Function at 0x10009869
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008a0a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf54
push esi
push edi
mov dword [ebp - 0x2c], 0xdb22124f
mov dword [ebp - 0x1a4], 0xf86f25db
mov dword [ebp - 0x390], 0
mov dword [ebp - 0xadc], 0x7cdd5376
mov dword [ebp - 0x278], 0
jmp 0x100098c7
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jge 0x100098e3
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0x36c], 0xb56411d7
jmp 0x100098ba
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x100098fb
push 2
pop eax
test eax, eax
jne 0x100098fb
and dword [ebp - 0x8ec], 0
jmp 0x10009905
mov dword [ebp - 0x8ec], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x8ec], eax
jne 0x1000991c
mov dword [ebp - 0x920], 1
jmp 0x10009923
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
sub eax, 0xd
cmp eax, 0x1afa9b64
jle 0x1000993f
mov dword [ebp - 0x928], 1
jmp 0x10009946
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x928]
jl 0x1000995d
mov dword [ebp - 0x9fc], 1
jmp 0x10009964
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe5c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jne 0x10009981
mov dword [ebp - 0xacc], 1
jmp 0x10009988
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xdf8], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x2c], eax
jle 0x100099a8
mov dword [ebp - 0x930], 1
jmp 0x100099af
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x930]
jge 0x100099c6
mov dword [ebp - 0x938], 1
jmp 0x100099cd
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x938]
sub eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x1a4]
jl 0x100099ed
mov dword [ebp - 0x940], 1
jmp 0x100099f4
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x940]
jl 0x10009a0b
mov dword [ebp - 0x948], 1
jmp 0x10009a12
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x948], eax
je 0x10009a29
mov dword [ebp - 0x950], 1
jmp 0x10009a30
and dword [ebp - 0x950], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x950]
mov dword [ebp + eax - 0x36c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe14], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x36c], 0
jne 0x10009a65
cmp dword [ebp - 0x1a4], 0
je 0x10009a78
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10009a78
mov dword [ebp - 0x958], 1
jmp 0x10009a7f
and dword [ebp - 0x958], 0
cmp dword [ebp - 0x958], 0xfff6
jae 0x10009a97
mov dword [ebp - 0x960], 1
jmp 0x10009a9e
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x390]
cmp dword [ebp - 0x960], eax
jne 0x10009ab8
mov dword [ebp - 0x968], 1
jmp 0x10009abf
and dword [ebp - 0x968], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x36c]
cmp dword [ebp - 0x968], eax
jl 0x10009ae0
mov dword [ebp - 0xad4], 1
jmp 0x10009ae7
and dword [ebp - 0xad4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x36c]
mov dword [ebp - 0xe00], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x36c]
mov dword [ebp - 0xe1c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x36c], 0
cmp dword [ebp - 0x2c], 1
je 0x10009b2d
mov dword [ebp - 0x970], 1
jmp 0x10009b34
and dword [ebp - 0x970], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x36c]
cmp eax, dword [ebp - 0x970]
jle 0x10009b55
mov dword [ebp - 0x760], 1
jmp 0x10009b5c
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x760], eax
jge 0x10009b76
mov dword [ebp - 0x388], 1
jmp 0x10009b7d
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x388], eax
jge 0x10009b94
mov dword [ebp - 0x768], 1
jmp 0x10009b9b
and dword [ebp - 0x768], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x36c]
cmp dword [ebp - 0x768], eax
jge 0x10009bbc
mov dword [ebp - 0x770], 1
jmp 0x10009bc3
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x390]
cmp dword [ebp - 0x770], eax
jne 0x10009bdd
mov dword [ebp - 0x2a4], 1
jmp 0x10009be4
and dword [ebp - 0x2a4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp + eax - 0x36c], ecx
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0x28], 0xdb22124f
mov dword [ebp - 0x188], 0xf86f25db
mov dword [ebp - 0x7b0], 0
mov dword [ebp - 0xb08], 0x7cdd5376
mov dword [ebp - 0x280], 0
jmp 0x10009c41
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jge 0x10009c5d
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0x354], 0xb56411d7
jmp 0x10009c34
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x10009c75
push 2
pop eax
test eax, eax
jne 0x10009c75
and dword [ebp - 0x398], 0
jmp 0x10009c7f
mov dword [ebp - 0x398], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x398], eax
jne 0x10009c96
mov dword [ebp - 0x778], 1
jmp 0x10009c9d
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
sub eax, 0xd
cmp eax, 0x1afa9b64
jle 0x10009cb9
mov dword [ebp - 0x3a0], 1
jmp 0x10009cc0
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x3a0]
jl 0x10009cd7
mov dword [ebp - 0xae4], 1
jmp 0x10009cde
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xe08], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jne 0x10009cfb
mov dword [ebp - 0xaec], 1
jmp 0x10009d02
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xe24], eax
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x28], eax
jle 0x10009d22
mov dword [ebp - 0x780], 1
jmp 0x10009d29
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x780]
jge 0x10009d40
mov dword [ebp - 0x3a8], 1
jmp 0x10009d47
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
sub eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0x188]
jl 0x10009d67
mov dword [ebp - 0x788], 1
jmp 0x10009d6e
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x788]
jl 0x10009d85
mov dword [ebp - 0x3b0], 1
jmp 0x10009d8c
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x3b0], eax
je 0x10009da3
mov dword [ebp - 0x790], 1
jmp 0x10009daa
and dword [ebp - 0x790], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x790]
mov dword [ebp + eax - 0x354], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xe18], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x354], 0
jne 0x10009ddf
cmp dword [ebp - 0x188], 0
je 0x10009df2
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10009df2
mov dword [ebp - 0x3b8], 1
jmp 0x10009df9
and dword [ebp - 0x3b8], 0
cmp dword [ebp - 0x3b8], 0xfff6
jae 0x10009e11
mov dword [ebp - 0x798], 1
jmp 0x10009e18
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x7b0]
cmp dword [ebp - 0x798], eax
jne 0x10009e32
mov dword [ebp - 0x3c0], 1
jmp 0x10009e39
and dword [ebp - 0x3c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
cmp dword [ebp - 0x3c0], eax
jl 0x10009e5a
mov dword [ebp - 0xb00], 1
jmp 0x10009e61
and dword [ebp - 0xb00], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
mov dword [ebp - 0xe80], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
mov dword [ebp - 0xe20], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x354], 0
cmp dword [ebp - 0x28], 1
je 0x10009ea7
mov dword [ebp - 0x7a0], 1
jmp 0x10009eae
and dword [ebp - 0x7a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
cmp eax, dword [ebp - 0x7a0]
jle 0x10009ecf
mov dword [ebp - 0x3c8], 1
jmp 0x10009ed6
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x3c8], eax
jge 0x10009ef0
mov dword [ebp - 0x7a8], 1
jmp 0x10009ef7
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x7a8], eax
jge 0x10009f0e
mov dword [ebp - 0x3d0], 1
jmp 0x10009f15
and dword [ebp - 0x3d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
cmp dword [ebp - 0x3d0], eax
jge 0x10009f36
mov dword [ebp - 0x3d8], 1
jmp 0x10009f3d
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x7b0]
cmp dword [ebp - 0x3d8], eax
jne 0x10009f57
mov dword [ebp - 0x32c], 1
jmp 0x10009f5e
and dword [ebp - 0x32c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x32c]
mov dword [ebp + eax - 0x354], ecx
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x180], 0
jmp 0x10009fa0
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xfffffff1
jg 0x10009ff5
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x10009fe8
push 0x2636
push 0x1dc3
push 0x230f
push 0x2599
push 0x68f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
cmp dword [ebp - 0x180], 0
je 0x10009ff3
jmp 0x10009f93
jmp 0x10009f93
mov dword [ebp - 0xe4], 0x5540d7f8
mov dword [ebp - 0x7c0], 0xffffffff
mov dword [ebp - 0x3f0], 0x8039d6b9
push 3
lea ecx, [ebp - 0xd08]
call fcn.10016d5e
and dword [ebp - 4], 0
mov dword [ebp - 0xb10], 0xbec5
mov dword [ebp - 0xb18], 0x3c86
mov dword [ebp - 0x58], 0
jmp 0x1000a048
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1000a05e
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x154], 0x73ff82f
jmp 0x1000a041
mov dword [ebp - 0x58], 0
jmp 0x1000a06e
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1000a08a
push dword [ebp - 0x58]
lea ecx, [ebp - 0xd08]
call fcn.10016dfc
mov dword [eax], 0x1ec2184e
jmp 0x1000a067
mov dword [ebp - 0xe4], 3
jmp 0x1000a0a3
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xfffffff8
jg 0x1000a0d4
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x1000a0d2
push 0
push 0x211e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x1000a096
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0xee4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x154], 0
je 0x1000a12d
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xe4], eax
jle 0x1000a111
mov dword [ebp - 0x7b8], 1
jmp 0x1000a118
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 0
je 0x1000a12d
mov dword [ebp - 0x3e0], 1
jmp 0x1000a134
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x7c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
cmp eax, dword [ebp - 0x7c0]
jg 0x1000a16d
mov dword [ebp - 0x3e8], 1
jmp 0x1000a174
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 0xffff
jne 0x1000a18c
mov dword [ebp - 0x7c8], 1
jmp 0x1000a193
and dword [ebp - 0x7c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
imul eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x7d0], eax
push 1
lea ecx, [ebp - 0xd08]
call fcn.10016dfc
mov ecx, dword [ebp - 0x7d0]
mov dword [eax], ecx
cmp dword [ebp - 0x7d0], 0
jne 0x1000a1e3
mov dword [ebp - 0x3f8], 1
jmp 0x1000a1ea
and dword [ebp - 0x3f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
cmp dword [ebp - 0x3f8], eax
jl 0x1000a20b
mov dword [ebp - 0x7d8], 1
jmp 0x1000a212
and dword [ebp - 0x7d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
sub eax, dword [ebp - 0x7d8]
je 0x1000a23c
cmp dword [ebp - 0xb10], 0
je 0x1000a23c
mov dword [ebp - 0x400], 1
jmp 0x1000a243
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0xb18], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd08]
call fcn.10016de0
mov dword [ebp - 0x30], 0xdb22124f
mov dword [ebp - 0x198], 0xf86f25db
mov dword [ebp - 0x440], 0
mov dword [ebp - 0xb38], 0x7cdd5376
mov dword [ebp - 0x258], 0
jmp 0x1000a29c
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x1000a2b8
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x360], 0xb56411d7
jmp 0x1000a28f
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1000a2d0
push 2
pop eax
test eax, eax
jne 0x1000a2d0
and dword [ebp - 0x7e0], 0
jmp 0x1000a2da
mov dword [ebp - 0x7e0], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x7e0], eax
jne 0x1000a2f1
mov dword [ebp - 0x408], 1
jmp 0x1000a2f8
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
sub eax, 0xd
cmp eax, 0x1afa9b64
jle 0x1000a314
mov dword [ebp - 0x7e8], 1
jmp 0x1000a31b
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x7e8]
jl 0x1000a332
mov dword [ebp - 0xb20], 1
jmp 0x1000a339
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xe28], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jne 0x1000a356
mov dword [ebp - 0xb28], 1
jmp 0x1000a35d
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xe88], eax
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x30], eax
jle 0x1000a37d
mov dword [ebp - 0x410], 1
jmp 0x1000a384
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x410]
jge 0x1000a39b
mov dword [ebp - 0x7f0], 1
jmp 0x1000a3a2
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x7f0]
sub eax, dword [ebp - 0x198]
cmp eax, dword [ebp - 0x198]
jl 0x1000a3c2
mov dword [ebp - 0x418], 1
jmp 0x1000a3c9
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x418]
jl 0x1000a3e0
mov dword [ebp - 0x7f8], 1
jmp 0x1000a3e7
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x7f8], eax
je 0x1000a3fe
mov dword [ebp - 0x420], 1
jmp 0x1000a405
and dword [ebp - 0x420], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x420]
mov dword [ebp + eax - 0x360], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xd58], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x360], 0
jne 0x1000a43a
cmp dword [ebp - 0x198], 0
je 0x1000a44d
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1000a44d
mov dword [ebp - 0x800], 1
jmp 0x1000a454
and dword [ebp - 0x800], 0
cmp dword [ebp - 0x800], 0xfff6
jae 0x1000a46c
mov dword [ebp - 0x428], 1
jmp 0x1000a473
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x440]
cmp dword [ebp - 0x428], eax
jne 0x1000a48d
mov dword [ebp - 0x808], 1
jmp 0x1000a494
and dword [ebp - 0x808], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x360]
cmp dword [ebp - 0x808], eax
jl 0x1000a4b5
mov dword [ebp - 0xb30], 1
jmp 0x1000a4bc
and dword [ebp - 0xb30], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x360]
mov dword [ebp - 0xd5c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x360]
mov dword [ebp - 0xd64], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x360], 0
cmp dword [ebp - 0x30], 1
je 0x1000a502
mov dword [ebp - 0x430], 1
jmp 0x1000a509
and dword [ebp - 0x430], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x360]
cmp eax, dword [ebp - 0x430]
jle 0x1000a52a
mov dword [ebp - 0x810], 1
jmp 0x1000a531
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x810], eax
jge 0x1000a54b
mov dword [ebp - 0x438], 1
jmp 0x1000a552
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x438], eax
jge 0x1000a569
mov dword [ebp - 0x818], 1
jmp 0x1000a570
and dword [ebp - 0x818], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x360]
cmp dword [ebp - 0x818], eax
jge 0x1000a591
mov dword [ebp - 0x820], 1
jmp 0x1000a598
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x440]
cmp dword [ebp - 0x820], eax
jne 0x1000a5b2
mov dword [ebp - 0x334], 1
jmp 0x1000a5b9
and dword [ebp - 0x334], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x334]
mov dword [ebp + eax - 0x360], ecx
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0x50], 0x8a1f9496
mov dword [ebp - 0x33c], 1
mov dword [ebp - 0x328], 0xa05d
mov dword [ebp - 0x2ac], 8
mov dword [ebp - 0x460], 0x6084edc0
mov dword [ebp - 0x470], 0xf7c2f5a2
push 3
lea ecx, [ebp - 0xd20]
call fcn.10016d5e
mov dword [ebp - 4], 1
mov dword [ebp - 0x1b4], 0
jmp 0x1000a63e
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x1000a65d
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0xd20]
call fcn.10016dfc
or dword [eax], 0xffffffff
jmp 0x1000a631
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xd6c], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
je 0x1000a67a
mov dword [ebp - 0x448], 1
jmp 0x1000a681
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x448], eax
jge 0x1000a69e
cmp dword [ebp - 0x50], 0
je 0x1000a69e
mov dword [ebp - 0x828], 1
jmp 0x1000a6a5
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x828]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0xd74], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xd7c], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x33c], eax
je 0x1000a6dd
mov dword [ebp - 0x450], 1
jmp 0x1000a6e4
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x450], eax
jne 0x1000a6fe
mov dword [ebp - 0x830], 1
jmp 0x1000a705
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x2ac], eax
jl 0x1000a72b
mov dword [ebp - 0x458], 1
jmp 0x1000a732
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x458]
jne 0x1000a74f
mov eax, 0x721f
test eax, eax
jne 0x1000a74f
and dword [ebp - 0x838], 0
jmp 0x1000a759
mov dword [ebp - 0x838], 1
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x460], eax
jle 0x1000a781
xor eax, eax
inc eax
je 0x1000a781
mov dword [ebp - 0x840], 1
jmp 0x1000a788
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x840], eax
jl 0x1000a79f
mov dword [ebp - 0x468], 1
jmp 0x1000a7a6
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x468], eax
jne 0x1000a7bd
mov dword [ebp - 0xb40], 1
jmp 0x1000a7c4
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0xd84], eax
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x50], eax
jl 0x1000a7e7
mov dword [ebp - 0x848], 1
jmp 0x1000a7ee
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x470], eax
push 2
lea ecx, [ebp - 0xd20]
call fcn.10016dfc
mov eax, dword [eax]
mov dword [ebp - 0x470], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd20]
call fcn.10016de0
mov dword [ebp - 0x54], 0x8a1f9496
mov dword [ebp - 0x310], 1
mov dword [ebp - 0x2b4], 0xa05d
mov dword [ebp - 0x304], 8
mov dword [ebp - 0x868], 0x6084edc0
mov dword [ebp - 0x8a8], 0xf7c2f5a2
push 3
lea ecx, [ebp - 0xd38]
call fcn.10016d5e
mov dword [ebp - 4], 2
mov dword [ebp - 0x260], 0
jmp 0x1000a884
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x1000a8a3
push dword [ebp - 0x260]
lea ecx, [ebp - 0xd38]
call fcn.10016dfc
or dword [eax], 0xffffffff
jmp 0x1000a877
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
je 0x1000a8c0
mov dword [ebp - 0x850], 1
jmp 0x1000a8c7
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x850], eax
jge 0x1000a8e4
cmp dword [ebp - 0x54], 0
je 0x1000a8e4
mov dword [ebp - 0x478], 1
jmp 0x1000a8eb
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x310], eax
je 0x1000a923
mov dword [ebp - 0x858], 1
jmp 0x1000a92a
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x858], eax
jne 0x1000a944
mov dword [ebp - 0x480], 1
jmp 0x1000a94b
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x304], eax
jl 0x1000a971
mov dword [ebp - 0x860], 1
jmp 0x1000a978
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x860]
jne 0x1000a995
mov eax, 0x721f
test eax, eax
jne 0x1000a995
and dword [ebp - 0x488], 0
jmp 0x1000a99f
mov dword [ebp - 0x488], 1
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x868], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x868], eax
jle 0x1000a9c7
xor eax, eax
inc eax
je 0x1000a9c7
mov dword [ebp - 0x490], 1
jmp 0x1000a9ce
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x490], eax
jl 0x1000a9e5
mov dword [ebp - 0x870], 1
jmp 0x1000a9ec
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x870], eax
jne 0x1000aa03
mov dword [ebp - 0xb48], 1
jmp 0x1000aa0a
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0xda4], eax
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0x54], eax
jl 0x1000aa2d
mov dword [ebp - 0x498], 1
jmp 0x1000aa34
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x8a8], eax
push 2
lea ecx, [ebp - 0xd38]
call fcn.10016dfc
mov eax, dword [eax]
mov dword [ebp - 0x8a8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd38]
call fcn.10016de0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x1bc], 0
jmp 0x1000aa87
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x1000aaa3
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xf54], 2
jmp 0x1000aa7a
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x1000aac1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x268], 2
jmp 0x1000aada
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jl 0x1000ab69
mov dword [ebp - 0x270], 0x86cce57b
mov dword [ebp - 0x270], 2
jmp 0x1000ab0a
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jl 0x1000ab36
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1000ab34
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
jmp 0x1000aafd
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x1000ab64
push 0
push 0x1f36
push 0x1f78
push 0xc74
push 0x1e27
call dword [sym.imp.GDI32.dll_CreateBitmap]
jmp 0x1000aacd
mov dword [ebp - 0x4c], 0x8a1f9496
mov dword [ebp - 0x2bc], 1
mov dword [ebp - 0x314], 0xa05d
mov dword [ebp - 0x2c4], 8
mov dword [ebp - 0x4b8], 0x6084edc0
mov dword [ebp - 0x4c8], 0xf7c2f5a2
push 3
lea ecx, [ebp - 0xd44]
call fcn.10016d5e
mov dword [ebp - 4], 3
mov dword [ebp - 0x284], 0
jmp 0x1000abcf
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jge 0x1000abee
push dword [ebp - 0x284]
lea ecx, [ebp - 0xd44]
call fcn.10016dfc
or dword [eax], 0xffffffff
jmp 0x1000abc2
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
je 0x1000ac0b
mov dword [ebp - 0x4a0], 1
jmp 0x1000ac12
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4a0], eax
jge 0x1000ac2f
cmp dword [ebp - 0x4c], 0
je 0x1000ac2f
mov dword [ebp - 0x8b0], 1
jmp 0x1000ac36
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0xdb4], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xdbc], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x2bc], eax
je 0x1000ac6e
mov dword [ebp - 0x4a8], 1
jmp 0x1000ac75
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0x4a8], eax
jne 0x1000ac8f
mov dword [ebp - 0x8b8], 1
jmp 0x1000ac96
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0x2c4], eax
jl 0x1000acbc
mov dword [ebp - 0x4b0], 1
jmp 0x1000acc3
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4b0]
jne 0x1000ace0
mov eax, 0x721f
test eax, eax
jne 0x1000ace0
and dword [ebp - 0x8c0], 0
jmp 0x1000acea
mov dword [ebp - 0x8c0], 1
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4b8], eax
jle 0x1000ad12
xor eax, eax
inc eax
je 0x1000ad12
mov dword [ebp - 0x8c8], 1
jmp 0x1000ad19
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x8c8], eax
jl 0x1000ad30
mov dword [ebp - 0x4c0], 1
jmp 0x1000ad37
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c0], eax
jne 0x1000ad4e
mov dword [ebp - 0xb50], 1
jmp 0x1000ad55
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0xdc4], eax
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x4c], eax
jl 0x1000ad78
mov dword [ebp - 0x8d0], 1
jmp 0x1000ad7f
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x4c8], eax
push 2
lea ecx, [ebp - 0xd44]
call fcn.10016dfc
mov eax, dword [eax]
mov dword [ebp - 0x4c8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd44]
call fcn.10016de0
mov dword [ebp - 0x18], 0xac64a684
mov dword [ebp - 0x234], 5
mov dword [ebp - 0x18], 0x1b
jmp 0x1000add0
cmp dword [ebp - 0x18], 0xfffffff5
jge 0x1000b0ce
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0xc00], 7
mov dword [ebp - 0xbfc], 7
mov dword [ebp - 0xbf8], 7
mov dword [ebp - 0xbf4], 7
mov dword [ebp - 0x2cc], 0x4ed25e42
mov dword [ebp - 0xb68], 0xd31fc531
mov dword [ebp - 0x1d4], 0
jmp 0x1000ae39
cmp dword [ebp - 0x1d4], 1
jge 0x1000ae55
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x8c], 0x4f9dbc9b
jmp 0x1000ae2c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xdcc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8c], 0
je 0x1000ae8a
mov dword [ebp - 0x18], 0xd
jmp 0x1000b0de
cmp dword [ebp - 0x18], 0x14
jge 0x1000b110
mov dword [ebp - 0xb70], 0x9d693ce8
mov dword [ebp - 0xb78], 0x278539ae
mov dword [ebp - 0x234], 1
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0xb78], eax
jmp 0x1000b0d7
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x1dc], 0
jmp 0x1000b133