Function at 0x10008e69
Capabilities:
Delete directory
Get common file path
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082c17
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xefc
push esi
push edi
mov dword [ebp - 0x1d4], 0xffffffff
push 2
lea ecx, [ebp - 0xd04]
call fcn.100160cf
and dword [ebp - 4], 0
mov dword [ebp - 0x344], 0
jmp 0x10008ebd
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 2
jge 0x10008edf
push dword [ebp - 0x344]
lea ecx, [ebp - 0xd04]
call fcn.1001613c
mov dword [eax], 7
jmp 0x10008eb0
mov dword [ebp - 0x1d4], 7
jmp 0x10008ef8
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xf
jg 0x10008f34
mov dword [ebp - 0x600], 0xf1d8987f
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x10008f25
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x600]
dec eax
mov dword [ebp - 0x600], eax
jmp 0x10008eeb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd04]
call fcn.10016137
mov dword [ebp - 0x24], 0x48d327cb
mov dword [ebp - 0x414], 1
mov dword [ebp - 0x7dc], 0xc1932e3c
mov dword [ebp - 0x104], 0xf6f49c23
mov dword [ebp - 0x39c], 7
mov dword [ebp - 0x24], 0xffffffed
jmp 0x10008f82
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jl 0x10009377
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x428], 0x737b78f1
mov dword [ebp - 0x8f8], 0x8e972ce3
mov dword [ebp - 0x294], 0
jmp 0x10008fc0
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 1
jge 0x10008fdc
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0x2f4], 0x972c40a9
jmp 0x10008fb3
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x24], eax
jne 0x10008ff0
mov dword [ebp - 0x86c], 1
jmp 0x10008ff7
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jge 0x1000900b
mov dword [ebp - 0x854], 1
jmp 0x10009012
and dword [ebp - 0x854], 0
cmp dword [ebp - 0x854], 0xffffffff
jne 0x10009027
mov dword [ebp - 0x85c], 1
jmp 0x1000902e
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x85c], eax
jle 0x10009045
mov dword [ebp - 0x864], 1
jmp 0x1000904c
and dword [ebp - 0x864], 0
cmp dword [ebp - 0x864], 0xfffb
je 0x10009064
mov dword [ebp - 0x8f0], 1
jmp 0x1000906b
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc5c], eax
cmp dword [ebp - 0x86c], 0x8213af72
jb 0x1000908c
mov dword [ebp - 0x874], 1
jmp 0x10009093
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x874]
add eax, 0x29694d2b
je 0x100090b8
cmp dword [ebp - 0x24], 0
je 0x100090b8
cmp dword [ebp - 0x24], 0
je 0x100090b8
mov dword [ebp - 0x87c], 1
jmp 0x100090bf
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x87c], eax
jg 0x100090d6
mov dword [ebp - 0x884], 1
jmp 0x100090dd
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x884]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x7dc]
cmp dword [ebp - 0x414], eax
jge 0x10009107
mov dword [ebp - 0x7b4], 1
jmp 0x1000910e
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x100091f5
mov dword [ebp - 0x104], 0
jmp 0x10009140
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jl 0x100091f3
push 3
lea ecx, [ebp - 0xa88]
call fcn.100160cf
mov dword [ebp - 4], 1
mov dword [ebp - 0x1dc], 0
jmp 0x1000917a
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x1000919c
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xa88]
call fcn.1001613c
mov dword [eax], 0x91b7
jmp 0x1000916d
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x100091b9
push 0x29b
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
lea ecx, [ebp - 0xa88]
call fcn.1001613c
cmp dword [eax], 0
je 0x100091df
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa88]
call fcn.10016137
jmp 0x10009133
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa88]
call fcn.10016137
jmp 0x10009133
jmp 0x10009212
mov dword [ebp - 0x8f4], 0xf5e4d8d9
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8f4]
mov dword [ebp + eax - 0x2f4], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f4], 0
je 0x10009351
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x100092a4
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x10009250
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x428]
add eax, dword [ebp - 0x4c]
cmp eax, 0xe213633e
je 0x10009262
mov eax, 0xffff
test eax, eax
jne 0x10009262
and dword [ebp - 0x7bc], 0
jmp 0x1000926c
mov dword [ebp - 0x7bc], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x7bc], eax
jle 0x10009283
mov dword [ebp - 0x430], 1
jmp 0x1000928a
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x39c]
cmp dword [ebp - 0x430], eax
je 0x100092a4
mov dword [ebp - 0x438], 1
jmp 0x100092ab
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x7c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7c4]
mov dword [ebp + eax - 0x2f4], ecx
mov eax, dword [ebp - 0x7c4]
sub eax, dword [ebp - 0x438]
jne 0x100092f1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f4], 0
jne 0x100092f1
and dword [ebp - 0x7cc], 0
jmp 0x100092fb
mov dword [ebp - 0x7cc], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x7cc], eax
jle 0x10009312
mov dword [ebp - 0x440], 1
jmp 0x10009319
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x440], eax
je 0x10009330
mov dword [ebp - 0x7d4], 1
jmp 0x10009337
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
sub eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x24]
jge 0x10009351
mov dword [ebp - 0x448], 1
jmp 0x10009358
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x39c]
imul eax, dword [ebp - 0x448]
imul eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x8f8], eax
jmp 0x10008f7b
mov dword [ebp - 0x29c], 0xffffffff
push 2
lea ecx, [ebp - 0xd14]
call fcn.100160cf
mov dword [ebp - 4], 2
mov dword [ebp - 0x1e4], 0
jmp 0x100093ae
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x100093d0
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0xd14]
call fcn.1001613c
mov dword [eax], 7
jmp 0x100093a1
mov dword [ebp - 0x29c], 7
jmp 0x100093e9
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xf
jg 0x10009425
mov dword [ebp - 0x450], 0xf1d8987f
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x10009416
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x450]
dec eax
mov dword [ebp - 0x450], eax
jmp 0x100093dc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd14]
call fcn.10016137
push 3
lea ecx, [ebp - 0x368]
call fcn.100160cf
mov dword [ebp - 4], 3
push 1
lea ecx, [ebp - 0x970]
call fcn.100160cf
mov byte [ebp - 4], 4
mov dword [ebp - 0x900], 0x81f3403c
mov dword [ebp - 0x908], 1
mov dword [ebp - 0x910], 0xffffffff
mov dword [ebp - 0x2c], 0
jmp 0x10009487
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x100094a0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x368]
call fcn.1001613c
or dword [eax], 0xffffffff
jmp 0x10009480
mov dword [ebp - 0x2c], 0
jmp 0x100094b0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x100094cc
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x970]
call fcn.1001613c
mov dword [eax], 0xb5457d67
jmp 0x100094a9
push 1
lea ecx, [ebp - 0x368]
call fcn.1001613c
mov esi, eax
push 0
lea ecx, [ebp - 0x368]
call fcn.1001613c
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x100094fa
mov dword [ebp - 0x7fc], 1
jmp 0x10009501
and dword [ebp - 0x7fc], 0
push 0
lea ecx, [ebp - 0x368]
call fcn.1001613c
mov esi, eax
push 1
lea ecx, [ebp - 0x368]
call fcn.1001613c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1000952f
mov dword [ebp - 0x7e4], 1
jmp 0x10009536
and dword [ebp - 0x7e4], 0
push 1
lea ecx, [ebp - 0x368]
call fcn.1001613c
mov ecx, dword [ebp - 0x7e4]
cmp ecx, dword [eax]
jg 0x10009559
mov dword [ebp - 0x7ec], 1
jmp 0x10009560
and dword [ebp - 0x7ec], 0
push 0
lea ecx, [ebp - 0x970]
call fcn.1001613c
mov dword [ebp - 0x458], eax
push 1
lea ecx, [ebp - 0x368]
call fcn.1001613c
mov ecx, dword [ebp - 0x458]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x458]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x7ec]
jle 0x100095a6
mov dword [ebp - 0x460], 1
jmp 0x100095ad
and dword [ebp - 0x460], 0
push 1
lea ecx, [ebp - 0x368]
call fcn.1001613c
mov ecx, dword [ebp - 0x460]
cmp ecx, dword [eax]
jle 0x100095d0
mov dword [ebp - 0x7f4], 1
jmp 0x100095d7
and dword [ebp - 0x7f4], 0
push 0
lea ecx, [ebp - 0x368]
call fcn.1001613c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x7f4]
jge 0x100095fa
mov dword [ebp - 0x468], 1
jmp 0x10009601
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x900]
cmp dword [ebp - 0x468], eax
jg 0x1000961b
mov dword [ebp - 0x470], 1
jmp 0x10009622
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x7fc]
cmp eax, dword [ebp - 0x470]
jne 0x1000963c
mov dword [ebp - 0x804], 1
jmp 0x10009643
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x908], eax
push 0
lea ecx, [ebp - 0x970]
call fcn.1001613c
mov esi, eax
push 1
lea ecx, [ebp - 0x368]
call fcn.1001613c
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x1000968f
push 0
lea ecx, [ebp - 0x970]
call fcn.1001613c
cmp dword [eax], 0
je 0x1000968f
mov dword [ebp - 0x478], 1
jmp 0x10009696
and dword [ebp - 0x478], 0
push 1
lea ecx, [ebp - 0x368]
call fcn.1001613c
mov ecx, dword [ebp - 0x478]
cmp ecx, dword [eax]
jne 0x100096bf
mov eax, 0xe77
test eax, eax
jne 0x100096bf
and dword [ebp - 0x80c], 0
jmp 0x100096c9
mov dword [ebp - 0x80c], 1
mov eax, dword [ebp - 0x80c]
sub eax, 0x4c9d
mov dword [ebp - 0x910], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x970]
call fcn.10016137
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368]
call fcn.10016137
mov dword [ebp - 0x204], 0xffffffff
mov dword [ebp - 0x148], 0xb4e1
push 3
lea ecx, [ebp - 0xd24]
call fcn.100160cf
mov dword [ebp - 4], 5
mov dword [ebp - 0x1ec], 0
jmp 0x10009739
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 3
jge 0x1000975b
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0xd24]
call fcn.1001613c
mov dword [eax], 0x4643cdf9
jmp 0x1000972c
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x148], 0
jmp 0x10009781
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jg 0x1000985c
push 1
lea ecx, [ebp - 0xc24]
call fcn.100160cf
mov byte [ebp - 4], 6
mov dword [ebp - 0x1f4], 0xe31551da
mov dword [ebp - 0x324], 0
jmp 0x100097c2
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 1
jge 0x100097e1
push dword [ebp - 0x324]
lea ecx, [ebp - 0xc24]
call fcn.1001613c
or dword [eax], 0xffffffff
jmp 0x100097b5
push 0
lea ecx, [ebp - 0xc24]
call fcn.1001613c
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x480]
mov dword [ecx], eax
mov dword [ebp - 0x1f4], 2
jmp 0x1000981e
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
jl 0x10009848
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x10009846
push 0x81b
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
jmp 0x10009811
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc24]
call fcn.10016137
jmp 0x10009774
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd24]
call fcn.10016137
push 2
lea ecx, [ebp - 0xd44]
call fcn.100160cf
mov dword [ebp - 4], 7
mov dword [ebp - 0x110], 0xa61928c1
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x100098af
push 0
push 0x18b9
push 0x25ef
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov dword [ebp - 0x110], 0xfffffff4
jmp 0x100098c8
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 9
jle 0x10009abd
mov dword [ebp - 0x2a4], 0
jmp 0x100098ee
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 3
jge 0x1000990a
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0x8ec], 4
jmp 0x100098e1
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x8ec], 0x1d
jmp 0x10009935
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8ec]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x8ec], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8ec], 0x12
jl 0x10009ab8
mov dword [ebp - 0x16c], 0x49f845d8
mov dword [ebp - 0x16c], 0xb
jmp 0x1000996b
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x19
jge 0x10009ab3
mov dword [ebp - 0x490], 0x3b6f9b69
mov dword [ebp - 0x834], 0x6721f7d
cmp dword [ebp - 0x110], 0
je 0x10009a80
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x110], eax
jg 0x100099b3
mov dword [ebp - 0x814], 1
jmp 0x100099ba
and dword [ebp - 0x814], 0
cmp dword [ebp - 0x814], 1
je 0x100099cf
mov dword [ebp - 0x488], 1
jmp 0x100099d6
and dword [ebp - 0x488], 0
cmp dword [ebp - 0x488], 0xffffffff
jl 0x100099eb
mov dword [ebp - 0x81c], 1
jmp 0x100099f2
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0
jg 0x10009a07
mov dword [ebp - 0x824], 1
jmp 0x10009a0e
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x490]
add eax, dword [ebp - 0x824]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x8ec]
je 0x10009a34
mov dword [ebp - 0x498], 1
jmp 0x10009a3b
and dword [ebp - 0x498], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8ec]
cmp dword [ebp - 0x498], eax
je 0x10009a5c
mov dword [ebp - 0x82c], 1
jmp 0x10009a63
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x16c]
imul eax, dword [ebp - 0x82c]
test eax, eax
je 0x10009a80
mov dword [ebp - 0x4a0], 1
jmp 0x10009a87
and dword [ebp - 0x4a0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8ec]
imul eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x10009aae
jmp 0x1000995e
jmp 0x1000995e
jmp 0x1000991c
jmp 0x100098bb
mov dword [ebp - 0x1fc], 0
jmp 0x10009ad6
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x10009af8
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0xd44]
call fcn.1001613c
mov dword [eax], 7
jmp 0x10009ac9
mov dword [ebp - 0xe00], 0xf825e7a6
mov dword [ebp - 0xa0], 0
push 1
lea ecx, [ebp - 0xd34]
call fcn.100160cf
mov byte [ebp - 4], 8
mov dword [ebp - 0x4a8], 0xbd2ab60e
mov dword [ebp - 0x2fc], 0
jmp 0x10009b40
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 1
jge 0x10009b5f
push dword [ebp - 0x2fc]
lea ecx, [ebp - 0xd34]
call fcn.1001613c
or dword [eax], 0xffffffff
jmp 0x10009b33
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
je 0x10009bca
mov dword [ebp - 0xcac], 1
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x10009b97
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov dword [ebp - 0xa0], 0xfffffff5
jmp 0x10009bb0
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x2d
jge 0x10009bc8
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
jmp 0x10009ba3
jmp 0x10009bde
mov dword [ebp - 0x918], 0x7059141a
mov dword [ebp - 0x918], 0x68be135e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd34]
call fcn.10016137
mov dword [ebp - 0x204], 7
jmp 0x10009c06
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0xf
jg 0x1000a3ff
push 3
lea ecx, [ebp - 0x1b4]
call fcn.100160cf
mov byte [ebp - 4], 9
mov dword [ebp - 0x4bc], 0x2c5d177c
mov dword [ebp - 0x4c0], 0
mov dword [ebp - 0x3dc], 0x98b94be3
mov dword [ebp - 0xd78], 0x8308faa8
mov dword [ebp - 0x2ac], 0
jmp 0x10009c65
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jge 0x10009c87
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
mov dword [eax], 0xfffffff9
jmp 0x10009c58
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
cmp dword [eax], 0
je 0x10009e44
push 2
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
cmp dword [eax], 0x30498d20
jne 0x10009cbe
mov dword [ebp - 0x83c], 1
jmp 0x10009cc5
and dword [ebp - 0x83c], 0
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
mov ecx, dword [ebp - 0x83c]
cmp ecx, dword [eax]
jne 0x10009ce8
mov dword [ebp - 0x4b0], 1
jmp 0x10009cef
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0xfffd
jbe 0x10009d07
mov dword [ebp - 0x844], 1
jmp 0x10009d0e
and dword [ebp - 0x844], 0
push 0
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
mov esi, eax
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
mov ecx, dword [ebp - 0x844]
sub ecx, dword [eax]
cmp dword [esi], ecx
je 0x10009d42
mov dword [ebp - 0x84c], 1
jmp 0x10009d49
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x4bc], eax
mov esi, dword [ebp - 0x4bc]
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
add esi, dword [eax]
mov dword [ebp - 0x4c0], esi
push 0xfffffffffffffff6
pop eax
sub eax, dword [ebp - 0x4c0]
neg eax
cmp eax, 1
jne 0x10009d8c
mov dword [ebp - 0x830], 1
jmp 0x10009d93
and dword [ebp - 0x830], 0
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
mov eax, dword [eax]
mov ecx, dword [ebp - 0x830]
lea eax, [ecx + eax - 0x79facd4a]
mov dword [ebp - 0x3dc], eax
mov esi, dword [ebp - 0x3dc]
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
cmp esi, dword [eax]
jle 0x10009ded
cmp dword [ebp - 0x3dc], 0
jne 0x10009ded
and dword [ebp - 0x4c8], 0
jmp 0x10009df7
mov dword [ebp - 0x4c8], 1
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
mov ecx, dword [ebp - 0x4c8]
cmp ecx, dword [eax]
jge 0x10009e1a
mov dword [ebp - 0x6c0], 1
jmp 0x10009e21
and dword [ebp - 0x6c0], 0
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
mov ecx, dword [ebp - 0x6c0]
cmp ecx, dword [eax]
jle 0x10009e44
mov dword [ebp - 0x4d0], 1
jmp 0x10009e4b
and dword [ebp - 0x4d0], 0
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
mov ecx, dword [ebp - 0x4d0]
cmp ecx, dword [eax]
jl 0x10009e6e
mov dword [ebp - 0x7b8], 1
jmp 0x10009e75
and dword [ebp - 0x7b8], 0
imul esi, dword [ebp - 0x7b8], 0xe8ef
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001613c
add esi, dword [eax]
cmp esi, 0xfff7
je 0x10009ea2
mov dword [ebp - 0x4d8], 1
jmp 0x10009ea9
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 0xfd09
jle 0x10009ed1
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x10009ecf
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x10009f11
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x10009ef7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x10009f11
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1b4]
call fcn.10016137
mov dword [ebp - 0x838], 0xf1d8987f
mov byte [ebp - 0xd1], 0
mov dword [ebp - 0xa7c], 0xa5d6c05b
mov dword [ebp - 0xa78], 0xa5d6c05b
mov dword [ebp - 0xa74], 0xa5d6c05b
mov dword [ebp - 0xa70], 0xa5d6c05b
mov dword [ebp - 0x170], 3
mov dword [ebp - 0x6c8], 0xbca7b5cf
mov dword [ebp - 0x4e0], 5
mov dword [ebp - 0x4e8], 0xffffffff
mov dword [ebp - 0x170], 0
jmp 0x10009f9a
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jg 0x1000a1ae
mov dword [ebp - 0x138], 0xd03248c6
mov dword [ebp - 0x6d0], 9
mov dword [ebp - 0x138], 0
jmp 0x10009fd4
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jg 0x1000a1a9
mov dword [ebp - 0x84], 0
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1000a011
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov dword [ebp - 0x84], 0
jmp 0x1000a02a
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jg 0x1000a1a4
mov dword [ebp - 0x20c], 0x307d7c11
mov dword [ebp - 0x928], 0x51fa4c82
mov dword [ebp - 0x20c], 3
jmp 0x1000a064
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jl 0x1000a0ce
mov dword [ebp - 0x33c], 0xffffffff
mov dword [ebp - 0x33c], 0
jmp 0x1000a090
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 3
jg 0x1000a0cc
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1000a0b8
push 0x17fd
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [ebp - 0x84]
cmp dword [ebp + eax*4 - 0xa7c], 0
je 0x1000a0ca
jmp 0x1000a083
jmp 0x1000a083
jmp 0x1000a057
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0xa7c]
mov dword [ebp - 0xe08], eax
cmp dword [ebp - 0x84], 0
jne 0x1000a13f
cmp dword [ebp - 0x170], 0x14ab
jl 0x1000a102
mov dword [ebp - 0x920], 1
jmp 0x1000a109
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x6c8], eax
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0xcc0], eax
cmp dword [ebp - 0x928], 0
jne 0x1000a13f
and dword [ebp - 0x870], 0
jmp 0x1000a149
mov dword [ebp - 0x870], 1
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 0xaed1
jne 0x1000a179
mov dword [ebp - 0x4f0], 1
jmp 0x1000a180
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0x4f0]
imul eax, eax, 0xec3
mov ecx, dword [ebp - 0x138]
mov dword [ebp + ecx*4 - 0xa7c], eax
jmp 0x1000a01d
jmp 0x10009fc7
jmp 0x10009f8d
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1000a1c6
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1000a3ed
mov dword [ebp - 0x188], 0xfffffffb
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x178], 0xffffffff
mov dword [ebp - 0x500], 0xfffffff6
mov dword [ebp - 0x214], 0
jmp 0x1000a216
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 1
jge 0x1000a232
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0x3fc], 0
jmp 0x1000a209
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x188], 0
jmp 0x1000a263
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x1000a3e5
mov dword [ebp - 0x118], 0
jmp 0x1000a289
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x1000a3e0
mov dword [ebp - 0x3a4], 0x68939f5f
mov dword [ebp - 0x6d8], 2
mov dword [ebp - 0xc44], 9
mov dword [ebp - 0xc40], 9
mov dword [ebp - 0xc3c], 9
mov dword [ebp - 0xc38], 9
mov dword [ebp - 0x178], 0
jmp 0x1000a2eb
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jg 0x1000a3db
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xd98], 0xc9995890
mov dword [ebp - 0xa8], 0
jmp 0x1000a325
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jg 0x1000a3d6
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x3fc]
mov dword [ebp - 0xcc8], eax
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x3fc]
cmp dword [ebp - 0x3a4], eax
jg 0x1000a380
mov eax, dword [ebp - 0xa8]
cmp dword [ebp + eax*4 - 0x3fc], 0
jne 0x1000a380
and dword [ebp - 0x7c0], 0
jmp 0x1000a38a
mov dword [ebp - 0x7c0], 1
cmp dword [ebp - 0x7c0], 0x16
je 0x1000a39f
mov dword [ebp - 0x4f8], 1
jmp 0x1000a3a6
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x500], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x500]
mov dword [ebp + eax - 0xc44], ecx
jmp 0x1000a318
jmp 0x1000a2de
jmp 0x1000a27c
jmp 0x1000a256
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x838]
dec eax
mov dword [ebp - 0x838], eax
jmp 0x10009bf9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd44]
call fcn.10016137
push 4
lea ecx, [ebp - 0xbd0]
call fcn.100160cf
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x508], 0xfffffffd
mov dword [ebp - 0x930], 1
mov dword [ebp - 0xe48], 0xab274bf9
push 3
lea ecx, [ebp - 0xd54]
call fcn.100160cf
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xcd0], 0x452a26f3
mov dword [ebp - 0x6e0], 0xffffffff
mov dword [ebp - 0x30], 0
jmp 0x1000a475
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1000a491
push dword [ebp - 0x30]
lea ecx, [ebp - 0xbd0]
call fcn.1001613c
mov dword [eax], 1
jmp 0x1000a46e
mov dword [ebp - 0x30], 0
jmp 0x1000a4a1
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1000a4bd
push dword [ebp - 0x30]
lea ecx, [ebp - 0xd54]
call fcn.1001613c
mov dword [eax], 0xfffffffa
jmp 0x1000a49a
push 3
lea ecx, [ebp - 0xbd0]
call fcn.1001613c
mov eax, dword [eax]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x508]
sub eax, 0x35d34ae3
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0x6e0]
dec eax
mov dword [ebp - 0x6e0], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xd54]
call fcn.10016137
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbd0]
call fcn.10016137
push 4
lea ecx, [ebp - 0xc00]
call fcn.100160cf
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x510], 0xfffffffd
mov dword [ebp - 0x938], 1
mov dword [ebp - 0xda8], 0xab274bf9
push 3
lea ecx, [ebp - 0xd64]
call fcn.100160cf
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xcd8], 0x452a26f3
mov dword [ebp - 0x7c8], 0xffffffff
mov dword [ebp - 0x34], 0
jmp 0x1000a575
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x1000a591
push dword [ebp - 0x34]
lea ecx, [ebp - 0xc00]
call fcn.1001613c
mov dword [eax], 1
jmp 0x1000a56e
mov dword [ebp - 0x34], 0
jmp 0x1000a5a1
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1000a5bd
push dword [ebp - 0x34]
lea ecx, [ebp - 0xd64]
call fcn.1001613c
mov dword [eax], 0xfffffffa
jmp 0x1000a59a
push 3
lea ecx, [ebp - 0xc00]
call fcn.1001613c
mov eax, dword [eax]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
sub eax, 0x35d34ae3
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0x7c8]
dec eax
mov dword [ebp - 0x7c8], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xd64]
call fcn.10016137
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc00]
call fcn.10016137
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x898], 0x1df82d83
mov dword [ebp - 0x7c], 0x876a47cd
mov dword [ebp - 0x68], 0
jmp 0x1000a636
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xd
jg 0x1000a9a1
push 1
lea ecx, [ebp - 0x894]
call fcn.100160cf
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x48], 0x78c38ec3
mov dword [ebp - 0x948], 0xffffffff
mov dword [ebp - 0x2b4], 0
jmp 0x1000a67e
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 1
jge 0x1000a6a0
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0x894]
call fcn.1001613c
mov dword [eax], 1
jmp 0x1000a671
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x518], eax
push 0
lea ecx, [ebp - 0x894]
call fcn.1001613c
mov ecx, dword [ebp - 0x518]
mov dword [eax], ecx
cmp dword [ebp - 0x518], 0
jne 0x1000a760
cmp dword [ebp - 0x48], 0x1a4e
jle 0x1000a6e0
mov dword [ebp - 0x6e8], 1
jmp 0x1000a6e7
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x6e8], eax
jle 0x1000a6fe
mov dword [ebp - 0x520], 1
jmp 0x1000a705
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
sub eax, 0x5145b2c2
cmp eax, dword [ebp - 0x68]
je 0x1000a721
mov dword [ebp - 0x940], 1
jmp 0x1000a728
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xe10], eax
push 0
lea ecx, [ebp - 0x894]
call fcn.1001613c
mov eax, dword [eax]
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x898]
add eax, dword [ebp - 0x7c]
jne 0x1000a760
and dword [ebp - 0x528], 0
jmp 0x1000a76a
mov dword [ebp - 0x528], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x528], eax
jge 0x1000a781
mov dword [ebp - 0x6f0], 1
jmp 0x1000a788
and dword [ebp - 0x6f0], 0
cmp dword [ebp - 0x6f0], 0
jl 0x1000a79d
mov dword [ebp - 0x530], 1
jmp 0x1000a7a4
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
shl eax, 3
mov dword [ebp - 0x948], eax
mov dword [ebp - 0x7c], 0
jmp 0x1000a7c3
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x1000a98d
mov dword [ebp - 0x950], 7
mov dword [ebp - 0x21c], 0
jmp 0x1000a7f0
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jge 0x1000a80c
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0xa2c], 0xd881
jmp 0x1000a7e3
mov dword [ebp - 0x48], 0
jmp 0x1000a81c
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1000a988
push dword [ebp - 0x48]
lea ecx, [ebp - 0x894]
call fcn.1001613c
cmp dword [eax], 0x623b
jne 0x1000a848
mov dword [ebp - 0x840], 1
jmp 0x1000a84f
and dword [ebp - 0x840], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa2c], 0
je 0x1000a872
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1000a872
mov dword [ebp - 0x7d0], 1
jmp 0x1000a879
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x7d0], eax
jle 0x1000a890
mov dword [ebp - 0x538], 1
jmp 0x1000a897
and dword [ebp - 0x538], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa2c]
cmp eax, dword [ebp - 0x538]
jl 0x1000a8b8
mov dword [ebp - 0x6f8], 1
jmp 0x1000a8bf
and dword [ebp - 0x6f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa2c]
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x894]
call fcn.1001613c
mov esi, eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x894]
call fcn.1001613c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1000a8fc
mov dword [ebp - 0x540], 1
jmp 0x1000a903
and dword [ebp - 0x540], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x894]
call fcn.1001613c
mov ecx, dword [ebp - 0x540]
cmp ecx, dword [eax]
je 0x1000a927
mov dword [ebp - 0x548], 1
jmp 0x1000a92e
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x840]
cmp eax, dword [ebp - 0x548]
jle 0x1000a948
mov dword [ebp - 0x700], 1
jmp 0x1000a94f
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x950], eax
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1000a983
push 0xb15
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x1000a815
jmp 0x1000a7bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x894]
call fcn.10016137
jmp 0x1000a62f
mov dword [ebp - 0x28], 0x48d327cb
mov dword [ebp - 0x3ac], 1
mov dword [ebp - 0x7e8], 0xc1932e3c
mov dword [ebp - 0x158], 0xf6f49c23
mov dword [ebp - 0x3e4], 7
mov dword [ebp - 0x28], 0xffffffed
jmp 0x1000a9e0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jl 0x1000add5
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x570], 0x737b78f1
mov dword [ebp - 0x9f4], 0x8e972ce3
mov dword [ebp - 0x304], 0
jmp 0x1000aa1e
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jge 0x1000aa3a
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x2bc], 0x972c40a9
jmp 0x1000aa11
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x28], eax
jne 0x1000aa4e
mov dword [ebp - 0x708], 1
jmp 0x1000aa55
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], eax
jge 0x1000aa69
mov dword [ebp - 0x550], 1
jmp 0x1000aa70
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0xffffffff
jne 0x1000aa85
mov dword [ebp - 0x7d8], 1
jmp 0x1000aa8c
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x7d8], eax
jle 0x1000aaa3
mov dword [ebp - 0x558], 1
jmp 0x1000aaaa
and dword [ebp - 0x558], 0
cmp dword [ebp - 0x558], 0xfffb
je 0x1000aac2
mov dword [ebp - 0x958], 1
jmp 0x1000aac9
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xce0], eax
cmp dword [ebp - 0x708], 0x8213af72
jb 0x1000aaea
mov dword [ebp - 0x560], 1
jmp 0x1000aaf1
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
add eax, 0x29694d2b
je 0x1000ab16
cmp dword [ebp - 0x28], 0
je 0x1000ab16
cmp dword [ebp - 0x28], 0
je 0x1000ab16
mov dword [ebp - 0x878], 1
jmp 0x1000ab1d
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x878], eax
jg 0x1000ab34
mov dword [ebp - 0x568], 1
jmp 0x1000ab3b
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x568]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x7e8]
cmp dword [ebp - 0x3ac], eax
jge 0x1000ab65
mov dword [ebp - 0x710], 1
jmp 0x1000ab6c
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
je 0x1000ac53
mov dword [ebp - 0x158], 0
jmp 0x1000ab9e
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x1000ac51
push 3
lea ecx, [ebp - 0xaac]
call fcn.100160cf
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x224], 0
jmp 0x1000abd8
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x1000abfa
push dword [ebp - 0x224]
lea ecx, [ebp - 0xaac]
call fcn.1001613c
mov dword [eax], 0x91b7
jmp 0x1000abcb
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1000ac17
push 0x29b
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
lea ecx, [ebp - 0xaac]
call fcn.1001613c
cmp dword [eax], 0
je 0x1000ac3d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaac]
call fcn.10016137
jmp 0x1000ab91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaac]
call fcn.10016137
jmp 0x1000ab91
jmp 0x1000ac70
mov dword [ebp - 0x960], 0xf5e4d8d9
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x960]
mov dword [ebp + eax - 0x2bc], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2bc], 0
je 0x1000adaf
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1000ad02
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x1000acae
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x570]
add eax, dword [ebp - 0x60]
cmp eax, 0xe213633e
je 0x1000acc0
mov eax, 0xffff
test eax, eax
jne 0x1000acc0
and dword [ebp - 0x7e0], 0
jmp 0x1000acca
mov dword [ebp - 0x7e0], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x7e0], eax
jle 0x1000ace1
mov dword [ebp - 0x578], 1
jmp 0x1000ace8
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x578], eax
je 0x1000ad02
mov dword [ebp - 0x580], 1
jmp 0x1000ad09
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x718], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x718]
mov dword [ebp + eax - 0x2bc], ecx
mov eax, dword [ebp - 0x718]
sub eax, dword [ebp - 0x580]
jne 0x1000ad4f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2bc], 0
jne 0x1000ad4f
and dword [ebp - 0x848], 0
jmp 0x1000ad59
mov dword [ebp - 0x848], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x848], eax
jle 0x1000ad70
mov dword [ebp - 0x588], 1
jmp 0x1000ad77
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x588], eax
je 0x1000ad8e
mov dword [ebp - 0x720], 1
jmp 0x1000ad95
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x28]
jge 0x1000adaf
mov dword [ebp - 0x590], 1
jmp 0x1000adb6
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x3e4]
imul eax, dword [ebp - 0x590]
imul eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x9f4], eax
jmp 0x1000a9d9
push 4
lea ecx, [ebp - 0xbac]
call fcn.100160cf
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x598], 0xfffffffd
mov dword [ebp - 0x8fc], 1
mov dword [ebp - 0xdb8], 0xab274bf9
push 3
lea ecx, [ebp - 0xd74]
call fcn.100160cf
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xce8], 0x452a26f3
mov dword [ebp - 0x728], 0xffffffff
mov dword [ebp - 0x50], 0
jmp 0x1000ae3c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x1000ae58
push dword [ebp - 0x50]
lea ecx, [ebp - 0xbac]
call fcn.1001613c
mov dword [eax], 1
jmp 0x1000ae35
mov dword [ebp - 0x50], 0
jmp 0x1000ae68
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1000ae84
push dword [ebp - 0x50]
lea ecx, [ebp - 0xd74]
call fcn.1001613c
mov dword [eax], 0xfffffffa
jmp 0x1000ae61
push 3
lea ecx, [ebp - 0xbac]
call fcn.1001613c
mov eax, dword [eax]
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x598]
sub eax, 0x35d34ae3
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x728]
dec eax
mov dword [ebp - 0x728], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xd74]
call fcn.10016137
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbac]
call fcn.10016137
mov dword [ebp - 0x32c], 0xa61928c1
mov dword [ebp - 0x22c], 0
jmp 0x1000aef8
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jge 0x1000af14
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xe54], 0x3718
jmp 0x1000aeeb
mov dword [ebp - 0x32c], 0
jmp 0x1000af2d
mov eax, dword [ebp - 0x32c]
dec eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0xffffffe4
jg 0x1000b13d
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x234], 0xffffffec
jmp 0x1000af5d
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xe
je 0x1000b138
push 2
lea ecx, [ebp - 0x980]
call fcn.100160cf
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x198], 0xfffffffc
mov dword [ebp - 0xa08], 0x6f93bd5d
mov dword [ebp - 0x2c4], 0
jmp 0x1000afab
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 2
jge 0x1000afcd
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0x980]
call fcn.1001613c
mov dword [eax], 0x49f845d8
jmp 0x1000af9e
mov dword [ebp - 0x198], 0
jmp 0x1000afe6
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jg 0x1000b124
mov dword [ebp - 0x23c], 0
jmp 0x1000b00c
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jge 0x1000b028
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0xb0], 0xffffffff
jmp 0x1000afff
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x1000b055
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb0], 1
jmp 0x1000b083
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb0], 0
jl 0x1000b11f
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xb0]
lea ecx, [ebp - 0x980]
call fcn.1001613c
cmp dword [eax], 0
jne 0x1000b104
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xb0]
lea ecx, [ebp - 0x980]
call fcn.1001613c
push dword [ebp - 0x198]
lea ecx, [ebp - 0x980]
call fcn.1001613c
cmp dword [eax], 0
jne 0x1000b0fb
mov eax, 0xa8fecf79
test eax, eax
jne 0x1000b0fb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb0], 1
je 0x1000b104
and dword [ebp - 0x5a0], 0
jmp 0x1000b10e
mov dword [ebp - 0x5a0], 1
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0xa08], eax
jmp 0x1000b068
jmp 0x1000afd9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x980]
call fcn.10016137
jmp 0x1000af50
jmp 0x1000af20
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x5b0], 0x1df82d83
mov dword [ebp - 0x80], 0x876a47cd
mov dword [ebp - 0x70], 0
jmp 0x1000b165
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xd
jg 0x1000b4d0
push 1
lea ecx, [ebp - 0x8a4]
call fcn.100160cf
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x58], 0x78c38ec3
mov dword [ebp - 0xa34], 0xffffffff
mov dword [ebp - 0x30c], 0
jmp 0x1000b1ad
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 1
jge 0x1000b1cf
push dword [ebp - 0x30c]
lea ecx, [ebp - 0x8a4]
call fcn.1001613c
mov dword [eax], 1
jmp 0x1000b1a0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x8b8], eax
push 0
lea ecx, [ebp - 0x8a4]
call fcn.1001613c
mov ecx, dword [ebp - 0x8b8]
mov dword [eax], ecx
cmp dword [ebp - 0x8b8], 0
jne 0x1000b28f
cmp dword [ebp - 0x58], 0x1a4e
jle 0x1000b20f
mov dword [ebp - 0x5a8], 1
jmp 0x1000b216
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x5a8], eax
jle 0x1000b22d
mov dword [ebp - 0x730], 1
jmp 0x1000b234
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x730]
sub eax, 0x5145b2c2
cmp eax, dword [ebp - 0x70]
je 0x1000b250
mov dword [ebp - 0x904], 1
jmp 0x1000b257
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xe30], eax
push 0
lea ecx, [ebp - 0x8a4]
call fcn.1001613c
mov eax, dword [eax]
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x5b0]
add eax, dword [ebp - 0x80]
jne 0x1000b28f
and dword [ebp - 0x7f0], 0
jmp 0x1000b299
mov dword [ebp - 0x7f0], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x7f0], eax
jge 0x1000b2b0
mov dword [ebp - 0x5b8], 1
jmp 0x1000b2b7
and dword [ebp - 0x5b8], 0
cmp dword [ebp - 0x5b8], 0
jl 0x1000b2cc
mov dword [ebp - 0x738], 1
jmp 0x1000b2d3
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x738]
shl eax, 3
mov dword [ebp - 0xa34], eax
mov dword [ebp - 0x80], 0
jmp 0x1000b2f2
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jg 0x1000b4bc
mov dword [ebp - 0x90c], 7
mov dword [ebp - 0x244], 0
jmp 0x1000b31f
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jge 0x1000b33b
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0xa00], 0xd881
jmp 0x1000b312
mov dword [ebp - 0x58], 0
jmp 0x1000b34b
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x1000b4b7
push dword [ebp - 0x58]
lea ecx, [ebp - 0x8a4]
call fcn.1001613c
cmp dword [eax], 0x623b
jne 0x1000b377
mov dword [ebp - 0x5d0], 1
jmp 0x1000b37e
and dword [ebp - 0x5d0], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa00], 0
je 0x1000b3a1
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1000b3a1
mov dword [ebp - 0x5c0], 1
jmp 0x1000b3a8
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x5c0], eax
jle 0x1000b3bf
mov dword [ebp - 0x850], 1
jmp 0x1000b3c6
and dword [ebp - 0x850], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa00]
cmp eax, dword [ebp - 0x850]
jl 0x1000b3e7
mov dword [ebp - 0x5c8], 1
jmp 0x1000b3ee
and dword [ebp - 0x5c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa00]
push dword [ebp - 0x80]
lea ecx, [ebp - 0x8a4]
call fcn.1001613c
mov esi, eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x8a4]
call fcn.1001613c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1000b42b
mov dword [ebp - 0x740], 1
jmp 0x1000b432
and dword [ebp - 0x740], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0x8a4]
call fcn.1001613c
mov ecx, dword [ebp - 0x740]
cmp ecx, dword [eax]
je 0x1000b456
mov dword [ebp - 0x7f8], 1
jmp 0x1000b45d
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x5d0]
cmp eax, dword [ebp - 0x7f8]
jle 0x1000b477
mov dword [ebp - 0x5d8], 1
jmp 0x1000b47e
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x90c], eax
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1000b4b2
push 0xb15
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x1000b344
jmp 0x1000b2eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a4]
call fcn.10016137
jmp 0x1000b15e
mov dword [ebp - 0x24c], 0x3ae35568
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x2cc], 0
jmp 0x1000b4fd
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 3
jge 0x1000b519
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0xefc], 0x3009
jmp 0x1000b4f0
mov dword [ebp - 0x24c], 0xffffffee
jmp 0x1000b532
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x17
jle 0x1000b72c
mov dword [ebp - 0x34c], 1
mov dword [ebp - 0x34c], 0x11
jmp 0x1000b562
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x1c
jl 0x1000b6f5
mov dword [ebp - 0x254], 0xffffffff
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1000b591
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [ebp - 0x254], 0
jmp 0x1000b5aa
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 4
je 0x1000b6f0
mov dword [ebp - 0x180], 0xffffc085
mov dword [ebp - 0x180], 0
jmp 0x1000b5da
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jg 0x1000b6eb
mov dword [ebp - 0x2d4], 0
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1000b610
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x2d4], 2
jmp 0x1000b629
mov eax, dword [ebp - 0x2d4]
dec eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
jl 0x1000b6e6
mov dword [ebp - 0x25c], 0x746a1c17
mov dword [ebp - 0x25c], 2
jmp 0x1000b659
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jl 0x1000b6e1
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x1000b67c
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x1000b6dc
push 0x12c3
push 0x73
push 0xe00
push 0
push 0x2315
push 0x1449
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1888
push 0x1f37
push 0x52b
push 0x26f7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x1000b64c
jmp 0x1000b61c
jmp 0x1000b5cd
jmp 0x1000b59d
jmp 0x1000b555
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1000b727
push 0
push 0xffc
push 0xb93
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x1000b525
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x5e8], 0x1df82d83
mov dword [ebp - 0x88], 0x876a47cd
mov dword [ebp - 0x3c], 0
jmp 0x1000b757
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xd
jg 0x1000bada
push 1
lea ecx, [ebp - 0x8b4]
call fcn.100160cf
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x44], 0x78c38ec3
mov dword [ebp - 0x914], 0xffffffff
mov dword [ebp - 0x314], 0
jmp 0x1000b79f
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 1
jge 0x1000b7c1
push dword [ebp - 0x314]
lea ecx, [ebp - 0x8b4]
call fcn.1001613c
mov dword [eax], 1
jmp 0x1000b792
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x748], eax
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1001613c
mov ecx, dword [ebp - 0x748]
mov dword [eax], ecx
cmp dword [ebp - 0x748], 0
jne 0x1000b887
cmp dword [ebp - 0x44], 0x1a4e
jle 0x1000b801
mov dword [ebp - 0x5e0], 1
jmp 0x1000b808
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x5e0], eax
jle 0x1000b81f
mov dword [ebp - 0x880], 1
jmp 0x1000b826
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x880]
sub eax, 0x5145b2c2
cmp eax, dword [ebp - 0x3c]
je 0x1000b842
mov dword [ebp - 0xa10], 1
jmp 0x1000b849
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xcf0], eax
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1001613c
mov eax, dword [eax]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x5e8]
add eax, dword [ebp - 0x88]
jne 0x1000b887
and dword [ebp - 0x750], 0
jmp 0x1000b891
mov dword [ebp - 0x750], 1
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x750], eax
jge 0x1000b8a8
mov dword [ebp - 0x5f0], 1
jmp 0x1000b8af
and dword [ebp - 0x5f0], 0
cmp dword [ebp - 0x5f0], 0
jl 0x1000b8c4
mov dword [ebp - 0x800], 1
jmp 0x1000b8cb
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x800]
shl eax, 3
mov dword [ebp - 0x914], eax
mov dword [ebp - 0x88], 0
jmp 0x1000b8f3
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jg 0x1000bac6
mov dword [ebp - 0xa58], 7
mov dword [ebp - 0x264], 0
jmp 0x1000b923
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 2
jge 0x1000b93f
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0xa48], 0xd881
jmp 0x1000b916
mov dword [ebp - 0x44], 0
jmp 0x1000b94f
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1000bac1
push dword [ebp - 0x44]
lea ecx, [ebp - 0x8b4]
call fcn.1001613c
cmp dword [eax], 0x623b
jne 0x1000b97b
mov dword [ebp - 0x608], 1
jmp 0x1000b982
and dword [ebp - 0x608], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa48], 0
je 0x1000b9a5
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1000b9a5
mov dword [ebp - 0x5f8], 1
jmp 0x1000b9ac
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x5f8], eax
jle 0x1000b9c6
mov dword [ebp - 0x758], 1
jmp 0x1000b9cd
and dword [ebp - 0x758], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa48]
cmp eax, dword [ebp - 0x758]
jl 0x1000b9ee
mov dword [ebp - 0x41c], 1
jmp 0x1000b9f5
and dword [ebp - 0x41c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa48]
push dword [ebp - 0x88]
lea ecx, [ebp - 0x8b4]
call fcn.1001613c
mov esi, eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x8b4]
call fcn.1001613c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1000ba35
mov dword [ebp - 0x858], 1
jmp 0x1000ba3c
and dword [ebp - 0x858], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x8b4]
call fcn.1001613c
mov ecx, dword [ebp - 0x858]
cmp ecx, dword [eax]
je 0x1000ba60
mov dword [ebp - 0x760], 1
jmp 0x1000ba67
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x608]
cmp eax, dword [ebp - 0x760]
jle 0x1000ba81
mov dword [ebp - 0x610], 1
jmp 0x1000ba88
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0xa58], eax
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1000babc
push 0xb15
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x1000b948
jmp 0x1000b8e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b4]
call fcn.10016137
jmp 0x1000b750
mov dword [ebp - 0x2dc], 6
push 1
lea ecx, [ebp - 0xd84]
call fcn.100160cf
mov dword [ebp - 4], 0x15
mov dword [ebp - 0xdc8], 0xfffffffc
mov dword [ebp - 0xcf8], 0xffffffff
mov dword [ebp - 0x120], 0xd0714ad
mov dword [ebp - 0xe18], 1
mov dword [ebp - 0x924], 0xfe936be8
mov dword [ebp - 0x38], 0
jmp 0x1000bb3a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000bb56
push dword [ebp - 0x38]
lea ecx, [ebp - 0xd84]
call fcn.1001613c
mov dword [eax], 0x7a7c2039
jmp 0x1000bb33
mov dword [ebp - 0x38], 0
jmp 0x1000bb66
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000bb7c
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xa18], 0x36de0184
jmp 0x1000bb5f
mov dword [ebp - 0x2dc], 0
jmp 0x1000bb95
mov eax, dword [ebp - 0x2dc]
dec eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0xfffffffd
jg 0x1000bc5d
mov dword [ebp - 0x26c], 0x2167fa5c
mov dword [ebp - 0xd08], 0xffffffff
mov dword [ebp - 0x91c], 1
mov dword [ebp - 0x26c], 0
jmp 0x1000bbd9
mov eax, dword [ebp - 0x26c]
dec eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jl 0x1000bc23
mov dword [ebp - 0xdd8], 0x11151c3
mov dword [ebp - 0xc4c], 0xa97963ba
mov dword [ebp - 0xc50], 0x49f6d4a0
mov dword [ebp - 0x808], 0xfffffffc
mov eax, dword [ebp - 0x808]
inc eax
mov dword [ebp - 0x808], eax
mov dword [ebp - 0x91c], 0xfffffff6
jmp 0x1000bbcc
mov dword [ebp - 0x120], 0
jmp 0x1000bc3c
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x1000bc58
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0xa18], 0xbefcdf11
jmp 0x1000bc2f
jmp 0x1000bb88
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x924], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd84]
call fcn.10016137
mov dword [ebp - 0x274], 0xa61928c1
mov dword [ebp - 0x334], 0
jmp 0x1000bc9b
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 2
jge 0x1000bcb7
mov eax, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0xebc], 0x3718
jmp 0x1000bc8e
mov dword [ebp - 0x274], 0
jmp 0x1000bcd0
mov eax, dword [ebp - 0x274]
dec eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffe4
jg 0x1000bee0
mov dword [ebp - 0x2e4], 1
mov dword [ebp - 0x2e4], 0xffffffec
jmp 0x1000bd00
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0xe
je 0x1000bedb
push 2
lea ecx, [ebp - 0x990]
call fcn.100160cf
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x168], 0xfffffffc
mov dword [ebp - 0x9dc], 0x6f93bd5d
mov dword [ebp - 0x27c], 0
jmp 0x1000bd4e
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x1000bd70
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x990]
call fcn.1001613c
mov dword [eax], 0x49f845d8
jmp 0x1000bd41
mov dword [ebp - 0x168], 0
jmp 0x1000bd89
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jg 0x1000bec7
mov dword [ebp - 0x31c], 0
jmp 0x1000bdaf
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 1
jge 0x1000bdcb
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0xb8], 0xffffffff
jmp 0x1000bda2
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x1000bdf8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb8], 1
jmp 0x1000be26
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb8], 0
jl 0x1000bec2
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xb8]
lea ecx, [ebp - 0x990]
call fcn.1001613c
cmp dword [eax], 0
jne 0x1000bea7
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xb8]
lea ecx, [ebp - 0x990]
call fcn.1001613c
push dword [ebp - 0x168]
lea ecx, [ebp - 0x990]
call fcn.1001613c
cmp dword [eax], 0
jne 0x1000be9e
mov eax, 0xa8fecf79
test eax, eax
jne 0x1000be9e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb8], 1
je 0x1000bea7
and dword [ebp - 0x618], 0
jmp 0x1000beb1
mov dword [ebp - 0x618], 1
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x9dc], eax
jmp 0x1000be0b
jmp 0x1000bd7c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x990]
call fcn.10016137
jmp 0x1000bcf3
jmp 0x1000bcc3
movzx eax, byte [0x10676be8]
test eax, eax
je 0x1000befe
mov esi, 0x1008b5b0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1000ffcf
mov dword [ebp - 0xb74], 0x7e8e
mov dword [ebp - 0xb70], 0x7e8e
mov dword [ebp - 0xb6c], 0x7e8e
mov dword [ebp - 0xb68], 0x7e8e
lea ecx, [ebp - 0x3e5]
call fcn.10008c23
push eax
lea eax, [ebp - 0xb64]
push eax
lea eax, [ebp - 0xb74]
push eax
lea ecx, [ebp - 0xee4]
call fcn.1001614b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x8c4]
call fcn.10016111
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x3b4], 0xfffffff6
mov dword [ebp - 0xc58], 0
mov dword [ebp - 0xc60], 0x1d66bd5d
mov dword [ebp - 0xc68], 0xffffffff
mov dword [ebp - 0xc70], 0
mov dword [ebp - 0x284], 0
jmp 0x1000bfad
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jge 0x1000bfc9
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0x374], 0xe3245f1d
jmp 0x1000bfa0
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1000bfe3
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x374], 3
jmp 0x1000c011
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x374]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x374], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x374], 0
jl 0x1000c429
push 3
lea ecx, [ebp - 0xa94]
call fcn.100160cf
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x648], 1
mov dword [ebp - 0x780], 0xd4763c6d
mov dword [ebp - 0xc78], 0xfffffff8
mov dword [ebp - 0xc80], 0
mov dword [ebp - 0x2ec], 0
jmp 0x1000c077
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 3
jge 0x1000c099
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0xa94]
call fcn.1001613c
mov dword [eax], 0xfffffffe
jmp 0x1000c06a
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x374]
lea ecx, [ebp - 0x8c4]
call fcn.1001613c
cmp dword [eax], 0
ja 0x1000c0c2
mov dword [ebp - 0x768], 1
jmp 0x1000c0c9
and dword [ebp - 0x768], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x374]
cmp dword [ebp - 0x768], eax
jl 0x1000c0e9
mov dword [ebp - 0x620], 1
jmp 0x1000c0f0
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x3b4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x374]
mov dword [ebp - 0xc88], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x374]
lea ecx, [ebp - 0x8c4]
call fcn.1001613c
cmp dword [eax], 0
je 0x1000c14a
push 2
lea ecx, [ebp - 0x8c4]
call fcn.1001613c
cmp dword [eax], 0
je 0x1000c14a
mov dword [ebp - 0x8a8], 1
jmp 0x1000c151
and dword [ebp - 0x8a8], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x374]
lea ecx, [ebp - 0x8c4]
call fcn.1001613c
mov ecx, dword [ebp - 0x8a8]
cmp ecx, dword [eax]
jg 0x1000c17f
mov dword [ebp - 0x628], 1
jmp 0x1000c186
and dword [ebp - 0x628], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x374]
cmp dword [ebp - 0x628], eax
jne 0x1000c1a7
mov dword [ebp - 0x770], 1
jmp 0x1000c1ae
and dword [ebp - 0x770], 0
cmp dword [ebp - 0x770], 0xbb35
jge 0x1000c1c6
mov dword [ebp - 0x630], 1
jmp 0x1000c1cd
and dword [ebp - 0x630], 0
cmp dword [ebp - 0x630], 0xffffffff
jl 0x1000c1e2
mov dword [ebp - 0x810], 1
jmp 0x1000c1e9
and dword [ebp - 0x810], 0
push 0
lea ecx, [ebp - 0xa94]
call fcn.1001613c
mov ecx, dword [ebp - 0x810]
cmp ecx, dword [eax]
jle 0x1000c20c
mov dword [ebp - 0x638], 1
jmp 0x1000c213
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0x638], eax
je 0x1000c22d
mov dword [ebp - 0x778], 1
jmp 0x1000c234
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
add eax, 0x77e0
cmp eax, 0xfffffff8
jge 0x1000c250
mov dword [ebp - 0x640], 1
jmp 0x1000c257
and dword [ebp - 0x640], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x640]
cmp eax, dword [ebp - 0x648]
jg 0x1000c274
mov dword [ebp - 0x860], 1
jmp 0x1000c27b
and dword [ebp - 0x860], 0
cmp dword [ebp - 0x860], 0xc88f
jne 0x1000c293
mov dword [ebp - 0x92c], 1
jmp 0x1000c29a
and dword [ebp - 0x92c], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x374]
lea ecx, [ebp - 0x8c4]
call fcn.1001613c
push 2
lea ecx, [ebp - 0x8c4]
call fcn.1001613c
cmp dword [eax], 0
jne 0x1000c2cb
cmp dword [ebp - 0x3b4], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x374]
lea ecx, [ebp - 0x8c4]
call fcn.1001613c
mov dword [eax], 0x169f
imul esi, dword [ebp - 0x648], 0x169f
inc esi
push 0
lea ecx, [ebp - 0xa94]
call fcn.1001613c
cmp esi, dword [eax]
jge 0x1000c3e0
push 1
lea ecx, [ebp - 0xbdc]
call fcn.100160cf
mov byte [ebp - 4], 0x19
push 3
lea ecx, [ebp - 0xbc4]
call fcn.100160cf
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x54], 0
jmp 0x1000c33b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x1000c354
push dword [ebp - 0x54]
lea ecx, [ebp - 0xbdc]
call fcn.1001613c
or dword [eax], 0xffffffff
jmp 0x1000c334
mov dword [ebp - 0x54], 0
jmp 0x1000c364
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x1000c380
push dword [ebp - 0x54]
lea ecx, [ebp - 0xbc4]
call fcn.1001613c
mov dword [eax], 0x6d4c01e0
jmp 0x1000c35d
mov dword [ebp - 0x780], 0x1404fc4b
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x650], eax
push 0
lea ecx, [ebp - 0xbdc]
call fcn.1001613c
mov ecx, dword [ebp - 0x650]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0xbc4]
call fcn.1001613c
mov ecx, dword [ebp - 0x650]
mov dword [eax], ecx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xbc4]
call fcn.10016137
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xbdc]
call fcn.10016137
jmp 0x1000c415
mov dword [ebp - 0x818], 0x820a
mov eax, dword [ebp - 0x818]
dec eax
mov dword [ebp - 0x818], eax
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1000c415
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xa94]
call fcn.10016137
jmp 0x1000bff6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c4]
call fcn.10016137
mov dword [ebp - 0x1c8], 0x3ae35568
mov dword [ebp - 0x164], 1
mov dword [ebp - 0x28c], 0
jmp 0x1000c465
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 3
jge 0x1000c481
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0xef0], 0x3009
jmp 0x1000c458
mov dword [ebp - 0x1c8], 0xffffffee
jmp 0x1000c49a
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x17
jle 0x1000c694
mov dword [ebp - 0x1d0], 1
mov dword [ebp - 0x1d0], 0x11
jmp 0x1000c4ca
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0x1c
jl 0x1000c65d
mov dword [ebp - 0x1c4], 0xffffffff
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1000c4f9
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [ebp - 0x1c4], 0
jmp 0x1000c512
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 4
je 0x1000c658
mov dword [ebp - 0x164], 0xffffc085
mov dword [ebp - 0x164], 0
jmp 0x1000c542
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jg 0x1000c653
mov dword [ebp - 0x1d8], 0
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x1000c578
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x1d8], 2
jmp 0x1000c591
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
jl 0x1000c64e
mov dword [ebp - 0x1e0], 0x746a1c17
mov dword [ebp - 0x1e0], 2
jmp 0x1000c5c1
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x1000c649
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1000c5e4
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x1000c644
push 0x12c3
push 0x73
push 0xe00
push 0
push 0x2315
push 0x1449
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1888
push 0x1f37
push 0x52b
push 0x26f7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x1000c5b4
jmp 0x1000c584
jmp 0x1000c535
jmp 0x1000c505
jmp 0x1000c4bd
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1000c68f
push 0
push 0xffc
push 0xb93
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x1000c48d
mov dword [ebp - 0x1c], 0x5540d7f8
mov dword [ebp - 0x40c], 0x951ea66e
mov dword [ebp - 0xc0], 0xbd2ab60e
mov dword [ebp - 0x140], 0
mov dword [ebp - 0xb4c], 3
mov dword [ebp - 0xb48], 3
mov dword [ebp - 0xb44], 3
mov dword [ebp - 0xb40], 3
lea ecx, [ebp - 0x405]
call fcn.10008c23
push eax
lea eax, [ebp - 0xb3c]
push eax
lea eax, [ebp - 0xb4c]
push eax
lea ecx, [ebp - 0xe84]
call fcn.1001614b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd94]
call fcn.10016111
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x1e8], 0
jmp 0x1000c736
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x1000c752
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x9f0], 0xffffffff
jmp 0x1000c729
mov dword [ebp - 0x1c], 0xf
jmp 0x1000c762
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jl 0x1000c7df
mov dword [ebp - 0x1f0], 0x5e1f6f08
mov dword [ebp - 0x934], 0xffffffff
mov eax, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1f0]
sub eax, ecx
cmp dword [ebp - 0x1f0], eax
jle 0x1000c7a1
mov dword [ebp - 0x9d8], 1
jmp 0x1000c7a8
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40c], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x40c]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc90], eax
xor eax, eax
sub eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x934], eax
jmp 0x1000c75b
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1c], eax
je 0x1000c802
mov dword [ebp - 0x9e8], 1
jmp 0x1000c809
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x140]
dec ecx
mov dword [ebp - 0x140], ecx
test eax, eax
je 0x1000c8ca
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1c], eax
jl 0x1000c844
mov dword [ebp - 0x658], 1
jmp 0x1000c84b
and dword [ebp - 0x658], 0
cmp dword [ebp - 0x658], 0x9843
jge 0x1000c861
cmp dword [ebp - 0x1c], 0
je 0x1000c861
cmp dword [ebp - 0x1c], 0
cmp dword [ebp - 0x140], 0
je 0x1000c87c
cmp dword [ebp - 0x1c], 0
je 0x1000c87c
mov dword [ebp - 0x788], 1
jmp 0x1000c883
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x788], eax
jne 0x1000c89d
mov dword [ebp - 0x660], 1
jmp 0x1000c8a4
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x660]
sub eax, 0x28e48792
cmp dword [ebp - 0x40c], eax
je 0x1000c8c3
mov dword [ebp - 0x888], 1
jmp 0x1000c8ca
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x93c], eax
push 3
lea ecx, [ebp - 0xd94]
call fcn.1001613c
mov ecx, dword [ebp - 0x93c]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x140]
mov dword [ebp + eax - 0x9f0], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd94]
call fcn.10016137
mov dword [ebp - 0x1b8], 0xa61928c1
mov dword [ebp - 0x1f8], 0
jmp 0x1000c92d
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x1000c949
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0xeb4], 0x3718
jmp 0x1000c920
mov dword [ebp - 0x1b8], 0
jmp 0x1000c962
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xffffffe4
jg 0x1000cb72
mov dword [ebp - 0x200], 1
mov dword [ebp - 0x200], 0xffffffec
jmp 0x1000c992
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xe
je 0x1000cb6d
push 2
lea ecx, [ebp - 0x9a0]
call fcn.100160cf
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x174], 0xfffffffc
mov dword [ebp - 0x944], 0x6f93bd5d
mov dword [ebp - 0x208], 0
jmp 0x1000c9e0
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x1000ca02
push dword [ebp - 0x208]
lea ecx, [ebp - 0x9a0]
call fcn.1001613c
mov dword [eax], 0x49f845d8
jmp 0x1000c9d3
mov dword [ebp - 0x174], 0
jmp 0x1000ca1b
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jg 0x1000cb59
mov dword [ebp - 0x210], 0
jmp 0x1000ca41
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x1000ca5d
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0xc8], 0xffffffff
jmp 0x1000ca34
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x1000ca8a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc8], 1
jmp 0x1000cab8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc8], 0
jl 0x1000cb54
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xc8]
lea ecx, [ebp - 0x9a0]
call fcn.1001613c
cmp dword [eax], 0
jne 0x1000cb39
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xc8]
lea ecx, [ebp - 0x9a0]
call fcn.1001613c
push dword [ebp - 0x174]
lea ecx, [ebp - 0x9a0]
call fcn.1001613c
cmp dword [eax], 0
jne 0x1000cb30
mov eax, 0xa8fecf79
test eax, eax
jne 0x1000cb30
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc8], 1
je 0x1000cb39
and dword [ebp - 0x668], 0
jmp 0x1000cb43
mov dword [ebp - 0x668], 1
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x944], eax
jmp 0x1000ca9d
jmp 0x1000ca0e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9a0]
call fcn.10016137
jmp 0x1000c985
jmp 0x1000c955
mov dword [ebp - 0x218], 6
push 1
lea ecx, [ebp - 0xda4]
call fcn.100160cf
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0xc98], 0xfffffffc
mov dword [ebp - 0xca0], 0xffffffff
mov dword [ebp - 0x128], 0xd0714ad
mov dword [ebp - 0xca8], 1
mov dword [ebp - 0xa04], 0xfe936be8
mov dword [ebp - 0x5c], 0
jmp 0x1000cbd2
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1000cbee
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xda4]
call fcn.1001613c
mov dword [eax], 0x7a7c2039
jmp 0x1000cbcb
mov dword [ebp - 0x5c], 0
jmp 0x1000cbfe
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1000cc14
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x94c], 0x36de0184
jmp 0x1000cbf7
mov dword [ebp - 0x218], 0
jmp 0x1000cc2d
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xfffffffd
jg 0x1000ccf5
mov dword [ebp - 0x220], 0x2167fa5c
mov dword [ebp - 0xcb0], 0xffffffff
mov dword [ebp - 0x9f8], 1
mov dword [ebp - 0x220], 0
jmp 0x1000cc71
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x1000ccbb
mov dword [ebp - 0xe28], 0x11151c3
mov dword [ebp - 0xd88], 0xa97963ba
mov dword [ebp - 0xcb4], 0x49f6d4a0
mov dword [ebp - 0x790], 0xfffffffc
mov eax, dword [ebp - 0x790]
inc eax
mov dword [ebp - 0x790], eax
mov dword [ebp - 0x9f8], 0xfffffff6
jmp 0x1000cc64
mov dword [ebp - 0x128], 0
jmp 0x1000ccd4
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x1000ccf0
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x94c], 0xbefcdf11
jmp 0x1000ccc7
jmp 0x1000cc20
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xa04], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xda4]
call fcn.10016137
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x228], 0
jmp 0x1000cd33
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 4
jge 0x1000cd4f
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xecc], 0x841b3c69
jmp 0x1000cd26
mov dword [ebp - 0x150], 0
jmp 0x1000cd68
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jg 0x1000cdbe
mov dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp + eax*4 - 0xecc], 0
je 0x1000cd8d
jmp 0x1000cdbe
mov dword [ebp - 0x230], 3
jmp 0x1000cda6
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jl 0x1000cdbc
cmp dword [ebp - 0x150], 0
je 0x1000cdba
jmp 0x1000cdbc
jmp 0x1000cd99
jmp 0x1000cd5b
mov dword [ebp - 0xcbc], 0x1008b5b0
mov dword [ebp - 0xcc4], 0x1008b5b4
mov dword [ebp - 0x1bc], 0x3ae35568
mov dword [ebp - 0x17c], 1
mov dword [ebp - 0x238], 0
jmp 0x1000cdff
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1000ce1b
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xf08], 0x3009
jmp 0x1000cdf2
mov dword [ebp - 0x1bc], 0xffffffee
jmp 0x1000ce34
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x17
jle 0x1000d02e
mov dword [ebp - 0x1c0], 1
mov dword [ebp - 0x1c0], 0x11
jmp 0x1000ce64
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x1c
jl 0x1000cff7
mov dword [ebp - 0x240], 0xffffffff
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x1000ce93
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [ebp - 0x240], 0
jmp 0x1000ceac
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
je 0x1000cff2
mov dword [ebp - 0x17c], 0xffffc085
mov dword [ebp - 0x17c], 0
jmp 0x1000cedc
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jg 0x1000cfed
mov dword [ebp - 0x248], 0
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x1000cf12
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x248], 2
jmp 0x1000cf2b
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x1000cfe8
mov dword [ebp - 0x250], 0x746a1c17
mov dword [ebp - 0x250], 2
jmp 0x1000cf5b
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jl 0x1000cfe3
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1000cf7e
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x1000cfde
push 0x12c3
push 0x73
push 0xe00
push 0
push 0x2315
push 0x1449
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1888
push 0x1f37
push 0x52b
push 0x26f7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x1000cf4e
jmp 0x1000cf1e
jmp 0x1000cecf
jmp 0x1000ce9f
jmp 0x1000ce57
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x1000d029
push 0
push 0xffc
push 0xb93
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x1000ce27
mov dword [ebp - 0x3ec], 0xbe4438b
mov dword [ebp - 0x3bc], 2
mov dword [ebp - 0x258], 0xba22e974
mov dword [ebp - 0x3c4], 0x3e1e01b1
push 3
lea ecx, [ebp - 0xadc]
call fcn.100160cf
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xccc], 0xffffffff
mov dword [ebp - 0xcd4], 0xffffffff
mov dword [ebp - 0xcdc], 1
mov dword [ebp - 0x688], 0x4fc3
mov dword [ebp - 0x14], 0
jmp 0x1000d0a2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000d0b8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xae8], 0xbbdebf88
jmp 0x1000d09b
mov dword [ebp - 0x14], 0
jmp 0x1000d0c8
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000d0e4
push dword [ebp - 0x14]
lea ecx, [ebp - 0xadc]
call fcn.1001613c
mov dword [eax], 1
jmp 0x1000d0c1
mov dword [ebp - 0x14], 0
jmp 0x1000d0f4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000d10a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe94], 0xfffffffa
jmp 0x1000d0ed
cmp dword [ebp - 0x258], 0
jne 0x1000d125
cmp dword [ebp - 0x258], 0
jne 0x1000d125
and dword [ebp - 0x670], 0
jmp 0x1000d12f
mov dword [ebp - 0x670], 1
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x3c4]
imul eax, dword [ebp - 0x3c4]
cmp dword [ebp - 0x258], eax
jg 0x1000d15c
mov dword [ebp - 0x820], 1
jmp 0x1000d163
and dword [ebp - 0x820], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xae8]
cmp dword [ebp - 0x820], eax
jg 0x1000d184
mov dword [ebp - 0x678], 1
jmp 0x1000d18b
and dword [ebp - 0x678], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x678]
sub ecx, dword [ebp + eax - 0xae8]
je 0x1000d1bc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xae8], 0
je 0x1000d1bc
mov dword [ebp - 0x798], 1
jmp 0x1000d1c3
and dword [ebp - 0x798], 0
push 0
lea ecx, [ebp - 0xadc]
call fcn.1001613c
mov ecx, dword [ebp - 0x798]
cmp ecx, dword [eax]
je 0x1000d1e6
mov dword [ebp - 0x680], 1
jmp 0x1000d1ed
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x3bc]
sub eax, dword [ebp - 0x680]
cmp dword [ebp - 0x3ec], eax
je 0x1000d225
mov dword [ebp - 0x868], 1
jmp 0x1000d22c
and dword [ebp - 0x868], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp - 0x868]
sub esi, dword [ebp + eax - 0xae8]
neg esi
push 1
lea ecx, [ebp - 0xadc]
call fcn.1001613c
add esi, dword [eax]
mov dword [ebp - 0x3c4], esi
mov eax, dword [ebp - 0x688]
dec eax
mov dword [ebp - 0x688], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xadc]
call fcn.10016137
mov dword [ebp - 0xb10], 0x7e8e
mov dword [ebp - 0xb0c], 0x7e8e
mov dword [ebp - 0xb08], 0x7e8e
mov dword [ebp - 0xb04], 0x7e8e
lea ecx, [ebp - 0x38d]
call fcn.10008c23
push eax
lea eax, [ebp - 0xb00]
push eax
lea eax, [ebp - 0xb10]
push eax
lea ecx, [ebp - 0xedc]
call fcn.1001614b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x8d4]
call fcn.10016111
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x404], 0xfffffff6
mov dword [ebp - 0xce4], 0
mov dword [ebp - 0xcec], 0x1d66bd5d
mov dword [ebp - 0xcf4], 0xffffffff
mov dword [ebp - 0xdfc], 0
mov dword [ebp - 0x260], 0
jmp 0x1000d321
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x1000d33d
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0x38c], 0xe3245f1d
jmp 0x1000d314
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x1000d357
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x38c], 3
jmp 0x1000d385
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38c], 0
jl 0x1000d79d
push 3
lea ecx, [ebp - 0xac4]
call fcn.100160cf
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x4c4], 1
mov dword [ebp - 0x4cc], 0xd4763c6d
mov dword [ebp - 0xe04], 0xfffffff8
mov dword [ebp - 0xe0c], 0
mov dword [ebp - 0x268], 0
jmp 0x1000d3eb
cmp dword [ebp - 0x268], 3
jge 0x1000d40d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d4]
call fcn.10016137
mov dword [ebp - 0xb38], 0xffab8c3a
mov dword [ebp - 0xb34], 0xffab8c3a
mov dword [ebp - 0xb30], 0xffab8c3a
mov dword [ebp - 0xb2c], 0xffab8c3a
lea ecx, [ebp - 0x415]
call fcn.10008c23
push eax
lea eax, [ebp - 0xb28]
push eax
lea eax, [ebp - 0xb38]
push eax
lea ecx, [ebp - 0xea4]
call fcn.1001614b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9b0]
call fcn.10016111
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x184], 0x2ee6d058
mov dword [ebp - 0x130], 0xd19c9214
mov dword [ebp - 0x108], 0xc7008b15
mov dword [ebp - 0x50c], 0x2e11914c
mov dword [ebp - 0xa0c], 0xfffffffe
mov dword [ebp - 0xe1c], 0x34ad
push 3
lea ecx, [ebp - 0x9b0]
call fcn.1001613c
imul eax, dword [ebp - 0x184], 5
test eax, eax
jne 0x1000d8ff
push 3
lea ecx, [ebp - 0x9b0]
call fcn.1001613c
cmp dword [eax], 0xfffc
jb 0x1000d889
mov dword [ebp - 0x4fc], 1
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x130], 0
jmp 0x1000d92e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret