Function at 0x1004f434
Capabilities:
Accept command line arguments
Check os version
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008e432
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x754
push esi
push edi
mov dword [ebp - 0x11c], 5
mov dword [ebp - 0x11c], 0xffffffff
jmp 0x1004f477
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x1b
jne 0x1004f4d5
mov dword [ebp - 0xd0], 0xfffffff6
mov dword [ebp - 0xd0], 0
jmp 0x1004f4a3
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xfffffff5
jg 0x1004f4d3
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x1004f4d1
push 0
push 0xb78
push 0x20c2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x1004f496
jmp 0x1004f46a
mov dword [ebp - 0x680], 0xfffffffb
mov dword [ebp - 0x124], 0
jmp 0x1004f4f8
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x1004f514
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0xd8], 0x48261f9c
jmp 0x1004f4eb
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x1004f526
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd8], 3
jmp 0x1004f554
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd8], 0x17
jl 0x1004f63c
mov dword [ebp - 0x12c], 0x37d45db3
mov byte [ebp - 0x6a], 0
movzx eax, byte [ebp - 0x6a]
test eax, eax
je 0x1004f5a2
push 0x1478
push 0
push 0
push 0
push 0
push 0xe09
push 0x186
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
mov dword [ebp - 0x12c], 0xffffffec
jmp 0x1004f5bb
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 4
je 0x1004f637
push 1
lea ecx, [ebp - 0x620]
call fcn.10016f54
and dword [ebp - 4], 0
mov dword [ebp - 0xe0], 0
jmp 0x1004f5ee
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x1004f610
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x620]
call fcn.10016fe2
mov dword [eax], 0xe30f
jmp 0x1004f5e1
push 0
lea ecx, [ebp - 0x620]
call fcn.10016fe2
mov dword [eax], 0xd9ba07e4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x620]
call fcn.10016fdd
jmp 0x1004f5ae
jmp 0x1004f539
mov dword [ebp - 0x78], 6
mov dword [ebp - 0x48], 0xb143e95a
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x4ec], 0x559653e3
mov dword [ebp - 0x5b8], 0x3268dd2a
mov dword [ebp - 0x5b4], 0x3268dd2a
mov dword [ebp - 0x5b0], 0x3268dd2a
mov dword [ebp - 0x5ac], 0x3268dd2a
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0x6d0], 0
mov dword [ebp - 0x538], 0xeb8efb66
mov dword [ebp - 0x78], 0xfffffff6
jmp 0x1004f6b4
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 6
jle 0x1004fa34
mov dword [ebp - 0x154], 0xfffffffc
mov dword [ebp - 0x1cc], 0xf889e022
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x80], 0x66de
mov dword [ebp - 0x530], 0xf0adc109
mov dword [ebp - 0x364], 0xfffffff9
push 1
lea ecx, [ebp - 0x4dc]
call fcn.10016f54
mov dword [ebp - 4], 1
mov dword [ebp - 0x19c], 0xffffffff
mov dword [ebp - 0x134], 0
jmp 0x1004f72e
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x1004f750
push dword [ebp - 0x134]
lea ecx, [ebp - 0x4dc]
call fcn.10016fe2
mov dword [eax], 0x26cdee94
jmp 0x1004f721
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x1004f7d9
cmp dword [ebp - 0x1d4], 0
jne 0x1004f774
mov dword [ebp - 0x3e8], 1
jmp 0x1004f77b
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x3e8], eax
jle 0x1004f792
mov dword [ebp - 0x4a4], 1
jmp 0x1004f799
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
neg eax
mov dword [ebp - 0x154], eax
jne 0x1004f7b5
mov dword [ebp - 0x4ac], 1
jmp 0x1004f7bc
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x80], eax
jl 0x1004f7d9
mov dword [ebp - 0x344], 1
jmp 0x1004f7e0
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0xbe4438b
je 0x1004f804
mov dword [ebp - 0x34c], 1
jmp 0x1004f80b
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x34c], eax
je 0x1004f825
mov dword [ebp - 0x1b4], 1
jmp 0x1004f82c
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x4ec]
cmp dword [ebp - 0x1b4], eax
jle 0x1004f846
mov dword [ebp - 0x354], 1
jmp 0x1004f84d
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x68c], eax
push 0
lea ecx, [ebp - 0x4dc]
call fcn.10016fe2
cmp dword [eax], 0
jne 0x1004f88b
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xb4], eax
jl 0x1004f88b
and dword [ebp - 0x1bc], 0
jmp 0x1004f895
mov dword [ebp - 0x1bc], 1
cmp dword [ebp - 0x1bc], 0xffffffff
jbe 0x1004f8aa
mov dword [ebp - 0x35c], 1
jmp 0x1004f8b1
and dword [ebp - 0x35c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5b8]
cmp dword [ebp - 0x35c], eax
jg 0x1004f8d2
mov dword [ebp - 0x1c4], 1
jmp 0x1004f8d9
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
cmp dword [ebp - 0x1cc], eax
jg 0x1004f8ff
mov dword [ebp - 0x36c], 1
jmp 0x1004f906
and dword [ebp - 0x36c], 0
mov esi, dword [ebp - 0x36c]
add esi, 5
push 0
lea ecx, [ebp - 0x4dc]
call fcn.10016fe2
sub esi, dword [eax]
cmp esi, dword [ebp - 0x1d4]
jl 0x1004f932
mov dword [ebp - 0x540], 1
jmp 0x1004f939
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
push 0
lea ecx, [ebp - 0x4dc]
call fcn.10016fe2
cmp dword [eax], 0
je 0x1004f9ab
push 0
lea ecx, [ebp - 0x4dc]
call fcn.10016fe2
push 4
pop ecx
imul ecx, ecx, 3
mov eax, dword [eax]
mov dword [ebp + ecx - 0x5b8], eax
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x1004f9a9
push 0
push 0x1cbf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x1004fa20
mov dword [ebp - 0xb4], 0xfffffff4
jmp 0x1004f9c4
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 4
jg 0x1004fa20
mov dword [ebp - 0x80], 0xffffffe9
jmp 0x1004f9dd
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x10
jg 0x1004fa1e
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x1004fa1c
push 0x2487
push 0x11be
push 0x2385
push 0x132a
push 0x1fbf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x1004f9d6
jmp 0x1004f9b7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4dc]
call fcn.10016fdd
jmp 0x1004f6ad
mov dword [ebp - 0x48], 0
jmp 0x1004fa44
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1004fa5a
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x5b8], 0xda0de902
jmp 0x1004fa3d
mov dword [ebp - 0x694], 0
mov dword [ebp - 0x90], 0xfffffffd
mov dword [ebp - 0xe8], 2
mov dword [ebp - 0x1e4], 0x9ef72d4e
mov dword [ebp - 0x38c], 0x99d94b4b
push 1
lea ecx, [ebp - 0x5fc]
call fcn.10016f54
mov dword [ebp - 4], 2
mov dword [ebp - 0x160], 3
mov dword [ebp - 0x28], 0
jmp 0x1004faba
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1004fad0
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5c4], 0xfc3eee2f
jmp 0x1004fab3
mov dword [ebp - 0x28], 0
jmp 0x1004fae0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1004fafc
push dword [ebp - 0x28]
lea ecx, [ebp - 0x5fc]
call fcn.10016fe2
mov dword [eax], 0xc924b541
jmp 0x1004fad9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5c4], 0
jne 0x1004fca9
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x90], 0
jne 0x1004fb31
mov dword [ebp - 0x374], 1
jmp 0x1004fb38
and dword [ebp - 0x374], 0
cmp dword [ebp - 0x374], 0xfffffffa
jb 0x1004fb4d
mov dword [ebp - 0x1dc], 1
jmp 0x1004fb54
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x1dc], eax
jl 0x1004fb6e
mov dword [ebp - 0x37c], 1
jmp 0x1004fb75
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
add eax, dword [ebp - 0xe8]
cmp eax, 7
jl 0x1004fba5
cmp dword [ebp - 0x90], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x5c4]
cmp dword [ebp + eax - 0x5c4], ecx
jl 0x1004fbcb
mov dword [ebp - 0x198], 1
jmp 0x1004fbd2
and dword [ebp - 0x198], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x198]
mov dword [ebp + eax - 0x5c4], ecx
mov eax, dword [ebp - 0x38c]
cmp dword [ebp - 0x198], eax
jle 0x1004fbfe
mov dword [ebp - 0x384], 1
jmp 0x1004fc05
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
add eax, 5
jne 0x1004fc2a
xor eax, eax
inc eax
jne 0x1004fc2a
and dword [ebp - 0x548], 0
jmp 0x1004fc34
mov dword [ebp - 0x548], 1
cmp dword [ebp - 0x160], 1
jge 0x1004fc49
mov dword [ebp - 0x1ec], 1
jmp 0x1004fc50
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x1ec], eax
je 0x1004fc6a
mov dword [ebp - 0x1f4], 1
jmp 0x1004fc71
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x38c]
cmp dword [ebp - 0x1f4], eax
jle 0x1004fc8b
mov dword [ebp - 0x394], 1
jmp 0x1004fc92
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x394]
sub eax, dword [ebp - 0x90]
jne 0x1004fca9
and dword [ebp - 0x1fc], 0
jmp 0x1004fcb3
mov dword [ebp - 0x1fc], 1
push 0
lea ecx, [ebp - 0x5fc]
call fcn.10016fe2
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x180]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5fc]
call fcn.10016fdd
mov dword [ebp - 0x6a4], 0xfffffff9
mov dword [ebp - 0x168], 8
mov dword [ebp - 0x39c], 0
mov dword [ebp - 0x550], 0xaad8
mov dword [ebp - 0x13c], 0
jmp 0x1004fd3b
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x1004fd57
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x688], 0xbf9f3617
jmp 0x1004fd2e
mov dword [ebp - 0x168], 0xf390197f
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0x39c], eax
jge 0x1004fd93
mov dword [ebp - 0x204], 1
jmp 0x1004fd9a
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x168]
add eax, 0xffff
imul eax, dword [ebp - 0x204]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x688], eax
mov byte [ebp - 0x6c], 0
movzx eax, byte [ebp - 0x6c]
test eax, eax
je 0x1004fdcb
call dword [sym.imp.USER32.dll_WaitMessage]
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x650], 1
mov dword [ebp - 0x30], 0x13a473eb
mov dword [ebp - 0x24], 0x11738ab6
mov dword [ebp - 0x190], 0x52e2cc7b
mov dword [ebp - 0x2c], 0
jmp 0x1004fe07
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1004fe1d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x70c], 0xd526
jmp 0x1004fe00
mov dword [ebp - 0x2c], 0
jmp 0x1004fe2d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1004fe43
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3e4], 3
jmp 0x1004fe26
cmp dword [ebp - 0x30], 7
ja 0x1004fe55
mov dword [ebp - 0x3a4], 1
jmp 0x1004fe5c
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 2
jmp 0x1004fe75
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x10050291
mov dword [ebp - 0xbc], 0xa3f30045
mov dword [ebp - 0xa4], 1
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x24], 2
jmp 0x1004fead
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x100500c2
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0xac], 0
jmp 0x1004feda
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jg 0x100500bd
mov dword [ebp - 0x144], 1
push 1
lea ecx, [ebp - 0x5d0]
call fcn.10016f54
mov dword [ebp - 4], 3
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x558], 0xffffffff
mov dword [ebp - 0xf0], 0
jmp 0x1004ff32
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x1004ff54
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x5d0]
call fcn.10016fe2
mov dword [eax], 0xc07c2076
jmp 0x1004ff25
mov dword [ebp - 0x144], 0
jmp 0x1004ff6d
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jg 0x100500a9
mov dword [ebp - 0x658], 0xfffffffe
mov dword [ebp - 0x100], 0
jmp 0x1004ff9d
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 4
jge 0x1004ffb9
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x73c], 0x6d6dbc1c
jmp 0x1004ff90
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x660], eax
push 0
lea ecx, [ebp - 0x5d0]
call fcn.10016fe2
mov eax, dword [eax]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x1004fff2
cmp dword [ebp - 0xac], 0
jne 0x1004fff2
and dword [ebp - 0x3ac], 0
jmp 0x1004fffc
mov dword [ebp - 0x3ac], 1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x73c], 0xfe81720d
cmp dword [ebp - 0x3ac], 0xfe81720d
je 0x10050025
mov dword [ebp - 0x214], 1
jmp 0x1005002c
and dword [ebp - 0x214], 0
push 0
lea ecx, [ebp - 0x5d0]
call fcn.10016fe2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x214]
jge 0x1005004f
mov dword [ebp - 0x3b4], 1
jmp 0x10050056
and dword [ebp - 0x3b4], 0
cmp dword [ebp - 0x3b4], 7
jae 0x1005006b
mov dword [ebp - 0x21c], 1
jmp 0x10050072
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x21c]
sub eax, dword [ebp - 0xbc]
je 0x10050091
xor eax, eax
inc eax
je 0x10050091
mov dword [ebp - 0x3bc], 1
jmp 0x10050098
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x558], eax
jmp 0x1004ff60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d0]
call fcn.10016fdd
jmp 0x1004fecd
jmp 0x1004fea6
cmp dword [ebp - 0xa4], 0
je 0x10050279
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x190]
je 0x100500fb
cmp dword [ebp - 0xbc], 0
je 0x100500fb
mov dword [ebp - 0x224], 1
jmp 0x10050102
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x23c]
add eax, dword [ebp - 0x224]
jne 0x1005011f
cmp dword [ebp - 0x24], 0
jne 0x1005011f
and dword [ebp - 0x3c4], 0
jmp 0x10050129
mov dword [ebp - 0x3c4], 1
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x3c4], eax
jle 0x10050143
mov dword [ebp - 0x22c], 1
jmp 0x1005014a
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x22c], eax
jne 0x10050164
mov dword [ebp - 0x3cc], 1
jmp 0x1005016b
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3cc], eax
jle 0x10050182
mov dword [ebp - 0x234], 1
jmp 0x10050189
and dword [ebp - 0x234], 0
cmp dword [ebp - 0x234], 0xffff
jne 0x100501a1
mov dword [ebp - 0x3dc], 1
jmp 0x100501a8
and dword [ebp - 0x3dc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp + eax - 0x3e4], ecx
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0xa4], 0xfffffffa
jne 0x100501d7
cmp dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x678], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3e4], 1
jbe 0x10050208
mov dword [ebp - 0x244], 1
jmp 0x1005020f
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x244]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x70c]
jge 0x10050237
mov dword [ebp - 0x3ec], 1
jmp 0x1005023e
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x3ec]
jl 0x10050255
mov dword [ebp - 0x560], 1
jmp 0x1005025c
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x690], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x24], eax
jne 0x10050279
mov dword [ebp - 0x24c], 1
jmp 0x10050280
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0xa4], eax
jmp 0x1004fe6e
mov dword [ebp - 0x6dc], 0x1836ccb0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x1c], 0xe446df37
push 4
lea ecx, [ebp - 0x3d8]
call fcn.10016f54
mov dword [ebp - 4], 4
mov dword [ebp - 0xa0], 0xfffffff6
mov dword [ebp - 0x88], 0x46d7
mov dword [ebp - 0x140], 0
jmp 0x100502ed
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x1005030f
push dword [ebp - 0x140]
lea ecx, [ebp - 0x3d8]
call fcn.10016fe2
mov dword [eax], 0x2df3
jmp 0x100502e0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x10050456
cmp dword [ebp - 0x1c], 0
je 0x10050346
push 3
lea ecx, [ebp - 0x3d8]
call fcn.10016fe2
cmp dword [eax], 0
je 0x10050346
mov dword [ebp - 0x3f4], 1
jmp 0x1005034d
and dword [ebp - 0x3f4], 0
cmp dword [ebp - 0x3f4], 0
jae 0x10050362
mov dword [ebp - 0x254], 1
jmp 0x10050369
and dword [ebp - 0x254], 0
cmp dword [ebp - 0x254], 3
jge 0x1005037e
mov dword [ebp - 0x3fc], 1
jmp 0x10050385
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3fc], eax
jge 0x1005039c
mov dword [ebp - 0x25c], 1
jmp 0x100503a3
and dword [ebp - 0x25c], 0
push 1
lea ecx, [ebp - 0x3d8]
call fcn.10016fe2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x25c]
je 0x100503c6
mov dword [ebp - 0x404], 1
jmp 0x100503cd
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x404]
jle 0x100503e7
mov dword [ebp - 0x264], 1
jmp 0x100503ee
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x264], eax
jge 0x10050408
mov dword [ebp - 0x40c], 1
jmp 0x1005040f
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x40c]
jge 0x10050429
mov dword [ebp - 0x26c], 1
jmp 0x10050430
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
push 1
lea ecx, [ebp - 0x3d8]
call fcn.10016fe2
cmp esi, dword [eax]
je 0x10050456
and dword [ebp - 0x414], 0
jmp 0x10050460
mov dword [ebp - 0x414], 1
push 1
lea ecx, [ebp - 0x3d8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x414]
add ecx, dword [eax]
je 0x10050637
mov dword [ebp - 0x170], 0x9ba87a5
mov dword [ebp - 0x274], 0x72737ae9
cmp dword [ebp - 0x1c], 0
jne 0x100504c1
push 1
lea ecx, [ebp - 0x3d8]
call fcn.10016fe2
mov eax, dword [eax]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x274], eax
jl 0x100504c1
and dword [ebp - 0x41c], 0
jmp 0x100504cb
mov dword [ebp - 0x41c], 1
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x41c]
cmp eax, 0x5f40e13f
jle 0x100504e8
mov dword [ebp - 0x27c], 1
jmp 0x100504ef
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x170]
mov ecx, 0xf4ea14c5
sub ecx, dword [ebp - 0x27c]
imul eax, ecx
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x568], 0
je 0x100505cd
mov dword [ebp - 0x5f0], 0xcc72b752
mov dword [ebp - 0x5ec], 0xcc72b752
mov dword [ebp - 0x5e8], 0xcc72b752
mov dword [ebp - 0x5e4], 0xcc72b752
lea ecx, [ebp - 0x191]
call fcn.10009273
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x5f0]
push eax
lea ecx, [ebp - 0x72c]
call fcn.10016ff1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6a0]
call fcn.10016fb3
mov byte [ebp - 4], 5
push 3
lea ecx, [ebp - 0x6a0]
call fcn.10016fe2
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x424]
mov dword [ecx], eax
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x100505bc
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6a0]
call fcn.10016fdd
jmp 0x10050632
mov dword [ebp - 0xa0], 0
jmp 0x100505e6
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jg 0x10050609
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x10050607
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
jmp 0x100505d9
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x10050632
push 0
push 0x1cbf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x10050744
mov dword [ebp - 0x42c], 4
mov dword [ebp - 0x630], 0x927db404
mov dword [ebp - 0x62c], 0x927db404
mov dword [ebp - 0x628], 0x927db404
mov dword [ebp - 0x624], 0x927db404
mov dword [ebp - 0x508], 6
mov esi, dword [ebp - 0x88]
push 3
lea ecx, [ebp - 0x3d8]
call fcn.10016fe2
cmp esi, dword [eax]
jle 0x10050696
mov dword [ebp - 0x284], 1
jmp 0x1005069d
and dword [ebp - 0x284], 0
cmp dword [ebp - 0x284], 0xb441
je 0x100506b5
mov dword [ebp - 0x528], 1
jmp 0x100506bc
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x42c]
add eax, 0x4fc6a3f0
cmp eax, dword [ebp - 0x42c]
jge 0x100506db
mov dword [ebp - 0x188], 1
jmp 0x100506e2
and dword [ebp - 0x188], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x188]
mov dword [ebp + eax - 0x630], ecx
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x10050710
mov dword [ebp - 0x28c], 1
jmp 0x10050717
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x28c], eax
jl 0x10050731
mov dword [ebp - 0x434], 1
jmp 0x10050738
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x88], 0
jmp 0x1005075d
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xc
jg 0x10050781
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1005077f
push 0
push 0x121d
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10050750
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d8]
call fcn.10016fdd
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x98], 0x5c174734
push 1
lea ecx, [ebp - 0x4e8]
call fcn.10016f54
mov dword [ebp - 4], 6
mov dword [ebp - 0x504], 0x26fbd10c
mov dword [ebp - 0x128], 0
jmp 0x100507db
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x100507fd
push dword [ebp - 0x128]
lea ecx, [ebp - 0x4e8]
call fcn.10016fe2
mov dword [eax], 0xd890
jmp 0x100507ce
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x110], eax
jg 0x10050817
mov dword [ebp - 0x294], 1
jmp 0x1005081e
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 6
jge 0x1005083f
mov dword [ebp - 0x4fc], 1
jmp 0x10050846
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x98], eax
jle 0x10050869
cmp dword [ebp - 0x98], 0
je 0x10050869
mov dword [ebp - 0x43c], 1
jmp 0x10050870
and dword [ebp - 0x43c], 0
push 0
lea ecx, [ebp - 0x4e8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x43c]
cmp ecx, dword [eax]
je 0x1005089c
mov eax, 0x8d46758e
test eax, eax
je 0x1005089c
mov dword [ebp - 0x54c], 1
jmp 0x100508a3
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x98]
add eax, 0x4392f209
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x3529
jl 0x100508cc
mov dword [ebp - 0x29c], 1
jmp 0x100508d3
and dword [ebp - 0x29c], 0
push 0
lea ecx, [ebp - 0x4e8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x29c]
cmp ecx, dword [eax]
jge 0x100508f6
mov dword [ebp - 0x444], 1
jmp 0x100508fd
and dword [ebp - 0x444], 0
push 0
lea ecx, [ebp - 0x4e8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x444]
add ecx, dword [eax]
cmp ecx, 1
ja 0x10050923
mov dword [ebp - 0x2a4], 1
jmp 0x1005092a
and dword [ebp - 0x2a4], 0
mov esi, dword [ebp - 0x2a4]
add esi, 0x649bc00e
push 0
lea ecx, [ebp - 0x4e8]
call fcn.10016fe2
cmp esi, dword [eax]
jle 0x10050953
mov dword [ebp - 0x44c], 1
jmp 0x1005095a
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x504], eax
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x1005097d
push 0xff0
call dword [sym.imp.USER32.dll_GetSysColorBrush]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e8]
call fcn.10016fdd
mov dword [ebp - 0x44], 0xc03342eb
mov dword [ebp - 0x57c], 0xc77dcda7
mov dword [ebp - 0x50c], 7
mov dword [ebp - 0x44], 2
jmp 0x100509b7
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffef
jle 0x10050af1
mov dword [ebp - 0x138], 0xffffffff
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x464], 0x589b5833
mov eax, 0xeac4
test eax, eax
je 0x10050ab3
cmp dword [ebp - 0x138], 0
je 0x10050a14
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x44]
neg eax
je 0x10050a14
mov dword [ebp - 0x2c4], 1
jmp 0x10050a1b
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x44], eax
je 0x10050a32
mov dword [ebp - 0x2ac], 1
jmp 0x10050a39
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x454], eax
jl 0x10050a5f
mov dword [ebp - 0x2b4], 1
jmp 0x10050a66
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 0
jg 0x10050a7b
mov dword [ebp - 0x45c], 1
jmp 0x10050a82
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 0xe80d
jle 0x10050a9a
mov dword [ebp - 0x2bc], 1
jmp 0x10050aa1
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x44], 0
jne 0x10050ac8
cmp dword [ebp - 0x44], 0
jne 0x10050ac8
and dword [ebp - 0x46c], 0
jmp 0x10050ad2
mov dword [ebp - 0x46c], 1
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x50c], 0
je 0x10050aec
jmp 0x100509b0
jmp 0x100509b0
mov dword [ebp - 0x518], 1
mov dword [ebp - 0x554], 0xffffffff
mov dword [ebp - 0x120], 0x4f833fcb
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x178], 0xfff7
mov dword [ebp - 0x584], 0x415
mov dword [ebp - 0x474], 0x43eef7d2
mov dword [ebp - 0x2dc], 0xfffffff6
mov dword [ebp - 0x49c], 0x4faf1418
mov dword [ebp - 0x118], 0
jmp 0x10050b64
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 4
jge 0x10050b80
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x74c], 0x9339b884
jmp 0x10050b57
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x554], 0
jne 0x10050bae
mov dword [ebp - 0x2cc], 1
jmp 0x10050bb5
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 0xb051
jle 0x10050bcd
mov dword [ebp - 0x514], 1
jmp 0x10050bd4
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x6e4], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0xfffd
jb 0x10050c10
mov dword [ebp - 0x2d4], 1
jmp 0x10050c17
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x2d4], eax
je 0x10050c31
mov dword [ebp - 0x47c], 1
jmp 0x10050c38
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x47c]
jl 0x10050c52
mov dword [ebp - 0x51c], 1
jmp 0x10050c59
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x130], eax
jne 0x10050c7c
cmp dword [ebp - 0x130], 0
je 0x10050c7c
mov dword [ebp - 0x484], 1
jmp 0x10050c83
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 3
jne 0x10050c98
mov dword [ebp - 0x2e4], 1
jmp 0x10050c9f
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x2e4]
add eax, 3
je 0x10050cb3
cmp dword [ebp - 0x120], 0
jne 0x10050cc8
cmp dword [ebp - 0x178], 0
je 0x10050cc8
mov dword [ebp - 0x48c], 1
jmp 0x10050ccf
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0xef23e469
je 0x10050ce7
mov dword [ebp - 0x2ec], 1
jmp 0x10050cee
and dword [ebp - 0x2ec], 0
cmp dword [ebp - 0x2ec], 0xfffffffa
jle 0x10050d03
mov dword [ebp - 0x494], 1
jmp 0x10050d0a
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0x451d
jne 0x10050d2e
mov dword [ebp - 0x304], 1
jmp 0x10050d35
and dword [ebp - 0x304], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x304]
mov dword [ebp + eax - 0x74c], ecx
mov dword [ebp - 0x634], 0x4b283066
push 3
lea ecx, [ebp - 0xfc]
call fcn.10016f54
mov dword [ebp - 4], 7
mov dword [ebp - 0x7c], 0xe9bf9f36
push 1
lea ecx, [ebp - 0x4c4]
call fcn.10016f54
mov byte [ebp - 4], 8
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x38], 0
jmp 0x10050d95
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10050db1
push dword [ebp - 0x38]
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
mov dword [eax], 2
jmp 0x10050d8e
mov dword [ebp - 0x38], 0
jmp 0x10050dc1
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10050ddd
push dword [ebp - 0x38]
lea ecx, [ebp - 0x4c4]
call fcn.10016fe2
mov dword [eax], 3
jmp 0x10050dba
push 1
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2fc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2fc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x4c4]
call fcn.10016fe2
mov dword [eax], 0xf34111d0
push 0xfffffffffffffff8
pop eax
cmp eax, 0xf34111d0
jb 0x10050e2a
mov dword [ebp - 0x300], 1
jmp 0x10050e31
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 5
jae 0x10050e46
mov dword [ebp - 0x478], 1
jmp 0x10050e4d
and dword [ebp - 0x478], 0
push 1
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
mov ecx, dword [ebp - 0x478]
cmp ecx, dword [eax]
jg 0x10050e70
mov dword [ebp - 0x308], 1
jmp 0x10050e77
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xbf889e02
jbe 0x10050e9c
push 2
pop eax
test eax, eax
je 0x10050e9c
mov dword [ebp - 0x3e0], 1
jmp 0x10050ea3
and dword [ebp - 0x3e0], 0
push 1
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x3e0]
jl 0x10050ecc
mov dword [ebp - 0x310], 1
jmp 0x10050ed3
and dword [ebp - 0x310], 0
push 0
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
mov ecx, dword [ebp - 0x310]
cmp ecx, dword [eax]
je 0x10050f08
push 0
lea ecx, [ebp - 0x4c4]
call fcn.10016fe2
cmp dword [eax], 0
je 0x10050f08
mov dword [ebp - 0x448], 1
jmp 0x10050f0f
and dword [ebp - 0x448], 0
push 0
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [eax]
jg 0x10050f33
push 1
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
push 1
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
imul esi, dword [eax], 0xfffffff8
push 1
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
cmp esi, dword [eax]
jge 0x10050f58
cmp dword [ebp - 0x4c], 0
mov eax, 0xf9d66de6
test eax, eax
je 0x10051168
mov dword [ebp - 0x104], 0xa26cdee9
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x328], 0
mov dword [ebp - 0xc4], 0
jmp 0x10050f9c
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x10050fb8
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x55c], 8
jmp 0x10050f8f
push 0
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
push 0
lea ecx, [ebp - 0x4c4]
call fcn.10016fe2
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x63c], eax
push 0
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
cmp dword [eax], 0xfd6b2214
jbe 0x10050fff
mov dword [ebp - 0x318], 1
jmp 0x10051006
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x318]
jl 0x10051020
mov dword [ebp - 0x1a0], 1
jmp 0x10051027
and dword [ebp - 0x1a0], 0
push 1
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
mov ecx, dword [ebp - 0x1a0]
add ecx, dword [eax]
imul ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x330]
jge 0x10051066
push 0
lea ecx, [ebp - 0x4c4]
call fcn.10016fe2
cmp dword [eax], 0
je 0x10051066
mov dword [ebp - 0x320], 1
jmp 0x1005106d
and dword [ebp - 0x320], 0
cmp dword [ebp - 0x320], 0
jg 0x10051082
mov dword [ebp - 0x4a0], 1
jmp 0x10051089
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x328], eax
jne 0x100510af
mov dword [ebp - 0x3f0], 1
jmp 0x100510b6
and dword [ebp - 0x3f0], 0
push 2
lea ecx, [ebp - 0xfc]
call fcn.10016fe2
mov ecx, dword [ebp - 0x3f0]
cmp ecx, dword [eax]
jge 0x100510eb
cmp dword [ebp - 0x330], 0
je 0x100510eb
cmp dword [ebp - 0x104], 0
je 0x100510eb
mov dword [ebp - 0x158], 1
jmp 0x100510f2
and dword [ebp - 0x158], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x158]
mov dword [ebp + eax - 0x55c], ecx
push 0
lea ecx, [ebp - 0x4c4]
call fcn.10016fe2
mov ecx, dword [ebp - 0x158]
mov dword [eax], ecx
mov dword [ebp - 0x4c], 0xfffffffe
jmp 0x1005112a
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x1c
jge 0x10051166
mov dword [ebp - 0x7c], 0
jmp 0x10051140
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x10051164
mov byte [ebp - 0x6b], 0
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x10051162
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10051139
jmp 0x10051123
jmp 0x100511e4
mov dword [ebp - 0x6ec], 0xfa755584
push 2
lea ecx, [ebp - 0x6b0]
call fcn.10016f54
mov byte [ebp - 4], 9
mov dword [ebp - 0x450], 0xfe298319
mov dword [ebp - 0x10c], 0
jmp 0x100511a6
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x100511c8
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x6b0]
call fcn.10016fe2
mov dword [eax], 0xf04e266b
jmp 0x10051199
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6b0]
call fcn.10016fdd
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4c4]
call fcn.10016fdd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.10016fdd
mov dword [ebp - 0x644], 0xfffffffd
mov dword [ebp - 0x84], 6
mov dword [ebp - 0x40], 0xb143e95a
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x524], 0x559653e3
mov dword [ebp - 0x5a8], 0x3268dd2a
mov dword [ebp - 0x5a4], 0x3268dd2a
mov dword [ebp - 0x5a0], 0x3268dd2a
mov dword [ebp - 0x59c], 0x3268dd2a
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x6b4], 0
mov dword [ebp - 0x52c], 0xeb8efb66
mov dword [ebp - 0x84], 0xfffffff6
jmp 0x10051290
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 6
jle 0x10051635
mov dword [ebp - 0x15c], 0xfffffffc
mov dword [ebp - 0x368], 0xf889e022
mov dword [ebp - 0x370], 0xffffffff
mov dword [ebp - 0x8c], 0x66de
mov dword [ebp - 0x598], 0xf0adc109
mov dword [ebp - 0x498], 0xfffffff9
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10016f54
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x164], 0xffffffff
mov dword [ebp - 0x114], 0
jmp 0x10051310
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x10051332
push dword [ebp - 0x114]
lea ecx, [ebp - 0x4d0]
call fcn.10016fe2
mov dword [eax], 0x26cdee94
jmp 0x10051303
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x100513cb
cmp dword [ebp - 0x370], 0
jne 0x1005135a
mov dword [ebp - 0x338], 1
jmp 0x10051361
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x338], eax
jle 0x1005137b
mov dword [ebp - 0x3f8], 1
jmp 0x10051382
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
neg eax
mov dword [ebp - 0x15c], eax
jne 0x1005139e
mov dword [ebp - 0x340], 1
jmp 0x100513a5
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x8c], eax
jl 0x100513cb
mov dword [ebp - 0x480], 1
jmp 0x100513d2
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xbe4438b
je 0x100513f6
mov dword [ebp - 0x400], 1
jmp 0x100513fd
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x400], eax
je 0x10051417
mov dword [ebp - 0x350], 1
jmp 0x1005141e
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0x350], eax
jle 0x10051438
mov dword [ebp - 0x458], 1
jmp 0x1005143f
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x64c], eax
push 0
lea ecx, [ebp - 0x4d0]
call fcn.10016fe2
cmp dword [eax], 0
jne 0x1005147d
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xa8], eax
jl 0x1005147d
and dword [ebp - 0x358], 0
jmp 0x10051487
mov dword [ebp - 0x358], 1
cmp dword [ebp - 0x358], 0xffffffff
jbe 0x1005149c
mov dword [ebp - 0x408], 1
jmp 0x100514a3
and dword [ebp - 0x408], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a8]
cmp dword [ebp - 0x408], eax
jg 0x100514c4
mov dword [ebp - 0x360], 1
jmp 0x100514cb
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0x368], eax
jg 0x100514f1
mov dword [ebp - 0x410], 1
jmp 0x100514f8
and dword [ebp - 0x410], 0
mov esi, dword [ebp - 0x410]
add esi, 5
push 0
lea ecx, [ebp - 0x4d0]
call fcn.10016fe2
sub esi, dword [eax]
cmp esi, dword [ebp - 0x370]
jl 0x10051524
mov dword [ebp - 0x564], 1
jmp 0x1005152b
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x6c8], eax
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
push 0
lea ecx, [ebp - 0x4d0]
call fcn.10016fe2
cmp dword [eax], 0
je 0x100515a0
push 0
lea ecx, [ebp - 0x4d0]
call fcn.10016fe2
push 4
pop ecx
imul ecx, ecx, 3
mov eax, dword [eax]
mov dword [ebp + ecx - 0x5a8], eax
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x1005159b
push 0
push 0x1cbf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x10051621
mov dword [ebp - 0xa8], 0xfffffff4
jmp 0x100515b9
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jg 0x10051621
mov dword [ebp - 0x8c], 0xffffffe9
jmp 0x100515db
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x10
jg 0x1005161f
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x1005161d
push 0x2487
push 0x11be
push 0x2385
push 0x132a
push 0x1fbf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x100515ce
jmp 0x100515ac
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d0]
call fcn.10016fdd
jmp 0x10051283
mov dword [ebp - 0x40], 0
jmp 0x10051645
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x1005165b
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x5a8], 0xda0de902
jmp 0x1005163e
mov dword [ebp - 0x16c], 0x9949dfcf
mov dword [ebp - 0x460], 7
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0x420], 0xe54ee87f
mov dword [ebp - 0x58], 0xcfaf
mov dword [ebp - 0xc8], 0x12af04
mov dword [ebp - 0x534], 0xfffffffd
push 3
lea ecx, [ebp - 0x614]
call fcn.10016f54
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x3c], 0
jmp 0x100516c2
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x100516d8
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x700], 0x37911b9c
jmp 0x100516bb
mov dword [ebp - 0x3c], 0
jmp 0x100516e8
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10051704
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x614]
call fcn.10016fe2
mov dword [eax], 0x9f8c5172
jmp 0x100516e1
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 1
jl 0x10051731
mov dword [ebp - 0x378], 1
jmp 0x10051738
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x378], eax
jne 0x10051752
mov dword [ebp - 0x468], 1
jmp 0x10051759
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
inc ecx
mov dword [ebp - 0x58], ecx
test eax, eax
jne 0x1005187f
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0xc8], eax
je 0x10051788
cmp dword [ebp - 0xb0], 0
jne 0x10051788
and dword [ebp - 0x174], 0
jmp 0x10051792
mov dword [ebp - 0x174], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x174]
mov dword [ebp + eax - 0x700], ecx
mov eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0xc8]
jne 0x100517d1
or eax, 0xffffffff
jne 0x100517d1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x700], 0
jne 0x100517d1
and dword [ebp - 0x418], 0
jmp 0x100517db
mov dword [ebp - 0x418], 1
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0x58]
jg 0x100517f5
mov dword [ebp - 0x380], 1
jmp 0x100517fc
and dword [ebp - 0x380], 0
cmp dword [ebp - 0x380], 0xffffffff
jle 0x10051811
mov dword [ebp - 0x488], 1
jmp 0x10051818
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x488], eax
jge 0x10051832
mov dword [ebp - 0x388], 1
jmp 0x10051839
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x388]
cmp dword [ebp - 0x420], eax
je 0x10051862
mov dword [ebp - 0x390], 1
jmp 0x10051869
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
add eax, 0x6896e60b
jne 0x1005187f
and dword [ebp - 0x398], 0
jmp 0x10051889
mov dword [ebp - 0x398], 1
mov eax, dword [ebp - 0x468]
cmp eax, dword [ebp - 0x398]
je 0x100518a3
mov dword [ebp - 0x428], 1
jmp 0x100518aa
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
sub eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb0], eax
mov esi, dword [ebp - 0xb0]
sub esi, dword [ebp - 0x534]
push 0
lea ecx, [ebp - 0x614]
call fcn.10016fe2
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x614]
call fcn.10016fdd
push 1
lea ecx, [ebp - 0x150]
call fcn.10016f54
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x184], 0xffffffff
mov dword [ebp - 0x94], 0xfffffffb
mov dword [ebp - 0x9c], 0xa37d7c86
mov dword [ebp - 0x60], 0xec352115
push 2
lea ecx, [ebp - 0x578]
call fcn.10016f54
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x10], 0
jmp 0x10051940
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x10051959
push dword [ebp - 0x10]
lea ecx, [ebp - 0x150]
call fcn.10016fe2
or dword [eax], 0xffffffff
jmp 0x10051939
mov dword [ebp - 0x10], 0
jmp 0x10051969
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1005197f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4b8], 0x5cb5542a
jmp 0x10051962
mov dword [ebp - 0x10], 0
jmp 0x1005198f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100519ab
push dword [ebp - 0x10]
lea ecx, [ebp - 0x578]
call fcn.10016fe2
mov dword [eax], 7
jmp 0x10051988
push 0
lea ecx, [ebp - 0x150]
call fcn.10016fe2
cmp dword [eax], 0
jge 0x100519c9
mov dword [ebp - 0x3a0], 1
jmp 0x100519d0
and dword [ebp - 0x3a0], 0
mov dword [ebp - 0x184], 1
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x4a8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp + eax - 0x4b8], ecx
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x94], eax
mov esi, dword [ebp - 0x4a8]
sub esi, dword [ebp - 0x94]
push 0
lea ecx, [ebp - 0x150]
call fcn.10016fe2
cmp esi, dword [eax]
jne 0x10051a2e
mov dword [ebp - 0x3a8], 1
jmp 0x10051a35
and dword [ebp - 0x3a8], 0
push 0
lea ecx, [ebp - 0x150]
call fcn.10016fe2
mov esi, dword [ebp - 0x3a8]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x150]
call fcn.10016fe2
cmp esi, dword [eax]
jge 0x10051a68
mov dword [ebp - 0x430], 1
jmp 0x10051a6f
and dword [ebp - 0x430], 0
cmp dword [ebp - 0x430], 0
jge 0x10051a84
mov dword [ebp - 0x3b0], 1
jmp 0x10051a8b
and dword [ebp - 0x3b0], 0
push 0
lea ecx, [ebp - 0x150]
call fcn.10016fe2
mov ecx, dword [ebp - 0x3b0]
cmp ecx, dword [eax]
jge 0x10051aae
mov dword [ebp - 0x470], 1
jmp 0x10051ab5
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xffff
jbe 0x10051ad9
mov dword [ebp - 0x3b8], 1
jmp 0x10051ae0
and dword [ebp - 0x3b8], 0
push 0
lea ecx, [ebp - 0x150]
call fcn.10016fe2
mov ecx, dword [ebp - 0x3b8]
cmp ecx, dword [eax]
jl 0x10051b03
mov dword [ebp - 0x438], 1
jmp 0x10051b0a
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 0xfffffffa
jge 0x10051b1f
mov dword [ebp - 0x3c0], 1
jmp 0x10051b26
and dword [ebp - 0x3c0], 0
push 0
lea ecx, [ebp - 0x150]
call fcn.10016fe2
mov ecx, dword [ebp - 0x3c0]
cmp ecx, dword [eax]
jl 0x10051b49
mov dword [ebp - 0x490], 1
jmp 0x10051b50
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x490]
add eax, 0x128abf8b
mov dword [ebp - 0x60], eax
mov esi, dword [ebp - 0x60]
push 0
lea ecx, [ebp - 0x150]
call fcn.10016fe2
cmp dword [eax], esi
jge 0x10051b7e
mov dword [ebp - 0x3c8], 1
jmp 0x10051b85
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
sub eax, 0xfafb
cmp eax, 0xffffffff
jge 0x10051ba1
mov dword [ebp - 0x440], 1
jmp 0x10051ba8
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0
je 0x10051bc3
mov eax, 0xbc69
test eax, eax
jne 0x10051bc3
and dword [ebp - 0x2f8], 0
jmp 0x10051bcd
mov dword [ebp - 0x2f8], 1
cmp dword [ebp - 0x2f8], 0x509c
je 0x10051be5
mov dword [ebp - 0x2f4], 1
jmp 0x10051bec
and dword [ebp - 0x2f4], 0
cmp dword [ebp - 0x2f4], 0xfffffff6
je 0x10051c1c
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x10051c17
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x10051d8f
mov dword [ebp - 0x17c], 0xfffffff9
mov dword [ebp - 0xcc], 0xc9d6c840
mov dword [ebp - 0x580], 0xffffffff
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x94], eax
jne 0x10051c54
mov dword [ebp - 0x2f0], 1
jmp 0x10051c5b
and dword [ebp - 0x2f0], 0
push 0
lea ecx, [ebp - 0x578]
call fcn.10016fe2
mov ecx, dword [ebp - 0x2f0]
cmp ecx, dword [eax]
jle 0x10051c7e
mov dword [ebp - 0x30c], 1
jmp 0x10051c85
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
imul ecx, dword [ebp - 0x60], 0xfffffff8
add eax, ecx
mov ecx, dword [ebp - 0x30c]
neg ecx
sub eax, ecx
mov dword [ebp - 0x314], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x314]
mov dword [ebp + eax - 0x4b8], ecx
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x314], eax
jg 0x10051cd9
mov dword [ebp - 0x31c], 1
jmp 0x10051ce0
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jbe 0x10051d01
mov dword [ebp - 0x324], 1
jmp 0x10051d08
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x580]
cmp dword [ebp - 0x324], eax
jg 0x10051d22
mov dword [ebp - 0x32c], 1
jmp 0x10051d29
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x32c], eax
jl 0x10051d43
mov dword [ebp - 0x334], 1
jmp 0x10051d4a
and dword [ebp - 0x334], 0
push 0
lea ecx, [ebp - 0x578]
call fcn.10016fe2
mov ecx, dword [ebp - 0x334]
cmp ecx, dword [eax]
jl 0x10051d6d
mov dword [ebp - 0x33c], 1
jmp 0x10051d74
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
sub eax, 8
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x9c], eax
push 0
lea ecx, [ebp - 0x150]
call fcn.10016fe2
push 0
lea ecx, [ebp - 0x150]
call fcn.10016fe2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4b8], 0
jl 0x10051dc5
mov dword [ebp - 0x1a4], 1
jmp 0x10051dcc
and dword [ebp - 0x1a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b8]
add eax, dword [ebp - 0x1a4]
sub eax, dword [ebp - 0x94]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x60], eax
jge 0x10051dff
mov dword [ebp - 0x53c], 1
jmp 0x10051e06
and dword [ebp - 0x53c], 0
push 0
lea ecx, [ebp - 0x578]
call fcn.10016fe2
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x4b8]
cmp dword [ebp + eax - 0x4b8], ecx
jl 0x10051e3b
mov dword [ebp - 0x1a8], 1
jmp 0x10051e42
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x1a8]
jge 0x10051e5c
mov dword [ebp - 0x1b0], 1
jmp 0x10051e63
and dword [ebp - 0x1b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b0]
mov dword [ebp + eax - 0x4b8], ecx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x654], eax
mov eax, dword [ebp - 0x60]
neg eax
mov dword [ebp - 0x9c], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x578]
call fcn.10016fdd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10016fdd
mov dword [ebp - 0xdc], 0x324ec2e0
mov dword [ebp - 0x6c4], 0
push 3
lea ecx, [ebp - 0x6c0]
call fcn.10016f54
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x65c], 3
mov dword [ebp - 0x1b8], 0x8b5131d8
mov dword [ebp - 0xd4], 0
jmp 0x10051efd
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x10051f1f
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x6c0]
call fcn.10016fe2
mov dword [eax], 1
jmp 0x10051ef0
mov dword [ebp - 0xdc], 0
jmp 0x10051f38
cmp dword [ebp - 0xdc], 0xffffffe9
je 0x10051f65
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x10051f63
push 0
push 0
push 0xadd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10051f2b
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c0]
call fcn.10016fdd
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb8], 0
jmp 0x10051fa4
cmp dword [ebp - 0xb8], 0xf
je 0x10051fd3