Function at 0x10051a96
Capabilities:
Check os version
Get common file path
Get disk information
Identify system language via api
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100885ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xacc
push esi
push edi
mov dword [ebp - 0x114], 0xfffffff7
mov dword [ebp - 0x114], 0
jmp 0x10051ad9
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfffffff6
jne 0x10051b12
mov byte [ebp - 0x9f], 0
movzx eax, byte [ebp - 0x9f]
test eax, eax
je 0x10051b05
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
cmp dword [ebp - 0x114], 0
je 0x10051b10
jmp 0x10051acc
jmp 0x10051acc
push 3
lea ecx, [ebp - 0x68c]
call fcn.1001855e
and dword [ebp - 4], 0
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x17c], 0xffffffff
push 2
lea ecx, [ebp - 0x650]
call fcn.1001855e
mov byte [ebp - 4], 1
mov dword [ebp - 0x624], 0xffffffff
mov dword [ebp - 0x120], 5
mov dword [ebp - 0x908], 0xfffffffc
mov dword [ebp - 0x70], 0
jmp 0x10051b73
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10051b8f
push dword [ebp - 0x70]
lea ecx, [ebp - 0x68c]
call fcn.100185ee
mov dword [eax], 0xea53061e
jmp 0x10051b6c
mov dword [ebp - 0x70], 0
jmp 0x10051b9f
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10051bbb
push dword [ebp - 0x70]
lea ecx, [ebp - 0x650]
call fcn.100185ee
mov dword [eax], 0xb6eab3cf
jmp 0x10051b98
push 1
lea ecx, [ebp - 0x68c]
call fcn.100185ee
cmp dword [ebp - 0x50], 0
je 0x10051be0
cmp dword [ebp - 0x50], 0
je 0x10051be0
mov dword [ebp - 0x468], 1
jmp 0x10051be7
and dword [ebp - 0x468], 0
push 1
lea ecx, [ebp - 0x68c]
call fcn.100185ee
mov eax, dword [eax]
add eax, dword [ebp - 0x468]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
sub eax, 0x780eec29
je 0x10051c2d
push 0
lea ecx, [ebp - 0x650]
call fcn.100185ee
cmp dword [eax], 0
je 0x10051c2d
mov dword [ebp - 0x61c], 1
jmp 0x10051c34
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0xffff
je 0x10051c58
mov dword [ebp - 0x62c], 1
jmp 0x10051c5f
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x62c], eax
jne 0x10051c76
mov dword [ebp - 0x5d0], 1
jmp 0x10051c7d
and dword [ebp - 0x5d0], 0
push 1
lea ecx, [ebp - 0x650]
call fcn.100185ee
mov ecx, dword [ebp - 0x5d0]
cmp ecx, dword [eax]
jl 0x10051ca0
mov dword [ebp - 0x690], 1
jmp 0x10051ca7
and dword [ebp - 0x690], 0
cmp dword [ebp - 0x50], 0
je 0x10051cba
push 1
lea ecx, [ebp - 0x68c]
call fcn.100185ee
cmp dword [ebp - 0x17c], 0
jne 0x10051cdb
cmp dword [ebp - 0x17c], 0
jne 0x10051cdb
cmp dword [ebp - 0x50], 0
jne 0x10051cdb
and dword [ebp - 0x6b0], 0
jmp 0x10051ce5
mov dword [ebp - 0x6b0], 1
push 2
lea ecx, [ebp - 0x68c]
call fcn.100185ee
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa44], eax
push 0
lea ecx, [ebp - 0x650]
call fcn.100185ee
mov esi, eax
push 0
lea ecx, [ebp - 0x650]
call fcn.100185ee
mov ecx, dword [esi]
imul ecx, dword [eax]
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x120], 0x1a
jmp 0x10051d3b
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xfffffff2
jg 0x10051d9b
mov dword [ebp - 0x50], 1
jmp 0x10051d54
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x10051d71
push dword [ebp - 0x50]
lea ecx, [ebp - 0x650]
call fcn.100185ee
cmp dword [eax], 0
je 0x10051d6f
jmp 0x10051d71
jmp 0x10051d4d
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x10051d99
push 0
push 0
push 0x373
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x10051d2e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x650]
call fcn.100185e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68c]
call fcn.100185e9
mov dword [ebp - 0x148], 0xfffffff7
mov dword [ebp - 0x148], 0
jmp 0x10051ddc
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xfffffff6
jne 0x100525de
mov byte [ebp - 0xa1], 0
mov dword [ebp - 0x1c], 0x8a062b00
mov dword [ebp - 0x240], 0xfdb69689
mov dword [ebp - 0x160], 0xee56e31b
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
je 0x10051e1f
mov dword [ebp - 0x2a0], 1
jmp 0x10051e26
and dword [ebp - 0x2a0], 0
cmp dword [ebp - 0x1c], 1
jbe 0x10051e38
mov dword [ebp - 0x298], 1
jmp 0x10051e3f
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x298]
jge 0x10051e62
mov dword [ebp - 0x554], 1
jmp 0x10051e69
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x554]
cmp eax, 0xfffb
jb 0x10051e85
mov dword [ebp - 0x55c], 1
jmp 0x10051e8c
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x2a0]
sub eax, dword [ebp - 0x55c]
imul eax, eax, 0xfff7
cmp eax, dword [ebp - 0x1c]
jg 0x10051eaf
mov dword [ebp - 0x2a8], 1
jmp 0x10051eb6
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2a8], eax
jle 0x10051eca
mov eax, 0x7f8b4dfe
test eax, eax
je 0x10051edf
mov eax, 0x3f9150fa
test eax, eax
je 0x10051edf
mov dword [ebp - 0x564], 1
jmp 0x10051ee6
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 4
jl 0x10051efb
mov dword [ebp - 0x2b0], 1
jmp 0x10051f02
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x2b0]
sub eax, dword [ebp - 0x1c]
jne 0x10051f1f
cmp dword [ebp - 0x240], 0
jne 0x10051f1f
and dword [ebp - 0x56c], 0
jmp 0x10051f29
mov dword [ebp - 0x56c], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x56c], eax
jle 0x10051f40
mov dword [ebp - 0x2b8], 1
jmp 0x10051f47
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2b8], eax
jg 0x10051f5e
mov dword [ebp - 0x574], 1
jmp 0x10051f65
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x160], 0
jmp 0x10051f8a
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffe2
jle 0x10052077
mov dword [ebp - 0x6b8], 0xffffffff
mov dword [ebp - 0x1bc], 0
jmp 0x10051fba
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jge 0x10051fd6
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xa08], 0x2549
jmp 0x10051fad
mov dword [ebp - 0x1c], 0xffffffe4
jmp 0x10051fe6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x10052039
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x10052024
push 0
push 0
push 0
push 0x1ab
push 0x14b7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa08]
mov dword [ebp - 0x6b8], eax
jmp 0x10051fdf
mov dword [ebp - 0x1c], 0
jmp 0x10052049
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x10052072
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x10052070
push 0
push 0x5e2
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x10052042
jmp 0x10051f7d
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x100525cb
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x44], 0x9e71b35d
push 2
lea ecx, [ebp - 0x668]
call fcn.1001855e
mov dword [ebp - 4], 2
mov dword [ebp - 0x184], 0
jmp 0x100520c1
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x100520e3
push dword [ebp - 0x184]
lea ecx, [ebp - 0x668]
call fcn.100185ee
mov dword [eax], 0x8d81
jmp 0x100520b4
cmp dword [ebp - 0x10], 0
je 0x10052215
cmp dword [ebp - 0x10], 0
je 0x1005214a
cmp dword [ebp - 0x10], 0
jne 0x10052108
cmp dword [ebp - 0x10], 0
jne 0x10052108
and dword [ebp - 0x2c0], 0
jmp 0x10052112
mov dword [ebp - 0x2c0], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x2c0]
jge 0x10052129
mov dword [ebp - 0x594], 1
jmp 0x10052130
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x594]
dec eax
dec eax
je 0x1005214a
mov dword [ebp - 0x2c8], 1
jmp 0x10052151
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2c8], eax
jg 0x10052168
mov dword [ebp - 0x59c], 1
jmp 0x1005216f
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x59c]
cmp eax, dword [ebp - 0x10]
jle 0x1005218a
mov dword [ebp - 0x2d0], 1
jmp 0x10052191
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2d0], eax
jne 0x100521a8
mov dword [ebp - 0x6c0], 1
jmp 0x100521af
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x978], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x9a0], eax
cmp dword [ebp - 0x10], 0
jne 0x100521d6
cmp dword [ebp - 0x44], 0
jne 0x100521d6
and dword [ebp - 0x5a4], 0
jmp 0x100521e0
mov dword [ebp - 0x5a4], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x5a4], eax
jge 0x100521f7
mov dword [ebp - 0x2d8], 1
jmp 0x100521fe
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2d8], eax
je 0x10052215
mov dword [ebp - 0x5ac], 1
jmp 0x1005221c
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0x1ef9
jl 0x10052234
mov dword [ebp - 0x2e0], 1
jmp 0x1005223b
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], 0
jmp 0x10052254
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jle 0x100525ab
mov dword [ebp - 0x24], 0xaa5d732a
mov dword [ebp - 0x128], 0
push 4
lea ecx, [ebp - 0x8c4]
call fcn.1001855e
mov byte [ebp - 4], 3
mov dword [ebp - 0x1dc], 0
jmp 0x10052299
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 4
jge 0x100522bb
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x8c4]
call fcn.100185ee
mov dword [eax], 0x93c5815d
jmp 0x1005228c
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x44]
je 0x100522e6
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x100522e6
mov eax, dword [ebp - 0x24]
neg eax
mov dword [ebp - 0x128], eax
jmp 0x10052597
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x5cc], 0xfffffff8
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x10052325
push 0x1fc2
push 0x135f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov dword [ebp - 0x24], 0
jmp 0x10052335
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jg 0x10052597
mov dword [ebp - 0x6c8], 0xa323
push dword [ebp - 0x24]
lea ecx, [ebp - 0x668]
call fcn.100185ee
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x44], eax
je 0x10052386
mov dword [ebp - 0x5b4], 1
jmp 0x1005238d
and dword [ebp - 0x5b4], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x668]
call fcn.100185ee
mov ecx, dword [ebp - 0x5b4]
neg ecx
mov esi, ecx
imul esi, dword [eax]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x668]
call fcn.100185ee
cmp esi, dword [eax]
jge 0x100523c6
mov dword [ebp - 0x2e8], 1
jmp 0x100523cd
and dword [ebp - 0x2e8], 0
imul eax, dword [ebp - 0x2e8], 0xbdb8
test eax, eax
jne 0x100523ed
cmp dword [ebp - 0xf4], 0
jne 0x100523ed
and dword [ebp - 0x5bc], 0
jmp 0x100523f7
mov dword [ebp - 0x5bc], 1
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffff
jne 0x1005241b
mov dword [ebp - 0x2f0], 1
jmp 0x10052422
and dword [ebp - 0x2f0], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x668]
call fcn.100185ee
mov eax, dword [eax]
imul eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x6c8]
jge 0x10052453
mov eax, 0xe06c
test eax, eax
jne 0x10052453
and dword [ebp - 0x5c4], 0
jmp 0x1005245d
mov dword [ebp - 0x5c4], 1
cmp dword [ebp - 0x5c4], 0x7eac
jg 0x10052475
mov dword [ebp - 0x2f8], 1
jmp 0x1005247c
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
sub eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x5cc], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x5cc], eax
jge 0x100524a5
mov dword [ebp - 0x300], 1
jmp 0x100524ac
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x300], eax
jne 0x100524c6
mov dword [ebp - 0x5d4], 1
jmp 0x100524cd
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x44], eax
jl 0x100524ed
mov dword [ebp - 0x308], 1
jmp 0x100524f4
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x308], eax
jl 0x1005250e
mov dword [ebp - 0x5dc], 1
jmp 0x10052515
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x5dc], eax
je 0x1005252f
mov dword [ebp - 0x310], 1
jmp 0x10052536
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x310], eax
jl 0x1005254d
mov dword [ebp - 0x6d0], 1
jmp 0x10052554
and dword [ebp - 0x6d0], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x668]
call fcn.100185ee
mov esi, dword [ebp - 0x10]
push 3
lea ecx, [ebp - 0x8c4]
call fcn.100185ee
mov dword [eax], esi
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x10052592
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x1005232e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8c4]
call fcn.100185e9
jmp 0x1005224d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x668]
call fcn.100185e9
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
cmp dword [ebp - 0x148], 0
je 0x100525d9
jmp 0x10051dcf
jmp 0x10051dcf
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x130], 4
mov dword [ebp - 0xdc], 0xb9737e0d
mov dword [ebp - 0x6d8], 6
mov dword [ebp - 0x6e0], 0x8ad88ca0
mov dword [ebp - 0x54], 0x13
jmp 0x1005261d
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffffd
je 0x10052945
push 2
lea ecx, [ebp - 0x644]
call fcn.1001855e
mov dword [ebp - 4], 4
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0x18c], 0
jmp 0x10052668
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x1005268a
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x644]
call fcn.100185ee
mov dword [eax], 1
jmp 0x1005265b
push 1
lea ecx, [ebp - 0x644]
call fcn.100185ee
cmp dword [eax], 0
je 0x10052841
mov dword [ebp - 0x84], 0xfff9
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x54], eax
jge 0x100526c1
mov dword [ebp - 0x5e4], 1
jmp 0x100526c8
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x5e4], eax
jle 0x100526df
mov dword [ebp - 0x5ec], 1
jmp 0x100526e6
and dword [ebp - 0x5ec], 0
push 1
lea ecx, [ebp - 0x644]
call fcn.100185ee
mov ecx, dword [ebp - 0x84]
cmp dword [eax], ecx
jge 0x10052709
mov dword [ebp - 0x318], 1
jmp 0x10052710
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x318]
jl 0x1005272a
mov dword [ebp - 0x320], 1
jmp 0x10052731
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x5ec]
neg eax
cmp eax, dword [ebp - 0x320]
jl 0x1005274d
mov dword [ebp - 0x5f4], 1
jmp 0x10052754
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x5f4], eax
je 0x10052777
cmp dword [ebp - 0x130], 0
je 0x10052777
mov dword [ebp - 0x5fc], 1
jmp 0x1005277e
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x5fc], eax
jne 0x100527a7
push 1
lea ecx, [ebp - 0x644]
call fcn.100185ee
cmp dword [eax], 0
je 0x100527a7
mov dword [ebp - 0x32c], 1
jmp 0x100527ae
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x32c], eax
jg 0x100527c5
mov dword [ebp - 0x330], 1
jmp 0x100527cc
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x84], 0
jmp 0x100527f1
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jg 0x1005283c
mov dword [ebp - 0xdc], 0
jmp 0x10052813
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jg 0x1005283a
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x10052838
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
jmp 0x10052806
jmp 0x100527e4
jmp 0x1005290b
mov dword [ebp - 0x4b8], 0xf68e
mov dword [ebp - 0x130], 0xd
jmp 0x10052864
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 5
jle 0x10052894
cmp dword [ebp - 0x6d8], 0
je 0x10052878
jmp 0x10052894
mov byte [ebp - 0xa3], 0
movzx eax, byte [ebp - 0xa3]
test eax, eax
je 0x10052892
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
jmp 0x10052857
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x904], eax
push 0
lea ecx, [ebp - 0x644]
call fcn.100185ee
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x220], eax
mov esi, dword [ebp - 0x220]
push 1
lea ecx, [ebp - 0x644]
call fcn.100185ee
sub esi, dword [eax]
cmp esi, dword [ebp - 0x4b8]
je 0x100528e2
mov dword [ebp - 0x338], 1
jmp 0x100528e9
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x54], 0
je 0x100528ff
cmp dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0xdc], eax
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x10052931
push 0x1f38
push 0
push 0x1419
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x644]
call fcn.100185e9
jmp 0x10052616
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x848], 0x928c176b
mov dword [ebp - 0x844], 0x928c176b
mov dword [ebp - 0x840], 0x928c176b
mov dword [ebp - 0x83c], 0x928c176b
lea ecx, [ebp - 0x255]
call fcn.100091f3
push eax
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0xacc]
call fcn.100185fd
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x728]
call fcn.100185bf
mov dword [ebp - 4], 5
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x158], 1
mov dword [ebp - 0x58], 3
jmp 0x100529d1
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x100529f1
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x100529ef
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
jmp 0x100529ca
push 1
lea ecx, [ebp - 0x728]
call fcn.100185ee
mov esi, dword [eax]
sub esi, dword [ebp - 0x58]
push 2
lea ecx, [ebp - 0x728]
call fcn.100185ee
cmp esi, dword [eax]
jle 0x10052a20
mov dword [ebp - 0x4c0], 1
jmp 0x10052a27
and dword [ebp - 0x4c0], 0
cmp dword [ebp - 0x58], 0xfffffffe
ja 0x10052a39
mov dword [ebp - 0x58c], 1
jmp 0x10052a40
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x58c]
sub eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jne 0x10052a5a
mov dword [ebp - 0x340], 1
jmp 0x10052a61
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x340], eax
jl 0x10052a7b
mov dword [ebp - 0x348], 1
jmp 0x10052a82
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x4c0]
add eax, dword [ebp - 0x348]
imul eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x158]
jg 0x10052aa9
mov dword [ebp - 0x580], 1
jmp 0x10052ab0
and dword [ebp - 0x580], 0
mov esi, dword [ebp - 0x158]
imul esi, dword [ebp - 0x580]
push 1
lea ecx, [ebp - 0x728]
call fcn.100185ee
add esi, dword [eax]
cmp esi, 0xfff7
je 0x10052ae0
mov dword [ebp - 0x350], 1
jmp 0x10052ae7
and dword [ebp - 0x350], 0
push 0
lea ecx, [ebp - 0x728]
call fcn.100185ee
mov ecx, dword [ebp - 0x350]
cmp ecx, dword [eax]
jne 0x10052b0a
mov dword [ebp - 0x4c8], 1
jmp 0x10052b11
and dword [ebp - 0x4c8], 0
cmp dword [ebp - 0x4c8], 0xd5fb
jne 0x10052b29
mov dword [ebp - 0x358], 1
jmp 0x10052b30
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x58], eax
jge 0x10052b50
mov dword [ebp - 0x6f0], 1
jmp 0x10052b57
and dword [ebp - 0x6f0], 0
mov eax, 0x99ea
sub eax, 0x40df
je 0x10052b8f
mov dword [ebp - 0x618], 0
mov dword [ebp - 0x6f8], 0xb64b6930
mov dword [ebp - 0x618], 0x668dacb3
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x6f8], eax
jmp 0x10052bc8
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x10052bb0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x10052bc8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x728]
call fcn.100185e9
push 3
lea ecx, [ebp - 0x820]
call fcn.1001855e
mov dword [ebp - 4], 6
mov dword [ebp - 0x118], 0x9ea4087b
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x20], 0x4ee7d21
mov dword [ebp - 0x708], 0xef9a8551
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x20], eax
jge 0x10052c27
mov dword [ebp - 0x360], 1
jmp 0x10052c2e
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x360], eax
jg 0x10052c45
mov dword [ebp - 0x700], 1
jmp 0x10052c4c
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jl 0x10052c69
mov dword [ebp - 0x4d0], 1
jmp 0x10052c70
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4d0], eax
je 0x10052d4e
push 1
lea ecx, [ebp - 0x9ac]
call fcn.1001855e
mov byte [ebp - 4], 7
mov dword [ebp - 0x914], 1
mov dword [ebp - 0x91c], 0xde0980db
mov dword [ebp - 0x924], 0x1d102278
mov dword [ebp - 0x1c4], 0
jmp 0x10052cc7
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jge 0x10052ce9
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x9ac]
call fcn.100185ee
mov dword [eax], 0xcc2f
jmp 0x10052cba
mov dword [ebp - 0x5c], 0
jmp 0x10052cf9
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x10052d3a
mov dword [ebp - 0x20], 0
jmp 0x10052d0f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x10052d38
mov dword [ebp - 0x92c], 0xa9864ba8
mov dword [ebp - 0x368], 5
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
jmp 0x10052d08
jmp 0x10052cf2
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x9ac]
call fcn.100185e9
jmp 0x10052f93
push 2
lea ecx, [ebp - 0x8d0]
call fcn.1001855e
mov byte [ebp - 4], 8
mov dword [ebp - 0x194], 1
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x370], 1
mov dword [ebp - 0x25c], 0x16e2
mov dword [ebp - 0x168], 0
jmp 0x10052da0
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x10052dc2
push dword [ebp - 0x168]
lea ecx, [ebp - 0x8d0]
call fcn.100185ee
mov dword [eax], 1
jmp 0x10052d93
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
mov eax, 0xfffc
test eax, eax
je 0x10052efa
cmp dword [ebp - 0x20], 0
jne 0x10052dee
mov dword [ebp - 0x588], 1
jmp 0x10052df5
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x370], eax
jl 0x10052e18
mov dword [ebp - 0x4d8], 1
jmp 0x10052e1f
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
sub eax, dword [ebp - 0x25c]
cmp eax, dword [ebp - 0x228]
jge 0x10052e3f
mov dword [ebp - 0x378], 1
jmp 0x10052e46
and dword [ebp - 0x378], 0
push 1
lea ecx, [ebp - 0x8d0]
call fcn.100185ee
mov eax, dword [eax]
imul eax, dword [ebp - 0x378]
cmp eax, 0xffff
jbe 0x10052e6f
mov dword [ebp - 0x5d8], 1
jmp 0x10052e76
and dword [ebp - 0x5d8], 0
cmp dword [ebp - 0x5d8], 0
jbe 0x10052e8b
mov dword [ebp - 0x380], 1
jmp 0x10052e92
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x380]
je 0x10052eac
mov dword [ebp - 0x4e0], 1
jmp 0x10052eb3
and dword [ebp - 0x4e0], 0
imul eax, dword [ebp - 0x4e0], 0x6593
test eax, eax
jne 0x10052ed3
mov eax, 0x78f1
test eax, eax
jne 0x10052ed3
and dword [ebp - 0x388], 0
jmp 0x10052edd
mov dword [ebp - 0x388], 1
mov eax, dword [ebp - 0x388]
sub eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x20]
je 0x10052efa
mov dword [ebp - 0x590], 1
jmp 0x10052f01
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x590]
add eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x194]
jle 0x10052f2b
cmp dword [ebp - 0x5c], 0
je 0x10052f2b
mov dword [ebp - 0x390], 1
jmp 0x10052f32
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x708]
cmp dword [ebp - 0x390], eax
jl 0x10052f4c
mov dword [ebp - 0x4e8], 1
jmp 0x10052f53
and dword [ebp - 0x4e8], 0
imul eax, dword [ebp - 0x4e8], 0
cmp eax, 0xffffffff
jle 0x10052f6b
mov dword [ebp - 0x398], 1
jmp 0x10052f72
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x194]
add eax, dword [ebp - 0x398]
mov dword [ebp - 0x194], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x8d0]
call fcn.100185e9
mov dword [ebp - 0x20], 0x16
jmp 0x10052fa3
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x17
jg 0x10052fcc
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x10052fca
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
jmp 0x10052f9c
mov dword [ebp - 0x1ec], 0
jmp 0x10052fe5
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 3
jge 0x10053007
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x820]
call fcn.100185ee
mov dword [eax], 0xd3cd3624
jmp 0x10052fd8
mov dword [ebp - 0x34], 0
jmp 0x10053017
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xa
jge 0x100539f7
push 2
lea ecx, [ebp - 0x9bc]
call fcn.1001855e
mov byte [ebp - 4], 9
mov dword [ebp - 0x1cc], 0xfffffff7
mov dword [ebp - 0x934], 0xe838
mov dword [ebp - 0x19c], 0
jmp 0x1005305f
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x10053081
push dword [ebp - 0x19c]
lea ecx, [ebp - 0x9bc]
call fcn.100185ee
mov dword [eax], 0x1713
jmp 0x10053052
mov dword [ebp - 0x1cc], 1
jmp 0x1005309a
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jl 0x100530d4
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x100530d2
push 0x6c0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
jmp 0x1005308d
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x9bc]
call fcn.100185e9
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x93c], 0x648261f9
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x10053116
push 0x1a1
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1005314d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x129c
push 0x81f
push 0x15be
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x7a0], 0xffff
mov dword [ebp - 0x79c], 0xffff
mov dword [ebp - 0x798], 0xffff
mov dword [ebp - 0x794], 0xffff
mov dword [ebp - 0x600], 0xfffffff8
mov dword [ebp - 0x944], 0xffffffff
mov dword [ebp - 0x94c], 0xa3062a4b
mov dword [ebp - 0x138], 0
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x100531c3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
xor eax, eax
inc eax
sub eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x138]
jne 0x100531e0
mov dword [ebp - 0x710], 1
jmp 0x100531e7
and dword [ebp - 0x710], 0
mov dword [ebp - 0x600], 7
imul eax, dword [ebp - 0x138], 0x67f6
cmp dword [ebp - 0x600], eax
je 0x1005320f
mov dword [ebp - 0x3a0], 1
jmp 0x10053216
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x3a0], eax
jne 0x10053230
mov dword [ebp - 0x4f0], 1
jmp 0x10053237
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0xec], 0
je 0x10053251
jmp 0x100539f7
mov dword [ebp - 0xfc], 1
mov dword [ebp - 0x80], 0x94643cdf
push 4
lea ecx, [ebp - 0x65c]
call fcn.1001855e
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x248], 0x7f59ec13
mov dword [ebp - 0x1a4], 0
jmp 0x10053296
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 4
jge 0x100532b8
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x65c]
call fcn.100185ee
mov dword [eax], 0xfffd
jmp 0x10053289
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0xfc], 0
jmp 0x100532da
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jg 0x1005349f
mov dword [ebp - 0xe4], 0x7071658a
mov dword [ebp - 0x69c], 0x42c3b03c
mov dword [ebp - 0x80], 0
jmp 0x1005330b
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jg 0x1005349a
mov dword [ebp - 0x104], 0x51da622a
mov dword [ebp - 0x104], 3
jmp 0x10053338
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jl 0x10053389
mov dword [ebp - 0x150], 6
mov dword [ebp - 0x150], 3
jmp 0x10053364
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x10053387
push dword [ebp - 0x150]
lea ecx, [ebp - 0x65c]
call fcn.100185ee
cmp dword [eax], 0
je 0x10053385
jmp 0x10053387
jmp 0x10053357
jmp 0x1005332b
push dword [ebp - 0x80]
lea ecx, [ebp - 0x65c]
call fcn.100185ee
cmp dword [eax], 0
jne 0x10053404
push dword [ebp - 0x80]
lea ecx, [ebp - 0x65c]
call fcn.100185ee
mov eax, dword [eax]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0xe4]
inc eax
cmp eax, dword [ebp - 0x248]
je 0x100533d3
mov eax, 0x6255
test eax, eax
jne 0x100533d3
and dword [ebp - 0x3a8], 0
jmp 0x100533dd
mov dword [ebp - 0x3a8], 1
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x10053404
cmp dword [ebp - 0x248], 0
jne 0x10053404
and dword [ebp - 0x718], 0
jmp 0x1005340e
mov dword [ebp - 0x718], 1
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x954], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x95c], eax
push dword [ebp - 0x80]
lea ecx, [ebp - 0x65c]
call fcn.100185ee
mov ecx, dword [ebp - 0xe4]
cmp dword [eax], ecx
jl 0x1005344a
mov dword [ebp - 0x6a8], 1
jmp 0x10053451
and dword [ebp - 0x6a8], 0
mov eax, 0xcb8e0045
test eax, eax
jne 0x1005346c
cmp dword [ebp - 0xe4], 0
jne 0x1005346c
and dword [ebp - 0x598], 0
jmp 0x10053476
mov dword [ebp - 0x598], 1
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x65c]
call fcn.100185ee
mov ecx, dword [ebp - 0x598]
add ecx, dword [eax]
mov dword [ebp - 0x69c], ecx
jmp 0x10053304
jmp 0x100532cd
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x65c]
call fcn.100185e9
mov dword [ebp - 0xec], 0
jmp 0x100534c7
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jg 0x100539f2
mov dword [ebp - 0x60], 0xffffffff
push 2
lea ecx, [ebp - 0x7cc]
call fcn.1001855e
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x964], 0xd9e2a8d3
mov dword [ebp - 0x96c], 0xfffffffb
mov dword [ebp - 0x974], 1
mov dword [ebp - 0x97c], 0xc383c67e
mov dword [ebp - 0x988], 5
mov dword [ebp - 0x994], 0x710dd013
mov dword [ebp - 0x1e4], 0
jmp 0x10053541
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x10053563
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x7cc]
call fcn.100185ee
mov dword [eax], 0xae77ab39
jmp 0x10053534
cmp dword [ebp - 0x60], 1
jge 0x10053575
mov dword [ebp - 0x3b0], 1
jmp 0x1005357c
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x100535ad
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x100535ab
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x100535e3
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x100535e3
push 0x826
push 0
push 0
push 0x1367
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 0x60], 1
jmp 0x100535f3
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10053669
mov dword [ebp - 0x4f8], 7
mov dword [ebp - 0x1ac], 0
jmp 0x1005361c
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x10053638
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0xa10], 0
jmp 0x1005360f
push dword [ebp - 0x60]
lea ecx, [ebp - 0x7cc]
call fcn.100185ee
mov esi, eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0x7cc]
call fcn.100185ee
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4f8]
dec eax
mov dword [ebp - 0x4f8], eax
jmp 0x100535ec
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7cc]
call fcn.100185e9
mov dword [ebp - 0x38], 0xcaad901
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x38]
jl 0x10053696
mov dword [ebp - 0x3b8], 1
jmp 0x1005369d
and dword [ebp - 0x3b8], 0
cmp dword [ebp - 0x3b8], 0x81d534a2
jne 0x100536b5
mov dword [ebp - 0x5e0], 1
jmp 0x100536bc
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x5e0], eax
jl 0x100536d3
mov dword [ebp - 0x3c0], 1
jmp 0x100536da
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x3c0], eax
jl 0x100536e9
cmp dword [ebp - 0x38], 0
mov eax, 0x10a6e
cmp eax, 0xffff
jae 0x10053701
mov dword [ebp - 0x230], 1
jmp 0x10053708
and dword [ebp - 0x230], 0
push 0
lea ecx, [ebp - 0x820]
call fcn.100185ee
mov ecx, dword [ebp - 0x230]
mov dword [eax], ecx
mov eax, dword [ebp - 0x230]
sub eax, dword [ebp - 0x34]
jne 0x1005373a
mov eax, 0xcab43068
test eax, eax
jne 0x1005373a
and dword [ebp - 0x500], 0
jmp 0x10053744
mov dword [ebp - 0x500], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7a0]
cmp eax, dword [ebp - 0x500]
jne 0x1005376a
cmp dword [ebp - 0xec], 0
jne 0x1005376a
and dword [ebp - 0x764], 0
jmp 0x10053774
mov dword [ebp - 0x764], 1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x99c], eax
cmp dword [ebp - 0x34], 0x28cb
jle 0x1005379b
mov dword [ebp - 0x6a4], 1
jmp 0x100537a2
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x38]
add eax, 0x4644688d
mov dword [ebp - 0x118], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a0]
cmp dword [ebp - 0x34], eax
jle 0x100537ce
mov dword [ebp - 0x744], 1
jmp 0x100537d5
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xa00], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7a0]
cmp dword [ebp - 0x38], eax
jge 0x100537fb
mov dword [ebp - 0x3c8], 1
jmp 0x10053802
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x3c8]
sub eax, 0x227283a3
je 0x10053831
push 0
lea ecx, [ebp - 0x820]
call fcn.100185ee
cmp dword [eax], 0
je 0x10053831
mov dword [ebp - 0x5a0], 1
jmp 0x10053838
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0
jmp 0x10053851
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x100539ed
mov dword [ebp - 0x1b4], 0x60477862
mov dword [ebp - 0xa0c], 0x8974b66
mov dword [ebp - 0xa14], 0
mov dword [ebp - 0xa1c], 0xa065c2dd
mov dword [ebp - 0xa24], 0x5c0de450
mov dword [ebp - 0xa2c], 0xf4df
mov dword [ebp - 0x3d0], 0xd978
mov dword [ebp - 0xa38], 0xbe26b5cf
mov dword [ebp - 0x1d4], 0
jmp 0x100538c4
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 1
jge 0x100538e0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0xa40], 0xfffffffc
jmp 0x100538b7
mov dword [ebp - 0x1b4], 7
jmp 0x100538f9
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0xfffffff2
jl 0x1005393c
mov dword [ebp - 0x6ac], 1
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x1005392f
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
cmp dword [ebp - 0x6ac], 0
je 0x1005393a
jmp 0x100538ec
jmp 0x100538ec
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x118], 3
jmp 0x10053962
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x100539e8
mov dword [ebp - 0x124], 0xb46f9f1
mov dword [ebp - 0x124], 0
jmp 0x1005398e
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 3
jg 0x100539e3
mov dword [ebp - 0x11c], 0xcf05746a
mov dword [ebp - 0x11c], 0
jmp 0x100539ba
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jge 0x100539d6
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x7a0], 0xfff8
jmp 0x100539ad
cmp dword [ebp - 0x124], 0
je 0x100539e1
jmp 0x10053981
jmp 0x10053981
jmp 0x10053955
jmp 0x1005384a
jmp 0x100534ba
jmp 0x10053010
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x820]
call fcn.100185e9
mov dword [ebp - 0x10c], 0xffffffff
mov dword [ebp - 0x74c], 0xfffffff7
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x10053a39
push 0x1e11
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [ebp - 0x10c], 0
jmp 0x10053a52
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffee
jle 0x10053c1d
mov dword [ebp - 0xb0], 0x1f665683
mov dword [ebp - 0x508], 0x729694d2
mov dword [ebp - 0xb0], 0xa
jmp 0x10053a8c
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xffffffe5
jle 0x10053c18
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0x6b4], 0x1f6f
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0xd0], 0
jmp 0x10053ad0
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xa
jge 0x10053c13
mov dword [ebp - 0x200], 0xfffffff6
mov dword [ebp - 0x790], 0xf7c8b166
cmp dword [ebp - 0xb0], 0
je 0x10053b0a
xor eax, eax
je 0x10053b0a
mov dword [ebp - 0x5a8], 1
jmp 0x10053b11
and dword [ebp - 0x5a8], 0
mov dword [ebp - 0x508], 0xffffffff
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x508], eax
jne 0x10053b35
mov dword [ebp - 0x3d8], 1
jmp 0x10053b3c
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x790]
sub eax, ecx
cmp eax, dword [ebp - 0x6b4]
jne 0x10053b70
mov dword [ebp - 0x628], 1
jmp 0x10053b77
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0x628]
test eax, eax
jne 0x10053b98
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10053b98
and dword [ebp - 0x3e0], 0
jmp 0x10053ba2
mov dword [ebp - 0x3e0], 1
mov eax, dword [ebp - 0x10c]
imul eax, dword [ebp - 0x3e0]
test eax, eax
jne 0x10053bbf
mov dword [ebp - 0x510], 1
jmp 0x10053bc6
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x74c]
cmp dword [ebp - 0x510], eax
jne 0x10053be0
mov dword [ebp - 0x3e8], 1
jmp 0x10053be7
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x3e8], eax
jge 0x10053bfc
cmp dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x5a8]
sub eax, dword [ebp - 0x200]
mov dword [ebp - 0x6bc], eax
jmp 0x10053ac3
jmp 0x10053a7f
jmp 0x10053a45
mov dword [ebp - 0x174], 0x55595070
mov dword [ebp - 0x85c], 1
mov dword [ebp - 0x858], 1
mov dword [ebp - 0x854], 1
mov dword [ebp - 0x850], 1
lea ecx, [ebp - 0x20d]
call fcn.100091f3
push eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0xa9c]
call fcn.100185fd
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa88]
call fcn.100185bf
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x8e0], 8
mov dword [ebp - 0x8dc], 8
mov dword [ebp - 0x8d8], 8
mov dword [ebp - 0x8d4], 8
mov dword [ebp - 0x3f0], 0x4d0c653d
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x8e0], 1
mov dword [ebp - 0x174], 0
jmp 0x10053ce6
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0xffffffea
jle 0x10053d77
mov dword [ebp - 0x884], 0xa4c5706b
mov dword [ebp - 0x880], 0xa4c5706b
mov dword [ebp - 0x87c], 0xa4c5706b
mov dword [ebp - 0x878], 0xa4c5706b
lea ecx, [ebp - 0x205]
call fcn.100091f3
push eax
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x884]
push eax
lea ecx, [ebp - 0xab4]
call fcn.100185fd
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa64]
call fcn.100185bf
mov dword [ebp - 0xa48], 0xfffffff8
mov eax, dword [ebp - 0x3f0]
dec eax
mov dword [ebp - 0x3f0], eax
lea ecx, [ebp - 0xa64]
call fcn.100185e9
jmp 0x10053cd9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa88]
call fcn.100185e9
push 3
lea ecx, [ebp - 0x7d8]
call fcn.1001855e
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x88], 0xfffffffc
mov dword [ebp - 0x520], 0x51d77f17
mov dword [ebp - 0x178], 0
jmp 0x10053dc7
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x10053de9
push dword [ebp - 0x178]
lea ecx, [ebp - 0x7d8]
call fcn.100185ee
mov dword [eax], 0x313dd33a
jmp 0x10053dba
mov dword [ebp - 0x88], 0
jmp 0x10053e02
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jg 0x1005400b
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0x5b0], 0
mov dword [ebp - 0x76c], 1
mov dword [ebp - 0xd8], 2
jmp 0x10053e46
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x10054006
mov dword [ebp - 0xcc], 0xfb5a5efa
mov dword [ebp - 0xcc], 0
jmp 0x10053e76
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jg 0x10053e9b
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x10053e99
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x10053e69
push dword [ebp - 0x88]
lea ecx, [ebp - 0x7d8]
call fcn.100185ee
cmp dword [eax], 0xfdb7
jle 0x10053ec0
mov dword [ebp - 0x518], 1
jmp 0x10053ec7
and dword [ebp - 0x518], 0
cmp dword [ebp - 0xd8], 0x6128f3b8
jne 0x10053edf
mov dword [ebp - 0x3f8], 1
jmp 0x10053ee6
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x518]
add eax, dword [ebp - 0x3f8]
imul eax, eax, 0xffff
cmp eax, 1
jne 0x10053f0f
mov eax, 0x87e3bc4a
test eax, eax
jne 0x10053f0f
and dword [ebp - 0x5e8], 0
jmp 0x10053f19
mov dword [ebp - 0x5e8], 1
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0x5e8]
add eax, 0x4c9a615c
imul eax, dword [ebp - 0xcc]
cmp eax, 0x7363
jle 0x10053f45
mov dword [ebp - 0x400], 1
jmp 0x10053f4c
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x520], eax
mov esi, dword [ebp - 0x520]
push dword [ebp - 0x88]
lea ecx, [ebp - 0x7d8]
call fcn.100185ee
cmp esi, dword [eax]
je 0x10053f7f
mov dword [ebp - 0x408], 1
jmp 0x10053f86
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x5b0], eax
je 0x10053fac
mov dword [ebp - 0x410], 1
jmp 0x10053fb3
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x410], eax
jg 0x10053fcd
mov dword [ebp - 0x528], 1
jmp 0x10053fd4
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x528], eax
jg 0x10053fee
mov dword [ebp - 0x418], 1
jmp 0x10053ff5
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x76c], eax
jmp 0x10053e39
jmp 0x10053df5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7d8]
call fcn.100185e9
push 3
lea ecx, [ebp - 0x28c]
call fcn.1001855e
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xe0], 0x5020f89b
mov dword [ebp - 0x204], 0xa5ea964a
mov dword [ebp - 0x8ac], 0xce695ef
mov dword [ebp - 0x8a8], 0xce695ef
mov dword [ebp - 0x8a4], 0xce695ef
mov dword [ebp - 0x8a0], 0xce695ef
lea ecx, [ebp - 0x24d]
call fcn.100091f3
push eax
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x8ac]
push eax
lea ecx, [ebp - 0xac4]
call fcn.100185fd
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9cc]
call fcn.100185bf
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x78], 0
jmp 0x100540b3
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x100540cf
push dword [ebp - 0x78]
lea ecx, [ebp - 0x28c]
call fcn.100185ee
mov dword [eax], 0xdc85f70a
jmp 0x100540ac
mov dword [ebp - 0x78], 0
jmp 0x100540df
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x100540f5
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x608], 0xbdfadf62
jmp 0x100540d8
mov dword [ebp - 0xe0], 0
jmp 0x1005410e
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jg 0x10054465
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20c], 0xffffffff
mov dword [ebp - 0x2c], 2
jmp 0x1005413c
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x10054449
mov dword [ebp - 0x188], 6
mov dword [ebp - 0x180], 0
jmp 0x10054169
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jge 0x10054185
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x984], 0xb56fe18
jmp 0x1005415c
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28c]
call fcn.100185ee
mov ecx, dword [ebp - 0x2c]
cmp dword [eax], ecx
je 0x100541e4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x608], 3
je 0x100541b6
mov dword [ebp - 0x60c], 1
jmp 0x100541bd
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x60c], eax
je 0x100541e4
mov dword [ebp - 0x420], 1
jmp 0x100541eb
and dword [ebp - 0x420], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28c]
call fcn.100185ee
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x420], eax
jne 0x1005421c
mov dword [ebp - 0x6c4], 1
jmp 0x10054223
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0x20c]
sub eax, dword [ebp - 0xe0]
mov dword [ebp - 0x530], eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28c]
call fcn.100185ee
mov ecx, dword [ebp - 0x530]
mov dword [eax], ecx
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x530], eax
jle 0x1005426e
mov dword [ebp - 0x428], 1
jmp 0x10054275
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x20c], eax
jge 0x1005429b
mov dword [ebp - 0x430], 1
jmp 0x100542a2
and dword [ebp - 0x430], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x608]
mov dword [ebp - 0x5b8], eax
push 1
lea ecx, [ebp - 0x28c]
call fcn.100185ee
mov ecx, dword [ebp - 0x5b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5b8]
cmp eax, dword [ebp - 0x430]
jne 0x10054370
push 4
pop eax
imul eax, eax, 0
imul esi, dword [ebp + eax - 0x608], 0xffff
push 4
pop eax
imul eax, eax, 0
sub esi, dword [ebp + eax - 0x608]
inc esi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28c]
call fcn.100185ee
cmp esi, dword [eax]
jg 0x10054319
mov dword [ebp - 0x538], 1
jmp 0x10054320
and dword [ebp - 0x538], 0
cmp dword [ebp - 0x538], 0xfffffffb
jb 0x10054342
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x984], 0
jne 0x10054342
and dword [ebp - 0x438], 0
jmp 0x1005434c
mov dword [ebp - 0x438], 1
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28c]
call fcn.100185ee
mov ecx, dword [ebp - 0x438]
cmp ecx, dword [eax]
je 0x10054370
mov dword [ebp - 0x5f0], 1
jmp 0x10054377
and dword [ebp - 0x5f0], 0
cmp dword [ebp - 0x5f0], 0xee1d
jg 0x1005438f
mov dword [ebp - 0x440], 1
jmp 0x10054396
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0x406c
jne 0x100543ae
mov dword [ebp - 0x540], 1
jmp 0x100543b5
and dword [ebp - 0x540], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x608]
cmp dword [ebp - 0x540], eax
jle 0x100543d6
mov dword [ebp - 0x448], 1
jmp 0x100543dd
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x448], eax
jne 0x100543f7
mov dword [ebp - 0x5c0], 1
jmp 0x100543fe
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x5c0]
sub eax, dword [ebp - 0x2c]
je 0x1005442f
push 2
lea ecx, [ebp - 0x9cc]
call fcn.100185ee
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x450]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x450]
mov dword [ecx], eax
jmp 0x10054444
mov dword [ebp - 0x754], 0
cmp dword [ebp - 0x754], 0
je 0x10054444
jmp 0x10054449
jmp 0x10054135
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x28c]
call fcn.100185ee
mov dword [eax], 0x44f8a3d3
jmp 0x10054101
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x9cc]
call fcn.100185e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28c]
call fcn.100185e9
mov dword [ebp - 0x13c], 0xfffffff7
push 3
lea ecx, [ebp - 0x680]
call fcn.1001855e
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0x190], 0xffffffff
push 2
lea ecx, [ebp - 0x674]
call fcn.1001855e
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x620], 0xffffffff
mov dword [ebp - 0x12c], 5
mov dword [ebp - 0xa20], 0xfffffffc
mov dword [ebp - 0x6c], 0
jmp 0x100544f1
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1005450d
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x680]
call fcn.100185ee
mov dword [eax], 0xea53061e
jmp 0x100544ea
mov dword [ebp - 0x6c], 0
jmp 0x1005451d
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10054539
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x674]
call fcn.100185ee
mov dword [eax], 0xb6eab3cf
jmp 0x10054516
push 1
lea ecx, [ebp - 0x680]
call fcn.100185ee
cmp dword [ebp - 0x4c], 0
je 0x1005455e
cmp dword [ebp - 0x4c], 0
je 0x1005455e
mov dword [ebp - 0x548], 1
jmp 0x10054565
and dword [ebp - 0x548], 0
push 1
lea ecx, [ebp - 0x680]
call fcn.100185ee
mov eax, dword [eax]
add eax, dword [ebp - 0x548]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
sub eax, 0x780eec29
je 0x100545ab
push 0
lea ecx, [ebp - 0x674]
call fcn.100185ee
cmp dword [eax], 0
je 0x100545ab
mov dword [ebp - 0x458], 1
jmp 0x100545b2
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0xffff
je 0x100545d6
mov dword [ebp - 0x460], 1
jmp 0x100545dd
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x460], eax
jne 0x100545f4
mov dword [ebp - 0x550], 1
jmp 0x100545fb
and dword [ebp - 0x550], 0
push 1
lea ecx, [ebp - 0x674]
call fcn.100185ee
mov ecx, dword [ebp - 0x550]
cmp ecx, dword [eax]
jl 0x1005461e
mov dword [ebp - 0x6cc], 1
jmp 0x10054625
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x4c], 0
je 0x10054638
push 1
lea ecx, [ebp - 0x680]
call fcn.100185ee
cmp dword [ebp - 0x190], 0
jne 0x10054659
cmp dword [ebp - 0x190], 0
jne 0x10054659
cmp dword [ebp - 0x4c], 0
jne 0x10054659
and dword [ebp - 0x788], 0
jmp 0x10054663
mov dword [ebp - 0x788], 1
push 2
lea ecx, [ebp - 0x680]
call fcn.100185ee
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xa54], eax
push 0
lea ecx, [ebp - 0x674]
call fcn.100185ee
mov esi, eax
push 0
lea ecx, [ebp - 0x674]
call fcn.100185ee
mov ecx, dword [esi]
imul ecx, dword [eax]
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x12c], 0x1a
jmp 0x100546b9
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xfffffff2
jg 0x10054719
mov dword [ebp - 0x4c], 1
jmp 0x100546d2
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x100546ef
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x674]
call fcn.100185ee
cmp dword [eax], 0
je 0x100546ed
jmp 0x100546ef
jmp 0x100546cb
mov byte [ebp - 0x98], 0
movzx eax, byte [ebp - 0x98]
test eax, eax
je 0x10054717
push 0
push 0
push 0x373
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x100546ac
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x674]
call fcn.100185e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x680]
call fcn.100185e9
push 1
lea ecx, [ebp - 0x274]
call fcn.1001855e
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x730], 0
mov dword [ebp - 0xa18], 0x8a0c
mov dword [ebp - 0x584], 1
mov dword [ebp - 0x6ec], 0x26cefc6e
mov dword [ebp - 0x64], 0
jmp 0x10054783
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x10054799
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x7c0], 0x40d7f825
jmp 0x1005477c
mov dword [ebp - 0x64], 0
jmp 0x100547a9
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x100547c5
push dword [ebp - 0x64]
lea ecx, [ebp - 0x274]
call fcn.100185ee
mov dword [eax], 6
jmp 0x100547a2
push 0
lea ecx, [ebp - 0x274]
call fcn.100185ee
and dword [eax], 0
jmp 0x100547fb
push 0
lea ecx, [ebp - 0x274]
call fcn.100185ee
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x290]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x290]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x274]
call fcn.100185ee
cmp dword [eax], 3
jg 0x10054c75
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0x900], 0xffffffff
mov dword [ebp - 0x6dc], 0x8670fc24
mov dword [ebp - 0x9b0], 0x8e487928
push 3
lea ecx, [ebp - 0x7f0]
call fcn.1001855e
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x4a8], 0xdd5d57d3
mov dword [ebp - 0x198], 0
jmp 0x1005486d
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jge 0x1005488f
push dword [ebp - 0x198]
lea ecx, [ebp - 0x7f0]
call fcn.100185ee
mov dword [eax], 0xfffffffe
jmp 0x10054860
push 0
lea ecx, [ebp - 0x274]
call fcn.100185ee
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x7c0], 0
je 0x100548bc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x7f0]
call fcn.100185e9
jmp 0x10054c75
mov dword [ebp - 0xb8], 3
jmp 0x100548d5
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x10054c61
mov dword [ebp - 0x6e4], 0x2c593c86
mov dword [ebp - 0x8f4], 0xffffffff
mov dword [ebp - 0x570], 0x69035a60
mov dword [ebp - 0xa3c], 0xffffffff
mov dword [ebp - 0x910], 0xfffffff8
mov dword [ebp - 0x9c0], 1
mov dword [ebp - 0x918], 0xffffffff
mov dword [ebp - 0x214], 0xf484
cmp dword [ebp - 0xb8], 0xfffffff6
je 0x10054947
mov dword [ebp - 0x5c8], 1
jmp 0x1005494e
and dword [ebp - 0x5c8], 0
push 0
lea ecx, [ebp - 0x274]
call fcn.100185ee
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x7c0]
cmp eax, dword [ebp - 0x5c8]
jl 0x10054978
mov dword [ebp - 0x470], 1
jmp 0x1005497f
and dword [ebp - 0x470], 0
cmp dword [ebp - 0x470], 0x41a9c213
jg 0x10054997
mov dword [ebp - 0x558], 1
jmp 0x1005499e
and dword [ebp - 0x558], 0
push 0
lea ecx, [ebp - 0x274]
call fcn.100185ee
mov esi, eax
push 0
lea ecx, [ebp - 0x274]
call fcn.100185ee
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x100549cc
mov dword [ebp - 0x478], 1
jmp 0x100549d3
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x558]
cmp eax, dword [ebp - 0x478]
jle 0x100549ed
mov dword [ebp - 0x5f8], 1
jmp 0x100549f4
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f8]
sub eax, 0x257e
je 0x10054a42
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x134], 0
jmp 0x10054a24
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x10054a40
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x7c0], 1
jmp 0x10054a17
jmp 0x10054a80
mov dword [ebp - 0x6d4], 0xfffc
cmp dword [ebp - 0x6d4], 0
jne 0x10054a63
or eax, 0xffffffff
jne 0x10054a63
and dword [ebp - 0x480], 0
jmp 0x10054a6d
mov dword [ebp - 0x480], 1
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x480]
mov dword [ebp + eax*4 - 0x7c0], ecx
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x560], eax
push 0
lea ecx, [ebp - 0x274]
call fcn.100185ee
mov eax, dword [eax]
mov ecx, dword [ebp - 0x560]
mov dword [ebp + eax*4 - 0x7c0], ecx
mov eax, dword [ebp - 0x560]
mov ecx, dword [ebp - 0x214]
dec ecx
mov dword [ebp - 0x214], ecx
test eax, eax
je 0x10054b31
imul eax, dword [ebp - 0x4a8], 0x70aa
mov dword [ebp - 0x488], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x488]
mov dword [ebp + eax - 0x7c0], ecx
cmp dword [ebp - 0x488], 0
je 0x10054b00
cmp dword [ebp - 0x570], 0
je 0x10054b00
mov dword [ebp - 0x21c], 1
jmp 0x10054b07
and dword [ebp - 0x21c], 0
push 1
lea ecx, [ebp - 0x7f0]
call fcn.100185ee
mov ecx, dword [ebp - 0x21c]
mov dword [eax], ecx
cmp dword [ebp - 0x21c], 0
je 0x10054b31
mov dword [ebp - 0x578], 1
jmp 0x10054b38
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 1
jne 0x10054b4d
mov dword [ebp - 0x490], 1
jmp 0x10054b54
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 0xffff
jne 0x10054b6e
or eax, 0xffffffff
jne 0x10054b6e
and dword [ebp - 0x568], 0
jmp 0x10054b78
mov dword [ebp - 0x568], 1
cmp dword [ebp - 0x568], 6
jl 0x10054b8d
mov dword [ebp - 0x498], 1
jmp 0x10054b94
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x498], eax
jge 0x10054bae
mov dword [ebp - 0x57c], 1
jmp 0x10054bb5
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 0x2b79
jg 0x10054bcd
mov dword [ebp - 0x4a0], 1
jmp 0x10054bd4
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x584]
cmp dword [ebp - 0x4a0], eax
jne 0x10054bee
mov dword [ebp - 0x75c], 1
jmp 0x10054bf5
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x9e4], eax
cmp dword [ebp - 0x6dc], 0xfffffffc
jne 0x10054c16
mov dword [ebp - 0x734], 1
jmp 0x10054c1d
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x4a8]
sub eax, dword [ebp - 0x730]
cmp eax, dword [ebp - 0x584]
jge 0x10054c49
mov dword [ebp - 0x4b0], 1
jmp 0x10054c50
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x6ec], eax
jmp 0x100548c8
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x7f0]
call fcn.100185e9
jmp 0x100547d7
mov byte [ebp - 0x9a], 0
movzx eax, byte [ebp - 0x9a]
test eax, eax
je 0x10054c96
push 0x1ec6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x274]
call fcn.100185e9
mov dword [ebp - 0x13c], 0
jmp 0x10054cbe
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xfffffff6
jne 0x10054cf7
mov byte [ebp - 0x9c], 0
movzx eax, byte [ebp - 0x9c]
test eax, eax
je 0x10054cea
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
cmp dword [ebp - 0x13c], 0
je 0x10054cf5
jmp 0x10054cb1
jmp 0x10054cb1
push 1
lea eax, [ebp - 0xad8]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.100512fb
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0xa70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0xa70]
lea edi, [ebp - 0x808]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1a0], 0
jmp 0x10054d3f
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 1
jge 0x10054d5b
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x1a8], 0xffffffff
jmp 0x10054d32
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1a8], 0xfffffff8
jmp 0x10054d89
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1a8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a8], 0xfffffff9
jle 0x10054dc3
mov byte [ebp - 0x9e], 0
movzx eax, byte [ebp - 0x9e]
test eax, eax
je 0x10054dc1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x10054d6e
mov dword [ebp - 0x18], 0x8a062b00
mov dword [ebp - 0x224], 0xfdb69689
mov dword [ebp - 0x144], 0xee56e31b
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x10054df2
mov dword [ebp - 0x334], 1
jmp 0x10054df9
and dword [ebp - 0x334], 0
cmp dword [ebp - 0x18], 1
jbe 0x10054e0b
mov dword [ebp - 0x328], 1
jmp 0x10054e12
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x328]
jge 0x10054e35
mov dword [ebp - 0x324], 1
jmp 0x10054e3c
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x324]
cmp eax, 0xfffb
jb 0x10054e58
mov dword [ebp - 0x33c], 1
jmp 0x10054e5f
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x334]
sub eax, dword [ebp - 0x33c]
imul eax, eax, 0xfff7
cmp eax, dword [ebp - 0x18]
jg 0x10054e82
mov dword [ebp - 0x344], 1
jmp 0x10054e89
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x344], eax
jle 0x10054e9d
mov eax, 0x7f8b4dfe
test eax, eax
je 0x10054eb2
mov eax, 0x3f9150fa
test eax, eax
je 0x10054eb2
mov dword [ebp - 0x34c], 1
jmp 0x10054eb9
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x34c], 4
jl 0x10054ece
mov dword [ebp - 0x354], 1
jmp 0x10054ed5
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
sub eax, dword [ebp - 0x18]
jne 0x10054ef2
cmp dword [ebp - 0x224], 0
jne 0x10054ef2
and dword [ebp - 0x35c], 0
jmp 0x10054efc
mov dword [ebp - 0x35c], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x35c], eax
jle 0x10054f13
mov dword [ebp - 0x364], 1
jmp 0x10054f1a
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x364], eax
jg 0x10054f31
mov dword [ebp - 0x36c], 1
jmp 0x10054f38
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x144], 0
jmp 0x10054f5d
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffe2
jle 0x1005504a
mov dword [ebp - 0x740], 0xffffffff
mov dword [ebp - 0x1b0], 0
jmp 0x10054f8d
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jge 0x10054fa9
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0xa34], 0x2549
jmp 0x10054f80
mov dword [ebp - 0x18], 0xffffffe4
jmp 0x10054fb9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x1005500c
mov byte [ebp - 0xa0], 0
movzx eax, byte [ebp - 0xa0]
test eax, eax
je 0x10054ff7
push 0
push 0
push 0
push 0x1ab
push 0x14b7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa34]
mov dword [ebp - 0x740], eax
jmp 0x10054fb2
mov dword [ebp - 0x18], 0
jmp 0x1005501c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x10055045
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x10055043
push 0
push 0x5e2
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x10055015
jmp 0x10054f50
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x48], 0x9e71b35d
push 2
lea ecx, [ebp - 0x638]
call fcn.1001855e
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x170], 0
jmp 0x10055085
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x100550a7
push dword [ebp - 0x170]
lea ecx, [ebp - 0x638]
call fcn.100185ee
mov dword [eax], 0x8d81
jmp 0x10055078
cmp dword [ebp - 0x14], 0
je 0x100551d9
cmp dword [ebp - 0x14], 0
je 0x1005510e
cmp dword [ebp - 0x14], 0
jne 0x100550cc
cmp dword [ebp - 0x14], 0
jne 0x100550cc
and dword [ebp - 0x374], 0
jmp 0x100550d6
mov dword [ebp - 0x374], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x374]
jge 0x100550ed
mov dword [ebp - 0x37c], 1
jmp 0x100550f4
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x37c]
dec eax
dec eax
je 0x1005510e
mov dword [ebp - 0x384], 1
jmp 0x10055115
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x384], eax
jg 0x1005512c
mov dword [ebp - 0x38c], 1
jmp 0x10055133
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x38c]
cmp eax, dword [ebp - 0x14]
jle 0x1005514e
mov dword [ebp - 0x394], 1
jmp 0x10055155
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x394], eax
jne 0x1005516c
mov dword [ebp - 0x6f4], 1
jmp 0x10055173
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x14], 0
jne 0x1005519a
cmp dword [ebp - 0x48], 0
jne 0x1005519a
and dword [ebp - 0x39c], 0
jmp 0x100551a4
mov dword [ebp - 0x39c], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x39c], eax
jge 0x100551bb
mov dword [ebp - 0x3a4], 1
jmp 0x100551c2
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x3a4], eax
je 0x100551d9
mov dword [ebp - 0x3ac], 1
jmp 0x100551e0
and dword [ebp - 0x3ac], 0
cmp dword [ebp - 0x3ac], 0x1ef9
jl 0x100551f8
mov dword [ebp - 0x3b4], 1
jmp 0x100551ff
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], 0
jmp 0x10055218
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jle 0x1005556f
mov dword [ebp - 0x28], 0xaa5d732a
mov dword [ebp - 0x14c], 0
push 4
lea ecx, [ebp - 0x8b8]
call fcn.1001855e
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x16c], 0
jmp 0x1005525d
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 4
jge 0x1005527f
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x8b8]
call fcn.100185ee
mov dword [eax], 0x93c5815d
jmp 0x10055250
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x48]
je 0x100552aa
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x100552aa
mov eax, dword [ebp - 0x28]
neg eax
mov dword [ebp - 0x14c], eax
jmp 0x1005555b
mov dword [ebp - 0xe8], 1
mov dword [ebp - 0x3ec], 0xfffffff8
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x100552e9
push 0x1fc2
push 0x135f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov dword [ebp - 0x28], 0
jmp 0x100552f9
cmp dword [ebp - 0x28], 1
jg 0x1005555b
mov dword [ebp - 0x748], 0xa323
push dword [ebp - 0x28]
lea ecx, [ebp - 0x638]
call fcn.100185ee
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x48], eax
je 0x1005534a
mov dword [ebp - 0x3bc], 1
jmp 0x10055351
and dword [ebp - 0x3bc], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x638]
call fcn.100185ee
mov ecx, dword [ebp - 0x3bc]
neg ecx
mov esi, ecx
imul esi, dword [eax]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x638]
call fcn.100185ee
cmp esi, dword [eax]
jge 0x1005538a
mov dword [ebp - 0x3c4], 1
jmp 0x10055391
and dword [ebp - 0x3c4], 0
imul eax, dword [ebp - 0x3c4], 0xbdb8
test eax, eax
jne 0x100553b1
cmp dword [ebp - 0xe8], 0
jne 0x100553b1
and dword [ebp - 0x3cc], 0
jmp 0x100553bb
mov dword [ebp - 0x3cc], 1
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffff
jne 0x100553df
mov dword [ebp - 0x3d4], 1
jmp 0x100553e6
and dword [ebp - 0x3d4], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x638]
call fcn.100185ee
mov eax, dword [eax]
imul eax, dword [ebp - 0x3d4]
cmp eax, dword [ebp - 0x748]
jge 0x10055417
mov eax, 0xe06c
test eax, eax
jne 0x10055417
and dword [ebp - 0x3dc], 0
jmp 0x10055421
mov dword [ebp - 0x3dc], 1
cmp dword [ebp - 0x3dc], 0x7eac
jg 0x10055439
mov dword [ebp - 0x3e4], 1
jmp 0x10055440
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
sub eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x3ec], eax
jge 0x10055469
mov dword [ebp - 0x3f4], 1
jmp 0x10055470
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x3f4], eax
jne 0x1005548a
mov dword [ebp - 0x3fc], 1
jmp 0x10055491
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x48], eax
jl 0x100554b1
mov dword [ebp - 0x404], 1
jmp 0x100554b8
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x404], eax
jl 0x100554d2
mov dword [ebp - 0x40c], 1
jmp 0x100554d9
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x40c], eax
je 0x100554f3
mov dword [ebp - 0x414], 1
jmp 0x100554fa
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x414], eax
jl 0x10055511
mov dword [ebp - 0x6fc], 1
jmp 0x10055518
and dword [ebp - 0x6fc], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x638]
call fcn.100185ee
mov esi, dword [ebp - 0x14]
push 3
lea ecx, [ebp - 0x8b8]
call fcn.100185ee
mov dword [eax], esi
mov byte [ebp - 0xa6], 0
movzx eax, byte [ebp - 0xa6]
test eax, eax
je 0x10055556
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x100552f2
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x8b8]
call fcn.100185e9
jmp 0x10055211
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x638]
call fcn.100185e9
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 0x758], 0xfffffff7
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x100555b1
push 0x1e11
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [ebp - 0xf0], 0
jmp 0x100555ca
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xffffffee
jle 0x10055795
mov dword [ebp - 0xc0], 0x1f665683
mov dword [ebp - 0x41c], 0x729694d2
mov dword [ebp - 0xc0], 0xa
jmp 0x10055604
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffe5
jle 0x10055790
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x704], 0x1f6f
mov dword [ebp - 0x70c], 0
mov dword [ebp - 0xf8], 0
jmp 0x10055648
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xa
jge 0x1005578b
mov dword [ebp - 0x22c], 0xfffffff6
mov dword [ebp - 0x750], 0xf7c8b166
cmp dword [ebp - 0xc0], 0
je 0x10055682
xor eax, eax
je 0x10055682
mov dword [ebp - 0x44c], 1
jmp 0x10055689
and dword [ebp - 0x44c], 0
mov dword [ebp - 0x41c], 0xffffffff
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x41c], eax
jne 0x100556ad
mov dword [ebp - 0x424], 1
jmp 0x100556b4
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xf0]
sub ecx, dword [ebp - 0x750]
sub eax, ecx
cmp eax, dword [ebp - 0x704]
jne 0x100556e8
mov dword [ebp - 0x42c], 1
jmp 0x100556ef
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x42c]
test eax, eax
jne 0x10055710
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10055710
and dword [ebp - 0x434], 0
jmp 0x1005571a
mov dword [ebp - 0x434], 1
mov eax, dword [ebp - 0xf0]
imul eax, dword [ebp - 0x434]
test eax, eax
jne 0x10055737
mov dword [ebp - 0x43c], 1
jmp 0x1005573e
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x758]
cmp dword [ebp - 0x43c], eax
jne 0x10055758
mov dword [ebp - 0x444], 1
jmp 0x1005575f
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x444], eax
jge 0x10055774
cmp dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0x22c]
mov dword [ebp - 0x70c], eax
jmp 0x1005563b
jmp 0x100555f7
jmp 0x100555bd
mov dword [ebp - 0x1b8], 0
jmp 0x100557ae
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x100557ca
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x1c8], 0xffffffff
jmp 0x100557a1
mov dword [ebp - 0x1c0], 0x55595070
mov dword [ebp - 0x870], 1
mov dword [ebp - 0x86c], 1
mov dword [ebp - 0x868], 1
mov dword [ebp - 0x864], 1
lea ecx, [ebp - 0x215]
call fcn.100091f3
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x870]
push eax
lea ecx, [ebp - 0xaa4]
call fcn.100185fd
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa94]
call fcn.100185bf
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x8f0], 8
mov dword [ebp - 0x8ec], 8
mov dword [ebp - 0x8e8], 8
mov dword [ebp - 0x8e4], 8
mov dword [ebp - 0x454], 0x4d0c653d
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x8f0], 1
mov dword [ebp - 0x1c0], 0
jmp 0x10055893
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0xffffffea
jle 0x10055924
mov dword [ebp - 0x834], 0xa4c5706b
mov dword [ebp - 0x830], 0xa4c5706b
mov dword [ebp - 0x82c], 0xa4c5706b
mov dword [ebp - 0x828], 0xa4c5706b
lea ecx, [ebp - 0x235]
call fcn.100091f3
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0xabc]
call fcn.100185fd
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa7c]
call fcn.100185bf
mov dword [ebp - 0x9e0], 0xfffffff8
mov eax, dword [ebp - 0x454]
dec eax
mov dword [ebp - 0x454], eax
lea ecx, [ebp - 0xa7c]
call fcn.100185e9
jmp 0x10055886
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa94]
call fcn.100185e9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1c8], 0xfffffff8
jmp 0x10055961
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c8], 0xfffffff9
jle 0x10056379
push 3
lea ecx, [ebp - 0x280]
call fcn.1001855e
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x100], 0x5020f89b
mov dword [ebp - 0x234], 0xa5ea964a
mov dword [ebp - 0x898], 0xce695ef
mov dword [ebp - 0x894], 0xce695ef
mov dword [ebp - 0x890], 0xce695ef
mov dword [ebp - 0x88c], 0xce695ef
lea ecx, [ebp - 0x1f9]
call fcn.100091f3
push eax
invalid
invalid
invalid