Function at 0x10008f89
Capabilities:
Compare security identifiers
Contain obfuscated stackstrings
Create directory
Get disk information
Get graphical window text
Get keyboard layout
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b46e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe00
push esi
push edi
mov dword [ebp - 0xfc], 0xf5720e83
mov dword [ebp - 0xad0], 3
mov dword [ebp - 0x208], 0
jmp 0x10008fd6
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jge 0x10008ff2
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x814], 0xffffffff
jmp 0x10008fc9
mov dword [ebp - 0xfc], 0
jmp 0x1000900b
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x10009027
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x814], 9
jmp 0x10008ffe
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1000904a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 0x13c], 0xf5720e83
mov dword [ebp - 0xa64], 3
mov dword [ebp - 0x160], 0
jmp 0x10009077
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x10009093
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x760], 0xffffffff
jmp 0x1000906a
mov dword [ebp - 0x13c], 0
jmp 0x100090ac
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x100090c8
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x760], 9
jmp 0x1000909f
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x100090eb
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 0x924], 0x5e48d327
mov dword [ebp - 0x920], 0x5e48d327
mov dword [ebp - 0x91c], 0x5e48d327
mov dword [ebp - 0x918], 0x5e48d327
lea ecx, [ebp - 0x2e9]
call fcn.10008dd3
push eax
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x924]
push eax
lea ecx, [ebp - 0xd40]
call fcn.100152be
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x844]
call fcn.10015284
and dword [ebp - 4], 0
push 2
lea ecx, [ebp - 0x844]
call fcn.100152af
and dword [eax], 0
jmp 0x10009182
push 2
lea ecx, [ebp - 0x844]
call fcn.100152af
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x408]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x844]
call fcn.100152af
cmp dword [eax], 7
je 0x100091b2
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x100091b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1000915e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x844]
call fcn.100152aa
mov dword [ebp - 0xa6c], 0xfffffff8
mov dword [ebp - 0xa74], 0xffffffff
mov dword [ebp - 0xa84], 0
mov dword [ebp - 0xa8c], 0x29bf3901
push 3
lea ecx, [ebp - 0xbdc]
call fcn.10015242
mov dword [ebp - 4], 1
mov dword [ebp - 0xa94], 0xffffffff
mov dword [ebp - 0xa9c], 0xe41b66ba
push 1
lea ecx, [ebp - 0x9b0]
call fcn.10015242
mov byte [ebp - 4], 2
mov dword [ebp - 0x768], 0
mov dword [ebp - 0x678], 9
mov dword [ebp - 0x58], 0
jmp 0x10009246
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x10009262
push dword [ebp - 0x58]
lea ecx, [ebp - 0xbdc]
call fcn.100152af
mov dword [eax], 0xbe4438b
jmp 0x1000923f
mov dword [ebp - 0x58], 0
jmp 0x10009272
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1000928e
push dword [ebp - 0x58]
lea ecx, [ebp - 0x9b0]
call fcn.100152af
mov dword [eax], 0xe95aad85
jmp 0x1000926b
mov eax, dword [ebp - 0x678]
dec eax
mov dword [ebp - 0x678], eax
mov esi, dword [ebp - 0x768]
push 0
lea ecx, [ebp - 0x9b0]
call fcn.100152af
mov dword [eax], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9b0]
call fcn.100152aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbdc]
call fcn.100152aa
mov dword [ebp - 0x10c], 0xf5720e83
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x780], 0xfffffffb
mov dword [ebp - 0x260], 0
jmp 0x10009302
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x1000931e
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0x874], 0
jmp 0x100092f5
mov dword [ebp - 0x2c], 0
jmp 0x1000932e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x10009405
mov dword [ebp - 0x104], 0x2d8c
mov dword [ebp - 0x104], 0x9532bb11
mov dword [ebp - 0x104], 0
jmp 0x10009365
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jg 0x10009400
mov dword [ebp - 0x168], 0xfffffffd
mov dword [ebp - 0x168], 2
jmp 0x10009395
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x100093fb
mov dword [ebp - 0x124], 1
mov dword [ebp - 0x124], 0
jmp 0x100093c1
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jg 0x100093f9
mov eax, dword [ebp - 0x124]
cmp dword [ebp + eax*4 - 0x874], 0
je 0x100093dc
jmp 0x100093f9
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x100093f7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x100093b4
jmp 0x10009388
jmp 0x10009358
jmp 0x10009327
mov dword [ebp - 0x2c], 0
jmp 0x10009415
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
je 0x100095d6
mov dword [ebp - 0x48], 0xae7b79f6
mov dword [ebp - 0xaa4], 0xbd77dfcc
mov dword [ebp - 0x2dc], 1
mov dword [ebp - 0x770], 0x71808adc
mov dword [ebp - 0x788], 0xcae26e16
mov dword [ebp - 0x48], 0
jmp 0x1000945e
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x100095d1
cmp dword [ebp - 0x2c], 0
je 0x10009500
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x874]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2dc], eax
jge 0x100094a2
mov dword [ebp - 0x680], 1
jmp 0x100094a9
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 0
jg 0x100094be
mov dword [ebp - 0x688], 1
jmp 0x100094c5
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x688], eax
jg 0x100094dc
mov dword [ebp - 0x690], 1
jmp 0x100094e3
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x770]
imul eax, dword [ebp - 0x690]
test eax, eax
je 0x10009500
mov dword [ebp - 0x698], 1
jmp 0x10009507
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x780]
cmp dword [ebp - 0x698], eax
jge 0x10009521
mov dword [ebp - 0x4fc], 1
jmp 0x10009528
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 0xffffffff
jae 0x1000953d
mov dword [ebp - 0x670], 1
jmp 0x10009544
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ebp + ecx*4 - 0x874]
add ecx, dword [ebp - 0x670]
cmp dword [ebp + eax*4 - 0x874], ecx
jne 0x1000956c
mov dword [ebp - 0x370], 1
jmp 0x10009573
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
sub eax, 0x5367
cmp eax, dword [ebp - 0x2dc]
jl 0x10009598
cmp dword [ebp - 0x2c], 0
je 0x10009598
mov dword [ebp - 0x364], 1
jmp 0x1000959f
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x364], eax
jne 0x100095b9
mov dword [ebp - 0x5cc], 1
jmp 0x100095c0
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x788], eax
jmp 0x10009457
jmp 0x1000940e
mov dword [ebp - 0xabc], 3
mov dword [ebp - 0x210], 0xffffffff
mov dword [ebp - 0xac4], 0xe713
mov dword [ebp - 0x210], 0
jmp 0x1000960d
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x10
jge 0x1000962c
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x1000962a
push 0
call dword [sym.imp.USER32.dll_CharNextW]
jmp 0x10009600
mov dword [ebp - 0xacc], 0xf70ad6f2
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x10009650
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x10009673
push 0x647
push 0x1ee6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [ebp - 0x170], 0
jmp 0x1000968c
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x100096a8
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x6e8], 0xffffffff
jmp 0x1000967f
mov dword [ebp - 0x10c], 0
jmp 0x100096c1
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x100096dd
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x6e8], 9
jmp 0x100096b4
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x100096fa
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 0xad4], 0x3b91
mov dword [ebp - 0xadc], 6
mov dword [ebp - 0xae4], 0xfffffffb
mov dword [ebp - 0xaec], 0x7937d8e6
mov dword [ebp - 0xaf4], 0x2751c76d
mov dword [ebp - 0xafc], 0x59b8bc5
mov dword [ebp - 0xb04], 1
mov dword [ebp - 0xb0c], 0x215e1abe
mov dword [ebp - 0x36c], 0x33c2
mov dword [ebp - 0x2a0], 0
jmp 0x1000976d
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 4
jge 0x10009789
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0xdec], 7
jmp 0x10009760
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0xd0], 0x1824a8c6
mov dword [ebp - 0xa04], 0xfffffffc
mov dword [ebp - 0xa00], 0xfffffffc
mov dword [ebp - 0x9fc], 0xfffffffc
mov dword [ebp - 0x9f8], 0xfffffffc
mov dword [ebp - 0x178], 0
jmp 0x100097e1
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x100097fd
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x320], 0xfffffffa
jmp 0x100097d4
mov dword [ebp - 0xd0], 0
jmp 0x10009816
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xf
jg 0x10009849
mov dword [ebp - 0x504], 0x69f4288a
cmp dword [ebp - 0x504], 0
je 0x10009834
jmp 0x10009849
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x504]
mov dword [ebp + eax - 0x320], ecx
jmp 0x10009809
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x320]
mov dword [ebp - 0xb14], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x320]
cmp dword [ebp + eax - 0x320], ecx
jle 0x10009884
mov dword [ebp - 0x798], 1
jmp 0x1000988b
and dword [ebp - 0x798], 0
mov dword [ebp - 0xd0], 0xfffffff6
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xb1c], eax
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xa04], 0xa61fc2da
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x320]
cmp dword [ebp + eax - 0x320], ecx
jge 0x100098da
mov dword [ebp - 0x374], 1
jmp 0x100098e1
and dword [ebp - 0x374], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x320]
imul eax, dword [ebp - 0x374]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x320]
jge 0x1000990f
mov dword [ebp - 0x634], 1
jmp 0x10009916
and dword [ebp - 0x634], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x320]
cmp dword [ebp - 0x634], eax
jg 0x10009937
mov dword [ebp - 0x37c], 1
jmp 0x1000993e
and dword [ebp - 0x37c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x37c]
mov dword [ebp + eax - 0x320], ecx
mov dword [ebp - 0xb24], 0x3b91
mov dword [ebp - 0xb2c], 6
mov dword [ebp - 0xb34], 0xfffffffb
mov dword [ebp - 0xb3c], 0x7937d8e6
mov dword [ebp - 0xb44], 0x2751c76d
mov dword [ebp - 0xb4c], 0x59b8bc5
mov dword [ebp - 0xb54], 1
mov dword [ebp - 0xb5c], 0x215e1abe
mov dword [ebp - 0x50c], 0x33c2
mov dword [ebp - 0x218], 0
jmp 0x100099c4
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 4
jge 0x100099e0
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0xdcc], 7
jmp 0x100099b7
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0xb64], 0x3b91
mov dword [ebp - 0xb6c], 6
mov dword [ebp - 0xb74], 0xfffffffb
mov dword [ebp - 0xb7c], 0x7937d8e6
mov dword [ebp - 0xb84], 0x2751c76d
mov dword [ebp - 0xb8c], 0x59b8bc5
mov dword [ebp - 0xb94], 1
mov dword [ebp - 0xb9c], 0x215e1abe
mov dword [ebp - 0x384], 0x33c2
mov dword [ebp - 0x180], 0
jmp 0x10009a60
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 4
jge 0x10009a7c
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0xdbc], 7
jmp 0x10009a53
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
mov dword [ebp - 0x188], 6
mov dword [ebp - 0xba4], 0
mov dword [ebp - 0x38c], 0x52027495
mov dword [ebp - 0x268], 0
jmp 0x10009ac0
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 3
jge 0x10009adc
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0xd88], 0xfffffff9
jmp 0x10009ab3
mov dword [ebp - 0x188], 0xffffffee
jmp 0x10009af5
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xffffffea
jge 0x10009c65
push 3
lea ecx, [ebp - 0x95c]
call fcn.10015242
mov dword [ebp - 4], 3
mov dword [ebp - 0x8fc], 8
mov dword [ebp - 0x8f8], 8
mov dword [ebp - 0x8f4], 8
mov dword [ebp - 0x8f0], 8
lea ecx, [ebp - 0x301]
call fcn.10008dd3
push eax
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x8fc]
push eax
lea ecx, [ebp - 0xd20]
call fcn.100152be
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7d0]
call fcn.10015284
mov byte [ebp - 4], 4
mov dword [ebp - 0x220], 0
jmp 0x10009b90
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jge 0x10009baf
push dword [ebp - 0x220]
lea ecx, [ebp - 0x95c]
call fcn.100152af
or dword [eax], 0xffffffff
jmp 0x10009b83
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x10009bd8
push 0
push 0x2515
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 1
lea ecx, [ebp - 0x7d0]
call fcn.100152af
and dword [eax], 0
jmp 0x10009c0e
push 1
lea ecx, [ebp - 0x7d0]
call fcn.100152af
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x5d4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5d4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x7d0]
call fcn.100152af
cmp dword [eax], 3
jge 0x10009c42
push 1
lea ecx, [ebp - 0x7d0]
call fcn.100152af
push dword [eax]
lea ecx, [ebp - 0x95c]
call fcn.100152af
mov dword [eax], 0xe4438bea
jmp 0x10009bea
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7d0]
call fcn.100152aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x95c]
call fcn.100152aa
jmp 0x10009ae8
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0xd8], 0x1824a8c6
mov dword [ebp - 0xa14], 0xfffffffc
mov dword [ebp - 0xa10], 0xfffffffc
mov dword [ebp - 0xa0c], 0xfffffffc
mov dword [ebp - 0xa08], 0xfffffffc
mov dword [ebp - 0x190], 0
jmp 0x10009cbd
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jge 0x10009cd9
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x32c], 0xfffffffa
jmp 0x10009cb0
mov dword [ebp - 0xd8], 0
jmp 0x10009cf2
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xf
jg 0x10009d25
mov dword [ebp - 0x514], 0x69f4288a
cmp dword [ebp - 0x514], 0
je 0x10009d10
jmp 0x10009d25
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x514]
mov dword [ebp + eax - 0x32c], ecx
jmp 0x10009ce5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x32c]
mov dword [ebp - 0xbac], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x32c]
cmp dword [ebp + eax - 0x32c], ecx
jle 0x10009d60
mov dword [ebp - 0x7a0], 1
jmp 0x10009d67
and dword [ebp - 0x7a0], 0
mov dword [ebp - 0xd8], 0xfffffff6
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xbb4], eax
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xa14], 0xa61fc2da
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x32c]
cmp dword [ebp + eax - 0x32c], ecx
jge 0x10009db6
mov dword [ebp - 0x394], 1
jmp 0x10009dbd
and dword [ebp - 0x394], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x32c]
imul eax, dword [ebp - 0x394]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x32c]
jge 0x10009deb
mov dword [ebp - 0x68c], 1
jmp 0x10009df2
and dword [ebp - 0x68c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x32c]
cmp dword [ebp - 0x68c], eax
jg 0x10009e13
mov dword [ebp - 0x39c], 1
jmp 0x10009e1a
and dword [ebp - 0x39c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x39c]
mov dword [ebp + eax - 0x32c], ecx
mov dword [ebp - 0x8c0], 1
mov dword [ebp - 0x8bc], 1
mov dword [ebp - 0x8b8], 1
mov dword [ebp - 0x8b4], 1
lea ecx, [ebp - 0x2c1]
call fcn.10008dd3
push eax
lea eax, [ebp - 0x8b0]
push eax
lea eax, [ebp - 0x8c0]
push eax
lea ecx, [ebp - 0xd30]
call fcn.100152be
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x85c]
call fcn.10015284
mov dword [ebp - 4], 5
mov dword [ebp - 0x7a8], 0xffffffff
push 1
lea ecx, [ebp - 0x85c]
call fcn.100152af
mov dword [eax], 0x1b
jmp 0x10009ed4
push 1
lea ecx, [ebp - 0x85c]
call fcn.100152af
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x51c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x51c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x85c]
call fcn.100152af
cmp dword [eax], 0xe
jle 0x10009f12
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x10009f06
push 0x221a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x7a8], 6
jmp 0x10009eb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x85c]
call fcn.100152aa
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x5dc], 1
mov dword [ebp - 0x7c0], 8
mov dword [ebp - 0x52c], 0
push 4
lea ecx, [ebp - 0x88c]
call fcn.10015242
mov dword [ebp - 4], 6
mov dword [ebp - 0x734], 0xa61940c9
mov dword [ebp - 0x290], 0
jmp 0x10009f7d
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 4
jge 0x10009f9f
push dword [ebp - 0x290]
lea ecx, [ebp - 0x88c]
call fcn.100152af
mov dword [eax], 0xfffffff6
jmp 0x10009f70
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x10009fbf
push 0x16a3
push 0
push 0x1c60
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
je 0x10009fd3
mov dword [ebp - 0x7b0], 1
jmp 0x10009fda
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xbbc], eax
cmp dword [ebp - 0x34], 0xffff
je 0x10009ff8
mov dword [ebp - 0x3a4], 1
jmp 0x10009fff
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x34], eax
jge 0x1000a01c
cmp dword [ebp - 0x34], 0
jne 0x1000a01c
and dword [ebp - 0x7b8], 0
jmp 0x1000a026
mov dword [ebp - 0x7b8], 1
mov dword [ebp - 0x5dc], 0xfffffffd
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x5dc], eax
jle 0x1000a047
mov dword [ebp - 0x3ac], 1
jmp 0x1000a04e
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x3ac]
test eax, eax
je 0x1000a060
cmp dword [ebp - 0x34], 0
cmp dword [ebp - 0x7c0], 0
je 0x1000a07e
mov eax, 0x9523
test eax, eax
je 0x1000a07e
mov dword [ebp - 0x524], 1
jmp 0x1000a085
and dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 0xa98ceef9
je 0x1000a09d
mov dword [ebp - 0x3b4], 1
jmp 0x1000a0a4
and dword [ebp - 0x3b4], 0
cmp dword [ebp - 0x3b4], 0x551b
jne 0x1000a0bc
mov dword [ebp - 0x63c], 1
jmp 0x1000a0c3
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0x26595ad3
je 0x1000a0db
mov dword [ebp - 0x3bc], 1
jmp 0x1000a0e2
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x52c], eax
mov esi, dword [ebp - 0x52c]
dec esi
push 2
lea ecx, [ebp - 0x88c]
call fcn.100152af
mov dword [eax], esi
push 2
lea ecx, [ebp - 0x88c]
call fcn.100152af
mov eax, dword [eax]
mov dword [ebp - 0x734], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88c]
call fcn.100152aa
mov dword [ebp - 0xe8], 0x1824a8c6
mov dword [ebp - 0xa34], 0xfffffffc
mov dword [ebp - 0xa30], 0xfffffffc
mov dword [ebp - 0xa2c], 0xfffffffc
mov dword [ebp - 0xa28], 0xfffffffc
mov dword [ebp - 0x198], 0
jmp 0x1000a173
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jge 0x1000a18f
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x314], 0xfffffffa
jmp 0x1000a166
mov dword [ebp - 0xe8], 0
jmp 0x1000a1a8
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xf
jg 0x1000a1db
mov dword [ebp - 0x3c4], 0x69f4288a
cmp dword [ebp - 0x3c4], 0
je 0x1000a1c6
jmp 0x1000a1db
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + eax - 0x314], ecx
jmp 0x1000a19b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x314]
mov dword [ebp - 0xbc4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x314]
cmp dword [ebp + eax - 0x314], ecx
jle 0x1000a216
mov dword [ebp - 0x790], 1
jmp 0x1000a21d
and dword [ebp - 0x790], 0
mov dword [ebp - 0xe8], 0xfffffff6
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xbcc], eax
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xa34], 0xa61fc2da
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x314]
cmp dword [ebp + eax - 0x314], ecx
jge 0x1000a26c
mov dword [ebp - 0x5e4], 1
jmp 0x1000a273
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x314]
imul eax, dword [ebp - 0x5e4]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x314]
jge 0x1000a2a1
mov dword [ebp - 0x3cc], 1
jmp 0x1000a2a8
and dword [ebp - 0x3cc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x314]
cmp dword [ebp - 0x3cc], eax
jg 0x1000a2c9
mov dword [ebp - 0x534], 1
jmp 0x1000a2d0
and dword [ebp - 0x534], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x534]
mov dword [ebp + eax - 0x314], ecx
mov dword [ebp - 0x228], 0x10c93b4e
mov dword [ebp - 0xc64], 0x3e31551d
mov dword [ebp - 0xc6c], 0
mov dword [ebp - 0xc74], 0xc0bf90a2
mov dword [ebp - 0xc7c], 0xfffffff9
mov dword [ebp - 0xc84], 0x7525d2d9
mov dword [ebp - 0xc8c], 0x13e13a6c
mov dword [ebp - 0x3d4], 0x8fb0b4
mov dword [ebp - 0xcd0], 0x2eda
mov dword [ebp - 0x228], 0xffffffe8
jmp 0x1000a356
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xfffffffd
jle 0x1000a40b
mov dword [ebp - 0x270], 0xfffffffe
mov dword [ebp - 0xcd8], 0xfffffffa
mov dword [ebp - 0x1a0], 0
jmp 0x1000a390
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x1000a3ac
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0xd4c], 0xd0d658ed
jmp 0x1000a383
mov dword [ebp - 0x270], 0
jmp 0x1000a3c5
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xd
jge 0x1000a3f9
mov dword [ebp - 0x714], 0xebb0
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1000a3ec
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp dword [ebp - 0x714], 0
je 0x1000a3f7
jmp 0x1000a3b8
jmp 0x1000a3b8
mov eax, dword [ebp - 0x3d4]
dec eax
mov dword [ebp - 0x3d4], eax
jmp 0x1000a349
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x1000a422
push 0xe11
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x230], 6
mov dword [ebp - 0xce0], 0
mov dword [ebp - 0x3dc], 0x52027495
mov dword [ebp - 0x1a8], 0
jmp 0x1000a459
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x1000a475
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0xd70], 0xfffffff9
jmp 0x1000a44c
mov dword [ebp - 0x230], 0xffffffee
jmp 0x1000a48e
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xffffffea
jge 0x1000a604
push 3
lea ecx, [ebp - 0x974]
call fcn.10015242
mov dword [ebp - 4], 7
mov dword [ebp - 0x8e8], 8
mov dword [ebp - 0x8e4], 8
mov dword [ebp - 0x8e0], 8
mov dword [ebp - 0x8dc], 8
lea ecx, [ebp - 0x2e1]
call fcn.10008dd3
push eax
lea eax, [ebp - 0x8d8]
push eax
lea eax, [ebp - 0x8e8]
push eax
lea ecx, [ebp - 0xd08]
call fcn.100152be
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7e0]
call fcn.10015284
mov byte [ebp - 4], 8
mov dword [ebp - 0x1b0], 0
jmp 0x1000a529
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x1000a548
push dword [ebp - 0x1b0]
lea ecx, [ebp - 0x974]
call fcn.100152af
or dword [eax], 0xffffffff
jmp 0x1000a51c
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1000a577
push 0
push 0x2515
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 1
lea ecx, [ebp - 0x7e0]
call fcn.100152af
and dword [eax], 0
jmp 0x1000a5ad
push 1
lea ecx, [ebp - 0x7e0]
call fcn.100152af
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x66c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x66c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x7e0]
call fcn.100152af
cmp dword [eax], 3
jge 0x1000a5e1
push 1
lea ecx, [ebp - 0x7e0]
call fcn.100152af
push dword [eax]
lea ecx, [ebp - 0x974]
call fcn.100152af
mov dword [eax], 0xe4438bea
jmp 0x1000a589
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7e0]
call fcn.100152aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x974]
call fcn.100152aa
jmp 0x1000a481
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x1b8], 0x29a3df60
mov dword [ebp - 0x2b0], 0
jmp 0x1000a634
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 1
jge 0x1000a650
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x3e4], 0xf1124f01
jmp 0x1000a627
mov dword [ebp - 0x1b8], 0
jmp 0x1000a669
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x1000a7f9
mov dword [ebp - 0x238], 0xd3f46721
mov dword [ebp - 0x238], 0
jmp 0x1000a699
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jg 0x1000a7f4
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x134], 0
jmp 0x1000a6c9
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x1000a7d3
push 1
lea ecx, [ebp - 0x6bc]
call fcn.10015242
mov dword [ebp - 4], 9
mov dword [ebp - 0x1c0], 0
jmp 0x1000a703
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x1000a725
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x6bc]
call fcn.100152af
mov dword [eax], 0x12e1dfe
jmp 0x1000a6f6
push 0
lea ecx, [ebp - 0x6bc]
call fcn.100152af
and dword [eax], 0
jmp 0x1000a75b
push 0
lea ecx, [ebp - 0x6bc]
call fcn.100152af
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x53c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x53c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6bc]
call fcn.100152af
cmp dword [eax], 0
jg 0x1000a792
push 0
lea ecx, [ebp - 0x6bc]
call fcn.100152af
mov eax, dword [eax]
mov ecx, dword [ebp - 0x134]
mov eax, dword [ebp + eax*4 - 0x3e4]
mov dword [ebp + ecx*4 - 0x3e4], eax
jmp 0x1000a737
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x1000a7bf
push 0x8ed
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6bc]
call fcn.100152aa
jmp 0x1000a6bc
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1000a7ef
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x1000a68c
jmp 0x1000a65c
mov dword [ebp - 0x1c8], 0x29a3df60
mov dword [ebp - 0x278], 0
jmp 0x1000a81c
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 1
jge 0x1000a838
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0x3ec], 0xf1124f01
jmp 0x1000a80f
mov dword [ebp - 0x1c8], 0
jmp 0x1000a851
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jl 0x1000a9e1
mov dword [ebp - 0x240], 0xd3f46721
mov dword [ebp - 0x240], 0
jmp 0x1000a881
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jg 0x1000a9dc
mov dword [ebp - 0x114], 0xffffffff
mov dword [ebp - 0x114], 0
jmp 0x1000a8b1
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jl 0x1000a9bb
push 1
lea ecx, [ebp - 0x6d4]
call fcn.10015242
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x1d0], 0
jmp 0x1000a8eb
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x1000a90d
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x6d4]
call fcn.100152af
mov dword [eax], 0x12e1dfe
jmp 0x1000a8de
push 0
lea ecx, [ebp - 0x6d4]
call fcn.100152af
and dword [eax], 0
jmp 0x1000a943
push 0
lea ecx, [ebp - 0x6d4]
call fcn.100152af
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5ec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5ec]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6d4]
call fcn.100152af
cmp dword [eax], 0
jg 0x1000a97a
push 0
lea ecx, [ebp - 0x6d4]
call fcn.100152af
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp + eax*4 - 0x3ec]
mov dword [ebp + ecx*4 - 0x3ec], eax
jmp 0x1000a91f
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x1000a9a7
push 0x8ed
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6d4]
call fcn.100152aa
jmp 0x1000a8a4
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1000a9d7
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x1000a874
jmp 0x1000a844
mov dword [ebp - 0x910], 1
mov dword [ebp - 0x90c], 1
mov dword [ebp - 0x908], 1
mov dword [ebp - 0x904], 1
lea ecx, [ebp - 0x2f9]
call fcn.10008dd3
push eax
lea eax, [ebp - 0x900]
push eax
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0xd18]
call fcn.100152be
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x838]
call fcn.10015284
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x6f8], 0xffffffff
push 1
lea ecx, [ebp - 0x838]
call fcn.100152af
mov dword [eax], 0x1b
jmp 0x1000aa88
push 1
lea ecx, [ebp - 0x838]
call fcn.100152af
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x544]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x544]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x838]
call fcn.100152af
cmp dword [eax], 0xe
jle 0x1000aacc
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x1000aac0
push 0x221a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x6f8], 6
jmp 0x1000aa64
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x838]
call fcn.100152aa
mov dword [ebp - 0x1d8], 0xfffffffd
mov dword [ebp - 0x298], 0
jmp 0x1000aafe
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 4
jge 0x1000ab1a
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0xe0c], 5
jmp 0x1000aaf1
mov dword [ebp - 0x1d8], 0
jmp 0x1000ab33
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xffffffec
jne 0x1000ad08
mov dword [ebp - 0x1e0], 0xc19c5a65
push 1
lea ecx, [ebp - 0xbec]
call fcn.10015242
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xce8], 0x3ec3d4e7
mov dword [ebp - 0xcf0], 0x38330377
mov dword [ebp - 0xca0], 0xfffffffa
mov dword [ebp - 0xc9c], 0xfffffffa
mov dword [ebp - 0xc98], 0xfffffffa
mov dword [ebp - 0xc94], 0xfffffffa
mov dword [ebp - 0x248], 0
jmp 0x1000abb3
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1000abd5
push dword [ebp - 0x248]
lea ecx, [ebp - 0xbec]
call fcn.100152af
mov dword [eax], 4
jmp 0x1000aba6
mov dword [ebp - 0x1e0], 0
jmp 0x1000abee
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jg 0x1000acf4
mov dword [ebp - 0xcf8], 0xa41449c9
mov dword [ebp - 0xd00], 0x4800fa72
mov dword [ebp - 0xa40], 0xfffffff6
mov dword [ebp - 0xa7c], 0xffffffff
mov dword [ebp - 0xc30], 4
mov dword [ebp - 0xa48], 0x65969a22
mov dword [ebp - 0xb70], 0xffffffff
push 1
lea ecx, [ebp - 0x98c]
call fcn.10015242
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x64], 0
jmp 0x1000ac62
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1000ac78
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xda0], 0x478c38ec
jmp 0x1000ac5b
mov dword [ebp - 0x64], 0
jmp 0x1000ac88
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1000aca4
push dword [ebp - 0x64]
lea ecx, [ebp - 0x98c]
call fcn.100152af
mov dword [eax], 1
jmp 0x1000ac81
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1000acbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
lea ecx, [ebp - 0x98c]
call fcn.100152af
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3f4]
mov dword [ecx], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x98c]
call fcn.100152aa
jmp 0x1000abe1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbec]
call fcn.100152aa
jmp 0x1000ab26
mov dword [ebp - 0x1e8], 6
mov dword [ebp - 0xa50], 0
mov dword [ebp - 0x3fc], 0x52027495
mov dword [ebp - 0x280], 0
jmp 0x1000ad3f
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jge 0x1000ad5b
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0xd58], 0xfffffff9
jmp 0x1000ad32
mov dword [ebp - 0x1e8], 0xffffffee
jmp 0x1000ad74
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0xffffffea
jge 0x1000aeea
push 3
lea ecx, [ebp - 0x9a4]
call fcn.10015242
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x938], 8
mov dword [ebp - 0x934], 8
mov dword [ebp - 0x930], 8
mov dword [ebp - 0x92c], 8
lea ecx, [ebp - 0x2c9]
call fcn.10008dd3
push eax
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x938]
push eax
lea ecx, [ebp - 0xd38]
call fcn.100152be
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7f0]
call fcn.10015284
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x250], 0
jmp 0x1000ae0f
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x1000ae2e
push dword [ebp - 0x250]
lea ecx, [ebp - 0x9a4]
call fcn.100152af
or dword [eax], 0xffffffff
jmp 0x1000ae02
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1000ae5d
push 0
push 0x2515
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 1
lea ecx, [ebp - 0x7f0]
call fcn.100152af
and dword [eax], 0
jmp 0x1000ae93
push 1
lea ecx, [ebp - 0x7f0]
call fcn.100152af
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x644]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x644]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x7f0]
call fcn.100152af
cmp dword [eax], 3
jge 0x1000aec7
push 1
lea ecx, [ebp - 0x7f0]
call fcn.100152af
push dword [eax]
lea ecx, [ebp - 0x9a4]
call fcn.100152af
mov dword [eax], 0xe4438bea
jmp 0x1000ae6f
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x7f0]
call fcn.100152aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9a4]
call fcn.100152aa
jmp 0x1000ad67
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x404], 1
mov dword [ebp - 0x784], 8
mov dword [ebp - 0x41c], 0
push 4
lea ecx, [ebp - 0x850]
call fcn.10015242
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x708], 0xa61940c9
mov dword [ebp - 0x1f0], 0
jmp 0x1000af53
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 4
jge 0x1000af75
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0x850]
call fcn.100152af
mov dword [eax], 0xfffffff6
jmp 0x1000af46
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1000af9b
push 0x16a3
push 0
push 0x1c60
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
je 0x1000afaf
mov dword [ebp - 0x7e4], 1
jmp 0x1000afb6
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xcdc], eax
cmp dword [ebp - 0x38], 0xffff
je 0x1000afd4
mov dword [ebp - 0x54c], 1
jmp 0x1000afdb
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x54c]
cmp dword [ebp - 0x38], eax
jge 0x1000aff8
cmp dword [ebp - 0x38], 0
jne 0x1000aff8
and dword [ebp - 0x700], 0
jmp 0x1000b002
mov dword [ebp - 0x700], 1
mov dword [ebp - 0x404], 0xfffffffd
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x404], eax
jle 0x1000b023
mov dword [ebp - 0x5f4], 1
jmp 0x1000b02a
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x5f4]
test eax, eax
je 0x1000b03c
cmp dword [ebp - 0x38], 0
cmp dword [ebp - 0x784], 0
je 0x1000b05a
mov eax, 0x9523
test eax, eax
je 0x1000b05a
mov dword [ebp - 0x40c], 1
jmp 0x1000b061
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 0xa98ceef9
je 0x1000b079
mov dword [ebp - 0x554], 1
jmp 0x1000b080
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0x551b
jne 0x1000b098
mov dword [ebp - 0x414], 1
jmp 0x1000b09f
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 0x26595ad3
je 0x1000b0b7
mov dword [ebp - 0x684], 1
jmp 0x1000b0be
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x41c], eax
mov esi, dword [ebp - 0x41c]
dec esi
push 2
lea ecx, [ebp - 0x850]
call fcn.100152af
mov dword [eax], esi
push 2
lea ecx, [ebp - 0x850]
call fcn.100152af
mov eax, dword [eax]
mov dword [ebp - 0x708], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x850]
call fcn.100152aa
mov dword [ebp - 0x14], 0x5c68ec0a
mov dword [ebp - 0xf4], 0x2585fafe
mov dword [ebp - 0x58c], 0xffffffff
mov dword [ebp - 0x2a8], 0
jmp 0x1000b138
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x1000b154
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0x740], 0x694a98a1
jmp 0x1000b12b
mov dword [ebp - 0x14], 0x17
jmp 0x1000b164
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
je 0x1000b655
push 4
lea ecx, [ebp - 0x344]
call fcn.10015242
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xa4], 0x6e5c7a00
mov dword [ebp - 0x12c], 0xffffffff
mov dword [ebp - 0x454], 0x8356
mov dword [ebp - 0x720], 0
mov dword [ebp - 0x1f8], 0
jmp 0x1000b1c3
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 4
jge 0x1000b1e5
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x344]
call fcn.100152af
mov dword [eax], 0x386cce57
jmp 0x1000b1b6
mov dword [ebp - 0xa4], 3
jmp 0x1000b1fe
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x1000b641
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2bc], 0xafe2499e
mov dword [ebp - 0x1c], 0
jmp 0x1000b22c
cmp dword [ebp - 0x1c], 3
jg 0x1000b63c
mov dword [ebp - 0x9c], 0xfffffff6
push 3
lea ecx, [ebp - 0x9bc]
call fcn.10015242
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x604], 0x13c9534c
mov dword [ebp - 0x258], 0
jmp 0x1000b274
cmp dword [ebp - 0x258], 3
jge 0x1000b293
push dword [ebp - 0x258]
lea ecx, [ebp - 0x9bc]
call fcn.100152af
or dword [eax], 0xffffffff
jmp 0x1000b267
mov dword [ebp - 0x9c], 0
jmp 0x1000b2ac
jmp 0x1000b1f1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344]
call fcn.100152aa
jmp 0x1000b15d
mov dword [ebp - 0x14], 1
jmp 0x1000b665
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1000b890
mov dword [ebp - 0xe0], 0x31b3dfa8
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x594], 0xa2e55fdc
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x740], 0
je 0x1000b81b
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x144], eax
jl 0x1000b6b8
mov dword [ebp - 0x57c], 1
jmp 0x1000b6bf
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x57c], eax
jl 0x1000b6d9
mov dword [ebp - 0x464], 1
jmp 0x1000b6e0
and dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 0x854e
jne 0x1000b6f8
mov dword [ebp - 0x60c], 1
jmp 0x1000b6ff
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 0x6c9a
jl 0x1000b717
mov dword [ebp - 0x46c], 1
jmp 0x1000b71e
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x740]
cmp eax, dword [ebp - 0x46c]
jl 0x1000b73c
mov dword [ebp - 0x584], 1
jmp 0x1000b743
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x584]
jge 0x1000b75d
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x594], eax
mov dword [ebp - 0xe0], 0
jmp 0x1000b847
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jg 0x1000b88b
mov dword [ebp - 0x9e4], 0x322e546e
mov dword [ebp - 0x9e0], 0x322e546e
mov dword [ebp - 0x9dc], 0x322e546e
mov dword [ebp - 0x9d8], 0x322e546e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9e4], 0x465c3015
jmp 0x1000b83a
jmp 0x1000b65e
movzx eax, byte [0x154e0fc0]
test eax, eax
je 0x1000b8ae
mov esi, 0x10082838
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1000ebfe
mov dword [ebp - 0x200], 0xac64a684
mov dword [ebp - 0x200], 0
jmp 0x1000b8d1
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xffffffff
jl 0x1000b8f8
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x1000b8f6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1000b8c4
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1000b910
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebp - 0x288], 0x10c93b4e
mov dword [ebp - 0xa68], 0x3e31551d
mov dword [ebp - 0xb80], 0
mov dword [ebp - 0xa70], 0xc0bf90a2
mov dword [ebp - 0xca4], 0xfffffff9
mov dword [ebp - 0xa78], 0x7525d2d9
mov dword [ebp - 0xb88], 0x13e13a6c
mov dword [ebp - 0x494], 0x8fb0b4
mov dword [ebp - 0xa80], 0x2eda
mov dword [ebp - 0x288], 0xffffffe8
jmp 0x1000b983
cmp dword [ebp - 0x288], 0xfffffffd
jle 0x1000ba3e
mov dword [ebp - 0x15c], 0xfffffffe
mov dword [ebp - 0xc50], 0xfffffffa
mov dword [ebp - 0x154], 0
jmp 0x1000b9bd
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1000ba5b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret