Function at 0x10009170
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008109f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x136c
call fcn.1007cd80
push esi
push edi
mov dword [ebp - 0x14c], 8
mov dword [ebp - 0x154], 0xffffffff
mov dword [ebp - 0x8dc], 0xda2ae7b7
mov dword [ebp - 0x8e4], 1
mov dword [ebp - 0x9c0], 0x8d9a2b82
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x1184], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x1134], eax
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x14c], eax
jg 0x100091f8
mov dword [ebp - 0x630], 1
jmp 0x100091ff
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp - 0x154]
sub eax, dword [ebp - 0x8dc]
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x8e4]
neg eax
cmp eax, 0x8b16
jge 0x10009238
mov dword [ebp - 0x8ec], 1
jmp 0x1000923f
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x8ec], eax
jl 0x10009259
mov dword [ebp - 0x8f4], 1
jmp 0x10009260
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x8f4], eax
jne 0x1000927a
mov dword [ebp - 0x8fc], 1
jmp 0x10009281
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x8fc], eax
jle 0x1000929b
mov dword [ebp - 0x904], 1
jmp 0x100092a2
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x904], eax
jle 0x100092bc
mov dword [ebp - 0x90c], 1
jmp 0x100092c3
and dword [ebp - 0x90c], 0
cmp dword [ebp - 0x90c], 0xd0e
jg 0x100092db
mov dword [ebp - 0x914], 1
jmp 0x100092e2
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x9c0], eax
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x1000930c
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov dword [ebp - 0x124], 8
mov dword [ebp - 0x174], 0xffffffff
mov dword [ebp - 0x3cc], 0xda2ae7b7
mov dword [ebp - 0xffc], 0
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x10009353
push 0x1ebf
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1000936d
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x67c], 1
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x2e8], 0x9c3d069f
mov dword [ebp - 0xa6c], 8
mov dword [ebp - 0xa74], 1
mov dword [ebp - 0xa4c], 0xffffffff
mov dword [ebp - 0x3ac], 9
mov dword [ebp - 0xa44], 0
mov dword [ebp - 0x3bc], 1
mov dword [ebp - 0x330], 5
mov dword [ebp - 0xa7c], 0x435
mov dword [ebp - 0x1214], 0x7348
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x168], 0
jmp 0x10009408
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jge 0x10009424
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x1004], 0xffffffff
jmp 0x100093fb
mov dword [ebp - 0xbc], 0
jmp 0x1000943d
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x19
je 0x1000954a
mov dword [ebp - 0x16c], 0x638ecf54
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1000947a
push 0
push 0xbc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov dword [ebp - 0x16c], 0xd
jmp 0x10009493
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xfffffffa
jne 0x10009545
push 4
lea ecx, [ebp - 0xd50]
call fcn.1001610f
and dword [ebp - 4], 0
mov dword [ebp - 0x144], 0x23b1a956
mov dword [ebp - 0x26c], 0
jmp 0x100094d4
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 4
jge 0x100094f6
push dword [ebp - 0x26c]
lea ecx, [ebp - 0xd50]
call fcn.100161ad
mov dword [eax], 0x7222
jmp 0x100094c7
mov dword [ebp - 0x144], 0
jmp 0x1000950f
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 4
jge 0x10009531
push dword [ebp - 0x144]
lea ecx, [ebp - 0xd50]
call fcn.100161ad
mov dword [eax], 0x8cc
jmp 0x10009502
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd50]
call fcn.10016191
jmp 0x10009486
jmp 0x10009430
cmp dword [ebp - 0xa44], 0xae2718b9
jne 0x10009568
cmp dword [ebp - 0xbc], 0
jne 0x10009568
and dword [ebp - 0x888], 0
jmp 0x10009572
mov dword [ebp - 0x888], 1
cmp dword [ebp - 0x888], 0
jae 0x10009587
mov dword [ebp - 0x928], 1
jmp 0x1000958e
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0xa4c]
cmp dword [ebp - 0x928], eax
jge 0x100095a8
mov dword [ebp - 0x66c], 1
jmp 0x100095af
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x66c]
je 0x100095e1
mov dword [ebp - 0xa54], 1
jmp 0x100095e8
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x1144], eax
cmp dword [ebp - 0xa6c], 0
jne 0x1000960f
cmp dword [ebp - 0xa74], 0
jne 0x1000960f
and dword [ebp - 0x3b4], 0
jmp 0x10009619
mov dword [ebp - 0x3b4], 1
mov eax, dword [ebp - 0xa7c]
cmp dword [ebp - 0x3b4], eax
jge 0x10009633
mov dword [ebp - 0x7cc], 1
jmp 0x1000963a
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0xa84]
cmp eax, dword [ebp - 0xa8c]
jge 0x10009679
mov dword [ebp - 0x674], 1
jmp 0x10009680
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x3bc]
cmp dword [ebp - 0x674], eax
jg 0x1000969a
mov dword [ebp - 0x3c4], 1
jmp 0x100096a1
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0x3c4]
imul eax, eax, 0
test eax, eax
je 0x1000970b
mov dword [ebp - 0xa94], 0x7d3709e8
mov dword [ebp - 0xe74], 7
mov dword [ebp - 0x11b4], 0xeae11771
mov dword [ebp - 0x11b0], 0xeae11771
mov dword [ebp - 0x11ac], 0xeae11771
mov dword [ebp - 0x11a8], 0xeae11771
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
jmp 0x10009721
mov dword [ebp - 0xa9c], 0xe1dc630d
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xaa4], 0x8d9a2b82
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xe78], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xe80], eax
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x124], eax
jg 0x1000975d
mov dword [ebp - 0x87c], 1
jmp 0x10009764
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x67c]
neg eax
cmp eax, 0x8b16
jge 0x1000979d
mov dword [ebp - 0x3d4], 1
jmp 0x100097a4
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x3d4], eax
jl 0x100097be
mov dword [ebp - 0x7d4], 1
jmp 0x100097c5
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x7d4], eax
jne 0x100097df
mov dword [ebp - 0x3dc], 1
jmp 0x100097e6
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x3dc], eax
jle 0x10009800
mov dword [ebp - 0x684], 1
jmp 0x10009807
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x684], eax
jle 0x10009821
mov dword [ebp - 0x3e4], 1
jmp 0x10009828
and dword [ebp - 0x3e4], 0
cmp dword [ebp - 0x3e4], 0xd0e
jg 0x10009840
mov dword [ebp - 0x8e8], 1
jmp 0x10009847
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0xaa4], eax
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x10009b7f
mov dword [ebp - 0x17c], 0xec2e0cf5
mov dword [ebp - 0xe88], 0x2ae7b79f
mov dword [ebp - 0xe98], 1
mov dword [ebp - 0xea0], 0x9ebf495e
mov dword [ebp - 0xea8], 2
mov dword [ebp - 0xeb0], 1
mov dword [ebp - 0xeb8], 0x526c7153
mov dword [ebp - 0xec0], 1
mov dword [ebp - 0xec8], 0xffffffff
mov dword [ebp - 0xed0], 0xfffffffa
mov dword [ebp - 0xed8], 0xfffffff9
mov dword [ebp - 0xee0], 1
mov dword [ebp - 0xee8], 0x6e523240
push 3
lea ecx, [ebp - 0x1070]
call fcn.1001610f
mov dword [ebp - 4], 1
mov dword [ebp - 0x204], 0
jmp 0x10009918
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x1000993a
push dword [ebp - 0x204]
lea ecx, [ebp - 0x1070]
call fcn.100161ad
mov dword [eax], 0xd40a7fc
jmp 0x1000990b
mov dword [ebp - 0x17c], 0
jmp 0x10009953
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 6
jge 0x10009b64
mov dword [ebp - 0xef0], 0x5af8b513
mov dword [ebp - 0xef8], 0xfffffffc
mov dword [ebp - 0xf00], 4
mov dword [ebp - 0xf08], 0xba29f583
mov dword [ebp - 0xf10], 1
push 2
lea ecx, [ebp - 0xd44]
call fcn.1001610f
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 0
jmp 0x100099b3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100099c9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12c8], 0xffff
jmp 0x100099ac
mov dword [ebp - 0x18], 0
jmp 0x100099d9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100099ef
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x93c], 1
jmp 0x100099d2
mov dword [ebp - 0x18], 0
jmp 0x100099ff
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10009a15
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x134c], 0x5f8d9a2b
jmp 0x100099f8
mov dword [ebp - 0x18], 0
jmp 0x10009a25
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10009a41
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd44]
call fcn.100161ad
mov dword [eax], 0xfffffff7
jmp 0x10009a1e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x93c], 0
jmp 0x10009a6f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x93c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x93c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x93c], 1
jg 0x10009b50
mov dword [ebp - 0xaac], 3
mov dword [ebp - 0xf18], 0
mov dword [ebp - 0xf20], 0x9af3
mov dword [ebp - 0xac4], 0
mov dword [ebp - 0x24c], 0
jmp 0x10009ac4
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x10009ae0
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x1328], 0xfffffff7
jmp 0x10009ab7
push 1
lea ecx, [ebp - 0xd44]
call fcn.100161ad
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0x384]
mov eax, dword [eax]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x384]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x384]
mov dword [ecx], eax
mov eax, dword [ebp - 0xab4]
cmp eax, dword [ebp - 0xabc]
jge 0x10009b38
mov dword [ebp - 0x3ec], 1
jmp 0x10009b3f
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0xac4], eax
jmp 0x10009a54
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd44]
call fcn.10016191
jmp 0x10009946
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1070]
call fcn.10016191
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov dword [ebp - 0xacc], 0xb7c7ce53
mov dword [ebp - 0x13c], 0xe97eede0
mov dword [ebp - 0xf28], 0xfffffff6
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x13c], 0
jmp 0x10009bc2
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 7
jl 0x10009bec
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x10009bea
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
jmp 0x10009bb5
mov dword [ebp - 0xc50], 0x3df75dce
mov dword [ebp - 0xc4c], 0x3df75dce
mov dword [ebp - 0xc48], 0x3df75dce
mov dword [ebp - 0xc44], 0x3df75dce
lea ecx, [ebp - 0x2a9]
call fcn.10008f33
push eax
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0xc50]
push eax
lea ecx, [ebp - 0x1320]
call fcn.100161bc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb90]
call fcn.1001616b
mov dword [ebp - 4], 3
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x104], 0x5bed8572
mov dword [ebp - 0x44c], 0xfffffffe
mov dword [ebp - 0x4c], 3
jmp 0x10009c7b
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1000a39d
mov dword [ebp - 0x28], 0x2e31d832
mov dword [ebp - 0x6bc], 0xfffffff9
push 3
lea ecx, [ebp - 0xd74]
call fcn.1001610f
mov byte [ebp - 4], 4
mov dword [ebp - 0x184], 0
jmp 0x10009cc0
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jge 0x10009ce2
push dword [ebp - 0x184]
lea ecx, [ebp - 0xd74]
call fcn.100161ad
mov dword [eax], 0x401bc10b
jmp 0x10009cb3
mov dword [ebp - 0x28], 0
jmp 0x10009cf2
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x1000a389
mov dword [ebp - 0xc00], 0x44ad72d7
mov dword [ebp - 0xbfc], 0x44ad72d7
mov dword [ebp - 0xbf8], 0x44ad72d7
mov dword [ebp - 0xbf4], 0x44ad72d7
lea ecx, [ebp - 0x2dd]
call fcn.10008f33
push eax
lea eax, [ebp - 0xbf0]
push eax
lea eax, [ebp - 0xc00]
push eax
lea ecx, [ebp - 0x1298]
call fcn.100161bc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2a8]
call fcn.1001616b
mov byte [ebp - 4], 5
mov dword [ebp - 0x9c], 0x98e64e6d
push 2
lea ecx, [ebp - 0x2a8]
call fcn.100161ad
and dword [eax], 0
jmp 0x10009d9d
push 2
lea ecx, [ebp - 0x2a8]
call fcn.100161ad
mov dword [ebp - 0x68c], eax
mov eax, dword [ebp - 0x68c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x68c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x2a8]
call fcn.100161ad
cmp dword [eax], 4
jge 0x10009dd1
push 2
lea ecx, [ebp - 0x2a8]
call fcn.100161ad
push dword [eax]
lea ecx, [ebp - 0xb90]
call fcn.100161ad
mov dword [eax], 0xedcc590f
jmp 0x10009d79
mov dword [ebp - 0x9c], 0
jmp 0x10009dea
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x1000a375
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0xadc], 0x85b
mov dword [ebp - 0xca0], 0xa5f72677
mov dword [ebp - 0xc9c], 0xa5f72677
mov dword [ebp - 0xc98], 0xa5f72677
mov dword [ebp - 0xc94], 0xa5f72677
lea ecx, [ebp - 0x342]
call fcn.10008f33
push eax
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0xca0]
push eax
lea ecx, [ebp - 0x1300]
call fcn.100161bc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd5c]
call fcn.1001616b
mov byte [ebp - 4], 6
mov dword [ebp - 0x20c], 0
jmp 0x10009e85
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x10009ea1
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0x964], 0xfffffffa
jmp 0x10009e78
mov dword [ebp - 0x12c], 0
jmp 0x10009eba
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jg 0x1000a058
mov dword [ebp - 0x18c], 0
cmp dword [ebp - 0x18c], 0
jne 0x10009fb2
cmp dword [ebp - 0x28], 0
je 0x10009ef9
cmp dword [ebp - 0x12c], 0
je 0x10009ef9
mov dword [ebp - 0x3f4], 1
jmp 0x10009f00
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x3f4], eax
jl 0x10009f1a
mov dword [ebp - 0x7dc], 1
jmp 0x10009f21
and dword [ebp - 0x7dc], 0
cmp dword [ebp - 0x7dc], 1
jl 0x10009f36
mov dword [ebp - 0x694], 1
jmp 0x10009f3d
and dword [ebp - 0x694], 0
push 2
lea ecx, [ebp - 0x2a8]
call fcn.100161ad
mov eax, dword [eax]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x3fc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp + eax - 0x964], ecx
mov eax, dword [ebp - 0x3fc]
cmp eax, dword [ebp - 0x694]
jge 0x10009f8b
mov dword [ebp - 0xad4], 1
jmp 0x10009f92
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xf30], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x18c], eax
jge 0x10009fb2
and dword [ebp - 0x404], 0
jmp 0x10009fbc
mov dword [ebp - 0x404], 1
mov eax, dword [ebp - 0x404]
inc eax
cmp eax, dword [ebp - 0x28]
jge 0x10009fd4
mov dword [ebp - 0x884], 1
jmp 0x10009fdb
and dword [ebp - 0x884], 0
push 2
lea ecx, [ebp - 0x2a8]
call fcn.100161ad
mov ecx, dword [ebp - 0x884]
imul ecx, dword [eax]
sub ecx, dword [ebp - 0x28]
cmp ecx, 0xfffffff9
jb 0x1000a005
mov dword [ebp - 0x40c], 1
jmp 0x1000a00c
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
dec eax
jne 0x1000a024
cmp dword [ebp - 0x28], 0
jne 0x1000a024
and dword [ebp - 0x69c], 0
jmp 0x1000a02e
mov dword [ebp - 0x69c], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x69c], eax
je 0x1000a040
cmp dword [ebp - 0xadc], 0
push 2
lea ecx, [ebp - 0x2a8]
call fcn.100161ad
mov dword [eax], 0x1cf6a124
jmp 0x10009ead
cmp dword [ebp - 0x28], 0
jne 0x1000a06a
mov dword [ebp - 0x908], 1
jmp 0x1000a071
and dword [ebp - 0x908], 0
cmp dword [ebp - 0x4c], 0
je 0x1000a095
push 2
lea ecx, [ebp - 0x2a8]
call fcn.100161ad
cmp dword [eax], 0
je 0x1000a095
mov dword [ebp - 0x414], 1
jmp 0x1000a09c
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x414], eax
je 0x1000a0b3
mov dword [ebp - 0x7e4], 1
jmp 0x1000a0ba
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x6bc]
add eax, dword [ebp - 0x7e4]
cmp eax, dword [ebp - 0x4c]
je 0x1000a0d7
mov dword [ebp - 0x41c], 1
jmp 0x1000a0de
and dword [ebp - 0x41c], 0
cmp dword [ebp - 0x41c], 0xa8ff013e
jbe 0x1000a0f6
mov dword [ebp - 0x6a4], 1
jmp 0x1000a0fd
and dword [ebp - 0x6a4], 0
push 1
lea ecx, [ebp - 0xb90]
call fcn.100161ad
mov ecx, dword [ebp - 0x6a4]
cmp ecx, dword [eax]
jle 0x1000a12f
push 3
lea ecx, [ebp - 0xb90]
call fcn.100161ad
cmp dword [eax], 0
jne 0x1000a12f
and dword [ebp - 0x424], 0
jmp 0x1000a139
mov dword [ebp - 0x424], 1
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x424]
cmp dword [ebp - 0x908], eax
jle 0x1000a157
mov dword [ebp - 0x42c], 1
jmp 0x1000a15e
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x42c], eax
jl 0x1000a17b
xor eax, eax
inc eax
je 0x1000a17b
push 0
lea ecx, [ebp - 0x2a8]
call fcn.100161ad
cmp dword [ebp - 0x104], 0
je 0x1000a199
cmp dword [ebp - 0x9c], 0
je 0x1000a199
mov dword [ebp - 0x6ac], 1
jmp 0x1000a1a0
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x6ac], eax
jne 0x1000a1b7
mov dword [ebp - 0x434], 1
jmp 0x1000a1be
and dword [ebp - 0x434], 0
push 3
lea ecx, [ebp - 0xd5c]
call fcn.100161ad
mov ecx, dword [ebp - 0x434]
imul ecx, dword [eax]
cmp ecx, 0x9c7d
je 0x1000a1e8
mov dword [ebp - 0x7ec], 1
jmp 0x1000a1ef
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x7ec], eax
je 0x1000a209
mov dword [ebp - 0x43c], 1
jmp 0x1000a210
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x43c]
jne 0x1000a227
mov dword [ebp - 0x6b4], 1
jmp 0x1000a22e
and dword [ebp - 0x6b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x964]
cmp dword [ebp - 0x6b4], eax
jle 0x1000a24f
mov dword [ebp - 0x444], 1
jmp 0x1000a256
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x88c], eax
push 0
lea ecx, [ebp - 0x2a8]
call fcn.100161ad
mov ecx, dword [ebp - 0x88c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x44c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x964]
add eax, dword [ebp - 0x44c]
cmp eax, dword [ebp - 0x9c]
je 0x1000a2d7
push 3
lea ecx, [ebp - 0xd5c]
call fcn.100161ad
cmp dword [eax], 0
jne 0x1000a2d7
push 2
lea ecx, [ebp - 0x2a8]
call fcn.100161ad
cmp dword [eax], 0
jne 0x1000a2d7
and dword [ebp - 0xae4], 0
jmp 0x1000a2e1
mov dword [ebp - 0xae4], 1
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xf40], eax
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x4c], eax
jle 0x1000a30d
mov dword [ebp - 0x454], 1
jmp 0x1000a314
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0x4c]
jne 0x1000a332
mov dword [ebp - 0x2f8], 1
jmp 0x1000a339
and dword [ebp - 0x2f8], 0
push 2
lea ecx, [ebp - 0xd74]
call fcn.100161ad
mov ecx, dword [ebp - 0x2f8]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2f8]
mov dword [ebp + eax - 0x964], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xd5c]
call fcn.10016191
jmp 0x10009ddd
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2a8]
call fcn.10016191
jmp 0x10009ceb
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd74]
call fcn.10016191
jmp 0x10009c74
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb90]
call fcn.10016191
mov dword [ebp - 0x120], 8
mov dword [ebp - 0x1bc], 0xffffffff
mov dword [ebp - 0x194], 0xb55bb2c2
mov dword [ebp - 0xf48], 0xfffffffa
push 2
lea ecx, [ebp - 0x1080]
call fcn.1001610f
mov dword [ebp - 4], 7
mov dword [ebp - 0xf50], 0x8d96753f
mov dword [ebp - 0x7f4], 0x4469
mov dword [ebp - 0x28c], 0
jmp 0x1000a415
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 2
jge 0x1000a437
push dword [ebp - 0x28c]
lea ecx, [ebp - 0x1080]
call fcn.100161ad
mov dword [eax], 0x2a8358bd
jmp 0x1000a408
mov dword [ebp - 0x194], 0x11
jmp 0x1000a450
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xb
jg 0x1000a4fe
mov dword [ebp - 0xf58], 0xffffffff
mov dword [ebp - 0xf60], 0xffffffff
mov dword [ebp - 0xf68], 0
mov dword [ebp - 0xf70], 0x21c3a23
mov dword [ebp - 0xf78], 0xfffffff6
mov dword [ebp - 0xf80], 0xffffffff
mov dword [ebp - 0xf88], 0xbdbdf7c
mov dword [ebp - 0xf90], 0x282d564c
mov dword [ebp - 0xf98], 0x9b2b534d
mov dword [ebp - 0x214], 0
jmp 0x1000a4d0
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 4
jge 0x1000a4ec
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0x1378], 4
jmp 0x1000a4c3
mov eax, dword [ebp - 0x7f4]
inc eax
mov dword [ebp - 0x7f4], eax
jmp 0x1000a443
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1080]
call fcn.10016191
push 4
lea ecx, [ebp - 0xda4]
call fcn.1001610f
mov dword [ebp - 4], 8
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x118], 0xfffffff7
mov dword [ebp - 0x898], 1
mov dword [ebp - 0xa60], 0xaa50887c
mov dword [ebp - 0xa3c], 0xfffffff7
mov dword [ebp - 0xfa0], 0xe2499e68
mov dword [ebp - 0xa64], 1
mov dword [ebp - 0xfa8], 4
mov dword [ebp - 0xfb0], 1
mov dword [ebp - 0xfb8], 0x50b7f45b
mov dword [ebp - 0xfc0], 0x93cc9d6c
mov dword [ebp - 0xfc8], 0
mov dword [ebp - 0xfd0], 5
mov dword [ebp - 0xfd8], 0xc67a9553
mov dword [ebp - 0xfe0], 0x4f5fdfda
mov dword [ebp - 0xfe8], 0x726f2c0e
mov dword [ebp - 0xff0], 0
mov dword [ebp - 0x978], 0xfffffff6
mov dword [ebp - 0xaec], 0xffffffff
mov dword [ebp - 0xff8], 0x41af53c8
mov dword [ebp - 0x1000], 0xffffffff
mov dword [ebp - 0x990], 0
mov dword [ebp - 0x1008], 0x5ce76562
mov dword [ebp - 0x1010], 0x1c721796
mov dword [ebp - 0x88], 0
jmp 0x1000a62a
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x1000a64c
push dword [ebp - 0x88]
lea ecx, [ebp - 0xda4]
call fcn.100161ad
mov dword [eax], 0xd72276b
jmp 0x1000a61d
mov dword [ebp - 0x88], 0
jmp 0x1000a665
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1000a681
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x1018], 6
jmp 0x1000a658
cmp dword [ebp - 0xac], 0
je 0x1000a6bd
cmp dword [ebp - 0xac], 1
jle 0x1000a69f
mov dword [ebp - 0x45c], 1
jmp 0x1000a6a6
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x45c], eax
jge 0x1000a6bd
and dword [ebp - 0x6c4], 0
jmp 0x1000a6c7
mov dword [ebp - 0x6c4], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x6c4], eax
jge 0x1000a6e1
mov dword [ebp - 0x464], 1
jmp 0x1000a6e8
and dword [ebp - 0x464], 0
push 3
lea ecx, [ebp - 0xda4]
call fcn.100161ad
mov dword [eax], 0x54165132
cmp dword [ebp - 0x464], 0x54165132
jg 0x1000a713
mov dword [ebp - 0x8f0], 1
jmp 0x1000a71a
and dword [ebp - 0x8f0], 0
cmp dword [ebp - 0x8f0], 0xffffffff
jne 0x1000a72f
mov dword [ebp - 0x46c], 1
jmp 0x1000a736
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 0xe61780ee
jae 0x1000a74e
mov dword [ebp - 0x6cc], 1
jmp 0x1000a755
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
sub eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xac]
jg 0x1000a775
mov dword [ebp - 0x474], 1
jmp 0x1000a77c
and dword [ebp - 0x474], 0
cmp dword [ebp - 0x474], 0xab3c
jge 0x1000a794
mov dword [ebp - 0x7fc], 1
jmp 0x1000a79b
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x118], 0xffffffed
jmp 0x1000a7cc
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffe4
jle 0x1000abaf
mov dword [ebp - 0x338], 1
mov dword [ebp - 0x1020], 0xfafe44fa
push 2
lea ecx, [ebp - 0xd8c]
call fcn.1001610f
mov byte [ebp - 4], 9
mov dword [ebp - 0x1028], 0xfffffffe
mov dword [ebp - 0xa34], 0xa8e8
mov dword [ebp - 0x1030], 0xfffffff8
mov dword [ebp - 0xaf4], 1
mov dword [ebp - 0x980], 0xfffffffb
push 1
lea ecx, [ebp - 0x10a0]
call fcn.1001610f
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x300], 0xfff7
or dword [ebp - 0xc28], 0xffffffff
or dword [ebp - 0xc24], 0xffffffff
or dword [ebp - 0xc20], 0xffffffff
or dword [ebp - 0xc1c], 0xffffffff
lea ecx, [ebp - 0x2c5]
call fcn.10008f33
push eax
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0xc28]
push eax
lea ecx, [ebp - 0x12a8]
call fcn.100161bc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1090]
call fcn.1001616b
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x988], 0x18e49b9d
mov dword [ebp - 0xac8], 0x3b75a479
mov dword [ebp - 0x20], 0
jmp 0x1000a8c4
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000a8da
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1250], 0x6171
jmp 0x1000a8bd
mov dword [ebp - 0x20], 0
jmp 0x1000a8ea
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1000a906
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd8c]
call fcn.100161ad
mov dword [eax], 0x7b187b35
jmp 0x1000a8e3
mov dword [ebp - 0x20], 0
jmp 0x1000a916
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000a92c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1338], 1
jmp 0x1000a90f
mov dword [ebp - 0x20], 0
jmp 0x1000a93c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1000a958
push dword [ebp - 0x20]
lea ecx, [ebp - 0x10a0]
call fcn.100161ad
mov dword [eax], 0xfffffff7
jmp 0x1000a935
mov eax, dword [ebp - 0xaec]
add eax, dword [ebp - 0xaf4]
jne 0x1000aa08
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1038], eax
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x1040], eax
push 0
lea ecx, [ebp - 0x1090]
call fcn.100161ad
xor eax, eax
sub eax, dword [ebp - 0xa34]
mov dword [ebp - 0x978], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa64]
cmp dword [ebp + eax - 0x1250], ecx
jge 0x1000a9be
mov dword [ebp - 0x47c], 1
jmp 0x1000a9c5
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0xe6a4
jne 0x1000a9de
xor eax, eax
jne 0x1000a9de
and dword [ebp - 0x6d4], 0
jmp 0x1000a9e8
mov dword [ebp - 0x6d4], 1
push 0
lea ecx, [ebp - 0xd8c]
call fcn.100161ad
mov ecx, dword [ebp - 0x6d4]
add ecx, dword [eax]
jne 0x1000aa08
and dword [ebp - 0x484], 0
jmp 0x1000aa12
mov dword [ebp - 0x484], 1
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 4
jb 0x1000aa3f
mov dword [ebp - 0x48c], 1
jmp 0x1000aa46
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0xbe523508
jb 0x1000aa5e
mov dword [ebp - 0x6dc], 1
jmp 0x1000aa65
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x980]
add eax, dword [ebp - 0x6dc]
cmp eax, 0xffff
jae 0x1000aa84
mov dword [ebp - 0x494], 1
jmp 0x1000aa8b
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
sub eax, dword [ebp - 0xa60]
jne 0x1000aaa9
push 7
pop eax
test eax, eax
jne 0x1000aaa9
and dword [ebp - 0x804], 0
jmp 0x1000aab3
mov dword [ebp - 0x804], 1
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x49c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x49c]
mov dword [ebp + eax - 0x1338], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1250]
sub eax, dword [ebp - 0x804]
cmp dword [ebp - 0x49c], eax
jle 0x1000ab05
mov dword [ebp - 0x6e4], 1
jmp 0x1000ab0c
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x988]
cmp dword [ebp - 0x6e4], eax
jne 0x1000ab26
mov dword [ebp - 0x4a4], 1
jmp 0x1000ab2d
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0xfff7
jb 0x1000ab45
mov dword [ebp - 0x8b4], 1
jmp 0x1000ab4c
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0xac8]
cmp dword [ebp - 0x8b4], eax
jge 0x1000ab66
mov dword [ebp - 0x4ac], 1
jmp 0x1000ab6d
and dword [ebp - 0x4ac], 0
imul eax, dword [ebp - 0x4ac], 0x3af9
mov dword [ebp - 0x990], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1090]
call fcn.10016191
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10a0]
call fcn.10016191
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd8c]
call fcn.10016191
jmp 0x1000a7bf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xda4]
call fcn.10016191
mov dword [ebp - 0x50c], 0xda2ae7b7
mov dword [ebp - 0x134], 0x91a049fe
push 2
lea ecx, [ebp - 0xdbc]
call fcn.1001610f
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x19c], 0
jmp 0x1000abff
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x1000ac21
push dword [ebp - 0x19c]
lea ecx, [ebp - 0xdbc]
call fcn.100161ad
mov dword [eax], 0x2374
jmp 0x1000abf2
mov dword [ebp - 0x134], 0
jmp 0x1000ac3a
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffee
jl 0x1000ad40
push 1
lea ecx, [ebp - 0xb84]
call fcn.1001610f
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xa68], 0xfffffff8
mov dword [ebp - 0x254], 0
jmp 0x1000ac7b
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 1
jge 0x1000ac9d
push dword [ebp - 0x254]
lea ecx, [ebp - 0xb84]
call fcn.100161ad
mov dword [eax], 0x70cd
jmp 0x1000ac6e
push 1
lea ecx, [ebp - 0xdbc]
call fcn.100161ad
mov dword [ebp - 0x6ec], eax
push 0
lea ecx, [ebp - 0xb84]
call fcn.100161ad
mov ecx, dword [ebp - 0x6ec]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x134]
sub eax, 3
mov ecx, dword [ebp - 0x6ec]
cmp dword [ecx], eax
jg 0x1000ace6
mov dword [ebp - 0x4b4], 1
jmp 0x1000aced
and dword [ebp - 0x4b4], 0
push 0
lea ecx, [ebp - 0xb84]
call fcn.100161ad
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4b4]
jle 0x1000ad16
mov eax, 0x8591
test eax, eax
jne 0x1000ad16
and dword [ebp - 0x80c], 0
jmp 0x1000ad20
mov dword [ebp - 0x80c], 1
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0xa68], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xb84]
call fcn.10016191
jmp 0x1000ac2d
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x1000ad66
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdbc]
call fcn.10016191
mov dword [ebp - 0xc4], 0x4c90d297
mov dword [ebp - 0xa4], 2
mov dword [ebp - 0x98], 0xe043eef7
mov dword [ebp - 0x1048], 0xfffffffc
mov dword [ebp - 0x1050], 0xcc90c63b
mov dword [ebp - 0x1058], 0
mov dword [ebp - 0x1060], 0x9d073d4
mov dword [ebp - 0x1198], 0xc17a3f0a
mov dword [ebp - 0x11a0], 0xffffffff
mov dword [ebp - 0x11e8], 1
mov dword [ebp - 0x11f0], 0xfe1f230
mov dword [ebp - 0x11f8], 0
mov dword [ebp - 0x1200], 0xde6b786a
mov dword [ebp - 0x1208], 0x181f51b4
push 2
lea ecx, [ebp - 0x10b0]
call fcn.1001610f
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x1210], 0xfffffffe
mov dword [ebp - 0x8c4], 0xb96bc97
mov dword [ebp - 0x1a4], 0
jmp 0x1000ae42
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x1000ae64
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x10b0]
call fcn.100161ad
mov dword [eax], 0x5e175309
jmp 0x1000ae35
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xc4], eax
jne 0x1000ae7e
mov dword [ebp - 0x8a4], 1
jmp 0x1000ae85
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x1218], eax
cmp dword [ebp - 0xc4], 0x56e7
je 0x1000aea9
mov dword [ebp - 0x4bc], 1
jmp 0x1000aeb0
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xa4], eax
jne 0x1000aed6
mov dword [ebp - 0x6f4], 1
jmp 0x1000aedd
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x6f4], 0xa1cf
jl 0x1000aef5
mov dword [ebp - 0x4c4], 1
jmp 0x1000aefc
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x4c4]
jl 0x1000af16
mov dword [ebp - 0x4cc], 1
jmp 0x1000af1d
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x8a4]
cmp eax, dword [ebp - 0x4cc]
jl 0x1000af37
mov dword [ebp - 0x6fc], 1
jmp 0x1000af3e
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x6fc]
jne 0x1000af5e
cmp dword [ebp - 0xa4], 0
jne 0x1000af5e
and dword [ebp - 0x4d4], 0
jmp 0x1000af68
mov dword [ebp - 0x4d4], 1
cmp dword [ebp - 0x4d4], 0x1f0d
jge 0x1000af80
mov dword [ebp - 0x814], 1
jmp 0x1000af87
and dword [ebp - 0x814], 0
cmp dword [ebp - 0x814], 0xcc9f
jle 0x1000af9f
mov dword [ebp - 0x4dc], 1
jmp 0x1000afa6
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x4dc], eax
jge 0x1000afc0
mov dword [ebp - 0x704], 1
jmp 0x1000afc7
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x704]
je 0x1000b025
cmp dword [ebp - 0x98], 0
je 0x1000b025
mov dword [ebp - 0x4e4], 0x2d683a7e
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa4], 0xfffffff0
jmp 0x1000b00d
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xfffffff6
jg 0x1000b023
cmp dword [ebp - 0x4e4], 0
je 0x1000b021
jmp 0x1000b023
jmp 0x1000b000
jmp 0x1000b082
mov dword [ebp - 0xe5c], 0xfff7
mov dword [ebp - 0xe58], 0xfff7
mov dword [ebp - 0xe54], 0xfff7
mov dword [ebp - 0xe50], 0xfff7
mov dword [ebp - 0x98], 0
jmp 0x1000b066
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x1000b082
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xe5c], 5
jmp 0x1000b059
mov eax, dword [ebp - 0x8c4]
inc eax
mov dword [ebp - 0x8c4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10b0]
call fcn.10016191
mov dword [ebp - 0x71c], 1
mov dword [ebp - 0x1ac], 0x9000d4e7
mov dword [ebp - 0x21c], 0
jmp 0x1000b0cb
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jge 0x1000b0e7
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x1340], 0xb9102071
jmp 0x1000b0be
mov dword [ebp - 0x1ac], 0
jmp 0x1000b100
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jg 0x1000b15d
mov dword [ebp - 0x274], 5
mov dword [ebp - 0x274], 1
jmp 0x1000b12c
mov eax, dword [ebp - 0x274]
dec eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
jl 0x1000b15b
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1000b159
push 0xda3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x1000b11f
jmp 0x1000b0f3
push 1
lea ecx, [ebp - 0x924]
call fcn.1001610f
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x1220], 0xfffffff7
mov dword [ebp - 0x1b4], 0
jmp 0x1000b194
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
jge 0x1000b1b6
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x924]
call fcn.100161ad
mov dword [eax], 0x665683c8
jmp 0x1000b187
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x1000b1d5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0
lea ecx, [ebp - 0x924]
call fcn.100161ad
mov eax, 0x6e7f737a
test eax, eax
je 0x1000b233
push 0
lea ecx, [ebp - 0x924]
call fcn.100161ad
cmp dword [eax], 0
jne 0x1000b209
mov dword [ebp - 0x4ec], 1
jmp 0x1000b210
and dword [ebp - 0x4ec], 0
push 0
lea ecx, [ebp - 0x924]
call fcn.100161ad
mov ecx, dword [ebp - 0x4ec]
cmp ecx, dword [eax]
jne 0x1000b233
mov dword [ebp - 0x70c], 1
jmp 0x1000b23a
and dword [ebp - 0x70c], 0
push 0
lea ecx, [ebp - 0x924]
call fcn.100161ad
mov eax, dword [eax]
cmp eax, dword [ebp - 0x70c]
jle 0x1000b25d
mov dword [ebp - 0x4f4], 1
jmp 0x1000b264
and dword [ebp - 0x4f4], 0
push 0
lea ecx, [ebp - 0x924]
call fcn.100161ad
mov ecx, dword [ebp - 0x4f4]
cmp ecx, dword [eax]
je 0x1000b287
mov dword [ebp - 0x81c], 1
jmp 0x1000b28e
and dword [ebp - 0x81c], 0
mov esi, 0x7cb3
sub esi, dword [ebp - 0x81c]
push 0
lea ecx, [ebp - 0x924]
call fcn.100161ad
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x924]
call fcn.10016191
mov dword [ebp - 0x4fc], 0xfb0b0297
mov dword [ebp - 0x998], 2
mov dword [ebp - 0x11c], 0xffffffff
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x1228], eax
cmp dword [ebp - 0x4fc], 0xfffc
jbe 0x1000b2f9
mov dword [ebp - 0x714], 1
jmp 0x1000b300
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x998]
cmp dword [ebp - 0x714], eax
jge 0x1000b31a
mov dword [ebp - 0x504], 1
jmp 0x1000b321
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x11c], 0xfffffff6
jmp 0x1000b346
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 5
jne 0x1000b3d8
mov dword [ebp - 0x224], 0
jmp 0x1000b36c
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 4
jge 0x1000b388
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x1280], 0xb055cc25
jmp 0x1000b35f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1280]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1280], eax
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1000b3d3
push 0x20a3
push 0x870
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x1000b339
mov dword [ebp - 0xb50], 0x8d9a2b82
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x1230], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x1238], eax
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x120], eax
jg 0x1000b414
mov dword [ebp - 0x8b0], 1
jmp 0x1000b41b
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x1bc]
sub eax, dword [ebp - 0x50c]
mov dword [ebp - 0x71c], eax
mov eax, dword [ebp - 0x71c]
neg eax
cmp eax, 0x8b16
jge 0x1000b454
mov dword [ebp - 0x514], 1
jmp 0x1000b45b
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x514], eax
jl 0x1000b475
mov dword [ebp - 0x824], 1
jmp 0x1000b47c
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x824], eax
jne 0x1000b496
mov dword [ebp - 0x51c], 1
jmp 0x1000b49d
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x51c], eax
jle 0x1000b4b7
mov dword [ebp - 0x724], 1
jmp 0x1000b4be
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x724], eax
jle 0x1000b4d8
mov dword [ebp - 0x524], 1
jmp 0x1000b4df
and dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 0xd0e
jg 0x1000b4f7
mov dword [ebp - 0x8cc], 1
jmp 0x1000b4fe
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0xb50], eax
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x1000b528
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov dword [ebp - 0xc78], 7
mov dword [ebp - 0xc74], 7
mov dword [ebp - 0xc70], 7
mov dword [ebp - 0xc6c], 7
lea ecx, [ebp - 0x31d]
call fcn.10008f33
push eax
lea eax, [ebp - 0xc68]
push eax
lea eax, [ebp - 0xc78]
push eax
lea ecx, [ebp - 0x12b8]
call fcn.100161bc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x350]
call fcn.1001616b
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x9a8], 0xfffffffc
mov dword [ebp - 0x3c], 3
jmp 0x1000b5ad
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1000b962
mov dword [ebp - 0x110], 0xffffffff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x350]
call fcn.100161ad
cmp dword [eax], 0
je 0x1000b5d9
jmp 0x1000b962
mov dword [ebp - 0x110], 0
jmp 0x1000b5f2
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 3
jg 0x1000b95d
mov dword [ebp - 0xcc], 1
push 3
lea ecx, [ebp - 0xdd4]
call fcn.1001610f
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x25c], 0
jmp 0x1000b633
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 3
jge 0x1000b655
push dword [ebp - 0x25c]
lea ecx, [ebp - 0xdd4]
call fcn.100161ad
mov dword [eax], 0x658069d1
jmp 0x1000b626
mov dword [ebp - 0xcc], 3
jmp 0x1000b66e
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x1000b93d
mov dword [ebp - 0x1c4], 0xfffffff8
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x350]
call fcn.100161ad
mov esi, eax
push dword [ebp - 0x110]
lea ecx, [ebp - 0x350]
call fcn.100161ad
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x1c4], 3
jmp 0x1000b6c3
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jl 0x1000b938
mov dword [ebp - 0xa70], 0x87662b0a
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x350]
call fcn.100161ad
cmp dword [eax], 1
jge 0x1000b6f9
mov dword [ebp - 0x72c], 1
jmp 0x1000b700
and dword [ebp - 0x72c], 0
mov esi, dword [ebp - 0xcc]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x350]
call fcn.100161ad
cmp esi, dword [eax]
je 0x1000b724
mov dword [ebp - 0x52c], 1
jmp 0x1000b72b
and dword [ebp - 0x52c], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x350]
call fcn.100161ad
mov ecx, dword [ebp - 0x52c]
sub ecx, dword [eax]
sub ecx, 0x48bd921b
cmp dword [ebp - 0x72c], ecx
jg 0x1000b75b
mov dword [ebp - 0x534], 1
jmp 0x1000b762
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
add eax, 9
je 0x1000b789
push 1
lea ecx, [ebp - 0x350]
call fcn.100161ad
cmp dword [eax], 0
je 0x1000b784
jmp 0x1000b938
jmp 0x1000b933
mov dword [ebp - 0x22c], 0x5b1510af
mov dword [ebp - 0x544], 0xffffffff
mov dword [ebp - 0x22c], 0
jmp 0x1000b7b6
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jg 0x1000b933
push 2
lea ecx, [ebp - 0xb0c]
call fcn.1001610f
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x1cc], 0
jmp 0x1000b7ed
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jge 0x1000b80f
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0xb0c]
call fcn.100161ad
mov dword [eax], 0xa2f617a9
jmp 0x1000b7e0
mov esi, dword [ebp - 0xcc]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x350]
call fcn.100161ad
cmp esi, dword [eax]
jge 0x1000b839
mov eax, 0x9eb11de2
test eax, eax
jne 0x1000b839
and dword [ebp - 0x9a0], 0
jmp 0x1000b843
mov dword [ebp - 0x9a0], 1
push 0
lea ecx, [ebp - 0xb0c]
call fcn.100161ad
mov esi, dword [ebp - 0x3c]
push 0
lea ecx, [ebp - 0xb0c]
call fcn.100161ad
cmp esi, dword [eax]
jl 0x1000b874
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x1000b874
and dword [ebp - 0x82c], 0
jmp 0x1000b87e
mov dword [ebp - 0x82c], 1
push 0
lea ecx, [ebp - 0xb0c]
call fcn.100161ad
mov ecx, dword [ebp - 0x82c]
cmp ecx, dword [eax]
jne 0x1000b8a1
mov dword [ebp - 0x53c], 1
jmp 0x1000b8a8
and dword [ebp - 0x53c], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x350]
call fcn.100161ad
mov eax, dword [eax]
cmp eax, dword [ebp - 0x53c]
jg 0x1000b8d2
mov eax, 0x51938d10
test eax, eax
jne 0x1000b8d2
and dword [ebp - 0x734], 0
jmp 0x1000b8dc
mov dword [ebp - 0x734], 1
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x544], eax
push 2
lea ecx, [ebp - 0xdd4]
call fcn.100161ad
mov esi, eax
push dword [ebp - 0x110]
lea ecx, [ebp - 0x350]
call fcn.100161ad
mov ecx, dword [esi]
add ecx, dword [eax]
mov dword [ebp - 0x544], ecx
mov eax, 0x8b26de0d
neg eax
mov dword [ebp - 0xa70], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xb0c]
call fcn.10016191
jmp 0x1000b7a9
jmp 0x1000b6b6
jmp 0x1000b661
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x9a8], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xdd4]
call fcn.10016191
jmp 0x1000b5e5
jmp 0x1000b5a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x350]
call fcn.10016191
mov dword [ebp - 0x1240], 0
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1000b99a
push 0x1ebf
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x1000b9b4
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0xbc4], 7
mov dword [ebp - 0xbc0], 7
mov dword [ebp - 0xbbc], 7
mov dword [ebp - 0xbb8], 7
lea ecx, [ebp - 0x2cd]
call fcn.10008f33
push eax
lea eax, [ebp - 0xbb4]
push eax
lea eax, [ebp - 0xbc4]
push eax
lea ecx, [ebp - 0x1310]
call fcn.100161bc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x360]
call fcn.1001616b
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0x354], 0x9c3d069f
mov dword [ebp - 0x9b8], 8
mov dword [ebp - 0xb10], 1
mov dword [ebp - 0x9b0], 0xffffffff
mov dword [ebp - 0x73c], 9
mov dword [ebp - 0xad0], 0
mov dword [ebp - 0x744], 1
mov dword [ebp - 0x308], 5
mov dword [ebp - 0x968], 0x435
mov dword [ebp - 0x11d4], 0x7348
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x284], 0
jmp 0x1000baa9
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jge 0x1000bac5
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0x100c], 0xffffffff
jmp 0x1000ba9c
mov dword [ebp - 0xd4], 0
jmp 0x1000bade
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x19
je 0x1000bbeb
mov dword [ebp - 0x1d4], 0x638ecf54
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x1000bb1b
push 0
push 0xbc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov dword [ebp - 0x1d4], 0xd
jmp 0x1000bb34
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xfffffffa
jne 0x1000bbe6
push 4
lea ecx, [ebp - 0xdec]
call fcn.1001610f
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x128], 0x23b1a956
mov dword [ebp - 0x234], 0
jmp 0x1000bb75
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 4
jge 0x1000bb97
push dword [ebp - 0x234]
lea ecx, [ebp - 0xdec]
call fcn.100161ad
mov dword [eax], 0x7222
jmp 0x1000bb68
mov dword [ebp - 0x128], 0
jmp 0x1000bbb0
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 4
jge 0x1000bbd2
push dword [ebp - 0x128]
lea ecx, [ebp - 0xdec]
call fcn.100161ad
mov dword [eax], 0x8cc
jmp 0x1000bba3
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xdec]
call fcn.10016191
jmp 0x1000bb27
jmp 0x1000bad1
cmp dword [ebp - 0xad0], 0xae2718b9
jne 0x1000bc09
cmp dword [ebp - 0xd4], 0
jne 0x1000bc09
and dword [ebp - 0x8d4], 0
jmp 0x1000bc13
mov dword [ebp - 0x8d4], 1
cmp dword [ebp - 0x8d4], 0
jae 0x1000bc28
mov dword [ebp - 0x54c], 1
jmp 0x1000bc2f
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x9b0]
cmp dword [ebp - 0x54c], eax
jge 0x1000bc49
mov dword [ebp - 0x554], 1
jmp 0x1000bc50
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
cmp eax, dword [ebp - 0x554]
je 0x1000bc82
mov dword [ebp - 0xa78], 1
jmp 0x1000bc89
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0xe90], eax
cmp dword [ebp - 0x9b8], 0
jne 0x1000bcb0
cmp dword [ebp - 0xb10], 0
jne 0x1000bcb0
and dword [ebp - 0x834], 0
jmp 0x1000bcba
mov dword [ebp - 0x834], 1
mov eax, dword [ebp - 0x968]
cmp dword [ebp - 0x834], eax
jge 0x1000bcd4
mov dword [ebp - 0x55c], 1
jmp 0x1000bcdb
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0xa80]
cmp eax, dword [ebp - 0x9c8]
jge 0x1000bd1a
mov dword [ebp - 0x564], 1
jmp 0x1000bd21
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x744]
cmp dword [ebp - 0x564], eax
jg 0x1000bd3b
mov dword [ebp - 0x918], 1
jmp 0x1000bd42
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0xd4]
sub eax, dword [ebp - 0x918]
imul eax, eax, 0
test eax, eax
je 0x1000bdac
mov dword [ebp - 0xad8], 0x7d3709e8
mov dword [ebp - 0xe7c], 7
mov dword [ebp - 0x11c8], 0xeae11771
mov dword [ebp - 0x11c4], 0xeae11771
mov dword [ebp - 0x11c0], 0xeae11771
mov dword [ebp - 0x11bc], 0xeae11771
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
jmp 0x1000bdc2
mov dword [ebp - 0x9d0], 0xe1dc630d
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x9d0], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0xa30], 0xfffffffc
mov dword [ebp - 0x44], 3
jmp 0x1000bde3
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1000d6d9
mov dword [ebp - 0x10c], 0xffffffff
mov dword [ebp - 0x264], 0xec2e0cf5
mov dword [ebp - 0x11ec], 0x2ae7b79f
mov dword [ebp - 0xe84], 1
mov dword [ebp - 0x1014], 0x9ebf495e
mov dword [ebp - 0xe8c], 2
mov dword [ebp - 0x1154], 1
mov dword [ebp - 0xe94], 0x526c7153
mov dword [ebp - 0x101c], 1
mov dword [ebp - 0xe9c], 0xffffffff
mov dword [ebp - 0x122c], 0xfffffffa
mov dword [ebp - 0xea4], 0xfffffff9
mov dword [ebp - 0x1024], 1
mov dword [ebp - 0xeac], 0x6e523240
push 3
lea ecx, [ebp - 0x10c0]
call fcn.1001610f
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x1dc], 0
jmp 0x1000bea3
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x1000bec5
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x10c0]
call fcn.100161ad
mov dword [eax], 0xd40a7fc
jmp 0x1000be96
mov dword [ebp - 0x264], 0
jmp 0x1000bede
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 6
jge 0x1000c0ef
mov dword [ebp - 0x1164], 0x5af8b513
mov dword [ebp - 0xeb4], 0xfffffffc
mov dword [ebp - 0x102c], 4
mov dword [ebp - 0xebc], 0xba29f583
mov dword [ebp - 0x11f4], 1
push 2
lea ecx, [ebp - 0xe04]
call fcn.1001610f
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x14], 0
jmp 0x1000bf3e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000bf54
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1288], 0xffff
jmp 0x1000bf37
mov dword [ebp - 0x14], 0
jmp 0x1000bf64
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000bf7a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x94c], 1
jmp 0x1000bf5d
mov dword [ebp - 0x14], 0
jmp 0x1000bf8a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000bfa0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1358], 0x5f8d9a2b
jmp 0x1000bf83
mov dword [ebp - 0x14], 0
jmp 0x1000bfb0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000bfcc
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe04]
call fcn.100161ad
mov dword [eax], 0xfffffff7
jmp 0x1000bfa9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x94c], 0
jmp 0x1000bffa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x94c], 1
jg 0x1000c0db
mov dword [ebp - 0xa88], 3
mov dword [ebp - 0xec4], 0
mov dword [ebp - 0x1034], 0x9af3
mov dword [ebp - 0x9e0], 0
mov dword [ebp - 0x1e4], 0
jmp 0x1000c04f
cmp dword [ebp - 0x1e4], 2
jge 0x1000c06b
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xe04]
call fcn.10016191
jmp 0x1000bed1
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x10c0]
call fcn.10016191
mov dword [ebp - 0xa90], 0xb7c7ce53
mov dword [ebp - 0x130], 0xe97eede0
mov dword [ebp - 0xecc], 0xfffffff6
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x130], 0
jmp 0x1000c141
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 7
jl 0x1000c16b
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x1000c169
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
jmp 0x1000c134
push dword [ebp - 0x44]
lea ecx, [ebp - 0x360]
call fcn.100161ad
cmp dword [eax], 0
je 0x1000c183
jmp 0x1000d6d9
mov dword [ebp - 0xbec], 0x3df75dce
mov dword [ebp - 0xbe8], 0x3df75dce
mov dword [ebp - 0xbe4], 0x3df75dce
mov dword [ebp - 0xbe0], 0x3df75dce
lea ecx, [ebp - 0x361]
call fcn.10008f33
push eax
lea eax, [ebp - 0xbdc]
push eax
lea eax, [ebp - 0xbec]
push eax
lea ecx, [ebp - 0x1290]
call fcn.100161bc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb9c]
call fcn.1001616b
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x108], 0x5bed8572
mov dword [ebp - 0x5cc], 0xfffffffe
mov dword [ebp - 0x50], 3
jmp 0x1000c20f
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x1000c931
mov dword [ebp - 0x2c], 0x2e31d832
mov dword [ebp - 0x77c], 0xfffffff9
push 3
lea ecx, [ebp - 0xe34]
call fcn.1001610f
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x23c], 0
jmp 0x1000c254
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 3
jge 0x1000c276
push dword [ebp - 0x23c]
lea ecx, [ebp - 0xe34]
call fcn.100161ad
mov dword [eax], 0x401bc10b
jmp 0x1000c247
mov dword [ebp - 0x2c], 0
jmp 0x1000c286
cmp dword [ebp - 0x2c], 3
jg 0x1000c91d
mov dword [ebp - 0xc14], 0x44ad72d7
mov dword [ebp - 0xc10], 0x44ad72d7
mov dword [ebp - 0xc0c], 0x44ad72d7
mov dword [ebp - 0xc08], 0x44ad72d7
lea ecx, [ebp - 0x2d5]
call fcn.10008f33
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0xc14]
push eax
lea ecx, [ebp - 0x12a0]
call fcn.100161bc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x29c]
call fcn.1001616b
mov byte [ebp - 4], 0x19
mov dword [ebp - 0xa0], 0x98e64e6d
push 2
lea ecx, [ebp - 0x29c]
call fcn.100161ad
and dword [eax], 0
jmp 0x1000c331
push 2
lea ecx, [ebp - 0x29c]
call fcn.100161ad
cmp dword [eax], 4
jge 0x1000c365
push 2
lea ecx, [ebp - 0x29c]
call fcn.100161ad
push dword [eax]
lea ecx, [ebp - 0xb9c]
call fcn.100161ad
mov dword [eax], 0xedcc590f
jmp 0x1000c30d
mov dword [ebp - 0xa0], 0
jmp 0x1000c37e
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xe34]
call fcn.10016191
jmp 0x1000c208
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xb9c]
call fcn.10016191
mov dword [ebp - 0x10c], 0
jmp 0x1000c959
cmp dword [ebp - 0x10c], 3
jg 0x1000d6d4
mov dword [ebp - 0xdc], 1
push 3
lea ecx, [ebp - 0xdf8]
call fcn.1001610f
mov byte [ebp - 4], 0x1b
push 4
lea ecx, [ebp - 0xd20]
call fcn.1001610f
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x140], 0xfffffff7
mov dword [ebp - 0x604], 1
mov dword [ebp - 0xa10], 0xaa50887c
mov dword [ebp - 0xb20], 0xfffffff7
mov dword [ebp - 0xedc], 0xe2499e68
mov dword [ebp - 0xa08], 1
mov dword [ebp - 0x121c], 4
mov dword [ebp - 0xee4], 1
mov dword [ebp - 0x1044], 0x50b7f45b
mov dword [ebp - 0xeec], 0x93cc9d6c
mov dword [ebp - 0xe70], 0
mov dword [ebp - 0xef4], 5
mov dword [ebp - 0x104c], 0xc67a9553
mov dword [ebp - 0xefc], 0x4f5fdfda
mov dword [ebp - 0x11fc], 0x726f2c0e
mov dword [ebp - 0xf04], 0
mov dword [ebp - 0xaa0], 0xfffffff6
mov dword [ebp - 0xa98], 0xffffffff
mov dword [ebp - 0x1054], 0x41af53c8
mov dword [ebp - 0xf0c], 0xffffffff
mov dword [ebp - 0xb60], 0
mov dword [ebp - 0x1194], 0x5ce76562
mov dword [ebp - 0xf14], 0x1c721796
mov dword [ebp - 0x74], 0
jmp 0x1000ca92
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x1000caae
push dword [ebp - 0x74]
lea ecx, [ebp - 0xd20]
call fcn.100161ad
mov dword [eax], 0xd72276b
jmp 0x1000ca8b
mov dword [ebp - 0x74], 0
jmp 0x1000cabe
cmp dword [ebp - 0x74], 1
jge 0x1000cad4
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x105c], 6
jmp 0x1000cab7
cmp dword [ebp - 0xa8], 0
je 0x1000cb10
jmp 0x1000bddc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x360]
call fcn.10016191
mov dword [ebp - 0xc8c], 7
mov dword [ebp - 0xc88], 7
mov dword [ebp - 0xc84], 7
mov dword [ebp - 0xc80], 7
lea ecx, [ebp - 0x343]
call fcn.10008f33
push eax
lea eax, [ebp - 0xc7c]
push eax
lea eax, [ebp - 0xc8c]
push eax
lea ecx, [ebp - 0x12e8]
call fcn.100161bc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x370]
call fcn.1001616b
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x40], 0
mov dword [ebp - 0xb30], 0xfffffffc
mov dword [ebp - 0x40], 3
jmp 0x1000d76d
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1000db22
mov dword [ebp - 0x114], 0xffffffff
push dword [ebp - 0x40]
lea ecx, [ebp - 0x370]
call fcn.100161ad
cmp dword [eax], 0
je 0x1000d799
jmp 0x1000db22
mov dword [ebp - 0x114], 0
jmp 0x1000d7b2
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jg 0x1000db1d
mov dword [ebp - 0xe4], 1
push 3
lea ecx, [ebp - 0xcf0]
call fcn.1001610f
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x1a0], 0
jmp 0x1000d7f3
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x1000d815
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xcf0]
call fcn.100161ad
mov dword [eax], 0x658069d1
jmp 0x1000d7e6
mov dword [ebp - 0xe4], 3
jmp 0x1000d82e
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jl 0x1000dafd
mov dword [ebp - 0x1a8], 0xfffffff8
push dword [ebp - 0x40]
lea ecx, [ebp - 0x370]
call fcn.100161ad
mov esi, eax
push dword [ebp - 0x114]
lea ecx, [ebp - 0x370]
call fcn.100161ad
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x1a8], 3
jmp 0x1000d883
cmp dword [ebp - 0x1a8], 0
jl 0x1000daf8
mov dword [ebp - 0xa38], 0x87662b0a
push dword [ebp - 0x40]
lea ecx, [ebp - 0x370]
call fcn.100161ad
cmp dword [eax], 1
jge 0x1000d8b9
mov dword [ebp - 0x664], 1
jmp 0x1000d8c0
and dword [ebp - 0x664], 0
mov esi, dword [ebp - 0xe4]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x370]
call fcn.100161ad
cmp esi, dword [eax]
je 0x1000d8e4
mov dword [ebp - 0x7c4], 1
jmp 0x1000d8eb
and dword [ebp - 0x7c4], 0
push dword [ebp - 0x40]
lea ecx, [ebp - 0x370]
call fcn.100161ad
mov ecx, dword [ebp - 0x7c4]
sub ecx, dword [eax]
sub ecx, 0x48bd921b
cmp dword [ebp - 0x664], ecx
jg 0x1000d91b
mov dword [ebp - 0x398], 1
jmp 0x1000d922
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x398]
add eax, 9
je 0x1000d949
push 1
lea ecx, [ebp - 0x370]
call fcn.100161ad
cmp dword [eax], 0
je 0x1000d944
mov dword [ebp - 0x1b0], 0x5b1510af
mov dword [ebp - 0x3c0], 0xffffffff
mov dword [ebp - 0x1b0], 0
jmp 0x1000d976
jmp 0x1000d821
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xb30], eax
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xcf0]
call fcn.10016191
jmp 0x1000d7a5
jmp 0x1000d766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x370]
call fcn.10016191
push 3
lea ecx, [ebp - 0xdb0]
call fcn.1001610f
mov dword [ebp - 4], 0x26
push 1
lea ecx, [ebp - 0x10f0]
call fcn.1001610f
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x3d8], 0
mov dword [ebp - 0xa40], 0
mov dword [ebp - 0x84], 0
jmp 0x1000db83
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1000dba5
push dword [ebp - 0x84]
lea ecx, [ebp - 0xdb0]
call fcn.100161ad
mov dword [eax], 0x4a2a4f40
jmp 0x1000db76
mov dword [ebp - 0x84], 0
jmp 0x1000dbbe
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1000dbe0
push dword [ebp - 0x84]
lea ecx, [ebp - 0x10f0]
call fcn.100161ad
mov dword [eax], 0x7c7be02
jmp 0x1000dbb1
push 0
lea ecx, [ebp - 0xdb0]
call fcn.100161ad
mov eax, 0x2937
test eax, eax
je 0x1000dc07
xor eax, eax
inc eax
je 0x1000dc07
mov dword [ebp - 0x3c8], 1
jmp 0x1000dc0e
and dword [ebp - 0x3c8], 0
cmp dword [ebp - 0x3c8], 0xffff
jne 0x1000dc26
mov dword [ebp - 0x3d0], 1
jmp 0x1000dc2d
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0xa40], eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x10f0]
call fcn.10016191
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb0]
call fcn.10016191
push 3
lea ecx, [ebp - 0xd08]
call fcn.1001610f
mov dword [ebp - 4], 0x28
push 1
lea ecx, [ebp - 0x1100]
call fcn.1001610f
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x3f0], 0
mov dword [ebp - 0xac0], 0
mov dword [ebp - 0x7c], 0
jmp 0x1000dcac
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000dcc8
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xd08]
call fcn.100161ad
mov dword [eax], 0x4a2a4f40
jmp 0x1000dca5
mov dword [ebp - 0x7c], 0
jmp 0x1000dcd8
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1000dcf4
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x1100]
call fcn.100161ad
mov dword [eax], 0x7c7be02
jmp 0x1000dcd1
push 0
lea ecx, [ebp - 0xd08]
call fcn.100161ad
mov eax, 0x2937
test eax, eax
je 0x1000dd1b
xor eax, eax
inc eax
je 0x1000dd1b
mov dword [ebp - 0x3e0], 1
jmp 0x1000dd22
and dword [ebp - 0x3e0], 0
cmp dword [ebp - 0x3e0], 0xffff
jne 0x1000dd3a
mov dword [ebp - 0x3e8], 1
jmp 0x1000dd41
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0xac0], eax
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1100]
call fcn.10016191
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd08]
call fcn.10016191
mov dword [ebp - 0x5c], 0xfffffffd
mov dword [ebp - 0x1c8], 0xffffffff
mov dword [ebp - 0x15c], 0x45f5b1b6
push 2
lea ecx, [ebp - 0xd14]
call fcn.1001610f
mov dword [ebp - 4], 0x2a
push 3
lea ecx, [ebp - 0x1120]
call fcn.1001610f
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x2cc], 0xffffffff
mov dword [ebp - 0xa48], 0
mov dword [ebp - 0x6c], 0
jmp 0x1000dddb
cmp dword [ebp - 0x6c], 2
jge 0x1000ddf7