ebp - 0x488], 1
jmp 0x1000a205
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
sub eax, dword [ebp - 0xa0]
cmp eax, 0x67e7
jle 0x1000a224
mov dword [ebp - 0xa0c], 1
jmp 0x1000a22b
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0xa0c]
cmp eax, dword [ebp - 0xe0]
jle 0x1000a24c
mov dword [ebp - 0x490], 1
jmp 0x1000a253
and dword [ebp - 0x490], 0
imul eax, dword [ebp - 0x490], 0x73e
test eax, eax
jne 0x1000a273
mov eax, 0xfffc
test eax, eax
jne 0x1000a273
and dword [ebp - 0xa14], 0
jmp 0x1000a27d
mov dword [ebp - 0xa14], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ac]
cmp dword [ebp - 0xa14], eax
jle 0x1000a29e
mov dword [ebp - 0x498], 1
jmp 0x1000a2a5
and dword [ebp - 0x498], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ac]
cmp dword [ebp - 0x498], eax
jl 0x1000a2c6
mov dword [ebp - 0xa1c], 1
jmp 0x1000a2cd
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xa1c], eax
jl 0x1000a2e7
mov dword [ebp - 0x4a0], 1
jmp 0x1000a2ee
and dword [ebp - 0x4a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ac]
cmp dword [ebp - 0x4a0], eax
jge 0x1000a30f
mov dword [ebp - 0xa24], 1
jmp 0x1000a316
and dword [ebp - 0xa24], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ac]
add eax, dword [ebp - 0xe0]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x1ac]
cmp eax, dword [ebp - 0xa24]
jl 0x1000a347
cmp dword [ebp - 0xd70], 0
je 0x1000a35c
mov eax, 0xeac8e4c1
test eax, eax
je 0x1000a35c
mov dword [ebp - 0x4a8], 1
jmp 0x1000a363
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0xe0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe0]
mov dword [ebp + eax - 0x1ac], ecx
jmp 0x1000a074
mov dword [ebp - 0x1e4], 0
jmp 0x1000a3a0
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jge 0x1000a3c2
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
mov dword [eax], 0xbacc5d9b
jmp 0x1000a393
cmp dword [ebp - 0x48], 0
je 0x1000a40e
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x307a
jne 0x1000a3ed
mov eax, 0x9ef4a042
test eax, eax
je 0x1000a3ed
mov dword [ebp - 0xa2c], 1
jmp 0x1000a3f4
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0xa2c]
test eax, eax
je 0x1000a40e
mov dword [ebp - 0x4b0], 1
jmp 0x1000a415
and dword [ebp - 0x4b0], 0
push 2
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
mov ecx, dword [ebp - 0x4b0]
cmp ecx, dword [eax]
je 0x1000a438
mov dword [ebp - 0xa34], 1
jmp 0x1000a43f
and dword [ebp - 0xa34], 0
xor eax, eax
sub eax, dword [ebp - 0xa34]
je 0x1000a467
push 0
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
cmp dword [eax], 0
je 0x1000a467
mov dword [ebp - 0x4b8], 1
jmp 0x1000a46e
and dword [ebp - 0x4b8], 0
push 1
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
mov ecx, dword [ebp - 0x4b8]
mov dword [eax], ecx
mov dword [ebp - 0x48], 0
jmp 0x1000a493
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x1000a78c
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x80], 0x90707e29
mov dword [ebp - 0xd98], 0xffffffff
mov dword [ebp - 0xda0], 0
mov dword [ebp - 0x60], 0
jmp 0x1000a4d2
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jg 0x1000a787
push dword [ebp - 0x48]
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
mov eax, dword [eax]
sub eax, 0xf5ec
cmp eax, 0x4015fb26
jne 0x1000a504
mov dword [ebp - 0x3f4], 1
jmp 0x1000a50b
and dword [ebp - 0x3f4], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
mov ecx, dword [ebp - 0x3f4]
mov dword [eax], ecx
cmp dword [ebp - 0x3f4], 0
je 0x1000a543
mov eax, dword [ebp - 0x180]
add eax, 0x2db756fd
je 0x1000a543
mov dword [ebp - 0xa3c], 1
jmp 0x1000a54a
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x80], 0
jmp 0x1000a563
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jg 0x1000a782
mov dword [ebp - 0xd78], 0xfffffff6
mov dword [ebp - 0x4d0], 0x513e67dc
mov dword [ebp - 0x180], 0
jmp 0x1000a59a
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jg 0x1000a77d
mov dword [ebp - 0x2c8], 0xded1456b
mov dword [ebp - 0x2c8], 2
jmp 0x1000a5ca
mov eax, dword [ebp - 0x2c8]
dec eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
jl 0x1000a778
push dword [ebp - 0x80]
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
or eax, 0xffffffff
je 0x1000a6af
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x48], eax
jne 0x1000a602
mov dword [ebp - 0x4c0], 1
jmp 0x1000a609
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0xd78]
imul eax, dword [ebp - 0x4c0]
add eax, dword [ebp - 0x60]
cmp eax, 0xacc8e11f
je 0x1000a62c
mov dword [ebp - 0xa44], 1
jmp 0x1000a633
and dword [ebp - 0xa44], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa44]
lea eax, [ecx + eax - 0x8b31]
test eax, eax
jne 0x1000a660
mov dword [ebp - 0x4c8], 1
jmp 0x1000a667
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4d0]
push dword [ebp - 0x80]
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
cmp dword [eax], 0
je 0x1000a691
xor eax, eax
inc eax
je 0x1000a691
mov dword [ebp - 0xa4c], 1
jmp 0x1000a698
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xa4c], eax
jg 0x1000a6af
mov dword [ebp - 0xd80], 1
jmp 0x1000a6b6
and dword [ebp - 0xd80], 0
push dword [ebp - 0x80]
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
push 2
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
cmp dword [eax], 0xffffffff
je 0x1000a6e2
mov dword [ebp - 0xd88], 1
jmp 0x1000a6e9
and dword [ebp - 0xd88], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
push dword [ebp - 0x80]
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
cmp dword [eax], 0x6264a05a
jl 0x1000a728
push 1
lea ecx, [ebp - 0x1b8]
call fcn.10018b0a
cmp dword [eax], 0
jne 0x1000a728
and dword [ebp - 0xd90], 0
jmp 0x1000a732
mov dword [ebp - 0xd90], 1
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xff4], eax
mov dword [ebp - 0xd98], 0x5f37d796
mov eax, 0xa74db503
cmp eax, 0x5ea0d0a0
je 0x1000a760
mov dword [ebp - 0xa54], 1
jmp 0x1000a767
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xda0], eax
jmp 0x1000a5bd
jmp 0x1000a58d
jmp 0x1000a55c
jmp 0x1000a4cb
jmp 0x1000a48c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b8]
call fcn.10018aee
mov dword [ebp - 0x39c], 0xc692
mov dword [ebp - 0x538], 0xc6338430
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x528], 0x16efa42b
mov dword [ebp - 0x1fc], 0x9253a34c
mov dword [ebp - 0xdd8], 3
push 3
lea ecx, [ebp - 0xe08]
call fcn.10018a69
mov dword [ebp - 4], 3
mov dword [ebp - 0x540], 1
mov dword [ebp - 0x32c], 0xec00
mov dword [ebp - 0xdd0], 0xfffffff6
mov dword [ebp - 0xde0], 0xca1d25f
mov dword [ebp - 0xde8], 0x79c0213a
mov dword [ebp - 0x1ec], 0
jmp 0x1000a836
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 3
jge 0x1000a858
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0xe08]
call fcn.10018b0a
mov dword [eax], 0xfffffffe
jmp 0x1000a829
cmp dword [ebp - 0x39c], 0
je 0x1000ac37
mov dword [ebp - 0xda8], 0xb674
mov dword [ebp - 0xa7c], 0x82abbf9a
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x334], 0xd81479b6
mov dword [ebp - 0xdc0], 0xc1747346
mov dword [ebp - 0xffc], 0
mov dword [ebp - 0x1d4], 0
jmp 0x1000a8ba
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jge 0x1000a8d6
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0xc10], 0
jmp 0x1000a8ad
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0x1044], eax
mov dword [ebp - 0xd0], 0xb674
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x104c], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x1054], eax
cmp dword [ebp - 0x1fc], 4
jl 0x1000a919
mov dword [ebp - 0xdb0], 1
jmp 0x1000a920
and dword [ebp - 0xdb0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc10]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0xdb8], eax
mov eax, dword [ebp - 0x32c]
dec eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0xdb8], 0x4b72
jg 0x1000a964
mov dword [ebp - 0x4d8], 1
jmp 0x1000a96b
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x538]
cmp eax, dword [ebp - 0x4d8]
jl 0x1000a985
mov dword [ebp - 0xa5c], 1
jmp 0x1000a98c
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0xa5c]
mov dword [ebp - 0xdc0], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x1fc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc10]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0x106c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc10], 0xfffffffa
jl 0x1000a9de
mov dword [ebp - 0x4e0], 1
jmp 0x1000a9e5
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x528]
cmp dword [ebp - 0x4e0], eax
jg 0x1000a9ff
mov dword [ebp - 0xa64], 1
jmp 0x1000aa06
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0xa64]
sub eax, dword [ebp - 0x1fc]
je 0x1000aa30
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc10], 0
je 0x1000aa30
mov dword [ebp - 0x4e8], 1
jmp 0x1000aa37
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x4e8]
jg 0x1000aa57
cmp dword [ebp - 0x334], 0
jne 0x1000aa57
and dword [ebp - 0xa6c], 0
jmp 0x1000aa61
mov dword [ebp - 0xa6c], 1
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0xa6c], eax
jle 0x1000aa7b
mov dword [ebp - 0x4f0], 1
jmp 0x1000aa82
and dword [ebp - 0x4f0], 0
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x4f0], 0x5217
cmp dword [ebp + eax - 0xc10], ecx
jge 0x1000aaa7
mov dword [ebp - 0xa74], 1
jmp 0x1000aaae
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0x39c]
add eax, dword [ebp - 0xa74]
cmp eax, 0x230a264
jg 0x1000aacd
mov dword [ebp - 0x4f8], 1
jmp 0x1000aad4
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
add eax, 0x2602a6c5
imul eax, eax, 0x9ea4
cmp eax, dword [ebp - 0x334]
jge 0x1000abc3
mov dword [ebp - 0x1f4], 0xffff
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x1f4], eax
jl 0x1000ab21
mov dword [ebp - 0x500], 1
jmp 0x1000ab28
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0xca2
jle 0x1000ab40
mov dword [ebp - 0xdc8], 1
jmp 0x1000ab47
and dword [ebp - 0xdc8], 0
cmp dword [ebp - 0x1f4], 0xfffffff8
jl 0x1000ab5c
mov dword [ebp - 0xa84], 1
jmp 0x1000ab63
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0xdd0]
cmp dword [ebp - 0xa84], eax
jne 0x1000ab7d
mov dword [ebp - 0x508], 1
jmp 0x1000ab84
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x508], eax
jne 0x1000ab9e
mov dword [ebp - 0xa8c], 1
jmp 0x1000aba5
and dword [ebp - 0xa8c], 0
mov esi, dword [ebp - 0xdd8]
imul esi, dword [ebp - 0xa8c]
push 1
lea ecx, [ebp - 0xe08]
call fcn.10018b0a
mov dword [eax], esi
jmp 0x1000ac32
mov dword [ebp - 0xd0], 2
jmp 0x1000abdc
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x1000ac32
mov byte [ebp - 0x134], 0
movzx eax, byte [ebp - 0x134]
test eax, eax
je 0x1000ac1e
push 0x1932
push 0
push 0xefd
push 0x683
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov eax, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0xc10], 0
je 0x1000ac30
jmp 0x1000ac32
jmp 0x1000abcf
jmp 0x1000ae2d
push 3
lea ecx, [ebp - 0xbc8]
call fcn.10018a69
mov byte [ebp - 4], 4
mov dword [ebp - 0xaac], 0xcc384641
mov dword [ebp - 0x2d0], 0
jmp 0x1000ac6b
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 3
jge 0x1000ac8d
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0xbc8]
call fcn.10018b0a
mov dword [eax], 5
jmp 0x1000ac5e
mov eax, dword [ebp - 0xde0]
cmp dword [ebp - 0x540], eax
jle 0x1000aca7
mov dword [ebp - 0x510], 1
jmp 0x1000acae
and dword [ebp - 0x510], 0
push 2
lea ecx, [ebp - 0xbc8]
call fcn.10018b0a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x510]
jl 0x1000acd1
mov dword [ebp - 0xa94], 1
jmp 0x1000acd8
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x190], eax
mov esi, dword [ebp - 0x190]
push 2
lea ecx, [ebp - 0xbc8]
call fcn.10018b0a
add esi, dword [eax]
mov dword [ebp - 0x518], esi
push 1
lea ecx, [ebp - 0xe08]
call fcn.10018b0a
mov ecx, dword [ebp - 0x518]
mov dword [eax], ecx
mov eax, dword [ebp - 0x518]
sub eax, 0xffff
jne 0x1000ad2d
mov dword [ebp - 0xa9c], 1
jmp 0x1000ad34
and dword [ebp - 0xa9c], 0
push 2
lea ecx, [ebp - 0xbc8]
call fcn.10018b0a
mov ecx, dword [ebp - 0xa9c]
sub ecx, dword [eax]
cmp ecx, 0xd3f149c9
je 0x1000ad5d
mov dword [ebp - 0x520], 1
jmp 0x1000ad64
and dword [ebp - 0x520], 0
push 0
lea ecx, [ebp - 0xbc8]
call fcn.10018b0a
mov ecx, dword [ebp - 0x520]
cmp ecx, dword [eax]
jg 0x1000ad8d
mov eax, 0xabf2
test eax, eax
jne 0x1000ad8d
and dword [ebp - 0xaa4], 0
jmp 0x1000ad97
mov dword [ebp - 0xaa4], 1
imul eax, dword [ebp - 0xaa4], 0x3fa0
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0x528]
cmp dword [ebp - 0xaac], eax
jge 0x1000adc1
mov dword [ebp - 0x530], 1
jmp 0x1000adc8
and dword [ebp - 0x530], 0
imul eax, dword [ebp - 0x1fc], 0x6add
cmp eax, dword [ebp - 0x530]
jg 0x1000ade6
mov dword [ebp - 0xab4], 1
jmp 0x1000aded
and dword [ebp - 0xab4], 0
cmp dword [ebp - 0xab4], 0
ja 0x1000ae0b
cmp dword [ebp - 0x538], 0
je 0x1000ae0b
mov dword [ebp - 0xabc], 1
jmp 0x1000ae12
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xde8], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xbc8]
call fcn.10018aee
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0xac4], eax
push 2
lea ecx, [ebp - 0xe08]
call fcn.10018b0a
mov ecx, dword [ebp - 0xac4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0x190], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe08]
call fcn.10018aee
mov dword [ebp - 0x33c], 0xc692
mov dword [ebp - 0x5b0], 0xc6338430
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x5a0], 0x16efa42b
mov dword [ebp - 0x2e8], 0x9253a34c
mov dword [ebp - 0xc38], 3
push 3
lea ecx, [ebp - 0xe18]
call fcn.10018a69
mov dword [ebp - 4], 5
mov dword [ebp - 0x5b8], 1
mov dword [ebp - 0x3d4], 0xec00
mov dword [ebp - 0xd68], 0xfffffff6
mov dword [ebp - 0xdd4], 0xca1d25f
mov dword [ebp - 0xc40], 0x79c0213a
mov dword [ebp - 0x2d8], 0
jmp 0x1000af04
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 3
jge 0x1000af26
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0xe18]
call fcn.10018b0a
mov dword [eax], 0xfffffffe
jmp 0x1000aef7
cmp dword [ebp - 0x33c], 0
je 0x1000b305
mov dword [ebp - 0xdf0], 0xb674
mov dword [ebp - 0x5a4], 0x82abbf9a
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0x3a4], 0xd81479b6
mov dword [ebp - 0xc44], 0xc1747346
mov dword [ebp - 0x1074], 0
mov dword [ebp - 0x204], 0
jmp 0x1000af88
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x1000afa4
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0xbf8], 0
jmp 0x1000af7b
mov eax, dword [ebp - 0xdf0]
mov dword [ebp - 0x107c], eax
mov dword [ebp - 0xb8], 0xb674
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1084], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x108c], eax
cmp dword [ebp - 0x2e8], 4
jl 0x1000afe7
mov dword [ebp - 0xdf8], 1
jmp 0x1000afee
and dword [ebp - 0xdf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbf8]
mov dword [ebp - 0x1094], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xcec], eax
mov eax, dword [ebp - 0x3d4]
dec eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0xcec], 0x4b72
jg 0x1000b032
mov dword [ebp - 0x548], 1
jmp 0x1000b039
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x5b0]
cmp eax, dword [ebp - 0x548]
jl 0x1000b053
mov dword [ebp - 0xacc], 1
jmp 0x1000b05a
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0xc44], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x2e8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbf8]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x10a4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbf8], 0xfffffffa
jl 0x1000b0ac
mov dword [ebp - 0x550], 1
jmp 0x1000b0b3
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x5a0]
cmp dword [ebp - 0x550], eax
jg 0x1000b0cd
mov dword [ebp - 0xad4], 1
jmp 0x1000b0d4
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0xad4]
sub eax, dword [ebp - 0x2e8]
je 0x1000b0fe
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbf8], 0
je 0x1000b0fe
mov dword [ebp - 0x558], 1
jmp 0x1000b105
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x558]
jg 0x1000b125
cmp dword [ebp - 0x3a4], 0
jne 0x1000b125
and dword [ebp - 0xadc], 0
jmp 0x1000b12f
mov dword [ebp - 0xadc], 1
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0xadc], eax
jle 0x1000b149
mov dword [ebp - 0x560], 1
jmp 0x1000b150
and dword [ebp - 0x560], 0
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x560], 0x5217
cmp dword [ebp + eax - 0xbf8], ecx
jge 0x1000b175
mov dword [ebp - 0xae4], 1
jmp 0x1000b17c
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x33c]
add eax, dword [ebp - 0xae4]
cmp eax, 0x230a264
jg 0x1000b19b
mov dword [ebp - 0xaec], 1
jmp 0x1000b1a2
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0xaec]
add eax, 0x2602a6c5
imul eax, eax, 0x9ea4
cmp eax, dword [ebp - 0x3a4]
jge 0x1000b291
mov dword [ebp - 0x2e0], 0xffff
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x2e0], eax
jl 0x1000b1ef
mov dword [ebp - 0x57c], 1
jmp 0x1000b1f6
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 0xca2
jle 0x1000b20e
mov dword [ebp - 0xc30], 1
jmp 0x1000b215
and dword [ebp - 0xc30], 0
cmp dword [ebp - 0x2e0], 0xfffffff8
jl 0x1000b22a
mov dword [ebp - 0xaa0], 1
jmp 0x1000b231
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0xd68]
cmp dword [ebp - 0xaa0], eax
jne 0x1000b24b
mov dword [ebp - 0x580], 1
jmp 0x1000b252
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x580], eax
jne 0x1000b26c
mov dword [ebp - 0x870], 1
jmp 0x1000b273
and dword [ebp - 0x870], 0
mov esi, dword [ebp - 0xc38]
imul esi, dword [ebp - 0x870]
push 1
lea ecx, [ebp - 0xe18]
call fcn.10018b0a
mov dword [eax], esi
jmp 0x1000b300
mov dword [ebp - 0xb8], 2
jmp 0x1000b2aa
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x1000b300
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x1000b2ec
push 0x1932
push 0
push 0xefd
push 0x683
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov eax, dword [ebp - 0xb8]
cmp dword [ebp + eax*4 - 0xbf8], 0
je 0x1000b2fe
jmp 0x1000b300
jmp 0x1000b29d
jmp 0x1000b4fb
push 3
lea ecx, [ebp - 0xbe0]
call fcn.10018a69
mov byte [ebp - 4], 6
mov dword [ebp - 0x880], 0xcc384641
mov dword [ebp - 0x20c], 0
jmp 0x1000b339
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jge 0x1000b35b
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xbe0]
call fcn.10018b0a
mov dword [eax], 5
jmp 0x1000b32c
mov eax, dword [ebp - 0xdd4]
cmp dword [ebp - 0x5b8], eax
jle 0x1000b375
mov dword [ebp - 0x588], 1
jmp 0x1000b37c
and dword [ebp - 0x588], 0
push 2
lea ecx, [ebp - 0xbe0]
call fcn.10018b0a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x588]
jl 0x1000b39f
mov dword [ebp - 0x9e8], 1
jmp 0x1000b3a6
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x9e8]
mov dword [ebp - 0x188], eax
mov esi, dword [ebp - 0x188]
push 2
lea ecx, [ebp - 0xbe0]
call fcn.10018b0a
add esi, dword [eax]
mov dword [ebp - 0x590], esi
push 1
lea ecx, [ebp - 0xe18]
call fcn.10018b0a
mov ecx, dword [ebp - 0x590]
mov dword [eax], ecx
mov eax, dword [ebp - 0x590]
sub eax, 0xffff
jne 0x1000b3fb
mov dword [ebp - 0x878], 1
jmp 0x1000b402
and dword [ebp - 0x878], 0
push 2
lea ecx, [ebp - 0xbe0]
call fcn.10018b0a
mov ecx, dword [ebp - 0x878]
sub ecx, dword [eax]
cmp ecx, 0xd3f149c9
je 0x1000b42b
mov dword [ebp - 0x598], 1
jmp 0x1000b432
and dword [ebp - 0x598], 0
push 0
lea ecx, [ebp - 0xbe0]
call fcn.10018b0a
mov ecx, dword [ebp - 0x598]
cmp ecx, dword [eax]
jg 0x1000b45b
mov eax, 0xabf2
test eax, eax
jne 0x1000b45b
and dword [ebp - 0xb00], 0
jmp 0x1000b465
mov dword [ebp - 0xb00], 1
imul eax, dword [ebp - 0xb00], 0x3fa0
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x5a0]
cmp dword [ebp - 0x880], eax
jge 0x1000b48f
mov dword [ebp - 0x5a8], 1
jmp 0x1000b496
and dword [ebp - 0x5a8], 0
imul eax, dword [ebp - 0x2e8], 0x6add
cmp eax, dword [ebp - 0x5a8]
jg 0x1000b4b4
mov dword [ebp - 0x9f0], 1
jmp 0x1000b4bb
and dword [ebp - 0x9f0], 0
cmp dword [ebp - 0x9f0], 0
ja 0x1000b4d9
cmp dword [ebp - 0x5b0], 0
je 0x1000b4d9
mov dword [ebp - 0x888], 1
jmp 0x1000b4e0
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0xc40], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbe0]
call fcn.10018aee
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0xaa8], eax
push 2
lea ecx, [ebp - 0xe18]
call fcn.10018b0a
mov ecx, dword [ebp - 0xaa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x188], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe18]
call fcn.10018aee
mov dword [ebp - 0x148], 0x68206240
mov dword [ebp - 0x148], 0xffffffeb
jmp 0x1000b55a
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xd
jle 0x1000b5d1
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x214], 0x19
jmp 0x1000b586
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xfffffff7
jg 0x1000b5cc
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1000b5ca
push 0x431
push 0
push 0
push 0x126e
push 0x2244
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
jmp 0x1000b579
jmp 0x1000b54d
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x3dc], 0xc692
mov dword [ebp - 0x620], 0xc6338430
mov dword [ebp - 0x178], 1
mov dword [ebp - 0x610], 0x16efa42b
mov dword [ebp - 0x300], 0x9253a34c
mov dword [ebp - 0xddc], 3
push 3
lea ecx, [ebp - 0xe28]
call fcn.10018a69
mov dword [ebp - 4], 7
mov dword [ebp - 0x628], 1
mov dword [ebp - 0x344], 0xec00
mov dword [ebp - 0xc58], 0xfffffff6
mov dword [ebp - 0xc60], 0xca1d25f
mov dword [ebp - 0xd6c], 0x79c0213a
mov dword [ebp - 0x2f0], 0
jmp 0x1000b678
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jge 0x1000b69a
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0xe28]
call fcn.10018b0a
mov dword [eax], 0xfffffffe
jmp 0x1000b66b
cmp dword [ebp - 0x3dc], 0
je 0x1000ba79
mov dword [ebp - 0xd5c], 0xb674
mov dword [ebp - 0x8a0], 0x82abbf9a
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0x34c], 0xd81479b6
mov dword [ebp - 0xc50], 0xc1747346
mov dword [ebp - 0x10ac], 0
mov dword [ebp - 0x21c], 0
jmp 0x1000b6fc
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 3
jge 0x1000b718
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0xbb0], 0
jmp 0x1000b6ef
mov eax, dword [ebp - 0xd5c]
mov dword [ebp - 0x10b4], eax
mov dword [ebp - 0xc8], 0xb674
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x10bc], eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x10c4], eax
cmp dword [ebp - 0x300], 4
jl 0x1000b75b
mov dword [ebp - 0xc48], 1
jmp 0x1000b762
and dword [ebp - 0xc48], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbb0]
mov dword [ebp - 0x10cc], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0xe2c], eax
mov eax, dword [ebp - 0x344]
dec eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0xe2c], 0x4b72
jg 0x1000b7a6
mov dword [ebp - 0x5c0], 1
jmp 0x1000b7ad
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x620]
cmp eax, dword [ebp - 0x5c0]
jl 0x1000b7c7
mov dword [ebp - 0x890], 1
jmp 0x1000b7ce
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x300], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbb0]
mov dword [ebp - 0x10d4], eax
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x10dc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbb0], 0xfffffffa
jl 0x1000b820
mov dword [ebp - 0x5c8], 1
jmp 0x1000b827
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x610]
cmp dword [ebp - 0x5c8], eax
jg 0x1000b841
mov dword [ebp - 0x9f8], 1
jmp 0x1000b848
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x9f8]
sub eax, dword [ebp - 0x300]
je 0x1000b872
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbb0], 0
je 0x1000b872
mov dword [ebp - 0x5d0], 1
jmp 0x1000b879
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x5d0]
jg 0x1000b899
cmp dword [ebp - 0x34c], 0
jne 0x1000b899
and dword [ebp - 0x898], 0
jmp 0x1000b8a3
mov dword [ebp - 0x898], 1
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x898], eax
jle 0x1000b8bd
mov dword [ebp - 0x5d8], 1
jmp 0x1000b8c4
and dword [ebp - 0x5d8], 0
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x5d8], 0x5217
cmp dword [ebp + eax - 0xbb0], ecx
jge 0x1000b8e9
mov dword [ebp - 0xb38], 1
jmp 0x1000b8f0
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0x3dc]
add eax, dword [ebp - 0xb38]
cmp eax, 0x230a264
jg 0x1000b90f
mov dword [ebp - 0x5e0], 1
jmp 0x1000b916
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
add eax, 0x2602a6c5
imul eax, eax, 0x9ea4
cmp eax, dword [ebp - 0x34c]
jge 0x1000ba05
mov dword [ebp - 0x2f8], 0xffff
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x2f8], eax
jl 0x1000b963
mov dword [ebp - 0x5e8], 1
jmp 0x1000b96a
and dword [ebp - 0x5e8], 0
cmp dword [ebp - 0x5e8], 0xca2
jle 0x1000b982
mov dword [ebp - 0xd64], 1
jmp 0x1000b989
and dword [ebp - 0xd64], 0
cmp dword [ebp - 0x2f8], 0xfffffff8
jl 0x1000b99e
mov dword [ebp - 0xa00], 1
jmp 0x1000b9a5
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0xc58]
cmp dword [ebp - 0xa00], eax
jne 0x1000b9bf
mov dword [ebp - 0x5f0], 1
jmp 0x1000b9c6
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x34c]
cmp dword [ebp - 0x5f0], eax
jne 0x1000b9e0
mov dword [ebp - 0x8a8], 1
jmp 0x1000b9e7
and dword [ebp - 0x8a8], 0
mov esi, dword [ebp - 0xddc]
imul esi, dword [ebp - 0x8a8]
push 1
lea ecx, [ebp - 0xe28]
call fcn.10018b0a
mov dword [eax], esi
jmp 0x1000ba74
mov dword [ebp - 0xc8], 2
jmp 0x1000ba1e
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x1000ba74
mov byte [ebp - 0x133], 0
movzx eax, byte [ebp - 0x133]
test eax, eax
je 0x1000ba60
push 0x1932
push 0
push 0xefd
push 0x683
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov eax, dword [ebp - 0xc8]
cmp dword [ebp + eax*4 - 0xbb0], 0
je 0x1000ba72
jmp 0x1000ba74
jmp 0x1000ba11
jmp 0x1000bc6f
push 3
lea ecx, [ebp - 0xbbc]
call fcn.10018a69
mov byte [ebp - 4], 8
mov dword [ebp - 0x8b8], 0xcc384641
mov dword [ebp - 0x224], 0
jmp 0x1000baad
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x1000bacf
push dword [ebp - 0x224]
lea ecx, [ebp - 0xbbc]
call fcn.10018b0a
mov dword [eax], 5
jmp 0x1000baa0
mov eax, dword [ebp - 0xc60]
cmp dword [ebp - 0x628], eax
jle 0x1000bae9
mov dword [ebp - 0x5f8], 1
jmp 0x1000baf0
and dword [ebp - 0x5f8], 0
push 2
lea ecx, [ebp - 0xbbc]
call fcn.10018b0a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5f8]
jl 0x1000bb13
mov dword [ebp - 0xab0], 1
jmp 0x1000bb1a
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0x178], eax
mov esi, dword [ebp - 0x178]
push 2
lea ecx, [ebp - 0xbbc]
call fcn.10018b0a
add esi, dword [eax]
mov dword [ebp - 0x600], esi
push 1
lea ecx, [ebp - 0xe28]
call fcn.10018b0a
mov ecx, dword [ebp - 0x600]
mov dword [eax], ecx
mov eax, dword [ebp - 0x600]
sub eax, 0xffff
jne 0x1000bb6f
mov dword [ebp - 0x8b0], 1
jmp 0x1000bb76
and dword [ebp - 0x8b0], 0
push 2
lea ecx, [ebp - 0xbbc]
call fcn.10018b0a
mov ecx, dword [ebp - 0x8b0]
sub ecx, dword [eax]
cmp ecx, 0xd3f149c9
je 0x1000bb9f
mov dword [ebp - 0x608], 1
jmp 0x1000bba6
and dword [ebp - 0x608], 0
push 0
lea ecx, [ebp - 0xbbc]
call fcn.10018b0a
mov ecx, dword [ebp - 0x608]
cmp ecx, dword [eax]
jg 0x1000bbcf
mov eax, 0xabf2
test eax, eax
jne 0x1000bbcf
and dword [ebp - 0xa08], 0
jmp 0x1000bbd9
mov dword [ebp - 0xa08], 1
imul eax, dword [ebp - 0xa08], 0x3fa0
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x610]
cmp dword [ebp - 0x8b8], eax
jge 0x1000bc03
mov dword [ebp - 0x618], 1
jmp 0x1000bc0a
and dword [ebp - 0x618], 0
imul eax, dword [ebp - 0x300], 0x6add
cmp eax, dword [ebp - 0x618]
jg 0x1000bc28
mov dword [ebp - 0xb0c], 1
jmp 0x1000bc2f
and dword [ebp - 0xb0c], 0
cmp dword [ebp - 0xb0c], 0
ja 0x1000bc4d
cmp dword [ebp - 0x620], 0
je 0x1000bc4d
mov dword [ebp - 0x8c0], 1
jmp 0x1000bc54
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0xd6c], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xbbc]
call fcn.10018aee
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0xa10], eax
push 2
lea ecx, [ebp - 0xe28]
call fcn.10018b0a
mov ecx, dword [ebp - 0xa10]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0x178], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe28]
call fcn.10018aee
mov dword [ebp - 0x16c], 0x68206240
mov dword [ebp - 0x16c], 0xffffffeb
jmp 0x1000bcce
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xd
jle 0x1000bd45
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x22c], 0x19
jmp 0x1000bcfa
mov eax, dword [ebp - 0x22c]
dec eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xfffffff7
jg 0x1000bd40
mov byte [ebp - 0x13b], 0
movzx eax, byte [ebp - 0x13b]
test eax, eax
je 0x1000bd3e
push 0x431
push 0
push 0
push 0x126e
push 0x2244
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
jmp 0x1000bced
jmp 0x1000bcc1
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x308], 0xfffffffa
mov dword [ebp - 0x10e4], 0xd8530de9
mov dword [ebp - 0x630], 1
mov dword [ebp - 0x308], 0xfffffff6
jmp 0x1000bd88
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0x1c
jne 0x1000bde3
mov dword [ebp - 0x310], 0x59e57ad9
mov dword [ebp - 0x310], 0
jmp 0x1000bdb4
mov eax, dword [ebp - 0x310]
dec eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0xffffffe4
je 0x1000bde1
mov dword [ebp - 0x3ac], 0xc3a0b8ee
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x10ec], eax
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x3ac], eax
jmp 0x1000bda7
jmp 0x1000bd7b
mov eax, dword [ebp - 0x630]
dec eax
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x154], 0x68206240
mov dword [ebp - 0x154], 0xffffffeb
jmp 0x1000be13
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xd
jle 0x1000be8a
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2ac], 0x19
jmp 0x1000be3f
mov eax, dword [ebp - 0x2ac]
dec eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0xfffffff7
jg 0x1000be85
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1000be83
push 0x431
push 0
push 0
push 0x126e
push 0x2244
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
jmp 0x1000be32
jmp 0x1000be06
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0xa4], 0xc45cdbe8
mov dword [ebp - 0x10f4], 0x7c04
mov dword [ebp - 0x10fc], 0xfffffffb
mov dword [ebp - 0x23c], 0
jmp 0x1000becd
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x1000bee9
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0x12b4], 0
jmp 0x1000bec0
mov dword [ebp - 0xa4], 1
jmp 0x1000bf02
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x1000bf61
mov dword [ebp - 0xc68], 0xb99
cmp dword [ebp - 0xc68], 0
je 0x1000bf20
jmp 0x1000bf61
mov byte [ebp - 0x13f], 0
movzx eax, byte [ebp - 0x13f]
test eax, eax
je 0x1000bf5f
push 0x1bb8
push 0x694
push 0x1908
push 0x8f6
push 0x45a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x1000bef5
mov dword [ebp - 0xa4], 1
jmp 0x1000bf7a
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x1000c056
mov dword [ebp - 0x1104], 0xcc5d9b4e
mov dword [ebp - 0x110c], 0xf545ee28
mov dword [ebp - 0x1114], 0x3cfce294
mov dword [ebp - 0x111c], 0x23e93d0b
mov dword [ebp - 0x1124], 1
push 3
lea ecx, [ebp - 0x11d4]
call fcn.10018a69
mov dword [ebp - 4], 9
mov dword [ebp - 0x8c8], 0x756fd8c6
mov dword [ebp - 0x304], 0
jmp 0x1000bff0
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 3
jge 0x1000c00f
push dword [ebp - 0x304]
lea ecx, [ebp - 0x11d4]
call fcn.10018b0a
and dword [eax], 0
jmp 0x1000bfe3
mov eax, dword [ebp - 0x8c8]
inc eax
mov dword [ebp - 0x8c8], eax
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1000c042
push 0
push 0x953
push 0x1c45
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11d4]
call fcn.10018aee
jmp 0x1000bf6d
mov dword [ebp - 0x244], 0xfffffffa
mov dword [ebp - 0x112c], 0xd8530de9
mov dword [ebp - 0x638], 1
mov dword [ebp - 0x244], 0xfffffff6
jmp 0x1000c08d
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x1c
jne 0x1000c0e8
mov dword [ebp - 0x2b4], 0x59e57ad9
mov dword [ebp - 0x2b4], 0
jmp 0x1000c0b9
mov eax, dword [ebp - 0x2b4]
dec eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0xffffffe4
je 0x1000c0e6
mov dword [ebp - 0x354], 0xc3a0b8ee
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x1134], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x354], eax
jmp 0x1000c0ac
jmp 0x1000c080
mov eax, dword [ebp - 0x638]
dec eax
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x17c], 1
mov dword [ebp - 0xc70], 0x65ab3e90
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x1000c12f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x17c], 0
jmp 0x1000c148
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x16
jne 0x1000c174
mov dword [ebp - 0xe6c], 0xfffa
mov eax, dword [ebp - 0xe6c]
mov dword [ebp - 0xc70], eax
cmp dword [ebp - 0x17c], 0
je 0x1000c172
jmp 0x1000c13b
jmp 0x1000c13b
mov dword [ebp - 0x24c], 0xfffffffa
mov dword [ebp - 0x113c], 0xd8530de9
mov dword [ebp - 0xab8], 1
mov dword [ebp - 0x24c], 0xfffffff6
jmp 0x1000c1ab
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x1c
jne 0x1000c206
mov dword [ebp - 0x2ec], 0x59e57ad9
mov dword [ebp - 0x2ec], 0
jmp 0x1000c1d7
mov eax, dword [ebp - 0x2ec]
dec eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0xffffffe4
je 0x1000c204
mov dword [ebp - 0x3e4], 0xc3a0b8ee
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x1144], eax
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x3e4], eax
jmp 0x1000c1ca
jmp 0x1000c19e
mov eax, dword [ebp - 0xab8]
dec eax
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0xd74], 0x112def90
mov dword [ebp - 0x254], 0
jmp 0x1000c23d
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 1
jge 0x1000c259
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0xe8], 0x4a6847df
jmp 0x1000c230
mov dword [ebp - 0x28], 0
jmp 0x1000c269
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1000c399
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xe8], 0xfffff4a8
jl 0x1000c28f
mov dword [ebp - 0x640], 1
jmp 0x1000c296
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xe8]
cmp dword [ebp - 0x640], eax
jg 0x1000c2b4
mov dword [ebp - 0x8d0], 1
jmp 0x1000c2bb
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xe8]
cmp dword [ebp - 0x8d0], eax
je 0x1000c2d9
mov dword [ebp - 0x648], 1
jmp 0x1000c2e0
and dword [ebp - 0x648], 0
push 0xfffffffffffffffc
pop eax
sub eax, dword [ebp - 0x648]
cmp eax, 0x2703d9b9
jl 0x1000c2fc
mov dword [ebp - 0xa18], 1
jmp 0x1000c303
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0xe8]
imul ecx, dword [ebp - 0xa18]
cmp dword [ebp + eax*4 - 0xe8], ecx
jne 0x1000c336
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xe8], 0
jne 0x1000c336
and dword [ebp - 0x650], 0
jmp 0x1000c340
mov dword [ebp - 0x650], 1
cmp dword [ebp - 0x650], 0
ja 0x1000c355
mov dword [ebp - 0x8d8], 1
jmp 0x1000c35c
and dword [ebp - 0x8d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8]
cmp dword [ebp - 0x8d8], eax
jl 0x1000c381
xor eax, eax
je 0x1000c381
mov dword [ebp - 0x658], 1
jmp 0x1000c388
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0xd74], eax
jmp 0x1000c262
mov dword [ebp - 0x28], 0
jmp 0x1000c3a9
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff2
jle 0x1000c3cb
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1000c3c9
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000c3a2
mov dword [ebp - 0xa8], 0xc45cdbe8
mov dword [ebp - 0x114c], 0x7c04
mov dword [ebp - 0x1154], 0xfffffffb
mov dword [ebp - 0x2bc], 0
jmp 0x1000c402
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 2
jge 0x1000c41e
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x12cc], 0
jmp 0x1000c3f5
mov dword [ebp - 0xa8], 1
jmp 0x1000c437
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1000c496
mov dword [ebp - 0xc78], 0xb99
cmp dword [ebp - 0xc78], 0
je 0x1000c455
jmp 0x1000c496
mov byte [ebp - 0x137], 0
movzx eax, byte [ebp - 0x137]
test eax, eax
je 0x1000c494
push 0x1bb8
push 0x694
push 0x1908
push 0x8f6
push 0x45a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x1000c42a
mov dword [ebp - 0xa8], 1
jmp 0x1000c4af
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1000c58b
mov dword [ebp - 0x115c], 0xcc5d9b4e
mov dword [ebp - 0x1164], 0xf545ee28
mov dword [ebp - 0x116c], 0x3cfce294
mov dword [ebp - 0x1174], 0x23e93d0b
mov dword [ebp - 0x117c], 1
push 3
lea ecx, [ebp - 0x11e4]
call fcn.10018a69
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xb50], 0x756fd8c6
mov dword [ebp - 0x25c], 0
jmp 0x1000c525
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 3
jge 0x1000c544
push dword [ebp - 0x25c]
lea ecx, [ebp - 0x11e4]
call fcn.10018b0a
and dword [eax], 0
jmp 0x1000c518
mov eax, dword [ebp - 0xb50]
inc eax
mov dword [ebp - 0xb50], eax
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1000c577
push 0
push 0x953
push 0x1c45
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11e4]
call fcn.10018aee
jmp 0x1000c4a2
mov dword [ebp - 0xc0], 0xcea5d6c0
mov dword [ebp - 0x900], 0x38991f32
mov dword [ebp - 0x1184], 0x61fa46b4
mov dword [ebp - 0x118c], 0x6e1851aa
mov dword [ebp - 0xc0], 0
jmp 0x1000c5cc
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffe9
jle 0x1000cd4b
push 1
lea ecx, [ebp - 0xb8c]
call fcn.10018a69
mov dword [ebp - 4], 0xb
push 1
lea ecx, [ebp - 0x424]
call fcn.10018a69
mov byte [ebp - 4], 0xc
push 2
lea ecx, [ebp - 0xbd4]
call fcn.10018a69
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x40], 0
jmp 0x1000c61f
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1000c63b
push dword [ebp - 0x40]
lea ecx, [ebp - 0xb8c]
call fcn.10018b0a
mov dword [eax], 0xeede0b40
jmp 0x1000c618
mov dword [ebp - 0x40], 0
jmp 0x1000c64b
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1000c667
push dword [ebp - 0x40]
lea ecx, [ebp - 0x424]
call fcn.10018b0a
mov dword [eax], 0x307d
jmp 0x1000c644
mov dword [ebp - 0x40], 0
jmp 0x1000c677
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1000c693
push dword [ebp - 0x40]
lea ecx, [ebp - 0xbd4]
call fcn.10018b0a
mov dword [eax], 1
jmp 0x1000c670
push 0
lea ecx, [ebp - 0xb8c]
call fcn.10018b0a
and dword [eax], 0
jmp 0x1000c6c9
push 0
lea ecx, [ebp - 0xb8c]
call fcn.10018b0a
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x660]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x660]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb8c]
call fcn.10018b0a
cmp dword [eax], 0xfffffff9
jne 0x1000cd19
push 1
lea ecx, [ebp - 0xb64]
call fcn.10018a69
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xac0], 0xfffffffc
mov dword [ebp - 0xc80], 0xffffffff
mov dword [ebp - 0xd7c], 0x4b05ef13
push 2
lea ecx, [ebp - 0xf68]
call fcn.10018a69
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x35c], 0xffffffff
mov dword [ebp - 0x84], 0
jmp 0x1000c742
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1000c761
push dword [ebp - 0x84]
lea ecx, [ebp - 0xb64]
call fcn.10018b0a
or dword [eax], 0xffffffff
jmp 0x1000c735
mov dword [ebp - 0x84], 0
jmp 0x1000c77a
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1000c79c
push dword [ebp - 0x84]
lea ecx, [ebp - 0xf68]
call fcn.10018b0a
mov dword [eax], 0xf6679856
jmp 0x1000c76d
push 0
lea ecx, [ebp - 0xb64]
call fcn.10018b0a
mov dword [eax], 0xffffffe2
jmp 0x1000c7d5
push 0
lea ecx, [ebp - 0xb64]
call fcn.10018b0a
cmp dword [eax], 0xffffffe9
jg 0x1000ccf6
mov dword [ebp - 0x30], 0xb844a754
mov dword [ebp - 0xb18], 0xffffffff
push 1
lea ecx, [ebp - 0xef0]
call fcn.10018a69
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x314], 0
jmp 0x1000c826
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 1
jge 0x1000c848
push dword [ebp - 0x314]
lea ecx, [ebp - 0xef0]
call fcn.10018b0a
mov dword [eax], 0xcc425f8e
jmp 0x1000c819
mov dword [ebp - 0x30], 0
jmp 0x1000c858
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1000ca75
push dword [ebp - 0x30]
lea ecx, [ebp - 0x424]
call fcn.10018b0a
cmp dword [eax], 0
je 0x1000c9e9
mov dword [ebp - 0xde4], 0xb42be197
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0x1194], eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x424]
call fcn.10018b0a
cmp dword [eax], 0
jne 0x1000c955
push dword [ebp - 0x30]
lea ecx, [ebp - 0x424]
call fcn.10018b0a
cmp dword [eax], 0
je 0x1000c8ce
cmp dword [ebp - 0xde4], 0
je 0x1000c8ce
mov dword [ebp - 0x668], 1
jmp 0x1000c8d5
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0xc80]
add eax, dword [ebp - 0x668]
cmp eax, 0xdab5
jge 0x1000c8f4
mov dword [ebp - 0xa20], 1
jmp 0x1000c8fb
and dword [ebp - 0xa20], 0
cmp dword [ebp - 0xa20], 0xa4c82104
jne 0x1000c913
mov dword [ebp - 0x670], 1
jmp 0x1000c91a
and dword [ebp - 0x670], 0
push 0
lea ecx, [ebp - 0x424]
call fcn.10018b0a
mov ecx, dword [ebp - 0x670]
cmp ecx, dword [eax]
je 0x1000c93a
cmp dword [ebp - 0xc0], 0
je 0x1000c94c
push 0
lea ecx, [ebp - 0xb8c]
call fcn.10018b0a
cmp dword [eax], 0
jne 0x1000c955
and dword [ebp - 0x8e8], 0
jmp 0x1000c95f
mov dword [ebp - 0x8e8], 1
cmp dword [ebp - 0x8e8], 0x6619
je 0x1000c977
mov dword [ebp - 0x678], 1
jmp 0x1000c97e
and dword [ebp - 0x678], 0
mov esi, dword [ebp - 0x678]
add esi, 0xe696
push 0
lea ecx, [ebp - 0xb8c]
call fcn.10018b0a
cmp esi, dword [eax]
je 0x1000c9a7
mov dword [ebp - 0x680], 1
jmp 0x1000c9ae
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0xac0]
cmp dword [ebp - 0x680], eax
jl 0x1000c9c8
mov dword [ebp - 0x8f0], 1
jmp 0x1000c9cf
and dword [ebp - 0x8f0], 0
push 1
lea ecx, [ebp - 0xbd4]
call fcn.10018b0a
mov ecx, dword [ebp - 0x8f0]
mov dword [eax], ecx
jmp 0x1000ca70
push dword [ebp - 0x30]
lea ecx, [ebp - 0x424]
call fcn.10018b0a
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x424]
call fcn.10018b0a
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1000ca19
mov dword [ebp - 0x688], 1
jmp 0x1000ca20
and dword [ebp - 0x688], 0
cmp dword [ebp - 0xc0], 0x6d7d
jle 0x1000ca38
mov dword [ebp - 0xa28], 1
jmp 0x1000ca3f
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x688]
cmp eax, dword [ebp - 0xa28]
jne 0x1000ca5d
mov dword [ebp - 0x690], 1
jmp 0x1000ca64
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0xd7c], eax
jmp 0x1000c851
push 0
lea ecx, [ebp - 0xb64]
call fcn.10018b0a
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x30]
push 0
lea ecx, [ebp - 0xb64]
call fcn.10018b0a
imul esi, dword [eax]
mov dword [ebp - 0x900], esi
cmp dword [ebp - 0xc0], 0
jle 0x1000cab5
mov dword [ebp - 0x8f8], 1
jmp 0x1000cabc
and dword [ebp - 0x8f8], 0
mov esi, dword [ebp - 0x30]
push 0
lea ecx, [ebp - 0xb64]
call fcn.10018b0a
sub esi, dword [eax]
jne 0x1000cae2
mov eax, 0x412f
test eax, eax
jne 0x1000cae2
and dword [ebp - 0x698], 0
jmp 0x1000caec
mov dword [ebp - 0x698], 1
mov eax, dword [ebp - 0x8f8]
cmp eax, dword [ebp - 0x698]
jge 0x1000cb06
mov dword [ebp - 0xc88], 1
jmp 0x1000cb0d
and dword [ebp - 0xc88], 0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xe3c], eax
mov eax, dword [ebp - 0x35c]
dec eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0xe3c], 6
jl 0x1000cb47
mov dword [ebp - 0x6a0], 1
jmp 0x1000cb4e
and dword [ebp - 0x6a0], 0
push 1
lea ecx, [ebp - 0xbd4]
call fcn.10018b0a
mov ecx, dword [ebp - 0x6a0]
cmp ecx, dword [eax]
jne 0x1000cb71
mov dword [ebp - 0x6a8], 1
jmp 0x1000cb78
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x900]
cmp dword [ebp - 0x6a8], eax
je 0x1000cb92
mov dword [ebp - 0xa30], 1
jmp 0x1000cb99
and dword [ebp - 0xa30], 0
cmp dword [ebp - 0xa30], 0xf3e63d4d
jb 0x1000cbb1
mov dword [ebp - 0x6b0], 1
jmp 0x1000cbb8
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x6b0]
sub eax, 0x4b91bf52
je 0x1000cbda
mov eax, 0x9de
test eax, eax
je 0x1000cbda
mov dword [ebp - 0x908], 1
jmp 0x1000cbe1
and dword [ebp - 0x908], 0
cmp dword [ebp - 0x908], 0xcbaba27f
ja 0x1000cbf9
mov dword [ebp - 0x6b8], 1
jmp 0x1000cc00
and dword [ebp - 0x6b8], 0
push 0
lea ecx, [ebp - 0xef0]
call fcn.10018b0a
mov ecx, dword [ebp - 0x6b8]
cmp ecx, dword [eax]
je 0x1000cc23
mov dword [ebp - 0xac8], 1
jmp 0x1000cc2a
and dword [ebp - 0xac8], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xac8], eax
jle 0x1000cc44
mov dword [ebp - 0x6c0], 1
jmp 0x1000cc4b
and dword [ebp - 0x6c0], 0
imul eax, dword [ebp - 0x6c0], 3
test eax, eax
jne 0x1000cc65
cmp dword [ebp - 0x30], 0
jne 0x1000cc65
and dword [ebp - 0x910], 0
jmp 0x1000cc6f
mov dword [ebp - 0x910], 1
push 0
lea ecx, [ebp - 0xbd4]
call fcn.10018b0a
mov ecx, dword [ebp - 0x910]
cmp ecx, dword [eax]
jge 0x1000cc92
mov dword [ebp - 0x3b4], 1
jmp 0x1000cc99
and dword [ebp - 0x3b4], 0
push 0
lea ecx, [ebp - 0xf68]
call fcn.10018b0a
mov ecx, dword [ebp - 0x3b4]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0xef0]
call fcn.10018b0a
mov esi, dword [ebp - 0x3b4]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x424]
call fcn.10018b0a
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0xbd4]
call fcn.10018b0a
mov dword [eax], esi
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xef0]
call fcn.10018aee
jmp 0x1000c7b1
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xf68]
call fcn.10018aee
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xb64]
call fcn.10018aee
jmp 0x1000c6a5
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xbd4]
call fcn.10018aee
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x424]
call fcn.10018aee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8c]
call fcn.10018aee
jmp 0x1000c5bf
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1000cd73
push 0x238a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
mov dword [ebp - 0xac], 0xc45cdbe8
mov dword [ebp - 0x119c], 0x7c04
mov dword [ebp - 0x11a4], 0xfffffffb
mov dword [ebp - 0x264], 0
jmp 0x1000cdaa
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 2
jge 0x1000cdc6
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0x12f4], 0
jmp 0x1000cd9d
mov dword [ebp - 0xac], 1
jmp 0x1000cddf
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x1000ce3e
mov dword [ebp - 0xc90], 0xb99
cmp dword [ebp - 0xc90], 0
je 0x1000cdfd
jmp 0x1000ce3e
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x1000ce3c
push 0x1bb8
push 0x694
push 0x1908
push 0x8f6
push 0x45a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x1000cdd2
mov dword [ebp - 0xac], 1
jmp 0x1000ce57
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x1000cf33
mov dword [ebp - 0x11ac], 0xcc5d9b4e
mov dword [ebp - 0x11b4], 0xf545ee28
mov dword [ebp - 0x11bc], 0x3cfce294
mov dword [ebp - 0x11c4], 0x23e93d0b
mov dword [ebp - 0x1294], 1
push 3
lea ecx, [ebp - 0x11f4]
call fcn.10018a69
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x6c8], 0x756fd8c6
mov dword [ebp - 0x2c4], 0
jmp 0x1000cecd
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 3
jge 0x1000ceec
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0x11f4]
call fcn.10018b0a
and dword [eax], 0
jmp 0x1000cec0
mov eax, dword [ebp - 0x6c8]
inc eax
mov dword [ebp - 0x6c8], eax
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x1000cf1f
push 0
push 0x953
push 0x1c45
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11f4]
call fcn.10018aee
jmp 0x1000ce4a
movzx eax, byte [0x10680250]
test eax, eax
je 0x1000cf51
mov esi, 0x1009465c
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1001226f
mov dword [ebp - 0x6c], 0xfffffff7
mov dword [ebp - 0x6d0], 0xd91509cf
push 1
lea ecx, [ebp - 0xe38]
call fcn.10018a69
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x6e0], 0x4255ebda
mov dword [ebp - 0xdec], 0x58a6
mov dword [ebp - 0xca0], 0x7f59ec13
mov dword [ebp - 0x26c], 0
jmp 0x1000cfad
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1000cfcc
push dword [ebp - 0x26c]
lea ecx, [ebp - 0xe38]
call fcn.10018b0a
or dword [eax], 0xffffffff
jmp 0x1000cfa0
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x6c]
je 0x1000cfe3
mov dword [ebp - 0xa38], 1
jmp 0x1000cfea
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0xa38]
mov dword [ebp - 0x6d0], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1260], eax
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x1020], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xf80], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1198], eax
mov eax, 0xfb0b44cf
cmp eax, 0x758e92ed
jb 0x1000d035
mov dword [ebp - 0x918], 1
jmp 0x1000d03c
and dword [ebp - 0x918], 0
cmp dword [ebp - 0x918], 3
jbe 0x1000d051
mov dword [ebp - 0x6d8], 1
jmp 0x1000d058
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6d8], eax
jle 0x1000d06f
mov dword [ebp - 0x364], 1
jmp 0x1000d076
and dword [ebp - 0x364], 0
push 0
lea ecx, [ebp - 0xe38]
call fcn.10018b0a
mov ecx, dword [ebp - 0x364]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x364], eax
jne 0x1000d0a2
mov dword [ebp - 0xd84], 1
jmp 0x1000d0a9
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xf88], eax
push 0
lea ecx, [ebp - 0xe38]
call fcn.10018b0a
cmp dword [eax], 0x1a82e77e
jl 0x1000d0d3
mov dword [ebp - 0xb40], 1
jmp 0x1000d0da
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0xb40]
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x6e0]
cmp dword [ebp - 0x6c], eax
jg 0x1000d0fd
mov dword [ebp - 0xc98], 1
jmp 0x1000d104
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0xdec]
mov dword [ebp - 0x10f8], eax
push 0
lea ecx, [ebp - 0xe38]
call fcn.10018b0a
mov eax, dword [eax]
mov dword [ebp - 0xca0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe38]
call fcn.10018aee
mov dword [ebp - 0x184], 1
mov dword [ebp - 0xca8], 0x65ab3e90
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1000d16e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x184], 0
jmp 0x1000d187
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x16
jne 0x1000d1b3
mov dword [ebp - 0xd8c], 0xfffa
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0xca8], eax
cmp dword [ebp - 0x184], 0
je 0x1000d1b1
jmp 0x1000d17a
jmp 0x1000d17a
mov dword [ebp - 0x3e0], 0xfffffff7
mov dword [ebp - 0xb4], 0xffffffff
mov dword [ebp - 0x164], 0xbd2ab60e
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xf38], 0xfffffff9
mov dword [ebp - 0xf34], 0xfffffff9
mov dword [ebp - 0xf30], 0xfffffff9
mov dword [ebp - 0xf2c], 0xfffffff9
lea ecx, [ebp - 0x3cd]
call fcn.10009523
push eax
lea eax, [ebp - 0xf28]
push eax
lea eax, [ebp - 0xf38]
push eax
lea ecx, [ebp - 0x12d4]
call fcn.10018b19
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe48]
call fcn.10018ac8
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xcb0], 1
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xf90], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x125c], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xf98], eax
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0xf0], eax
jg 0x1000d293
mov dword [ebp - 0x920], 1
jmp 0x1000d29a
and dword [ebp - 0x920], 0
cmp dword [ebp - 0x920], 0x4b5a
jge 0x1000d2b2
mov dword [ebp - 0xe8c], 1
jmp 0x1000d2b9
and dword [ebp - 0xe8c], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x1100], eax
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0xb4], eax
je 0x1000d2df
mov dword [ebp - 0x6e8], 1
jmp 0x1000d2e6
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
sub eax, 0x2057
cmp dword [ebp - 0xb4], eax
jl 0x1000d311
mov dword [ebp - 0xa40], 1
jmp 0x1000d318
and dword [ebp - 0xa40], 0
cmp dword [ebp - 0xa40], 0xb79d
jg 0x1000d336
cmp dword [ebp - 0xf0], 0
jne 0x1000d336
and dword [ebp - 0x6f0], 0
jmp 0x1000d340
mov dword [ebp - 0x6f0], 1
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x6f0], eax
jne 0x1000d360
cmp dword [ebp - 0xf0], 0
jne 0x1000d360
and dword [ebp - 0x928], 0
jmp 0x1000d36a
mov dword [ebp - 0x928], 1
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x928], eax
jg 0x1000d384
mov dword [ebp - 0x6f8], 1
jmp 0x1000d38b
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
sub eax, dword [ebp - 0x164]
jne 0x1000d3ab
cmp dword [ebp - 0xf0], 0
jne 0x1000d3ab
and dword [ebp - 0xad0], 0
jmp 0x1000d3b5
mov dword [ebp - 0xad0], 1
push 3
lea ecx, [ebp - 0xe48]
call fcn.10018b0a
mov ecx, dword [ebp - 0xad0]
cmp ecx, dword [eax]
jg 0x1000d3d8
mov dword [ebp - 0x700], 1
jmp 0x1000d3df
and dword [ebp - 0x700], 0
push 3
lea ecx, [ebp - 0xe48]
call fcn.10018b0a
mov ecx, dword [ebp - 0x700]
add ecx, dword [eax]
cmp ecx, 0x84365721
jne 0x1000d411
cmp dword [ebp - 0x164], 0
je 0x1000d411
mov dword [ebp - 0x930], 1
jmp 0x1000d418
and dword [ebp - 0x930], 0
push 2
lea ecx, [ebp - 0xe48]
call fcn.10018b0a
mov ecx, dword [ebp - 0x930]
cmp ecx, dword [eax]
jl 0x1000d43b
mov dword [ebp - 0x708], 1
jmp 0x1000d442
and dword [ebp - 0x708], 0
push 1
lea ecx, [ebp - 0xe48]
call fcn.10018b0a
mov ecx, dword [ebp - 0x708]
cmp ecx, dword [eax]
jl 0x1000d465
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret