Function at 0x10009014
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100782e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x122c
call fcn.10060670
push esi
push edi
mov dword [ebp - 0xc4], 0xbf34fda0
mov dword [ebp - 0xa8], 0x708ef6b8
mov dword [ebp - 0x78], 0
jmp 0x1000905c
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x10009072
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xee0], 0xe164caf
jmp 0x10009055
mov dword [ebp - 0x78], 0
jmp 0x10009082
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10009098
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xfb4], 0xe790e864
jmp 0x1000907b
cmp dword [ebp - 0xc4], 0xfffffffe
jbe 0x100090ad
mov dword [ebp - 0x524], 1
jmp 0x100090b4
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x524]
jle 0x100090ce
mov dword [ebp - 0x97c], 1
jmp 0x100090d5
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x97c]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xc4], 0
jmp 0x10009100
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jg 0x1000917f
mov dword [ebp - 0x984], 0xffff
mov dword [ebp - 0xa8], 0
jmp 0x1000912c
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x10009144
mov eax, dword [ebp - 0x984]
dec eax
mov dword [ebp - 0x984], eax
jmp 0x1000911f
mov dword [ebp - 0xa8], 1
jmp 0x1000915d
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1000917a
mov eax, dword [ebp - 0xc4]
cmp dword [ebp + eax*4 - 0xfb4], 0
je 0x10009178
jmp 0x1000917a
jmp 0x10009150
jmp 0x100090f3
mov dword [ebp - 0xc8], 0xbf34fda0
mov dword [ebp - 0xbc], 0x708ef6b8
mov dword [ebp - 0x80], 0
jmp 0x100091a3
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x100091b9
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xf80], 0xe164caf
jmp 0x1000919c
mov dword [ebp - 0x80], 0
jmp 0x100091c9
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x100091df
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1090], 0xe790e864
jmp 0x100091c2
cmp dword [ebp - 0xc8], 0xfffffffe
jbe 0x100091f4
mov dword [ebp - 0x98c], 1
jmp 0x100091fb
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x98c]
jle 0x10009215
mov dword [ebp - 0x9f0], 1
jmp 0x1000921c
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0x9f0]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc8], 0
jmp 0x10009247
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jg 0x100092c6
mov dword [ebp - 0x9f8], 0xffff
mov dword [ebp - 0xbc], 0
jmp 0x10009273
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x1000928b
mov eax, dword [ebp - 0x9f8]
dec eax
mov dword [ebp - 0x9f8], eax
jmp 0x10009266
mov dword [ebp - 0xbc], 1
jmp 0x100092a4
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x100092c1
mov eax, dword [ebp - 0xc8]
cmp dword [ebp + eax*4 - 0x1090], 0
je 0x100092bf
jmp 0x100092c1
jmp 0x10009297
jmp 0x1000923a
mov dword [ebp - 0x54], 0x69fdf99f
mov dword [ebp - 0xcd4], 2
mov dword [ebp - 0xcd0], 2
mov dword [ebp - 0xccc], 2
mov dword [ebp - 0xcc8], 2
lea ecx, [ebp - 0x3a1]
call fcn.10008dd3
push eax
lea eax, [ebp - 0xcc4]
push eax
lea eax, [ebp - 0xcd4]
push eax
lea ecx, [ebp - 0x11e8]
call fcn.10015e3b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdf4]
call fcn.10015e01
and dword [ebp - 4], 0
mov dword [ebp - 0x54], 4
jmp 0x1000933e
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffff2
jle 0x1000954a
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x18], 3
jmp 0x1000935f
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10009427
push 2
lea ecx, [ebp - 0xb60]
call fcn.10015dbf
mov byte [ebp - 4], 1
mov dword [ebp - 0x25c], 0
jmp 0x10009393
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 2
jge 0x100093b5
push dword [ebp - 0x25c]
lea ecx, [ebp - 0xb60]
call fcn.10015e2c
mov dword [eax], 3
jmp 0x10009386
push 1
lea ecx, [ebp - 0xb60]
call fcn.10015e2c
and dword [eax], 0
jmp 0x100093eb
push 1
lea ecx, [ebp - 0xb60]
call fcn.10015e2c
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp - 0xa00]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa00]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb60]
call fcn.10015e2c
cmp dword [eax], 3
jg 0x10009413
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdf4]
call fcn.10015e2c
mov dword [eax], 0x92c5eb20
jmp 0x100093c7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb60]
call fcn.10015e27
jmp 0x10009358
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
jge 0x1000943b
mov dword [ebp - 0xa08], 1
jmp 0x10009442
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xa08], eax
jl 0x1000945f
cmp dword [ebp - 0x54], 0
je 0x1000945f
mov dword [ebp - 0xa10], 1
jmp 0x10009466
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xa10]
jl 0x1000947d
mov dword [ebp - 0xa18], 1
jmp 0x10009484
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0xa18]
shl eax, 2
cmp dword [ebp - 0x54], eax
jle 0x1000949e
mov dword [ebp - 0xa20], 1
jmp 0x100094a5
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0xa20]
jne 0x100094bf
cmp dword [ebp - 0x18], 0
jne 0x100094bf
and dword [ebp - 0xa28], 0
jmp 0x100094c9
mov dword [ebp - 0xa28], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xa28]
lea ecx, [edx + ecx + 3]
imul eax, ecx
cmp eax, dword [ebp - 0x54]
jl 0x100094ed
mov dword [ebp - 0xa04], 1
jmp 0x100094f4
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xa04], eax
jg 0x1000950b
mov dword [ebp - 0x8c0], 1
jmp 0x10009512
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x8c0], eax
jle 0x10009529
mov dword [ebp - 0x424], 1
jmp 0x10009530
and dword [ebp - 0x424], 0
push 2
lea ecx, [ebp - 0xdf4]
call fcn.10015e2c
mov ecx, dword [ebp - 0x424]
mov dword [eax], ecx
jmp 0x10009337
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf4]
call fcn.10015e27
push 3
lea ecx, [ebp - 0xe0c]
call fcn.10015dbf
mov dword [ebp - 4], 2
mov dword [ebp - 0x18c], 0xfffffff8
mov dword [ebp - 0x1fc], 0
jmp 0x10009590
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x100095b2
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0xe0c]
call fcn.10015e2c
mov dword [eax], 9
jmp 0x10009583
mov dword [ebp - 0x18c], 2
jmp 0x100095cb
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jl 0x1000960f
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x100095f5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 0x18c]
lea ecx, [ebp - 0xe0c]
call fcn.10015e2c
cmp dword [eax], 0
je 0x1000960d
jmp 0x1000960f
jmp 0x100095be
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0c]
call fcn.10015e27
mov dword [ebp - 0x168], 4
push 3
lea ecx, [ebp - 0xb70]
call fcn.10015dbf
mov dword [ebp - 4], 3
mov dword [ebp - 0xa64], 0x84eb300a
mov dword [ebp - 0x2b4], 0
jmp 0x1000965f
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 3
jge 0x10009681
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0xb70]
call fcn.10015e2c
mov dword [eax], 0x86e871d9
jmp 0x10009652
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x100096a9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov dword [ebp - 0x168], 0x14
jmp 0x100096c2
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x10
jne 0x100098c3
mov dword [ebp - 0x138], 0xe1ca2961
mov dword [ebp - 0x37c], 0xe44142b9
mov dword [ebp - 0x138], 0
jmp 0x100096fc
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jg 0x100098be
mov dword [ebp - 0x14c], 0xffffffff
mov dword [ebp - 0x14c], 0
jmp 0x1000972c
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jg 0x100098b9
mov dword [ebp - 0x328], 0x478c9dff
push dword [ebp - 0x138]
lea ecx, [ebp - 0xb70]
call fcn.10015e2c
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x1074], eax
mov dword [ebp - 0x37c], 0x9c7c6f1f
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x37c], eax
je 0x10009793
push 2
lea ecx, [ebp - 0xb70]
call fcn.10015e2c
cmp dword [eax], 0
jne 0x10009793
and dword [ebp - 0x8fc], 0
jmp 0x1000979d
mov dword [ebp - 0x8fc], 1
push dword [ebp - 0x138]
lea ecx, [ebp - 0xb70]
call fcn.10015e2c
mov ecx, dword [ebp - 0x8fc]
cmp ecx, dword [eax]
jge 0x100097c4
mov dword [ebp - 0x42c], 1
jmp 0x100097cb
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
inc eax
cmp eax, dword [ebp - 0x138]
jge 0x100097e6
mov dword [ebp - 0x904], 1
jmp 0x100097ed
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x168], 0xdc6d
je 0x10009811
mov dword [ebp - 0x90c], 1
jmp 0x10009818
and dword [ebp - 0x90c], 0
xor eax, eax
inc eax
je 0x10009832
cmp dword [ebp - 0x37c], 0
je 0x10009832
mov dword [ebp - 0x434], 1
jmp 0x10009839
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
sub eax, dword [ebp - 0x328]
imul eax, dword [ebp - 0x90c]
inc eax
inc eax
cmp eax, 5
jne 0x1000985f
mov dword [ebp - 0x43c], 1
jmp 0x10009866
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x43c], eax
jl 0x10009880
mov dword [ebp - 0x914], 1
jmp 0x10009887
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x328]
cmp eax, dword [ebp - 0x914]
jg 0x100098a1
mov dword [ebp - 0x444], 1
jmp 0x100098a8
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0xa64], eax
jmp 0x1000971f
jmp 0x100096ef
jmp 0x100096b5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb70]
call fcn.10015e27
mov dword [ebp - 0xcc], 0xbf34fda0
mov dword [ebp - 0x158], 0xb110c93b
mov dword [ebp - 0xa60], 0xfffffffa
mov dword [ebp - 0xa5c], 0xfffffffa
mov dword [ebp - 0xa58], 0xfffffffa
mov dword [ebp - 0xa54], 0xfffffffa
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x158], 0
jmp 0x10009931
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x1b
jle 0x10009bca
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xac8], 0xe9942c3b
mov dword [ebp - 0xad0], 0x1361131e
mov dword [ebp - 0x204], 0
jmp 0x10009972
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x1000998e
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x113c], 0
jmp 0x10009965
mov dword [ebp - 0x14], 3
jmp 0x1000999e
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10009bc5
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x14], eax
jge 0x100099bf
mov dword [ebp - 0x91c], 1
jmp 0x100099c6
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x91c], eax
je 0x100099dd
mov dword [ebp - 0x44c], 1
jmp 0x100099e4
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x924], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x924]
mov dword [ebp + eax - 0x113c], ecx
cmp dword [ebp - 0x924], 4
jl 0x10009a22
mov dword [ebp - 0x454], 1
jmp 0x10009a29
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
shl eax, 2
cmp eax, 0x4da8
jle 0x10009a45
mov dword [ebp - 0x92c], 1
jmp 0x10009a4c
and dword [ebp - 0x92c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa60]
imul ecx, dword [ebp - 0x92c], 0x8777
push 4
pop edx
imul edx, edx, 3
add ecx, dword [ebp + edx - 0xa60]
sub eax, ecx
cmp dword [ebp - 0x158], eax
jne 0x10009a86
mov dword [ebp - 0xac0], 1
jmp 0x10009a8d
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf88], eax
cmp dword [ebp - 0x14], 0x3efc
jne 0x10009aab
mov dword [ebp - 0x45c], 1
jmp 0x10009ab2
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa60]
cmp dword [ebp - 0x45c], eax
jg 0x10009ad9
mov eax, 0x423cb8e0
test eax, eax
je 0x10009ad9
mov dword [ebp - 0x934], 1
jmp 0x10009ae0
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0xac8]
cmp dword [ebp - 0x934], eax
je 0x10009afa
mov dword [ebp - 0x464], 1
jmp 0x10009b01
and dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 0xfffffffd
jge 0x10009b16
mov dword [ebp - 0x93c], 1
jmp 0x10009b1d
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x93c], eax
jne 0x10009b34
mov dword [ebp - 0x46c], 1
jmp 0x10009b3b
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa60]
cmp eax, dword [ebp - 0x46c]
jg 0x10009b59
mov dword [ebp - 0x944], 1
jmp 0x10009b60
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x944]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0x846c
jl 0x10009b84
mov dword [ebp - 0x94c], 1
jmp 0x10009b8b
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa60]
add eax, dword [ebp - 0x94c]
mov dword [ebp - 0xad0], eax
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x10009bc0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x10009997
jmp 0x10009924
mov dword [ebp - 0x64], 0x708ef6b8
mov dword [ebp - 0x1cc], 0x90c4d8e5
mov dword [ebp - 0x47c], 0xfffffffb
mov dword [ebp - 0x264], 0
jmp 0x10009bfe
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 2
jge 0x10009c1a
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0xfc0], 1
jmp 0x10009bf1
mov dword [ebp - 0x1cc], 1
jmp 0x10009c33
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jl 0x10009cb6
push 3
lea ecx, [ebp - 0xff8]
call fcn.10015dbf
mov dword [ebp - 4], 4
mov dword [ebp - 0x10c8], 0xfffffffc
mov dword [ebp - 0x20c], 0
jmp 0x10009c73
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jge 0x10009c95
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xff8]
call fcn.10015e2c
mov dword [eax], 9
jmp 0x10009c66
mov eax, dword [ebp - 0x47c]
dec eax
mov dword [ebp - 0x47c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xff8]
call fcn.10015e27
jmp 0x10009c26
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfc0]
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x88], 0
jmp 0x10009ce2
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x10009cfe
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xf90], 0xe164caf
jmp 0x10009cd5
mov dword [ebp - 0x88], 0
jmp 0x10009d17
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x10009d33
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x10f4], 0xe790e864
jmp 0x10009d0a
cmp dword [ebp - 0xcc], 0xfffffffe
jbe 0x10009d48
mov dword [ebp - 0x954], 1
jmp 0x10009d4f
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x954]
jle 0x10009d69
mov dword [ebp - 0x484], 1
jmp 0x10009d70
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0x484]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xcc], 0
jmp 0x10009d98
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jg 0x10009dfc
mov dword [ebp - 0x95c], 0xffff
mov dword [ebp - 0x64], 0
jmp 0x10009dbb
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x10009dd0
mov eax, dword [ebp - 0x95c]
dec eax
mov dword [ebp - 0x95c], eax
jmp 0x10009db4
mov dword [ebp - 0x64], 1
jmp 0x10009de0
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x10009dfa
mov eax, dword [ebp - 0xcc]
cmp dword [ebp + eax*4 - 0x10f4], 0
je 0x10009df8
jmp 0x10009dfa
jmp 0x10009dd9
jmp 0x10009d8b
mov dword [ebp - 0x178], 0xffffffff
push 3
lea ecx, [ebp - 0xc28]
call fcn.10015dbf
mov dword [ebp - 4], 5
mov dword [ebp - 0xb0], 0
jmp 0x10009e33
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x10009e4f
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0xc10], 1
jmp 0x10009e26
mov dword [ebp - 0xb0], 0
jmp 0x10009e68
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x10009e87
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xc28]
call fcn.10015e2c
and dword [eax], 0
jmp 0x10009e5b
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xc10]
cmp dword [ebp + eax - 0xc10], ecx
jne 0x10009eae
mov dword [ebp - 0x48c], 1
jmp 0x10009eb5
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x964], eax
push 0
lea ecx, [ebp - 0xc28]
call fcn.10015e2c
mov ecx, dword [ebp - 0x964]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc10]
cmp dword [ebp - 0x964], eax
jne 0x10009f30
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc10], 0xffffffff
jle 0x10009f12
mov dword [ebp - 0x494], 1
jmp 0x10009f19
and dword [ebp - 0x494], 0
push 1
lea ecx, [ebp - 0xc28]
call fcn.10015e2c
mov ecx, dword [ebp - 0x494]
mov dword [eax], ecx
jmp 0x10009f94
mov dword [ebp - 0xad8], 0x652d0da0
mov dword [ebp - 0x178], 8
jmp 0x10009f53
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xfffffffa
je 0x10009f69
cmp dword [ebp - 0xad8], 0
je 0x10009f67
jmp 0x10009f69
jmp 0x10009f46
mov byte [ebp - 0x13c], 0
movzx eax, byte [ebp - 0x13c]
test eax, eax
je 0x10009f94
push 0
push 0x8f5
push 0x1741
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc28]
call fcn.10015e27
mov dword [ebp - 0x5c], 0x69fdf99f
mov dword [ebp - 0xd74], 2
mov dword [ebp - 0xd70], 2
mov dword [ebp - 0xd6c], 2
mov dword [ebp - 0xd68], 2
lea ecx, [ebp - 0x2fd]
call fcn.10008dd3
push eax
lea eax, [ebp - 0xd64]
push eax
lea eax, [ebp - 0xd74]
push eax
lea ecx, [ebp - 0x11b0]
call fcn.10015e3b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe24]
call fcn.10015e01
mov dword [ebp - 4], 6
mov dword [ebp - 0x5c], 4
jmp 0x1000a01e
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffff2
jle 0x1000a22a
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x1c], 3
jmp 0x1000a03f
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1000a107
push 2
lea ecx, [ebp - 0xb80]
call fcn.10015dbf
mov byte [ebp - 4], 7
mov dword [ebp - 0x294], 0
jmp 0x1000a073
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 2
jge 0x1000a095
push dword [ebp - 0x294]
lea ecx, [ebp - 0xb80]
call fcn.10015e2c
mov dword [eax], 3
jmp 0x1000a066
push 1
lea ecx, [ebp - 0xb80]
call fcn.10015e2c
and dword [eax], 0
jmp 0x1000a0cb
push 1
lea ecx, [ebp - 0xb80]
call fcn.10015e2c
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0x96c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x96c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb80]
call fcn.10015e2c
cmp dword [eax], 3
jg 0x1000a0f3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe24]
call fcn.10015e2c
mov dword [eax], 0x92c5eb20
jmp 0x1000a0a7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb80]
call fcn.10015e27
jmp 0x1000a038
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], eax
jge 0x1000a11b
mov dword [ebp - 0x974], 1
jmp 0x1000a122
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x974], eax
jl 0x1000a13f
cmp dword [ebp - 0x5c], 0
je 0x1000a13f
mov dword [ebp - 0x4a0], 1
jmp 0x1000a146
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x4a0]
jl 0x1000a15d
mov dword [ebp - 0x764], 1
jmp 0x1000a164
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x764]
shl eax, 2
cmp dword [ebp - 0x5c], eax
jle 0x1000a17e
mov dword [ebp - 0x4a8], 1
jmp 0x1000a185
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x4a8]
jne 0x1000a19f
cmp dword [ebp - 0x1c], 0
jne 0x1000a19f
and dword [ebp - 0x768], 0
jmp 0x1000a1a9
mov dword [ebp - 0x768], 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x768]
lea ecx, [edx + ecx + 3]
imul eax, ecx
cmp eax, dword [ebp - 0x5c]
jl 0x1000a1cd
mov dword [ebp - 0x4b0], 1
jmp 0x1000a1d4
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4b0], eax
jg 0x1000a1eb
mov dword [ebp - 0x970], 1
jmp 0x1000a1f2
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x970], eax
jle 0x1000a209
mov dword [ebp - 0x4b8], 1
jmp 0x1000a210
and dword [ebp - 0x4b8], 0
push 2
lea ecx, [ebp - 0xe24]
call fcn.10015e2c
mov ecx, dword [ebp - 0x4b8]
mov dword [eax], ecx
jmp 0x1000a017
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe24]
call fcn.10015e27
mov dword [ebp - 0x148], 0xd4e06482
mov dword [ebp - 0x194], 0xffffffff
mov dword [ebp - 0x214], 0
jmp 0x1000a266
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 2
jge 0x1000a282
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0xfcc], 0xffffffff
jmp 0x1000a259
mov dword [ebp - 0x148], 0x17
jmp 0x1000a29b
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 5
je 0x1000a54d
mov dword [ebp - 0xdc], 0x6d4f2887
mov dword [ebp - 0xb00], 0xad0d7276
mov dword [ebp - 0x26c], 0
jmp 0x1000a2d5
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x1000a2f1
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x998], 0xe446df3
jmp 0x1000a2c8
mov dword [ebp - 0xdc], 1
jmp 0x1000a30a
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x1000a548
mov dword [ebp - 0xcfc], 1
mov dword [ebp - 0xcf8], 1
mov dword [ebp - 0xcf4], 1
mov dword [ebp - 0xcf0], 1
lea ecx, [ebp - 0x305]
call fcn.10008dd3
push eax
lea eax, [ebp - 0xcec]
push eax
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0x11c8]
call fcn.10015e3b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd94]
call fcn.10015e01
mov dword [ebp - 4], 8
mov dword [ebp - 0xaf0], 0xaea0
mov dword [ebp - 0xaf8], 0x99da9727
cmp dword [ebp - 0x148], 0
je 0x1000a436
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x998]
mov dword [ebp - 0x107c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x998]
dec eax
mov dword [ebp - 0xae0], eax
push 3
lea ecx, [ebp - 0xd94]
call fcn.10015e2c
mov ecx, dword [ebp - 0xae0]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0xd94]
call fcn.10015e2c
cmp dword [eax], 0x5530
jge 0x1000a3f9
mov dword [ebp - 0x770], 1
jmp 0x1000a400
and dword [ebp - 0x770], 0
cmp dword [ebp - 0x770], 0xffffffff
jl 0x1000a415
mov dword [ebp - 0x4c0], 1
jmp 0x1000a41c
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x4c0], eax
jne 0x1000a436
mov dword [ebp - 0xa68], 1
jmp 0x1000a43d
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xf98], eax
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0x110c], eax
mov eax, dword [ebp - 0xaf8]
add eax, dword [ebp - 0x194]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x998]
je 0x1000a47c
mov dword [ebp - 0x8c8], 1
jmp 0x1000a483
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x8c8]
add eax, 0xef8a
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0xdc], eax
jge 0x1000a4ae
mov dword [ebp - 0x4c8], 1
jmp 0x1000a4b5
and dword [ebp - 0x4c8], 0
cmp dword [ebp - 0x4c8], 3
jne 0x1000a4ca
mov dword [ebp - 0x778], 1
jmp 0x1000a4d1
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp + eax*4 - 0x998]
cmp eax, dword [ebp - 0x778]
jne 0x1000a4f2
mov dword [ebp - 0x4d0], 1
jmp 0x1000a4f9
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x998]
cmp dword [ebp - 0x4d0], eax
je 0x1000a51a
mov dword [ebp - 0x9e8], 1
jmp 0x1000a521
and dword [ebp - 0x9e8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9e8]
mov dword [ebp + eax - 0xfcc], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd94]
call fcn.10015e27
jmp 0x1000a2fd
jmp 0x1000a28e
mov dword [ebp - 0x194], 0
jmp 0x1000a566
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jg 0x1000a5ce
mov dword [ebp - 0xfa0], 3
mov dword [ebp - 0x1084], 0xfffffff7
mov dword [ebp - 0xfa8], 0x9b41dbc4
mov dword [ebp - 0x10d0], 0xffffffff
mov dword [ebp - 0xeb4], 0x5e40c883
mov dword [ebp - 0xebc], 0
mov dword [ebp - 0xec4], 0x1d127a4e
mov dword [ebp - 0x4d8], 0xb167d3d8
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
jmp 0x1000a559
mov dword [ebp - 0x160], 0xffffffff
push 3
lea ecx, [ebp - 0xc58]
call fcn.10015dbf
mov dword [ebp - 4], 9
mov dword [ebp - 0x90], 0
jmp 0x1000a605
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1000a621
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xc40], 1
jmp 0x1000a5f8
mov dword [ebp - 0x90], 0
jmp 0x1000a63a
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1000a659
push dword [ebp - 0x90]
lea ecx, [ebp - 0xc58]
call fcn.10015e2c
and dword [eax], 0
jmp 0x1000a62d
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xc40]
cmp dword [ebp + eax - 0xc40], ecx
jne 0x1000a680
mov dword [ebp - 0x780], 1
jmp 0x1000a687
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x4e0], eax
push 0
lea ecx, [ebp - 0xc58]
call fcn.10015e2c
mov ecx, dword [ebp - 0x4e0]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc40]
cmp dword [ebp - 0x4e0], eax
jne 0x1000a702
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc40], 0xffffffff
jle 0x1000a6e4
mov dword [ebp - 0x8d0], 1
jmp 0x1000a6eb
and dword [ebp - 0x8d0], 0
push 1
lea ecx, [ebp - 0xc58]
call fcn.10015e2c
mov ecx, dword [ebp - 0x8d0]
mov dword [eax], ecx
jmp 0x1000a766
mov dword [ebp - 0xb08], 0x652d0da0
mov dword [ebp - 0x160], 8
jmp 0x1000a725
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xfffffffa
je 0x1000a73b
cmp dword [ebp - 0xb08], 0
je 0x1000a739
jmp 0x1000a73b
jmp 0x1000a718
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1000a766
push 0
push 0x8f5
push 0x1741
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc58]
call fcn.10015e27
mov dword [ebp - 0x1bc], 9
mov dword [ebp - 0xecc], 0x45d811f0
mov dword [ebp - 0xb18], 0xffffffff
mov dword [ebp - 0xed4], 0xededb5ca
mov dword [ebp - 0xedc], 0x8dd44ad3
mov dword [ebp - 0xee4], 0x10fecafe
mov dword [ebp - 0xe4c], 0x3e0566a9
mov dword [ebp - 0xe48], 0x3e0566a9
mov dword [ebp - 0xe44], 0x3e0566a9
mov dword [ebp - 0xe40], 0x3e0566a9
mov dword [ebp - 0xb10], 0xf6e2
mov dword [ebp - 0xeec], 0xfffffffe
mov dword [ebp - 0x388], 0x7626a9d9
push 1
lea ecx, [ebp - 0xe18]
call fcn.10015dbf
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x788], 0xffffffff
mov dword [ebp - 0xc0], 0
jmp 0x1000a82e
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x1000a84a
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0xa30], 0
jmp 0x1000a821
mov dword [ebp - 0xc0], 0
jmp 0x1000a863
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x1000a882
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xe18]
call fcn.10015e2c
and dword [eax], 0
jmp 0x1000a856
mov dword [ebp - 0x1bc], 0
jmp 0x1000a89b
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jge 0x1000a8b7
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xa30], 0xffffffff
jmp 0x1000a88e
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0xef4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa30]
mov dword [ebp - 0xefc], eax
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0xf04], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4c]
mov dword [ebp - 0xf0c], eax
push 0
lea ecx, [ebp - 0xe18]
call fcn.10015e2c
mov eax, dword [eax]
add eax, 8
jne 0x1000a92f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa30], 0
jne 0x1000a92f
and dword [ebp - 0x4e8], 0
jmp 0x1000a939
mov dword [ebp - 0x4e8], 1
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 1
ja 0x1000a95a
mov dword [ebp - 0x4f0], 1
jmp 0x1000a961
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 1
jg 0x1000a976
mov dword [ebp - 0x978], 1
jmp 0x1000a97d
and dword [ebp - 0x978], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa30]
cmp eax, dword [ebp - 0x978]
jne 0x1000a99e
mov dword [ebp - 0x4f8], 1
jmp 0x1000a9a5
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xb18], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe18]
call fcn.10015e27
mov dword [ebp - 0x50], 0x69fdf99f
mov dword [ebp - 0xd4c], 2
mov dword [ebp - 0xd48], 2
mov dword [ebp - 0xd44], 2
mov dword [ebp - 0xd40], 2
lea ecx, [ebp - 0x37d]
call fcn.10008dd3
push eax
lea eax, [ebp - 0xd3c]
push eax
lea eax, [ebp - 0xd4c]
push eax
lea ecx, [ebp - 0x11d8]
call fcn.10015e3b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdb8]
call fcn.10015e01
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x50], 4
jmp 0x1000aa3b
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffff2
jle 0x1000ac47
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x20], 3
jmp 0x1000aa5c
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1000ab24
push 2
lea ecx, [ebp - 0xb90]
call fcn.10015dbf
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x21c], 0
jmp 0x1000aa90
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jge 0x1000aab2
push dword [ebp - 0x21c]
lea ecx, [ebp - 0xb90]
call fcn.10015e2c
mov dword [eax], 3
jmp 0x1000aa83
push 1
lea ecx, [ebp - 0xb90]
call fcn.10015e2c
and dword [eax], 0
jmp 0x1000aae8
push 1
lea ecx, [ebp - 0xb90]
call fcn.10015e2c
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x790]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x790]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb90]
call fcn.10015e2c
cmp dword [eax], 3
jg 0x1000ab10
push dword [ebp - 0x20]
lea ecx, [ebp - 0xdb8]
call fcn.10015e2c
mov dword [eax], 0x92c5eb20
jmp 0x1000aac4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xb90]
call fcn.10015e27
jmp 0x1000aa55
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jge 0x1000ab38
mov dword [ebp - 0x500], 1
jmp 0x1000ab3f
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x500], eax
jl 0x1000ab5c
cmp dword [ebp - 0x50], 0
je 0x1000ab5c
mov dword [ebp - 0x8d8], 1
jmp 0x1000ab63
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x8d8]
jl 0x1000ab7a
mov dword [ebp - 0x508], 1
jmp 0x1000ab81
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
shl eax, 2
cmp dword [ebp - 0x50], eax
jle 0x1000ab9b
mov dword [ebp - 0x798], 1
jmp 0x1000aba2
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x798]
jne 0x1000abbc
cmp dword [ebp - 0x20], 0
jne 0x1000abbc
and dword [ebp - 0x510], 0
jmp 0x1000abc6
mov dword [ebp - 0x510], 1
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x510]
lea ecx, [edx + ecx + 3]
imul eax, ecx
cmp eax, dword [ebp - 0x50]
jl 0x1000abea
mov dword [ebp - 0x9e4], 1
jmp 0x1000abf1
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x9e4], eax
jg 0x1000ac08
mov dword [ebp - 0x518], 1
jmp 0x1000ac0f
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x518], eax
jle 0x1000ac26
mov dword [ebp - 0x7a0], 1
jmp 0x1000ac2d
and dword [ebp - 0x7a0], 0
push 2
lea ecx, [ebp - 0xdb8]
call fcn.10015e2c
mov ecx, dword [ebp - 0x7a0]
mov dword [eax], ecx
jmp 0x1000aa34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb8]
call fcn.10015e27
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x19c], 0x819d3388
mov dword [ebp - 0x390], 0xb35b6890
mov dword [ebp - 0x58], 0xfffffffe
mov dword [ebp - 0xec], 0xfffffff9
mov dword [ebp - 0x2ac], 0
jmp 0x1000ac9b
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 2
jge 0x1000acb7
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x3f0], 0x7e06985b
jmp 0x1000ac8e
cmp dword [ebp - 0x34], 8
jne 0x1000acc9
mov dword [ebp - 0x7b0], 1
jmp 0x1000acd0
and dword [ebp - 0x7b0], 0
cmp dword [ebp - 0x34], 0
jne 0x1000ad2a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xf14], eax
mov eax, 0x1cb27f08
test eax, eax
je 0x1000acfa
cmp dword [ebp - 0x34], 0
je 0x1000acfa
mov dword [ebp - 0x520], 1
jmp 0x1000ad01
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
imul eax, dword [ebp - 0x34]
sub eax, 0x66b
sub eax, dword [ebp - 0x34]
jne 0x1000ad2a
and dword [ebp - 0x8e0], 0
jmp 0x1000ad34
mov dword [ebp - 0x8e0], 1
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x390], eax
jl 0x1000ad57
mov dword [ebp - 0xb20], 1
jmp 0x1000ad5e
and dword [ebp - 0xb20], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3f0], 0
jne 0x1000ad87
cmp dword [ebp - 0x19c], 0
jne 0x1000ad87
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x1000ad87
and dword [ebp - 0x528], 0
jmp 0x1000ad91
mov dword [ebp - 0x528], 1
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x528]
cmp eax, 0x428
jl 0x1000adad
mov dword [ebp - 0x7a8], 1
jmp 0x1000adb4
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x34]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f0]
sub eax, 0x1a6afe97
cmp eax, dword [ebp - 0x58]
jge 0x1000adda
mov dword [ebp - 0x530], 1
jmp 0x1000ade1
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x530], eax
jl 0x1000adf8
mov dword [ebp - 0x980], 1
jmp 0x1000adff
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x980], eax
jle 0x1000ae16
mov dword [ebp - 0xb28], 1
jmp 0x1000ae1d
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xf1c], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0x58], 1
jne 0x1000ae44
mov dword [ebp - 0x538], 1
jmp 0x1000ae4b
and dword [ebp - 0x538], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f0]
cmp dword [ebp - 0x538], eax
je 0x1000ae6c
mov dword [ebp - 0x540], 1
jmp 0x1000ae73
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x7b0]
cmp eax, dword [ebp - 0x540]
jle 0x1000ae8d
mov dword [ebp - 0x8e8], 1
jmp 0x1000ae94
and dword [ebp - 0x8e8], 0
cmp dword [ebp - 0x8e8], 0xad46
jg 0x1000b284
mov dword [ebp - 0x48], 0xfffffff8
mov dword [ebp - 0x224], 0
jmp 0x1000aec4
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x1000aee0
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xe4], 0xd9cec61c
jmp 0x1000aeb7
cmp dword [ebp - 0x58], 0
je 0x1000af18
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x58], eax
jge 0x1000aefa
mov dword [ebp - 0x548], 1
jmp 0x1000af01
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x548]
je 0x1000af18
mov dword [ebp - 0x7b8], 1
jmp 0x1000af1f
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 0x3384f7a3
je 0x1000af37
mov dword [ebp - 0xb30], 1
jmp 0x1000af3e
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xf24], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xf2c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xf34], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xf3c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f0]
cmp dword [ebp - 0x48], eax
jge 0x1000af83
mov dword [ebp - 0x550], 1
jmp 0x1000af8a
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x550], eax
jg 0x1000afa1
mov dword [ebp - 0xa24], 1
jmp 0x1000afa8
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xa24], eax
je 0x1000afbf
mov dword [ebp - 0x558], 1
jmp 0x1000afc6
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x3f0]
imul eax, eax, 0x8efe
test eax, eax
ja 0x1000affc
mov dword [ebp - 0x7c0], 1
jmp 0x1000b003
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x7c0], eax
jl 0x1000b01d
mov dword [ebp - 0xb38], 1
jmp 0x1000b024
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xf44], eax
cmp dword [ebp - 0x48], 0xffffffff
jg 0x1000b03f
mov dword [ebp - 0x560], 1
jmp 0x1000b046
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x560], eax
jl 0x1000b05d
mov dword [ebp - 0x8f0], 1
jmp 0x1000b064
and dword [ebp - 0x8f0], 0
mov eax, 0x19c36c1
sub eax, dword [ebp - 0x8f0]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0xec], eax
jle 0x1000b09c
mov dword [ebp - 0x568], 1
jmp 0x1000b0a3
and dword [ebp - 0x568], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0x568], eax
jg 0x1000b0d1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe4], 0
jne 0x1000b0d1
and dword [ebp - 0x7c8], 0
jmp 0x1000b0db
mov dword [ebp - 0x7c8], 1
mov eax, dword [ebp - 0x58]
add eax, 0xfffc
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x7c8]
cmp eax, ecx
je 0x1000b0fc
mov dword [ebp - 0x570], 1
jmp 0x1000b103
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 1
jge 0x1000b118
mov dword [ebp - 0x988], 1
jmp 0x1000b11f
and dword [ebp - 0x988], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0x988], eax
jge 0x1000b140
mov dword [ebp - 0x578], 1
jmp 0x1000b147
and dword [ebp - 0x578], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0x578], eax
je 0x1000b168
mov dword [ebp - 0x7d0], 1
jmp 0x1000b16f
and dword [ebp - 0x7d0], 0
cmp dword [ebp - 0x7d0], 0
jne 0x1000b184
mov dword [ebp - 0x580], 1
jmp 0x1000b18b
and dword [ebp - 0x580], 0
cmp dword [ebp - 0x580], 8
jae 0x1000b1a0
mov dword [ebp - 0x8f8], 1
jmp 0x1000b1a7
and dword [ebp - 0x8f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0x8f8], eax
jle 0x1000b1c8
mov dword [ebp - 0x588], 1
jmp 0x1000b1cf
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x588], eax
jge 0x1000b1e6
mov dword [ebp - 0x330], 1
jmp 0x1000b1ed
and dword [ebp - 0x330], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x330]
mov dword [ebp + eax - 0xe4], ecx
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
add eax, 0xffff
cmp eax, 0xffffffff
jne 0x1000b228
mov dword [ebp - 0x7d8], 1
jmp 0x1000b22f
and dword [ebp - 0x7d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f0]
cmp dword [ebp - 0x7d8], eax
jg 0x1000b250
mov dword [ebp - 0x590], 1
jmp 0x1000b257
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0xffcb
je 0x1000b26f
mov dword [ebp - 0x9ec], 1
jmp 0x1000b276
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x390], eax
jmp 0x1000b2a8
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x1000b2a8
push 0x1d62
push 0x19d1
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov dword [ebp - 0xf4], 0xd4e06482
mov dword [ebp - 0x1dc], 0xffffffff
mov dword [ebp - 0x274], 0
jmp 0x1000b2d5
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jge 0x1000b2f1
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0xe78], 0xffffffff
jmp 0x1000b2c8
mov dword [ebp - 0xf4], 0x17
jmp 0x1000b30a
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 5
je 0x1000b5bc
mov dword [ebp - 0xfc], 0x6d4f2887
mov dword [ebp - 0xbfc], 0xad0d7276
mov dword [ebp - 0x22c], 0
jmp 0x1000b344
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jge 0x1000b360
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0x9a4], 0xe446df3
jmp 0x1000b337
mov dword [ebp - 0xfc], 1
jmp 0x1000b379
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x1000b5b7
mov dword [ebp - 0xc98], 1
mov dword [ebp - 0xc94], 1
mov dword [ebp - 0xc90], 1
mov dword [ebp - 0xc8c], 1
lea ecx, [ebp - 0x30d]
call fcn.10008dd3
push eax
lea eax, [ebp - 0xc88]
push eax
lea eax, [ebp - 0xc98]
push eax
lea ecx, [ebp - 0x1198]
call fcn.10015e3b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe3c]
call fcn.10015e01
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xb50], 0xaea0
mov dword [ebp - 0xbf4], 0x99da9727
cmp dword [ebp - 0xf4], 0
je 0x1000b4a5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9a4]
mov dword [ebp - 0xf54], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9a4]
dec eax
mov dword [ebp - 0xb40], eax
push 3
lea ecx, [ebp - 0xe3c]
call fcn.10015e2c
mov ecx, dword [ebp - 0xb40]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0xe3c]
call fcn.10015e2c
cmp dword [eax], 0x5530
jge 0x1000b468
mov dword [ebp - 0x598], 1
jmp 0x1000b46f
and dword [ebp - 0x598], 0
cmp dword [ebp - 0x598], 0xffffffff
jl 0x1000b484
mov dword [ebp - 0x7e0], 1
jmp 0x1000b48b
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x7e0], eax
jne 0x1000b4a5
mov dword [ebp - 0xb48], 1
jmp 0x1000b4ac
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xf5c], eax
mov eax, dword [ebp - 0xb50]
mov dword [ebp - 0xf64], eax
mov eax, dword [ebp - 0xbf4]
add eax, dword [ebp - 0x1dc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x9a4]
je 0x1000b4eb
mov dword [ebp - 0x5a0], 1
jmp 0x1000b4f2
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
add eax, 0xef8a
mov dword [ebp - 0xbfc], eax
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0xfc], eax
jge 0x1000b51d
mov dword [ebp - 0x900], 1
jmp 0x1000b524
and dword [ebp - 0x900], 0
cmp dword [ebp - 0x900], 3
jne 0x1000b539
mov dword [ebp - 0x5a8], 1
jmp 0x1000b540
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0x9a4]
cmp eax, dword [ebp - 0x5a8]
jne 0x1000b561
mov dword [ebp - 0x7e8], 1
jmp 0x1000b568
and dword [ebp - 0x7e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a4]
cmp dword [ebp - 0x7e8], eax
je 0x1000b589
mov dword [ebp - 0x5b0], 1
jmp 0x1000b590
and dword [ebp - 0x5b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5b0]
mov dword [ebp + eax - 0xe78], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe3c]
call fcn.10015e27
jmp 0x1000b36c
jmp 0x1000b2fd
mov dword [ebp - 0x1dc], 0
jmp 0x1000b5d5
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jg 0x1000b63d
mov dword [ebp - 0xf6c], 3
mov dword [ebp - 0xf74], 0xfffffff7
mov dword [ebp - 0xf7c], 0x9b41dbc4
mov dword [ebp - 0xf84], 0xffffffff
mov dword [ebp - 0xf8c], 0x5e40c883
mov dword [ebp - 0xf94], 0
mov dword [ebp - 0xf9c], 0x1d127a4e
mov dword [ebp - 0x990], 0xb167d3d8
mov eax, dword [ebp - 0x990]
inc eax
mov dword [ebp - 0x990], eax
jmp 0x1000b5c8
mov dword [ebp - 0x170], 0xffffffff
push 3
lea ecx, [ebp - 0xc4c]
call fcn.10015dbf
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x98], 0
jmp 0x1000b674
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1000b690
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xc70], 1
jmp 0x1000b667
mov dword [ebp - 0x98], 0
jmp 0x1000b6a9
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1000b6c8
push dword [ebp - 0x98]
lea ecx, [ebp - 0xc4c]
call fcn.10015e2c
and dword [eax], 0
jmp 0x1000b69c
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xc70]
cmp dword [ebp + eax - 0xc70], ecx
jne 0x1000b6ef
mov dword [ebp - 0x5b8], 1
jmp 0x1000b6f6
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x7f0], eax
push 0
lea ecx, [ebp - 0xc4c]
call fcn.10015e2c
mov ecx, dword [ebp - 0x7f0]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc70]
cmp dword [ebp - 0x7f0], eax
jne 0x1000b771
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc70], 0xffffffff
jle 0x1000b753
mov dword [ebp - 0x5c0], 1
jmp 0x1000b75a
and dword [ebp - 0x5c0], 0
push 1
lea ecx, [ebp - 0xc4c]
call fcn.10015e2c
mov ecx, dword [ebp - 0x5c0]
mov dword [eax], ecx
jmp 0x1000b7d5
mov dword [ebp - 0xc04], 0x652d0da0
mov dword [ebp - 0x170], 8
jmp 0x1000b794
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xfffffffa
je 0x1000b7aa
cmp dword [ebp - 0xc04], 0
je 0x1000b7a8
jmp 0x1000b7aa
jmp 0x1000b787
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000b7d5
push 0
push 0x8f5
push 0x1741
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4c]
call fcn.10015e27
mov dword [ebp - 0x1a4], 9
mov dword [ebp - 0xfa4], 0x45d811f0
mov dword [ebp - 0xbe4], 0xffffffff
mov dword [ebp - 0xfac], 0xededb5ca
mov dword [ebp - 0xfb8], 0x8dd44ad3
mov dword [ebp - 0xfc4], 0x10fecafe
mov dword [ebp - 0xe6c], 0x3e0566a9
mov dword [ebp - 0xe68], 0x3e0566a9
mov dword [ebp - 0xe64], 0x3e0566a9
mov dword [ebp - 0xe60], 0x3e0566a9
mov dword [ebp - 0xbe8], 0xf6e2
mov dword [ebp - 0xfd0], 0xfffffffe
mov dword [ebp - 0x338], 0x7626a9d9
push 1
lea ecx, [ebp - 0xe00]
call fcn.10015dbf
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x5c8], 0xffffffff
mov dword [ebp - 0xb8], 0
jmp 0x1000b89d
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x1000b8b9
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xa40], 0
jmp 0x1000b890
mov dword [ebp - 0xb8], 0
jmp 0x1000b8d2
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x1000b8f1
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xe00]
call fcn.10015e2c
and dword [eax], 0
jmp 0x1000b8c5
mov dword [ebp - 0x1a4], 0
jmp 0x1000b90a
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x1000b926
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0xa40], 0xffffffff
jmp 0x1000b8fd
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0xfd8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa40]
mov dword [ebp - 0xfe0], eax
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0xfe8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe6c]
mov dword [ebp - 0x1068], eax
push 0
lea ecx, [ebp - 0xe00]
call fcn.10015e2c
mov eax, dword [eax]
add eax, 8
jne 0x1000b99e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa40], 0
jne 0x1000b99e
and dword [ebp - 0x908], 0
jmp 0x1000b9a8
mov dword [ebp - 0x908], 1
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 1
ja 0x1000b9c9
mov dword [ebp - 0x7f8], 1
jmp 0x1000b9d0
and dword [ebp - 0x7f8], 0
cmp dword [ebp - 0x7f8], 1
jg 0x1000b9e5
mov dword [ebp - 0x5d0], 1
jmp 0x1000b9ec
and dword [ebp - 0x5d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa40]
cmp eax, dword [ebp - 0x5d0]
jne 0x1000ba0d
mov dword [ebp - 0xa0c], 1
jmp 0x1000ba14
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0xbe4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe00]
call fcn.10015e27
mov dword [ebp - 0x180], 0x9d29be1d
mov dword [ebp - 0x29c], 0
jmp 0x1000ba52
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 3
jge 0x1000ba6e
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x1178], 0x648261f9
jmp 0x1000ba45
mov byte [ebp - 0x140], 0
movzx eax, byte [ebp - 0x140]
test eax, eax
je 0x1000ba88
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
mov dword [ebp - 0x180], 0
jmp 0x1000baa1
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jge 0x1000babd
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x1178], 0x5b0e446d
jmp 0x1000ba94
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c4], 0x819d3388
mov dword [ebp - 0x340], 0xb35b6890
mov dword [ebp - 0x60], 0xfffffffe
mov dword [ebp - 0x10c], 0xfffffff9
mov dword [ebp - 0x234], 0
jmp 0x1000bb02
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jge 0x1000bb1e
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x3f8], 0x7e06985b
jmp 0x1000baf5
cmp dword [ebp - 0x2c], 8
jne 0x1000bb30
mov dword [ebp - 0x99c], 1
jmp 0x1000bb37
and dword [ebp - 0x99c], 0
cmp dword [ebp - 0x2c], 0
jne 0x1000bb91
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1070], eax
mov eax, 0x1cb27f08
test eax, eax
je 0x1000bb61
mov dword [ebp - 0x800], 1
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x340], eax
jl 0x1000bbbe