Function at 0x10009434
Capabilities:
Check os version
Get common file path
Get disk information
Identify system language via api
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10086e35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x110c
call fcn.100821b0
push esi
push edi
mov dword [ebp - 0x1b0], 0xfffffff7
mov dword [ebp - 0x1b0], 0
jmp 0x1000947b
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xfffffff6
jne 0x100094b4
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x100094a7
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
cmp dword [ebp - 0x1b0], 0
je 0x100094b2
jmp 0x1000946e
jmp 0x1000946e
mov dword [ebp - 0x210], 0xfffffff7
mov dword [ebp - 0x210], 0
jmp 0x100094d7
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xfffffff6
jne 0x10009510
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x10009503
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
cmp dword [ebp - 0x210], 0
je 0x1000950e
jmp 0x100094ca
jmp 0x100094ca
push 2
lea ecx, [ebp - 0xf5c]
call fcn.1001855e
and dword [ebp - 4], 0
mov dword [ebp - 0x248], 0xfffffff7
mov dword [ebp - 0x1044], 0xe838
mov dword [ebp - 0x2e0], 0
jmp 0x1000954e
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 2
jge 0x10009570
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xf5c]
call fcn.100185ee
mov dword [eax], 0x1713
jmp 0x10009541
mov dword [ebp - 0x248], 1
jmp 0x10009589
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x100095c3
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x100095c1
push 0x6c0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
jmp 0x1000957c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf5c]
call fcn.100185e9
mov dword [ebp - 0x1c8], 0xfffffff7
mov dword [ebp - 0xf0c], 0x648261f9
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x10009605
push 0x1a1
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1000963c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x129c
push 0x81f
push 0x15be
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x1c8], 0
jmp 0x10009655
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xfffffff6
jne 0x10009ba9
mov dword [ebp - 0x150], 1
mov dword [ebp - 0xd0], 0x94643cdf
push 4
lea ecx, [ebp - 0x9e0]
call fcn.1001855e
mov dword [ebp - 4], 1
mov dword [ebp - 0x390], 0x7f59ec13
mov dword [ebp - 0x2b0], 0
jmp 0x100096ad
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 4
jge 0x100096cf
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0x9e0]
call fcn.100185ee
mov dword [eax], 0xfffd
jmp 0x100096a0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x150], 0
jmp 0x100096f4
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jg 0x100098ce
mov dword [ebp - 0x1a0], 0x7071658a
mov dword [ebp - 0xb24], 0x42c3b03c
mov dword [ebp - 0xd0], 0
jmp 0x1000972e
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jg 0x100098c9
mov dword [ebp - 0x148], 0x51da622a
mov dword [ebp - 0x148], 3
jmp 0x1000975e
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jl 0x100097af
mov dword [ebp - 0x1c0], 6
mov dword [ebp - 0x1c0], 3
jmp 0x1000978a
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x100097ad
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x9e0]
call fcn.100185ee
cmp dword [eax], 0
je 0x100097ab
jmp 0x100097ad
jmp 0x1000977d
jmp 0x10009751
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x9e0]
call fcn.100185ee
cmp dword [eax], 0
jne 0x10009830
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x9e0]
call fcn.100185ee
mov eax, dword [eax]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x1a0]
inc eax
cmp eax, dword [ebp - 0x390]
je 0x100097ff
mov eax, 0x6255
test eax, eax
jne 0x100097ff
and dword [ebp - 0x6f4], 0
jmp 0x10009809
mov dword [ebp - 0x6f4], 1
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jne 0x10009830
cmp dword [ebp - 0x390], 0
jne 0x10009830
and dword [ebp - 0xa5c], 0
jmp 0x1000983a
mov dword [ebp - 0xa5c], 1
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1074], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xf14], eax
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x9e0]
call fcn.100185ee
mov ecx, dword [ebp - 0x1a0]
cmp dword [eax], ecx
jl 0x10009879
mov dword [ebp - 0xb1c], 1
jmp 0x10009880
and dword [ebp - 0xb1c], 0
mov eax, 0xcb8e0045
test eax, eax
jne 0x1000989b
cmp dword [ebp - 0x1a0], 0
jne 0x1000989b
and dword [ebp - 0x99c], 0
jmp 0x100098a5
mov dword [ebp - 0x99c], 1
push dword [ebp - 0x150]
lea ecx, [ebp - 0x9e0]
call fcn.100185ee
mov ecx, dword [ebp - 0x99c]
add ecx, dword [eax]
mov dword [ebp - 0xb24], ecx
jmp 0x10009721
jmp 0x100096e7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.100185e9
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x98], 0xffffffff
push 2
lea ecx, [ebp - 0xc6c]
call fcn.1001855e
mov dword [ebp - 4], 2
mov dword [ebp - 0xe20], 0xd9e2a8d3
mov dword [ebp - 0xe28], 0xfffffffb
mov dword [ebp - 0xe30], 1
mov dword [ebp - 0xe38], 0xc383c67e
mov dword [ebp - 0xe40], 5
mov dword [ebp - 0xe48], 0x710dd013
mov dword [ebp - 0x250], 0
jmp 0x10009957
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 2
jge 0x10009979
push dword [ebp - 0x250]
lea ecx, [ebp - 0xc6c]
call fcn.100185ee
mov dword [eax], 0xae77ab39
jmp 0x1000994a
cmp dword [ebp - 0x98], 1
jge 0x1000998e
mov dword [ebp - 0x9a4], 1
jmp 0x10009995
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x100099cc
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x100099ca
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x10009a02
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x10009a02
push 0x826
push 0
push 0
push 0x1367
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 0x98], 1
jmp 0x10009a1b
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x10009a9d
mov dword [ebp - 0x9ac], 7
mov dword [ebp - 0x308], 0
jmp 0x10009a47
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jge 0x10009a63
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0xe50], 0
jmp 0x10009a3a
push dword [ebp - 0x98]
lea ecx, [ebp - 0xc6c]
call fcn.100185ee
mov esi, eax
push dword [ebp - 0x98]
lea ecx, [ebp - 0xc6c]
call fcn.100185ee
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9ac]
dec eax
mov dword [ebp - 0x9ac], eax
jmp 0x10009a0e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc6c]
call fcn.100185e9
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x10009ac8
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [ebp - 0x9b4], 0xfffffff8
mov dword [ebp - 0xe58], 0xffffffff
mov dword [ebp - 0xe60], 0xa3062a4b
mov dword [ebp - 0x1f8], 0
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10009b16
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
xor eax, eax
inc eax
sub eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0x1f8]
jne 0x10009b33
mov dword [ebp - 0xb38], 1
jmp 0x10009b3a
and dword [ebp - 0xb38], 0
mov dword [ebp - 0x9b4], 7
imul eax, dword [ebp - 0x1f8], 0x67f6
cmp dword [ebp - 0x9b4], eax
je 0x10009b62
mov dword [ebp - 0x9bc], 1
jmp 0x10009b69
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x9bc], eax
jne 0x10009b83
mov dword [ebp - 0x87c], 1
jmp 0x10009b8a
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1c8], 0
je 0x10009ba4
jmp 0x10009648
jmp 0x10009648
mov dword [ebp - 0x258], 0
jmp 0x10009bc2
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x10009bde
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x2b8], 0xffffffff
jmp 0x10009bb5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2b8], 0xfffffff8
jmp 0x10009c0c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2b8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2b8], 0xfffffff9
jle 0x10009c46
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x10009c44
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x10009bf1
mov dword [ebp - 0x2e8], 0x60477862
mov dword [ebp - 0xe68], 0x8974b66
mov dword [ebp - 0xe70], 0
mov dword [ebp - 0xe78], 0xa065c2dd
mov dword [ebp - 0xe80], 0x5c0de450
mov dword [ebp - 0xe88], 0xf4df
mov dword [ebp - 0x400], 0xd978
mov dword [ebp - 0xe90], 0xbe26b5cf
mov dword [ebp - 0x260], 0
jmp 0x10009caf
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jge 0x10009ccb
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0xe98], 0xfffffffc
jmp 0x10009ca2
mov dword [ebp - 0x2e8], 7
jmp 0x10009ce4
mov eax, dword [ebp - 0x2e8]
dec eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0xfffffff2
jl 0x10009d27
mov dword [ebp - 0xb40], 1
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x10009d1a
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
cmp dword [ebp - 0xb40], 0
je 0x10009d25
jmp 0x10009cd7
jmp 0x10009cd7
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
mov dword [ebp - 0x268], 0
jmp 0x10009d4d
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 1
jge 0x10009d69
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0x2c0], 0xffffffff
jmp 0x10009d40
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2c0], 0xfffffff8
jmp 0x10009d97
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2c0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c0], 0xfffffff9
jle 0x10009dd1
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x10009dcf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x10009d7c
mov dword [ebp - 0x48], 1
push 3
lea ecx, [ebp - 0xc84]
call fcn.1001855e
mov dword [ebp - 4], 3
mov dword [ebp - 0x220], 0x9ea4087b
mov dword [ebp - 0x230], 0
jmp 0x10009e0f
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x10009e31
push dword [ebp - 0x230]
lea ecx, [ebp - 0xc84]
call fcn.100185ee
mov dword [eax], 0xd3cd3624
jmp 0x10009e02
mov dword [ebp - 0x48], 0
jmp 0x10009e41
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xa
jge 0x1000a142
mov dword [ebp - 0x180], 0
mov dword [ebp - 0xc04], 0xffff
mov dword [ebp - 0xc00], 0xffff
mov dword [ebp - 0xbfc], 0xffff
mov dword [ebp - 0xbf8], 0xffff
cmp dword [ebp - 0x180], 0
je 0x10009e8b
jmp 0x1000a142
mov dword [ebp - 0x180], 0
jmp 0x10009ea4
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jg 0x1000a13d
mov dword [ebp - 0x58], 0xcaad901
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x58]
jl 0x10009ecf
mov dword [ebp - 0x898], 1
jmp 0x10009ed6
and dword [ebp - 0x898], 0
cmp dword [ebp - 0x898], 0x81d534a2
jne 0x10009eee
mov dword [ebp - 0x408], 1
jmp 0x10009ef5
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x408], eax
jl 0x10009f0c
mov dword [ebp - 0x8a0], 1
jmp 0x10009f13
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x8a0], eax
jl 0x10009f22
cmp dword [ebp - 0x58], 0
mov eax, 0x10a6e
cmp eax, 0xffff
jae 0x10009f3a
mov dword [ebp - 0x340], 1
jmp 0x10009f41
and dword [ebp - 0x340], 0
push 0
lea ecx, [ebp - 0xc84]
call fcn.100185ee
mov ecx, dword [ebp - 0x340]
mov dword [eax], ecx
mov eax, dword [ebp - 0x340]
sub eax, dword [ebp - 0x48]
jne 0x10009f73
mov eax, 0xcab43068
test eax, eax
jne 0x10009f73
and dword [ebp - 0x410], 0
jmp 0x10009f7d
mov dword [ebp - 0x410], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc04]
cmp eax, dword [ebp - 0x410]
jne 0x10009fa3
cmp dword [ebp - 0x180], 0
jne 0x10009fa3
and dword [ebp - 0xb48], 0
jmp 0x10009fad
mov dword [ebp - 0xb48], 1
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xea8], eax
cmp dword [ebp - 0x48], 0x28cb
jle 0x10009fd4
mov dword [ebp - 0xb50], 1
jmp 0x10009fdb
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0x58]
add eax, 0x4644688d
mov dword [ebp - 0x220], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc04]
cmp dword [ebp - 0x48], eax
jle 0x1000a007
mov dword [ebp - 0xb58], 1
jmp 0x1000a00e
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xeb0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc04]
cmp dword [ebp - 0x58], eax
jge 0x1000a034
mov dword [ebp - 0x8a8], 1
jmp 0x1000a03b
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x8a8]
sub eax, 0x227283a3
je 0x1000a06a
push 0
lea ecx, [ebp - 0xc84]
call fcn.100185ee
cmp dword [eax], 0
je 0x1000a06a
mov dword [ebp - 0x418], 1
jmp 0x1000a071
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x58], 0
jmp 0x1000a08a
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x1000a138
mov dword [ebp - 0x220], 3
jmp 0x1000a0ad
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x1000a133
mov dword [ebp - 0x200], 0xb46f9f1
mov dword [ebp - 0x200], 0
jmp 0x1000a0d9
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jg 0x1000a12e
mov dword [ebp - 0x1d0], 0xcf05746a
mov dword [ebp - 0x1d0], 0
jmp 0x1000a105
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 4
jge 0x1000a121
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0xc04], 0xfff8
jmp 0x1000a0f8
cmp dword [ebp - 0x200], 0
je 0x1000a12c
jmp 0x1000a0cc
jmp 0x1000a0cc
jmp 0x1000a0a0
jmp 0x1000a083
jmp 0x10009e97
jmp 0x10009e3a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc84]
call fcn.100185e9
mov dword [ebp - 0x270], 0
jmp 0x1000a16a
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x1000a186
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x300], 0xffffffff
jmp 0x1000a15d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x300], 0xfffffff8
jmp 0x1000a1b4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x300]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x300], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x300], 0xfffffff9
jle 0x1000a1ee
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1000a1ec
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x1000a199
push 3
lea ecx, [ebp - 0xc9c]
call fcn.1001855e
mov dword [ebp - 4], 4
mov dword [ebp - 0xc8], 0xfffffffc
mov dword [ebp - 0x8c0], 0x51d77f17
mov dword [ebp - 0x278], 0
jmp 0x1000a22f
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jge 0x1000a251
push dword [ebp - 0x278]
lea ecx, [ebp - 0xc9c]
call fcn.100185ee
mov dword [eax], 0x313dd33a
jmp 0x1000a222
mov dword [ebp - 0xc8], 0
jmp 0x1000a26a
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jg 0x1000a473
mov dword [ebp - 0x158], 0xffffffff
mov dword [ebp - 0x8c8], 0
mov dword [ebp - 0xb60], 1
mov dword [ebp - 0x158], 2
jmp 0x1000a2ae
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x1000a46e
mov dword [ebp - 0x198], 0xfb5a5efa
mov dword [ebp - 0x198], 0
jmp 0x1000a2de
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jg 0x1000a303
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x1000a301
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x1000a2d1
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xc9c]
call fcn.100185ee
cmp dword [eax], 0xfdb7
jle 0x1000a328
mov dword [ebp - 0x8b0], 1
jmp 0x1000a32f
and dword [ebp - 0x8b0], 0
cmp dword [ebp - 0x158], 0x6128f3b8
jne 0x1000a347
mov dword [ebp - 0x420], 1
jmp 0x1000a34e
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x8b0]
add eax, dword [ebp - 0x420]
imul eax, eax, 0xffff
cmp eax, 1
jne 0x1000a377
mov eax, 0x87e3bc4a
test eax, eax
jne 0x1000a377
and dword [ebp - 0x8b8], 0
jmp 0x1000a381
mov dword [ebp - 0x8b8], 1
mov eax, dword [ebp - 0x158]
imul eax, dword [ebp - 0x8b8]
add eax, 0x4c9a615c
imul eax, dword [ebp - 0x198]
cmp eax, 0x7363
jle 0x1000a3ad
mov dword [ebp - 0x428], 1
jmp 0x1000a3b4
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x8c0], eax
mov esi, dword [ebp - 0x8c0]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xc9c]
call fcn.100185ee
cmp esi, dword [eax]
je 0x1000a3e7
mov dword [ebp - 0x430], 1
jmp 0x1000a3ee
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x8c8], eax
je 0x1000a414
mov dword [ebp - 0x438], 1
jmp 0x1000a41b
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x438], eax
jg 0x1000a435
mov dword [ebp - 0x8d0], 1
jmp 0x1000a43c
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x8d0], eax
jg 0x1000a456
mov dword [ebp - 0x440], 1
jmp 0x1000a45d
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0xb60], eax
jmp 0x1000a2a1
jmp 0x1000a25d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc9c]
call fcn.100185e9
push 3
lea ecx, [ebp - 0xa4c]
call fcn.1001855e
mov dword [ebp - 4], 5
mov dword [ebp - 0x68], 0xfffffff9
mov dword [ebp - 0x2c8], 0xffffffff
push 2
lea ecx, [ebp - 0xa10]
call fcn.1001855e
mov byte [ebp - 4], 6
mov dword [ebp - 0x8e0], 0xffffffff
mov dword [ebp - 0x1d8], 5
mov dword [ebp - 0xeb8], 0xfffffffc
mov dword [ebp - 0xb0], 0
jmp 0x1000a4ef
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x1000a511
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xa4c]
call fcn.100185ee
mov dword [eax], 0xea53061e
jmp 0x1000a4e2
mov dword [ebp - 0xb0], 0
jmp 0x1000a52a
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1000a54c
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xa10]
call fcn.100185ee
mov dword [eax], 0xb6eab3cf
jmp 0x1000a51d
push 1
lea ecx, [ebp - 0xa4c]
call fcn.100185ee
cmp dword [ebp - 0x68], 0
je 0x1000a571
cmp dword [ebp - 0x68], 0
je 0x1000a571
mov dword [ebp - 0x8d8], 1
jmp 0x1000a578
and dword [ebp - 0x8d8], 0
push 1
lea ecx, [ebp - 0xa4c]
call fcn.100185ee
mov eax, dword [eax]
add eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c8]
sub eax, 0x780eec29
je 0x1000a5be
push 0
lea ecx, [ebp - 0xa10]
call fcn.100185ee
cmp dword [eax], 0
je 0x1000a5be
mov dword [ebp - 0x448], 1
jmp 0x1000a5c5
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x8e0], eax
cmp dword [ebp - 0x8e0], 0xffff
je 0x1000a5e9
mov dword [ebp - 0x450], 1
jmp 0x1000a5f0
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x450], eax
jne 0x1000a607
mov dword [ebp - 0x8e8], 1
jmp 0x1000a60e
and dword [ebp - 0x8e8], 0
push 1
lea ecx, [ebp - 0xa10]
call fcn.100185ee
mov ecx, dword [ebp - 0x8e8]
cmp ecx, dword [eax]
jl 0x1000a631
mov dword [ebp - 0xb68], 1
jmp 0x1000a638
and dword [ebp - 0xb68], 0
cmp dword [ebp - 0x68], 0
je 0x1000a64b
push 1
lea ecx, [ebp - 0xa4c]
call fcn.100185ee
cmp dword [ebp - 0x2c8], 0
jne 0x1000a66c
cmp dword [ebp - 0x2c8], 0
jne 0x1000a66c
cmp dword [ebp - 0x68], 0
jne 0x1000a66c
and dword [ebp - 0xb70], 0
jmp 0x1000a676
mov dword [ebp - 0xb70], 1
push 2
lea ecx, [ebp - 0xa4c]
call fcn.100185ee
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xec0], eax
push 0
lea ecx, [ebp - 0xa10]
call fcn.100185ee
mov esi, eax
push 0
lea ecx, [ebp - 0xa10]
call fcn.100185ee
mov ecx, dword [esi]
imul ecx, dword [eax]
mov dword [ebp - 0x1d8], ecx
mov dword [ebp - 0x1d8], 0x1a
jmp 0x1000a6cc
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xfffffff2
jg 0x1000a72c
mov dword [ebp - 0x68], 1
jmp 0x1000a6e5
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x1000a702
push dword [ebp - 0x68]
lea ecx, [ebp - 0xa10]
call fcn.100185ee
cmp dword [eax], 0
je 0x1000a700
jmp 0x1000a702
jmp 0x1000a6de
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x1000a72a
push 0
push 0
push 0x373
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1000a6bf
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa10]
call fcn.100185e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4c]
call fcn.100185e9
mov dword [ebp - 0x4c], 1
push 3
lea ecx, [ebp - 0xc90]
call fcn.1001855e
mov dword [ebp - 4], 7
mov dword [ebp - 0x218], 0x9ea4087b
mov dword [ebp - 0x280], 0
jmp 0x1000a788
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jge 0x1000a7aa
push dword [ebp - 0x280]
lea ecx, [ebp - 0xc90]
call fcn.100185ee
mov dword [eax], 0xd3cd3624
jmp 0x1000a77b
mov dword [ebp - 0x4c], 0
jmp 0x1000a7ba
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xa
jge 0x1000aabb
mov dword [ebp - 0x160], 0
mov dword [ebp - 0xc18], 0xffff
mov dword [ebp - 0xc14], 0xffff
mov dword [ebp - 0xc10], 0xffff
mov dword [ebp - 0xc0c], 0xffff
cmp dword [ebp - 0x160], 0
je 0x1000a804
jmp 0x1000aabb
mov dword [ebp - 0x160], 0
jmp 0x1000a81d
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jg 0x1000aab6
mov dword [ebp - 0x54], 0xcaad901
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x54]
jl 0x1000a848
mov dword [ebp - 0x458], 1
jmp 0x1000a84f
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 0x81d534a2
jne 0x1000a867
mov dword [ebp - 0x8f0], 1
jmp 0x1000a86e
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x8f0], eax
jl 0x1000a885
mov dword [ebp - 0x460], 1
jmp 0x1000a88c
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x460], eax
jl 0x1000a89b
cmp dword [ebp - 0x54], 0
mov eax, 0x10a6e
cmp eax, 0xffff
jae 0x1000a8b3
mov dword [ebp - 0x378], 1
jmp 0x1000a8ba
and dword [ebp - 0x378], 0
push 0
lea ecx, [ebp - 0xc90]
call fcn.100185ee
mov ecx, dword [ebp - 0x378]
mov dword [eax], ecx
mov eax, dword [ebp - 0x378]
sub eax, dword [ebp - 0x4c]
jne 0x1000a8ec
mov eax, 0xcab43068
test eax, eax
jne 0x1000a8ec
and dword [ebp - 0x8f8], 0
jmp 0x1000a8f6
mov dword [ebp - 0x8f8], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc18]
cmp eax, dword [ebp - 0x8f8]
jne 0x1000a91c
cmp dword [ebp - 0x160], 0
jne 0x1000a91c
and dword [ebp - 0xb78], 0
jmp 0x1000a926
mov dword [ebp - 0xb78], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xec8], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xed0], eax
cmp dword [ebp - 0x4c], 0x28cb
jle 0x1000a94d
mov dword [ebp - 0xb80], 1
jmp 0x1000a954
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0x54]
add eax, 0x4644688d
mov dword [ebp - 0x218], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc18]
cmp dword [ebp - 0x4c], eax
jle 0x1000a980
mov dword [ebp - 0xb88], 1
jmp 0x1000a987
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xed8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc18]
cmp dword [ebp - 0x54], eax
jge 0x1000a9ad
mov dword [ebp - 0x468], 1
jmp 0x1000a9b4
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x468]
sub eax, 0x227283a3
je 0x1000a9e3
push 0
lea ecx, [ebp - 0xc90]
call fcn.100185ee
cmp dword [eax], 0
je 0x1000a9e3
mov dword [ebp - 0x900], 1
jmp 0x1000a9ea
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], 0
jmp 0x1000aa03
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x1000aab1
mov dword [ebp - 0x218], 3
jmp 0x1000aa26
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x1000aaac
mov dword [ebp - 0x208], 0xb46f9f1
mov dword [ebp - 0x208], 0
jmp 0x1000aa52
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jg 0x1000aaa7
mov dword [ebp - 0x1e0], 0xcf05746a
mov dword [ebp - 0x1e0], 0
jmp 0x1000aa7e
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 4
jge 0x1000aa9a
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0xc18], 0xfff8
jmp 0x1000aa71
cmp dword [ebp - 0x208], 0
je 0x1000aaa5
jmp 0x1000aa45
jmp 0x1000aa45
jmp 0x1000aa19
jmp 0x1000a9fc
jmp 0x1000a810
jmp 0x1000a7b3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc90]
call fcn.100185e9
push 3
lea ecx, [ebp - 0xcb4]
call fcn.1001855e
mov dword [ebp - 4], 8
mov dword [ebp - 0xc0], 0xfffffffc
mov dword [ebp - 0x480], 0x51d77f17
mov dword [ebp - 0x2f0], 0
jmp 0x1000ab0b
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jge 0x1000ab2d
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0xcb4]
call fcn.100185ee
mov dword [eax], 0x313dd33a
jmp 0x1000aafe
mov dword [ebp - 0xc0], 0
jmp 0x1000ab46
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jg 0x1000ad4f
mov dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 0x488], 0
mov dword [ebp - 0xb90], 1
mov dword [ebp - 0x188], 2
jmp 0x1000ab8a
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x1000ad4a
mov dword [ebp - 0x168], 0xfb5a5efa
mov dword [ebp - 0x168], 0
jmp 0x1000abba
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jg 0x1000abdf
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1000abdd
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x1000abad
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xcb4]
call fcn.100185ee
cmp dword [eax], 0xfdb7
jle 0x1000ac04
mov dword [ebp - 0x470], 1
jmp 0x1000ac0b
and dword [ebp - 0x470], 0
cmp dword [ebp - 0x188], 0x6128f3b8
jne 0x1000ac23
mov dword [ebp - 0x908], 1
jmp 0x1000ac2a
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x470]
add eax, dword [ebp - 0x908]
imul eax, eax, 0xffff
cmp eax, 1
jne 0x1000ac53
mov eax, 0x87e3bc4a
test eax, eax
jne 0x1000ac53
and dword [ebp - 0x478], 0
jmp 0x1000ac5d
mov dword [ebp - 0x478], 1
mov eax, dword [ebp - 0x188]
imul eax, dword [ebp - 0x478]
add eax, 0x4c9a615c
imul eax, dword [ebp - 0x168]
cmp eax, 0x7363
jle 0x1000ac89
mov dword [ebp - 0x910], 1
jmp 0x1000ac90
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0x480], eax
mov esi, dword [ebp - 0x480]
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xcb4]
call fcn.100185ee
cmp esi, dword [eax]
je 0x1000acc3
mov dword [ebp - 0x918], 1
jmp 0x1000acca
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x488], eax
je 0x1000acf0
mov dword [ebp - 0x920], 1
jmp 0x1000acf7
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x920], eax
jg 0x1000ad11
mov dword [ebp - 0x490], 1
jmp 0x1000ad18
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x490], eax
jg 0x1000ad32
mov dword [ebp - 0x928], 1
jmp 0x1000ad39
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0xb90], eax
jmp 0x1000ab7d
jmp 0x1000ab39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb4]
call fcn.100185e9
mov dword [ebp - 0x5c], 1
push 3
lea ecx, [ebp - 0xccc]
call fcn.1001855e
mov dword [ebp - 4], 9
mov dword [ebp - 0x1e8], 0x9ea4087b
mov dword [ebp - 0x288], 0
jmp 0x1000ad9c
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 3
jge 0x1000adbe
push dword [ebp - 0x288]
lea ecx, [ebp - 0xccc]
call fcn.100185ee
mov dword [eax], 0xd3cd3624
jmp 0x1000ad8f
mov dword [ebp - 0x5c], 0
jmp 0x1000adce
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xa
jge 0x1000b0cf
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0xb34], 0xffff
mov dword [ebp - 0xb30], 0xffff
mov dword [ebp - 0xb2c], 0xffff
mov dword [ebp - 0xb28], 0xffff
cmp dword [ebp - 0x1a8], 0
je 0x1000ae18
jmp 0x1000b0cf
mov dword [ebp - 0x1a8], 0
jmp 0x1000ae31
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jg 0x1000b0ca
mov dword [ebp - 0x50], 0xcaad901
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x50]
jl 0x1000ae5c
mov dword [ebp - 0x498], 1
jmp 0x1000ae63
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 0x81d534a2
jne 0x1000ae7b
mov dword [ebp - 0x930], 1
jmp 0x1000ae82
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x930], eax
jl 0x1000ae99
mov dword [ebp - 0x4a0], 1
jmp 0x1000aea0
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x4a0], eax
jl 0x1000aeaf
cmp dword [ebp - 0x50], 0
mov eax, 0x10a6e
cmp eax, 0xffff
jae 0x1000aec7
mov dword [ebp - 0x348], 1
jmp 0x1000aece
and dword [ebp - 0x348], 0
push 0
lea ecx, [ebp - 0xccc]
call fcn.100185ee
mov ecx, dword [ebp - 0x348]
mov dword [eax], ecx
mov eax, dword [ebp - 0x348]
sub eax, dword [ebp - 0x5c]
jne 0x1000af00
mov eax, 0xcab43068
test eax, eax
jne 0x1000af00
and dword [ebp - 0x938], 0
jmp 0x1000af0a
mov dword [ebp - 0x938], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb34]
cmp eax, dword [ebp - 0x938]
jne 0x1000af30
cmp dword [ebp - 0x1a8], 0
jne 0x1000af30
and dword [ebp - 0xb98], 0
jmp 0x1000af3a
mov dword [ebp - 0xb98], 1
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xee0], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xee8], eax
cmp dword [ebp - 0x5c], 0x28cb
jle 0x1000af61
mov dword [ebp - 0xba0], 1
jmp 0x1000af68
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x50]
add eax, 0x4644688d
mov dword [ebp - 0x1e8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb34]
cmp dword [ebp - 0x5c], eax
jle 0x1000af94
mov dword [ebp - 0xba8], 1
jmp 0x1000af9b
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xef0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb34]
cmp dword [ebp - 0x50], eax
jge 0x1000afc1
mov dword [ebp - 0x4a8], 1
jmp 0x1000afc8
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x4a8]
sub eax, 0x227283a3
je 0x1000aff7
push 0
lea ecx, [ebp - 0xccc]
call fcn.100185ee
cmp dword [eax], 0
je 0x1000aff7
mov dword [ebp - 0x940], 1
jmp 0x1000affe
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x940]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x50], 0
jmp 0x1000b017
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jg 0x1000b0c5
mov dword [ebp - 0x1e8], 3
jmp 0x1000b03a
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x1000b0c0
mov dword [ebp - 0x1f0], 0xb46f9f1
mov dword [ebp - 0x1f0], 0
jmp 0x1000b066
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jg 0x1000b0bb
mov dword [ebp - 0x228], 0xcf05746a
mov dword [ebp - 0x228], 0
jmp 0x1000b092
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 4
jge 0x1000b0ae
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xb34], 0xfff8
jmp 0x1000b085
cmp dword [ebp - 0x1f0], 0
je 0x1000b0b9
jmp 0x1000b059
jmp 0x1000b059
jmp 0x1000b02d
jmp 0x1000b010
jmp 0x1000ae24
jmp 0x1000adc7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xccc]
call fcn.100185e9
push 3
lea ecx, [ebp - 0xa58]
call fcn.1001855e
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x70], 0xfffffff9
mov dword [ebp - 0x2d0], 0xffffffff
push 2
lea ecx, [ebp - 0x9f8]
call fcn.1001855e
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x4b8], 0xffffffff
mov dword [ebp - 0x1b4], 5
mov dword [ebp - 0xef8], 0xfffffffc
mov dword [ebp - 0x90], 0
jmp 0x1000b14b
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1000b16d
push dword [ebp - 0x90]
lea ecx, [ebp - 0xa58]
call fcn.100185ee
mov dword [eax], 0xea53061e
jmp 0x1000b13e
mov dword [ebp - 0x90], 0
jmp 0x1000b186
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1000b1a8
push dword [ebp - 0x90]
lea ecx, [ebp - 0x9f8]
call fcn.100185ee
mov dword [eax], 0xb6eab3cf
jmp 0x1000b179
push 1
lea ecx, [ebp - 0xa58]
call fcn.100185ee
cmp dword [ebp - 0x70], 0
je 0x1000b1cd
cmp dword [ebp - 0x70], 0
je 0x1000b1cd
mov dword [ebp - 0x4b0], 1
jmp 0x1000b1d4
and dword [ebp - 0x4b0], 0
push 1
lea ecx, [ebp - 0xa58]
call fcn.100185ee
mov eax, dword [eax]
add eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
sub eax, 0x780eec29
je 0x1000b21a
push 0
lea ecx, [ebp - 0x9f8]
call fcn.100185ee
cmp dword [eax], 0
je 0x1000b21a
mov dword [ebp - 0x948], 1
jmp 0x1000b221
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0xffff
je 0x1000b245
mov dword [ebp - 0x950], 1
jmp 0x1000b24c
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x950], eax
jne 0x1000b263
mov dword [ebp - 0x4c0], 1
jmp 0x1000b26a
and dword [ebp - 0x4c0], 0
push 1
lea ecx, [ebp - 0x9f8]
call fcn.100185ee
mov ecx, dword [ebp - 0x4c0]
cmp ecx, dword [eax]
jl 0x1000b28d
mov dword [ebp - 0xbb0], 1
jmp 0x1000b294
and dword [ebp - 0xbb0], 0
cmp dword [ebp - 0x70], 0
je 0x1000b2a7
push 1
lea ecx, [ebp - 0xa58]
call fcn.100185ee
cmp dword [ebp - 0x2d0], 0
jne 0x1000b2c8
cmp dword [ebp - 0x2d0], 0
jne 0x1000b2c8
cmp dword [ebp - 0x70], 0
jne 0x1000b2c8
and dword [ebp - 0xbb8], 0
jmp 0x1000b2d2
mov dword [ebp - 0xbb8], 1
push 2
lea ecx, [ebp - 0xa58]
call fcn.100185ee
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xf00], eax
push 0
lea ecx, [ebp - 0x9f8]
call fcn.100185ee
mov esi, eax
push 0
lea ecx, [ebp - 0x9f8]
call fcn.100185ee
mov ecx, dword [esi]
imul ecx, dword [eax]
mov dword [ebp - 0x1b4], ecx
mov dword [ebp - 0x1b4], 0x1a
jmp 0x1000b328
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0xfffffff2
jg 0x1000b388
mov dword [ebp - 0x70], 1
jmp 0x1000b341
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x1000b35e
push dword [ebp - 0x70]
lea ecx, [ebp - 0x9f8]
call fcn.100185ee
cmp dword [eax], 0
je 0x1000b35c
jmp 0x1000b35e
jmp 0x1000b33a
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1000b386
push 0
push 0
push 0x373
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1000b31b
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x9f8]
call fcn.100185e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa58]
call fcn.100185e9
mov dword [ebp - 0x1c], 0x8a062b00
mov dword [ebp - 0x3a0], 0xfdb69689
mov dword [ebp - 0x1bc], 0xee56e31b
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
je 0x1000b3d5
mov dword [ebp - 0x960], 1
jmp 0x1000b3dc
and dword [ebp - 0x960], 0
cmp dword [ebp - 0x1c], 1
jbe 0x1000b3ee
mov dword [ebp - 0x958], 1
jmp 0x1000b3f5
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x3a0]
cmp eax, dword [ebp - 0x958]
jge 0x1000b418
mov dword [ebp - 0x4c8], 1
jmp 0x1000b41f
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x4c8]
cmp eax, 0xfffb
jb 0x1000b43b
mov dword [ebp - 0x4d0], 1
jmp 0x1000b442
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x960]
sub eax, dword [ebp - 0x4d0]
imul eax, eax, 0xfff7
cmp eax, dword [ebp - 0x1c]
jg 0x1000b465
mov dword [ebp - 0x968], 1
jmp 0x1000b46c
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x968], eax
jle 0x1000b480
mov eax, 0x7f8b4dfe
test eax, eax
je 0x1000b495
mov eax, 0x3f9150fa
test eax, eax
je 0x1000b495
mov dword [ebp - 0x970], 1
jmp 0x1000b49c
and dword [ebp - 0x970], 0
cmp dword [ebp - 0x970], 4
jl 0x1000b4b1
mov dword [ebp - 0x508], 1
jmp 0x1000b4b8
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
sub eax, dword [ebp - 0x1c]
jne 0x1000b4d5
cmp dword [ebp - 0x3a0], 0
jne 0x1000b4d5
and dword [ebp - 0x500], 0
jmp 0x1000b4df
mov dword [ebp - 0x500], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x500], eax
jle 0x1000b4f6
mov dword [ebp - 0x4e4], 1
jmp 0x1000b4fd
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4e4], eax
jg 0x1000b514
mov dword [ebp - 0x74c], 1
jmp 0x1000b51b
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1bc], 0
jmp 0x1000b540
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xffffffe2
jle 0x1000b62d
mov dword [ebp - 0xbc0], 0xffffffff
mov dword [ebp - 0x290], 0
jmp 0x1000b570
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 2
jge 0x1000b58c
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xff4], 0x2549
jmp 0x1000b563
mov dword [ebp - 0x1c], 0xffffffe4
jmp 0x1000b59c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x1000b5ef
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x1000b5da
push 0
push 0
push 0
push 0x1ab
push 0x14b7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xff4]
mov dword [ebp - 0xbc0], eax
jmp 0x1000b595
mov dword [ebp - 0x1c], 0
jmp 0x1000b5ff
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x1000b628
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x1000b626
push 0
push 0x5e2
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x1000b5f8
jmp 0x1000b533
push 3
lea ecx, [ebp - 0xcc0]
call fcn.1001855e
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xc4], 0xfffffffc
mov dword [ebp - 0x4fc], 0x51d77f17
mov dword [ebp - 0x310], 0
jmp 0x1000b66e
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 3
jge 0x1000b690
push dword [ebp - 0x310]
lea ecx, [ebp - 0xcc0]
call fcn.100185ee
mov dword [eax], 0x313dd33a
jmp 0x1000b661
mov dword [ebp - 0xc4], 0
jmp 0x1000b6a9
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jg 0x1000b8b2
mov dword [ebp - 0x170], 0xffffffff
mov dword [ebp - 0x504], 0
mov dword [ebp - 0xbc8], 1
mov dword [ebp - 0x170], 2
jmp 0x1000b6ed
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jl 0x1000b8ad
mov dword [ebp - 0x190], 0xfb5a5efa
mov dword [ebp - 0x190], 0
jmp 0x1000b71d
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jg 0x1000b742
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1000b740
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x1000b710
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xcc0]
call fcn.100185ee
cmp dword [eax], 0xfdb7
jle 0x1000b767
mov dword [ebp - 0x4ec], 1
jmp 0x1000b76e
and dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x170], 0x6128f3b8
jne 0x1000b786
mov dword [ebp - 0x964], 1
jmp 0x1000b78d
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x4ec]
add eax, dword [ebp - 0x964]
imul eax, eax, 0xffff
cmp eax, 1
jne 0x1000b7b6
mov eax, 0x87e3bc4a
test eax, eax
jne 0x1000b7b6
and dword [ebp - 0x4f4], 0
jmp 0x1000b7c0
mov dword [ebp - 0x4f4], 1
mov eax, dword [ebp - 0x170]
imul eax, dword [ebp - 0x4f4]
add eax, 0x4c9a615c
imul eax, dword [ebp - 0x190]
cmp eax, 0x7363
jle 0x1000b7ec
mov dword [ebp - 0x754], 1
jmp 0x1000b7f3
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x4fc], eax
mov esi, dword [ebp - 0x4fc]
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xcc0]
call fcn.100185ee
cmp esi, dword [eax]
je 0x1000b826
mov dword [ebp - 0x884], 1
jmp 0x1000b82d
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x504], eax
je 0x1000b853
mov dword [ebp - 0x75c], 1
jmp 0x1000b85a
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x75c], eax
jg 0x1000b874
mov dword [ebp - 0x50c], 1
jmp 0x1000b87b
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x50c], eax
jg 0x1000b895
mov dword [ebp - 0x91c], 1
jmp 0x1000b89c
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0xbc8], eax
jmp 0x1000b6e0
jmp 0x1000b69c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc0]
call fcn.100185e9
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x64], 0x9e71b35d
push 2
lea ecx, [ebp - 0xa28]
call fcn.1001855e
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x298], 0
jmp 0x1000b8fc
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 2
jge 0x1000b91e
push dword [ebp - 0x298]
lea ecx, [ebp - 0xa28]
call fcn.100185ee
mov dword [eax], 0x8d81
jmp 0x1000b8ef
cmp dword [ebp - 0x18], 0
je 0x1000ba50
cmp dword [ebp - 0x18], 0
je 0x1000b985
cmp dword [ebp - 0x18], 0
jne 0x1000b943
cmp dword [ebp - 0x18], 0
jne 0x1000b943
and dword [ebp - 0x514], 0
jmp 0x1000b94d
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x514]
jge 0x1000b964
mov dword [ebp - 0x764], 1
jmp 0x1000b96b
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x764]
dec eax
dec eax
je 0x1000b985
mov dword [ebp - 0x51c], 1
jmp 0x1000b98c
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x51c], eax
jg 0x1000b9a3
mov dword [ebp - 0x88c], 1
jmp 0x1000b9aa
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x64]
imul eax, dword [ebp - 0x88c]
cmp eax, dword [ebp - 0x18]
jle 0x1000b9c5
mov dword [ebp - 0x524], 1
jmp 0x1000b9cc
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x524], eax
jne 0x1000b9e3
mov dword [ebp - 0xbd0], 1
jmp 0x1000b9ea
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xf08], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xf10], eax
cmp dword [ebp - 0x18], 0
jne 0x1000ba11
cmp dword [ebp - 0x64], 0
jne 0x1000ba11
and dword [ebp - 0x76c], 0
jmp 0x1000ba1b
mov dword [ebp - 0x76c], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x76c], eax
jge 0x1000ba32
mov dword [ebp - 0x52c], 1
jmp 0x1000ba39
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x52c], eax
je 0x1000ba50
mov dword [ebp - 0x998], 1
jmp 0x1000ba57
and dword [ebp - 0x998], 0
cmp dword [ebp - 0x998], 0x1ef9
jl 0x1000ba6f
mov dword [ebp - 0x534], 1
jmp 0x1000ba76
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x18], 0
jmp 0x1000ba8f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jle 0x1000bde6
mov dword [ebp - 0x34], 0xaa5d732a
mov dword [ebp - 0x1c4], 0
push 4
lea ecx, [ebp - 0xdc0]
call fcn.1001855e
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x2d8], 0
jmp 0x1000bad4
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 4
jge 0x1000baf6
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0xdc0]
call fcn.100185ee
mov dword [eax], 0x93c5815d
jmp 0x1000bac7
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x64]
je 0x1000bb21
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x1000bb21
mov eax, dword [ebp - 0x34]
neg eax
mov dword [ebp - 0x1c4], eax
jmp 0x1000bdd2
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x924], 0xfffffff8
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1000bb60
push 0x1fc2
push 0x135f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov dword [ebp - 0x34], 0
jmp 0x1000bb70
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jg 0x1000bdd2
mov dword [ebp - 0xb14], 0xa323
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa28]
call fcn.100185ee
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0xf18], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0xf24], eax
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x64], eax
je 0x1000bbc1
mov dword [ebp - 0x774], 1
jmp 0x1000bbc8
and dword [ebp - 0x774], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa28]
call fcn.100185ee
mov ecx, dword [ebp - 0x774]
neg ecx
mov esi, ecx
imul esi, dword [eax]
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa28]
call fcn.100185ee
cmp esi, dword [eax]
jge 0x1000bc01
mov dword [ebp - 0x53c], 1
jmp 0x1000bc08
and dword [ebp - 0x53c], 0
imul eax, dword [ebp - 0x53c], 0xbdb8
test eax, eax
jne 0x1000bc28
cmp dword [ebp - 0x140], 0
jne 0x1000bc28
and dword [ebp - 0x894], 0
jmp 0x1000bc32
mov dword [ebp - 0x894], 1
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0xffff
jne 0x1000bc56
mov dword [ebp - 0x544], 1
jmp 0x1000bc5d
and dword [ebp - 0x544], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa28]
call fcn.100185ee
mov eax, dword [eax]
imul eax, dword [ebp - 0x544]
cmp eax, dword [ebp - 0xb14]
jge 0x1000bc8e
mov eax, 0xe06c
test eax, eax
jne 0x1000bc8e
and dword [ebp - 0x77c], 0
jmp 0x1000bc98
mov dword [ebp - 0x77c], 1
cmp dword [ebp - 0x77c], 0x7eac
jg 0x1000bcb0
mov dword [ebp - 0x54c], 1
jmp 0x1000bcb7
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
sub eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x924], eax
jge 0x1000bce0
mov dword [ebp - 0x554], 1
jmp 0x1000bce7
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x554], eax
jne 0x1000bd01
mov dword [ebp - 0x784], 1
jmp 0x1000bd08
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x64], eax
jl 0x1000bd28
mov dword [ebp - 0x55c], 1
jmp 0x1000bd2f
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x55c], eax
jl 0x1000bd49
mov dword [ebp - 0x89c], 1
jmp 0x1000bd50
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x89c], eax
je 0x1000bd6a
mov dword [ebp - 0x564], 1
jmp 0x1000bd71
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x564], eax
jl 0x1000bd88
mov dword [ebp - 0xae4], 1
jmp 0x1000bd8f
and dword [ebp - 0xae4], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa28]
call fcn.100185ee
mov esi, dword [ebp - 0x18]
push 3
lea ecx, [ebp - 0xdc0]
call fcn.100185ee
mov dword [eax], esi
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x1000bdcd
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x1000bb69
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xdc0]
call fcn.100185e9
jmp 0x1000ba88
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa28]
call fcn.100185e9
movzx eax, byte [0x1067a74c]
test eax, eax
je 0x1000be13
mov esi, 0x1008e5c0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x100114d5
push 3
lea ecx, [ebp - 0xa40]
call fcn.1001855e
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x60], 0xfffffff9
mov dword [ebp - 0x2a0], 0xffffffff
push 2
lea ecx, [ebp - 0x9d4]
call fcn.1001855e
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x96c], 0xffffffff
mov dword [ebp - 0x1cc], 5
mov dword [ebp - 0xf30], 0xfffffffc
mov dword [ebp - 0xb8], 0
jmp 0x1000be80
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1000bea2
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xa40]
call fcn.100185ee
mov dword [eax], 0xea53061e
jmp 0x1000be73
mov dword [ebp - 0xb8], 0
jmp 0x1000bebb
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x1000bedd
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x9d4]
call fcn.100185ee
mov dword [eax], 0xb6eab3cf
jmp 0x1000beae
push 1
lea ecx, [ebp - 0xa40]
call fcn.100185ee
cmp dword [ebp - 0x60], 0
je 0x1000bf02
cmp dword [ebp - 0x60], 0
je 0x1000bf02
mov dword [ebp - 0x78c], 1
jmp 0x1000bf09
and dword [ebp - 0x78c], 0
push 1
lea ecx, [ebp - 0xa40]
call fcn.100185ee
mov eax, dword [eax]
add eax, dword [ebp - 0x78c]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
sub eax, 0x780eec29
je 0x1000bf4f
push 0
lea ecx, [ebp - 0x9d4]
call fcn.100185ee
cmp dword [eax], 0
je 0x1000bf4f
mov dword [ebp - 0x56c], 1
jmp 0x1000bf56
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x96c], eax
cmp dword [ebp - 0x96c], 0xffff
je 0x1000bf7a
mov dword [ebp - 0x574], 1
jmp 0x1000bf81
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x574], eax
jne 0x1000bf98
mov dword [ebp - 0x794], 1
jmp 0x1000bf9f
and dword [ebp - 0x794], 0
push 1
lea ecx, [ebp - 0x9d4]
call fcn.100185ee
mov ecx, dword [ebp - 0x794]
cmp ecx, dword [eax]
jl 0x1000bfc2
mov dword [ebp - 0xa9c], 1
jmp 0x1000bfc9
and dword [ebp - 0xa9c], 0
cmp dword [ebp - 0x60], 0
je 0x1000bfdc
push 1
lea ecx, [ebp - 0xa40]
call fcn.100185ee
cmp dword [ebp - 0x2a0], 0
jne 0x1000bffd
cmp dword [ebp - 0x2a0], 0
jne 0x1000bffd
cmp dword [ebp - 0x60], 0
jne 0x1000bffd
and dword [ebp - 0xa70], 0
jmp 0x1000c007
mov dword [ebp - 0xa70], 1
push 2
lea ecx, [ebp - 0xa40]
call fcn.100185ee
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xf3c], eax
push 0
lea ecx, [ebp - 0x9d4]
call fcn.100185ee
mov esi, eax
push 0
lea ecx, [ebp - 0x9d4]
call fcn.100185ee
mov ecx, dword [esi]
imul ecx, dword [eax]
mov dword [ebp - 0x1cc], ecx
mov dword [ebp - 0x1cc], 0x1a
jmp 0x1000c05d
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xfffffff2
jg 0x1000c0bd
mov dword [ebp - 0x60], 1
jmp 0x1000c076
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x1000c093
push dword [ebp - 0x60]
lea ecx, [ebp - 0x9d4]
call fcn.100185ee
cmp dword [eax], 0
je 0x1000c091
jmp 0x1000c093
jmp 0x1000c06f
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x1000c0bb
push 0
push 0
push 0x373
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1000c050
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x9d4]
call fcn.100185e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa40]
call fcn.100185e9
mov dword [ebp - 0x144], 0xffffffff
mov dword [ebp - 0xb3c], 0xfffffff7
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1000c10e
push 0x1e11
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [ebp - 0x144], 0
jmp 0x1000c127
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffee
jle 0x1000c2f2
mov dword [ebp - 0x110], 0x1f665683
mov dword [ebp - 0x57c], 0x729694d2
mov dword [ebp - 0x110], 0xa
jmp 0x1000c161
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffe5
jle 0x1000c2ed
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0xa78], 0x1f6f
mov dword [ebp - 0xa80], 0
mov dword [ebp - 0x13c], 0
jmp 0x1000c1a5
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xa
jge 0x1000c2e8
mov dword [ebp - 0x350], 0xfffffff6
mov dword [ebp - 0xb94], 0xf7c8b166
cmp dword [ebp - 0x110], 0
je 0x1000c1df
xor eax, eax
je 0x1000c1df
mov dword [ebp - 0x594], 1
jmp 0x1000c1e6
and dword [ebp - 0x594], 0
mov dword [ebp - 0x57c], 0xffffffff
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x57c], eax
jne 0x1000c20a
mov dword [ebp - 0x8a4], 1
jmp 0x1000c211
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x350]
mov ecx, dword [ebp - 0x144]
sub ecx, dword [ebp - 0xb94]
sub eax, ecx
cmp eax, dword [ebp - 0xa78]
jne 0x1000c245
mov dword [ebp - 0x584], 1
jmp 0x1000c24c
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x110]
imul eax, dword [ebp - 0x584]
test eax, eax
jne 0x1000c26d
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x1000c26d
and dword [ebp - 0x79c], 0
jmp 0x1000c277
mov dword [ebp - 0x79c], 1
mov eax, dword [ebp - 0x144]
imul eax, dword [ebp - 0x79c]
test eax, eax
jne 0x1000c294
mov dword [ebp - 0x58c], 1
jmp 0x1000c29b
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0xb3c]
cmp dword [ebp - 0x58c], eax
jne 0x1000c2b5
mov dword [ebp - 0x92c], 1
jmp 0x1000c2bc
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x92c], eax
jge 0x1000c2d1
cmp dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x594]
sub eax, dword [ebp - 0x350]
mov dword [ebp - 0xa80], eax
jmp 0x1000c198
jmp 0x1000c154
jmp 0x1000c11a
mov dword [ebp - 0xf44], 0x1008e5c0
mov dword [ebp - 0x2f8], 0x55595070
mov dword [ebp - 0xcf4], 1
mov dword [ebp - 0xcf0], 1
mov dword [ebp - 0xcec], 1
mov dword [ebp - 0xce8], 1
lea ecx, [ebp - 0x36d]
call fcn.100091f3
push eax
lea eax, [ebp - 0xce4]
push eax
lea eax, [ebp - 0xcf4]
push eax
lea ecx, [ebp - 0x10d8]
call fcn.100185fd
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10b4]
call fcn.100185bf
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xe04], 8
mov dword [ebp - 0xe00], 8
mov dword [ebp - 0xdfc], 8
mov dword [ebp - 0xdf8], 8
mov dword [ebp - 0x7a4], 0x4d0c653d
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xe04], 1
mov dword [ebp - 0x2f8], 0
jmp 0x1000c3c5
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0xffffffea
jle 0x1000c456
mov dword [ebp - 0xd08], 0xa4c5706b
mov dword [ebp - 0xd04], 0xa4c5706b
mov dword [ebp - 0xd00], 0xa4c5706b
mov dword [ebp - 0xcfc], 0xa4c5706b
lea ecx, [ebp - 0x329]
call fcn.100091f3
push eax
lea eax, [ebp - 0xcf8]
push eax
lea eax, [ebp - 0xd08]
push eax
lea ecx, [ebp - 0x1110]
call fcn.100185fd
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1084]
call fcn.100185bf
mov dword [ebp - 0xf4c], 0xfffffff8
mov eax, dword [ebp - 0x7a4]
dec eax
mov dword [ebp - 0x7a4], eax
lea ecx, [ebp - 0x1084]
call fcn.100185e9
jmp 0x1000c3b8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10b4]
call fcn.100185e9
mov dword [ebp - 0x24], 0x8a062b00
mov dword [ebp - 0x380], 0xfdb69689
mov dword [ebp - 0x1d4], 0xee56e31b
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
je 0x1000c494
mov dword [ebp - 0x5a4], 1
jmp 0x1000c49b
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x24], 1
jbe 0x1000c4ad
mov dword [ebp - 0x59c], 1
jmp 0x1000c4b4
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
cmp eax, dword [ebp - 0x59c]
jge 0x1000c4d7
mov dword [ebp - 0x8ac], 1
jmp 0x1000c4de
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x8ac]
cmp eax, 0xfffb
jb 0x1000c4fa
mov dword [ebp - 0x7ac], 1
jmp 0x1000c501
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x5a4]
sub eax, dword [ebp - 0x7ac]
imul eax, eax, 0xfff7
cmp eax, dword [ebp - 0x24]
jg 0x1000c524
mov dword [ebp - 0x5ac], 1
jmp 0x1000c52b
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x5ac], eax
jle 0x1000c53f
mov eax, 0x7f8b4dfe
test eax, eax
je 0x1000c554
mov eax, 0x3f9150fa
test eax, eax
je 0x1000c554
mov dword [ebp - 0x9b8], 1
jmp 0x1000c55b
and dword [ebp - 0x9b8], 0
cmp dword [ebp - 0x9b8], 4
jl 0x1000c570
mov dword [ebp - 0x5b4], 1
jmp 0x1000c577
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
sub eax, dword [ebp - 0x24]
jne 0x1000c594
cmp dword [ebp - 0x380], 0
jne 0x1000c594
and dword [ebp - 0x7b4], 0
jmp 0x1000c59e
mov dword [ebp - 0x7b4], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x7b4], eax
jle 0x1000c5b5
mov dword [ebp - 0x5bc], 1
jmp 0x1000c5bc
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x5bc], eax
jg 0x1000c5d3
mov dword [ebp - 0x8b4], 1
jmp 0x1000c5da
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d4], 0
jmp 0x1000c5ff
cmp dword [ebp - 0x1d4], 0xffffffe2
jle 0x1000c6ec
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret