Function at 0x100096e9
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008d952
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x116c
call fcn.1008ac50
push esi
push edi
push 1
lea ecx, [ebp - 0x3c4]
call fcn.10018753
and dword [ebp - 4], 0
mov dword [ebp - 0x74], 0x2c39d5b6
mov dword [ebp - 0xbd8], 0xfffffff8
mov dword [ebp - 0x2fc], 0
jmp 0x10009748
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 1
jge 0x1000976a
push dword [ebp - 0x2fc]
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
mov dword [eax], 0xb26bdde0
jmp 0x1000973b
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
mov dword [eax], 0xffffffe2
jmp 0x100097a3
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x7cc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7cc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
cmp dword [eax], 0x13
jne 0x10009c0d
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0xe54], 0xb88cdf8a
mov dword [ebp - 0xe50], 0xb88cdf8a
mov dword [ebp - 0xe4c], 0xb88cdf8a
mov dword [ebp - 0xe48], 0xb88cdf8a
lea ecx, [ebp - 0x43d]
call fcn.100094a3
push eax
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0xe54]
push eax
lea ecx, [ebp - 0x1178]
call fcn.10018803
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe90]
call fcn.100187b2
mov byte [ebp - 4], 1
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10009847
push 0x1ab7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
cmp dword [eax], 0
je 0x10009a9a
push 4
lea ecx, [ebp - 0xdcc]
call fcn.10018753
mov byte [ebp - 4], 2
mov dword [ebp - 0x78], 0
jmp 0x1000987e
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x10009894
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x1000], 0
jmp 0x10009877
mov dword [ebp - 0x78], 0
jmp 0x100098a4
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x100098c0
push dword [ebp - 0x78]
lea ecx, [ebp - 0xdcc]
call fcn.100187f4
mov dword [eax], 3
jmp 0x1000989d
cmp dword [ebp - 0x14c], 0x73417203
jle 0x100098e8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1000], 0
je 0x100098e8
mov dword [ebp - 0xb54], 1
jmp 0x100098ef
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0xb54], eax
jl 0x1000990f
cmp dword [ebp - 0x14c], 0
jne 0x1000990f
and dword [ebp - 0xc40], 0
jmp 0x10009919
mov dword [ebp - 0xc40], 1
mov eax, 0xc248
test eax, eax
je 0x1000992e
mov dword [ebp - 0xb5c], 1
jmp 0x10009935
and dword [ebp - 0xb5c], 0
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
mov ecx, dword [ebp - 0xb5c]
cmp ecx, dword [eax]
je 0x10009958
mov dword [ebp - 0xb64], 1
jmp 0x1000995f
and dword [ebp - 0xb64], 0
cmp dword [ebp - 0xb64], 0xead9bacc
je 0x10009977
mov dword [ebp - 0x450], 1
jmp 0x1000997e
and dword [ebp - 0x450], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x450]
mov dword [ebp + eax - 0x1000], ecx
cmp dword [ebp - 0x450], 0
jne 0x100099ac
mov eax, 0x9b8fa48a
test eax, eax
jne 0x100099ac
and dword [ebp - 0xb6c], 0
jmp 0x100099b6
mov dword [ebp - 0xb6c], 1
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
mov eax, dword [eax]
cmp eax, dword [ebp - 0xb6c]
jg 0x100099d9
mov dword [ebp - 0xb74], 1
jmp 0x100099e0
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x74], eax
jle 0x10009a00
mov dword [ebp - 0xb7c], 1
jmp 0x10009a07
and dword [ebp - 0xb7c], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0xb7c], eax
jle 0x10009a21
mov dword [ebp - 0xb84], 1
jmp 0x10009a28
and dword [ebp - 0xb84], 0
push 2
lea ecx, [ebp - 0xdcc]
call fcn.100187f4
mov ecx, dword [ebp - 0xb84]
cmp ecx, dword [eax]
jne 0x10009a4b
mov dword [ebp - 0xb8c], 1
jmp 0x10009a52
and dword [ebp - 0xb8c], 0
push 2
lea ecx, [ebp - 0xe90]
call fcn.100187f4
mov ecx, dword [ebp - 0xb8c]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0xdcc]
call fcn.100187f4
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdcc]
call fcn.100187d8
jmp 0x10009bf9
mov dword [ebp - 0xba8], 4
mov dword [ebp - 0x460], 0xb3883faa
mov byte [ebp - 0x12c], 0
movzx eax, byte [ebp - 0x12c]
test eax, eax
je 0x10009acf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp - 0x460]
sub eax, 0x4f34
je 0x10009aef
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10009aef
mov dword [ebp - 0xc80], 1
jmp 0x10009af6
and dword [ebp - 0xc80], 0
cmp dword [ebp - 0x14c], 0xcfde
jne 0x10009b0e
mov dword [ebp - 0xbb0], 1
jmp 0x10009b15
and dword [ebp - 0xbb0], 0
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
mov eax, dword [eax]
mov dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0xba8]
cmp eax, dword [ebp - 0xbb0]
jne 0x10009b44
mov dword [ebp - 0xbb8], 1
jmp 0x10009b4b
and dword [ebp - 0xbb8], 0
mov esi, dword [ebp - 0xbb8]
dec esi
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
cmp esi, dword [eax]
jge 0x10009b6f
mov dword [ebp - 0x458], 1
jmp 0x10009b76
and dword [ebp - 0x458], 0
push 2
lea ecx, [ebp - 0xe90]
call fcn.100187f4
mov ecx, dword [ebp - 0x458]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x458], eax
jge 0x10009ba2
mov dword [ebp - 0xbc0], 1
jmp 0x10009ba9
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0x460]
imul eax, dword [ebp - 0xbc0]
cmp eax, 1
jge 0x10009bc7
mov dword [ebp - 0xbc8], 1
jmp 0x10009bce
and dword [ebp - 0xbc8], 0
cmp dword [ebp - 0xbc8], 0x7e2
jge 0x10009be6
mov dword [ebp - 0xbd0], 1
jmp 0x10009bed
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0x460], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe90]
call fcn.100187d8
jmp 0x1000977f
mov dword [ebp - 0x74], 0xd
jmp 0x10009c1d
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x1d
jle 0x10009dc3
mov dword [ebp - 0x264], 0x7913da51
push 1
lea ecx, [ebp - 0x4f8]
call fcn.10018753
mov byte [ebp - 4], 3
mov dword [ebp - 0xbf8], 0x1ba05761
mov dword [ebp - 0xc88], 0x2ce4
mov dword [ebp - 0x2ec], 0
jmp 0x10009c6f
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 1
jge 0x10009c91
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0x4f8]
call fcn.100187f4
mov dword [eax], 9
jmp 0x10009c62
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0x1090], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0xef6e
jge 0x10009cda
mov dword [ebp - 0xbe0], 1
jmp 0x10009ce1
and dword [ebp - 0xbe0], 0
push 0
lea ecx, [ebp - 0x4f8]
call fcn.100187f4
mov ecx, dword [ebp - 0xbe0]
cmp ecx, dword [eax]
jl 0x10009d04
mov dword [ebp - 0xbe8], 1
jmp 0x10009d0b
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0xbf8]
cmp dword [ebp - 0xbe8], eax
je 0x10009d34
push 0
lea ecx, [ebp - 0x4f8]
call fcn.100187f4
cmp dword [eax], 0
jne 0x10009d34
and dword [ebp - 0xbf0], 0
jmp 0x10009d3e
mov dword [ebp - 0xbf0], 1
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100187f4
mov ecx, dword [ebp - 0xbf0]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x4f8]
call fcn.100187f4
push 0
lea ecx, [ebp - 0x4f8]
call fcn.100187f4
cmp dword [ebp - 0xbf8], 0
jne 0x10009d83
push 0
lea ecx, [ebp - 0x4f8]
call fcn.100187f4
push 0
lea ecx, [ebp - 0x4f8]
call fcn.100187f4
mov esi, dword [ebp - 0x74]
add esi, 0xea0d
push 0
lea ecx, [ebp - 0x4f8]
call fcn.100187f4
imul esi, dword [eax]
mov dword [ebp - 0xc88], esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4f8]
call fcn.100187d8
jmp 0x10009c16
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c4]
call fcn.100187d8
push 4
lea ecx, [ebp - 0x410]
call fcn.10018753
mov dword [ebp - 4], 4
mov dword [ebp - 0x34], 0x37b1891f
push 3
lea ecx, [ebp - 0xe78]
call fcn.10018753
mov byte [ebp - 4], 5
mov dword [ebp - 0x154], 0xffffffff
mov dword [ebp - 0xb94], 0xdedfc3e8
mov dword [ebp - 0xcd4], 0x9e56e623
mov dword [ebp - 0x154], 0
jmp 0x10009e35
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffec
jge 0x1000a052
mov dword [ebp - 0x25c], 7
mov dword [ebp - 0x25c], 9
jmp 0x10009e65
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x17
je 0x1000a04d
mov dword [ebp - 0x194], 0xd3f46721
mov dword [ebp - 0x514], 0x26d8d38
push 3
lea ecx, [ebp - 0xeb4]
call fcn.10018753
mov byte [ebp - 4], 6
mov dword [ebp - 0x348], 0
jmp 0x10009eb0
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 3
jge 0x10009ed2
push dword [ebp - 0x348]
lea ecx, [ebp - 0xeb4]
call fcn.100187f4
mov dword [eax], 0xfffffff9
jmp 0x10009ea3
mov dword [ebp - 0x194], 0x1b
jmp 0x10009eeb
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0x1b
jge 0x1000a039
mov dword [ebp - 0xc00], 0xbb6b
mov dword [ebp - 0xccc], 0x7d19
mov dword [ebp - 0x250], 0
jmp 0x10009f25
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 2
jge 0x10009f41
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x1038], 0x3672d714
jmp 0x10009f18
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0xc00], eax
jne 0x10009f5b
mov dword [ebp - 0x864], 1
jmp 0x10009f62
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0xc00]
cmp dword [ebp - 0x194], eax
jle 0x10009f7c
mov dword [ebp - 0xcc4], 1
jmp 0x10009f83
and dword [ebp - 0xcc4], 0
xor eax, eax
sub eax, dword [ebp - 0x154]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0xccc]
mov dword [ebp - 0x10c0], eax
or eax, 0xffffffff
cmp eax, 0xffffffff
je 0x10009fbd
mov dword [ebp - 0x51c], 1
jmp 0x10009fc4
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x86c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x86c]
mov dword [ebp + eax - 0x1038], ecx
mov eax, dword [ebp - 0x86c]
add eax, dword [ebp - 0x51c]
cmp eax, dword [ebp - 0x194]
je 0x1000a021
push 1
lea ecx, [ebp - 0xeb4]
call fcn.100187f4
cmp dword [eax], 0
je 0x1000a021
mov dword [ebp - 0x874], 1
jmp 0x1000a028
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0xcd4], eax
jmp 0x10009ede
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xeb4]
call fcn.100187d8
jmp 0x10009e58
jmp 0x10009e28
mov dword [ebp - 0xf4c], 0xfffffff6
mov dword [ebp - 0x1014], 0x847dfa86
mov dword [ebp - 0xf54], 0x7bf0b96c
mov dword [ebp - 0x10c8], 0xffffffff
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0xf5c], 0x5043c4ab
mov dword [ebp - 0xce4], 0xedcad208
mov dword [ebp - 0xcdc], 0xc9e53e58
mov dword [ebp - 0xdc], 0x21a3
mov dword [ebp - 0x87c], 0xd9935ff5
mov dword [ebp - 0xcec], 0xd36fbc6a
mov dword [ebp - 0xa4], 0
jmp 0x1000a0d9
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1000a0f5
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xf78], 0xd2703d9b
jmp 0x1000a0cc
mov dword [ebp - 0xa4], 0
jmp 0x1000a10e
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 4
jge 0x1000a12a
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x10d8], 9
jmp 0x1000a101
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x10d8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x10d8], eax
mov dword [ebp - 0x1e0], 0
jmp 0x1000a15e
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jg 0x1000a336
mov dword [ebp - 0x468], 0xb39e
mov dword [ebp - 0x884], 0x2506ed55
mov dword [ebp - 0x470], 6
mov dword [ebp - 0xdc], 0
jmp 0x1000a1a2
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jg 0x1000a1c4
mov dword [ebp - 0x524], 0x7fce
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
jmp 0x1000a195
cmp dword [ebp - 0x468], 0
jne 0x1000a216
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x1024], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0xf64], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x10c4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf78]
mov dword [ebp - 0xf6c], eax
cmp dword [ebp - 0xcdc], 0
jne 0x1000a216
and dword [ebp - 0x52c], 0
jmp 0x1000a220
mov dword [ebp - 0x52c], 1
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0xce4]
cmp dword [ebp - 0x884], eax
je 0x1000a246
mov dword [ebp - 0x534], 1
jmp 0x1000a24d
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0xcec]
cmp dword [ebp - 0x534], eax
jne 0x1000a267
mov dword [ebp - 0x88c], 1
jmp 0x1000a26e
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x88c], eax
jge 0x1000a288
mov dword [ebp - 0x53c], 1
jmp 0x1000a28f
and dword [ebp - 0x53c], 0
imul eax, dword [ebp - 0x468], 0x3f29
cmp eax, dword [ebp - 0x53c]
jge 0x1000a2ad
mov dword [ebp - 0x894], 1
jmp 0x1000a2b4
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0
je 0x1000a2f8
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x1000a2e8
push 0x90a
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
cmp dword [ebp - 0x470], 0
je 0x1000a2f6
jmp 0x1000a151
jmp 0x1000a331
mov dword [ebp - 0xcf4], 4
mov dword [ebp - 0xdc], 0xfffffff8
jmp 0x1000a31b
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xfffffffd
jg 0x1000a331
cmp dword [ebp - 0xcf4], 0
je 0x1000a32f
jmp 0x1000a331
jmp 0x1000a30e
jmp 0x1000a151
mov dword [ebp - 0xfa4], 0xfffffffc
mov dword [ebp - 0x2f8], 0xf5540d7f
mov dword [ebp - 0xfac], 0xdce9d05b
mov dword [ebp - 0x2f8], 0
jmp 0x1000a36d
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0
jl 0x1000a3a0
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x1000a39e
push 0
push 0
push 0x17fd
push 0x7b3
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x1000a360
mov dword [ebp - 0x5a4], 0xffffffff
mov dword [ebp - 0x15c], 0xfffffffd
mov dword [ebp - 0x10b0], 0
mov dword [ebp - 0x258], 0
jmp 0x1000a3d7
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jge 0x1000a3f3
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x10a8], 0x8948
jmp 0x1000a3ca
mov dword [ebp - 0x15c], 0
jmp 0x1000a40c
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jg 0x1000a443
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x1000a42f
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov eax, dword [ebp - 0x15c]
cmp dword [ebp + eax*4 - 0x10a8], 0
je 0x1000a441
jmp 0x1000a443
jmp 0x1000a3ff
mov dword [ebp - 0x15c], 9
mov dword [ebp - 0xfb4], 0xd1d4
mov dword [ebp - 0x106c], 0x847dfa86
mov dword [ebp - 0xfbc], 0x7bf0b96c
mov dword [ebp - 0x1098], 0xffffffff
mov dword [ebp - 0x220], 0
mov dword [ebp - 0xfc4], 0x5043c4ab
mov dword [ebp - 0xd04], 0xedcad208
mov dword [ebp - 0xcfc], 0xc9e53e58
mov dword [ebp - 0xd8], 0x21a3
mov dword [ebp - 0x89c], 0xd9935ff5
mov dword [ebp - 0xd0c], 0xd36fbc6a
mov dword [ebp - 0x7c], 0
jmp 0x1000a4cb
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1000a4e1
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xf84], 0xd2703d9b
jmp 0x1000a4c4
mov dword [ebp - 0x7c], 0
jmp 0x1000a4f1
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x1000a507
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x1168], 9
jmp 0x1000a4ea
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1168]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1168], eax
mov dword [ebp - 0x220], 0
jmp 0x1000a53b
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jg 0x1000a713
mov dword [ebp - 0x478], 0xb39e
mov dword [ebp - 0x8a4], 0x2506ed55
mov dword [ebp - 0x480], 6
mov dword [ebp - 0xd8], 0
jmp 0x1000a57f
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jg 0x1000a5a1
mov dword [ebp - 0x544], 0x7fce
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
jmp 0x1000a572
cmp dword [ebp - 0x478], 0
jne 0x1000a5f3
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x107c], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0xfcc], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x10a0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf84]
mov dword [ebp - 0xfd4], eax
cmp dword [ebp - 0xcfc], 0
jne 0x1000a5f3
and dword [ebp - 0x54c], 0
jmp 0x1000a5fd
mov dword [ebp - 0x54c], 1
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0xd04]
cmp dword [ebp - 0x8a4], eax
je 0x1000a623
mov dword [ebp - 0x554], 1
jmp 0x1000a62a
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0xd0c]
cmp dword [ebp - 0x554], eax
jne 0x1000a644
mov dword [ebp - 0x8ac], 1
jmp 0x1000a64b
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x478]
cmp dword [ebp - 0x8ac], eax
jge 0x1000a665
mov dword [ebp - 0x55c], 1
jmp 0x1000a66c
and dword [ebp - 0x55c], 0
imul eax, dword [ebp - 0x478], 0x3f29
cmp eax, dword [ebp - 0x55c]
jge 0x1000a68a
mov dword [ebp - 0x8b4], 1
jmp 0x1000a691
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x1000a6d5
mov byte [ebp - 0x130], 0
movzx eax, byte [ebp - 0x130]
test eax, eax
je 0x1000a6c5
push 0x90a
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
cmp dword [ebp - 0x480], 0
je 0x1000a6d3
jmp 0x1000a52e
jmp 0x1000a70e
mov dword [ebp - 0xd14], 4
mov dword [ebp - 0xd8], 0xfffffff8
jmp 0x1000a6f8
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xfffffffd
jg 0x1000a70e
cmp dword [ebp - 0xd14], 0
je 0x1000a70c
jmp 0x1000a70e
jmp 0x1000a6eb
jmp 0x1000a52e
mov dword [ebp - 0x24], 0
jmp 0x1000a723
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1000a73f
push dword [ebp - 0x24]
lea ecx, [ebp - 0x410]
call fcn.100187f4
mov dword [eax], 0x824a8c6a
jmp 0x1000a71c
mov dword [ebp - 0x24], 0
jmp 0x1000a74f
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000a765
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc30], 0x6ccb0362
jmp 0x1000a748
mov dword [ebp - 0x24], 0
jmp 0x1000a775
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000a791
push dword [ebp - 0x24]
lea ecx, [ebp - 0xe78]
call fcn.100187f4
mov dword [eax], 8
jmp 0x1000a76e
push 2
lea ecx, [ebp - 0x410]
call fcn.100187f4
and dword [eax], 0
jmp 0x1000a7c7
push 2
lea ecx, [ebp - 0x410]
call fcn.100187f4
mov dword [ebp - 0x564], eax
mov eax, dword [ebp - 0x564]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x564]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x410]
call fcn.100187f4
cmp dword [eax], 0x1c
je 0x1000abce
push 2
lea ecx, [ebp - 0x4b8]
call fcn.10018753
mov byte [ebp - 4], 7
mov dword [ebp - 0x8cc], 0xa1a8
mov dword [ebp - 0x8ec], 5
mov dword [ebp - 0x8f4], 0xffffffff
mov dword [ebp - 0x388], 0
jmp 0x1000a825
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 2
jge 0x1000a847
push dword [ebp - 0x388]
lea ecx, [ebp - 0x4b8]
call fcn.100187f4
mov dword [eax], 0xd225
jmp 0x1000a818
push 1
lea ecx, [ebp - 0x4b8]
call fcn.100187f4
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x8bc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x8bc]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x4b8]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x410]
call fcn.100187f4
push 0
lea ecx, [ebp - 0x4b8]
call fcn.100187f4
cmp dword [eax], 0
je 0x1000a8eb
mov esi, dword [ebp - 0x8cc]
push 0
lea ecx, [ebp - 0x4b8]
call fcn.100187f4
cmp esi, dword [eax]
jge 0x1000a8ba
mov dword [ebp - 0x56c], 1
jmp 0x1000a8c1
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x56c], eax
je 0x1000a8d8
mov dword [ebp - 0x8c4], 1
jmp 0x1000a8df
and dword [ebp - 0x8c4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc30]
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xc30]
add eax, dword [ebp + ecx - 0xc30]
mov dword [ebp - 0x574], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x574]
mov dword [ebp + eax - 0xc30], ecx
cmp dword [ebp - 0x574], 0
jne 0x1000a938
cmp dword [ebp - 0x8cc], 0
jne 0x1000a938
and dword [ebp - 0x57c], 0
jmp 0x1000a942
mov dword [ebp - 0x57c], 1
mov esi, dword [ebp - 0x34]
shl esi, 2
push 1
lea ecx, [ebp - 0x4b8]
call fcn.100187f4
cmp esi, dword [eax]
jle 0x1000a965
mov dword [ebp - 0x8d4], 1
jmp 0x1000a96c
and dword [ebp - 0x8d4], 0
push 1
lea ecx, [ebp - 0x4b8]
call fcn.100187f4
mov ecx, dword [ebp - 0x8d4]
cmp ecx, dword [eax]
jne 0x1000a98f
mov dword [ebp - 0x584], 1
jmp 0x1000a996
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x34], eax
mov esi, dword [ebp - 0x34]
push 2
lea ecx, [ebp - 0x410]
call fcn.100187f4
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x410]
call fcn.100187f4
cmp esi, dword [eax]
jg 0x1000a9cf
mov dword [ebp - 0x8dc], 1
jmp 0x1000a9d6
and dword [ebp - 0x8dc], 0
push 2
lea ecx, [ebp - 0x410]
call fcn.100187f4
mov ecx, dword [ebp - 0x8dc]
cmp ecx, dword [eax]
je 0x1000a9f9
mov dword [ebp - 0xd1c], 1
jmp 0x1000aa00
and dword [ebp - 0xd1c], 0
push 2
lea ecx, [ebp - 0x410]
call fcn.100187f4
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0xc30]
push 1
lea ecx, [ebp - 0x410]
call fcn.100187f4
cmp esi, dword [eax]
jle 0x1000aa36
mov dword [ebp - 0x58c], 1
jmp 0x1000aa3d
and dword [ebp - 0x58c], 0
cmp dword [ebp - 0x58c], 0xfffffff9
jg 0x1000aa52
mov dword [ebp - 0x8e4], 1
jmp 0x1000aa59
and dword [ebp - 0x8e4], 0
cmp dword [ebp - 0x8e4], 6
jbe 0x1000ab4b
mov dword [ebp - 0x260], 6
mov esi, dword [ebp - 0x260]
push 0
lea ecx, [ebp - 0x410]
call fcn.100187f4
add esi, dword [eax]
jne 0x1000aaa2
cmp dword [ebp - 0x260], 0
jne 0x1000aaa2
cmp dword [ebp - 0x260], 0
jne 0x1000aaa2
and dword [ebp - 0x594], 0
jmp 0x1000aaac
mov dword [ebp - 0x594], 1
push 1
lea ecx, [ebp - 0x4b8]
call fcn.100187f4
mov esi, dword [ebp - 0x594]
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0xe78]
call fcn.100187f4
cmp esi, dword [eax]
jne 0x1000aade
mov dword [ebp - 0xd24], 1
jmp 0x1000aae5
and dword [ebp - 0xd24], 0
mov esi, dword [ebp - 0x260]
push 0
lea ecx, [ebp - 0x4b8]
call fcn.100187f4
imul esi, dword [eax]
mov dword [ebp - 0x8ec], esi
mov esi, dword [ebp - 0x8ec]
push 1
lea ecx, [ebp - 0x4b8]
call fcn.100187f4
cmp esi, dword [eax]
jle 0x1000ab24
mov dword [ebp - 0x59c], 1
jmp 0x1000ab2b
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x8f4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8f4]
mov dword [ebp + eax - 0xc30], ecx
jmp 0x1000abba
mov dword [ebp - 0x34], 0xfffffffc
jmp 0x1000ab5b
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff6
jle 0x1000ab81
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1000ab7f
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x1000ab54
mov dword [ebp - 0x34], 0xb
jmp 0x1000ab91
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x19
jle 0x1000abba
mov byte [ebp - 0x132], 0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x1000abb8
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x1000ab8a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4b8]
call fcn.100187d8
jmp 0x1000a7a3
mov eax, dword [ebp - 0x5a4]
inc eax
mov dword [ebp - 0x5a4], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xe78]
call fcn.100187d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call fcn.100187d8
push 4
lea ecx, [ebp - 0x41c]
call fcn.10018753
mov dword [ebp - 4], 8
mov dword [ebp - 0x4c], 0x37b1891f
push 3
lea ecx, [ebp - 0xe9c]
call fcn.10018753
mov byte [ebp - 4], 9
mov dword [ebp - 0x1084], 0xfffffff6
mov dword [ebp - 0xef8], 0xfffffffc
mov dword [ebp - 0x93c], 0xffffffff
mov dword [ebp - 0xf00], 0xd1d4
mov dword [ebp - 0x2c], 0
jmp 0x1000ac5d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1000ac79
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x41c]
call fcn.100187f4
mov dword [eax], 0x824a8c6a
jmp 0x1000ac56
mov dword [ebp - 0x2c], 0
jmp 0x1000ac89
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000ac9f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc18], 0x6ccb0362
jmp 0x1000ac82
mov dword [ebp - 0x2c], 0
jmp 0x1000acaf
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000accb
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xe9c]
call fcn.100187f4
mov dword [eax], 8
jmp 0x1000aca8
push 2
lea ecx, [ebp - 0x41c]
call fcn.100187f4
and dword [eax], 0
jmp 0x1000ad01
push 2
lea ecx, [ebp - 0x41c]
call fcn.100187f4
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x8fc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x8fc]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x41c]
call fcn.100187f4
cmp dword [eax], 0x1c
je 0x1000b108
push 2
lea ecx, [ebp - 0x4c8]
call fcn.10018753
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x5bc], 0xa1a8
mov dword [ebp - 0x5dc], 5
mov dword [ebp - 0x5e4], 0xffffffff
mov dword [ebp - 0x300], 0
jmp 0x1000ad5f
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 2
jge 0x1000ad81
push dword [ebp - 0x300]
lea ecx, [ebp - 0x4c8]
call fcn.100187f4
mov dword [eax], 0xd225
jmp 0x1000ad52
push 1
lea ecx, [ebp - 0x4c8]
call fcn.100187f4
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5ac]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x4c8]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x41c]
call fcn.100187f4
push 0
lea ecx, [ebp - 0x4c8]
call fcn.100187f4
cmp dword [eax], 0
je 0x1000ae25
mov esi, dword [ebp - 0x5bc]
push 0
lea ecx, [ebp - 0x4c8]
call fcn.100187f4
cmp esi, dword [eax]
jge 0x1000adf4
mov dword [ebp - 0x904], 1
jmp 0x1000adfb
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x904], eax
je 0x1000ae12
mov dword [ebp - 0x5b4], 1
jmp 0x1000ae19
and dword [ebp - 0x5b4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc18]
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xc18]
add eax, dword [ebp + ecx - 0xc18]
mov dword [ebp - 0x90c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x90c]
mov dword [ebp + eax - 0xc18], ecx
cmp dword [ebp - 0x90c], 0
jne 0x1000ae72
cmp dword [ebp - 0x5bc], 0
jne 0x1000ae72
and dword [ebp - 0x914], 0
jmp 0x1000ae7c
mov dword [ebp - 0x914], 1
mov esi, dword [ebp - 0x4c]
shl esi, 2
push 1
lea ecx, [ebp - 0x4c8]
call fcn.100187f4
cmp esi, dword [eax]
jle 0x1000ae9f
mov dword [ebp - 0x5c4], 1
jmp 0x1000aea6
and dword [ebp - 0x5c4], 0
push 1
lea ecx, [ebp - 0x4c8]
call fcn.100187f4
mov ecx, dword [ebp - 0x5c4]
cmp ecx, dword [eax]
jne 0x1000aec9
mov dword [ebp - 0x91c], 1
jmp 0x1000aed0
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x4c], eax
mov esi, dword [ebp - 0x4c]
push 2
lea ecx, [ebp - 0x41c]
call fcn.100187f4
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x41c]
call fcn.100187f4
cmp esi, dword [eax]
jg 0x1000af09
mov dword [ebp - 0x5cc], 1
jmp 0x1000af10
and dword [ebp - 0x5cc], 0
push 2
lea ecx, [ebp - 0x41c]
call fcn.100187f4
mov ecx, dword [ebp - 0x5cc]
cmp ecx, dword [eax]
je 0x1000af33
mov dword [ebp - 0xd2c], 1
jmp 0x1000af3a
and dword [ebp - 0xd2c], 0
push 2
lea ecx, [ebp - 0x41c]
call fcn.100187f4
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0xc18]
push 1
lea ecx, [ebp - 0x41c]
call fcn.100187f4
cmp esi, dword [eax]
jle 0x1000af70
mov dword [ebp - 0x924], 1
jmp 0x1000af77
and dword [ebp - 0x924], 0
cmp dword [ebp - 0x924], 0xfffffff9
jg 0x1000af8c
mov dword [ebp - 0x5d4], 1
jmp 0x1000af93
and dword [ebp - 0x5d4], 0
cmp dword [ebp - 0x5d4], 6
jbe 0x1000b085
mov dword [ebp - 0x268], 6
mov esi, dword [ebp - 0x268]
push 0
lea ecx, [ebp - 0x41c]
call fcn.100187f4
add esi, dword [eax]
jne 0x1000afdc
cmp dword [ebp - 0x268], 0
jne 0x1000afdc
cmp dword [ebp - 0x268], 0
jne 0x1000afdc
and dword [ebp - 0x92c], 0
jmp 0x1000afe6
mov dword [ebp - 0x92c], 1
push 1
lea ecx, [ebp - 0x4c8]
call fcn.100187f4
mov esi, dword [ebp - 0x92c]
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0xe9c]
call fcn.100187f4
cmp esi, dword [eax]
jne 0x1000b018
mov dword [ebp - 0xd34], 1
jmp 0x1000b01f
and dword [ebp - 0xd34], 0
mov esi, dword [ebp - 0x268]
push 0
lea ecx, [ebp - 0x4c8]
call fcn.100187f4
imul esi, dword [eax]
mov dword [ebp - 0x5dc], esi
mov esi, dword [ebp - 0x5dc]
push 1
lea ecx, [ebp - 0x4c8]
call fcn.100187f4
cmp esi, dword [eax]
jle 0x1000b05e
mov dword [ebp - 0x934], 1
jmp 0x1000b065
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x5e4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5e4]
mov dword [ebp + eax - 0xc18], ecx
jmp 0x1000b0f4
mov dword [ebp - 0x4c], 0xfffffffc
jmp 0x1000b095
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffff6
jle 0x1000b0bb
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1000b0b9
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x1000b08e
mov dword [ebp - 0x4c], 0xb
jmp 0x1000b0cb
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x19
jle 0x1000b0f4
mov byte [ebp - 0x134], 0
movzx eax, byte [ebp - 0x134]
test eax, eax
je 0x1000b0f2
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x1000b0c4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4c8]
call fcn.100187d8
jmp 0x1000acdd
mov eax, dword [ebp - 0x93c]
inc eax
mov dword [ebp - 0x93c], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe9c]
call fcn.100187d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x41c]
call fcn.100187d8
push 4
lea ecx, [ebp - 0x404]
call fcn.10018753
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x44], 0x37b1891f
push 3
lea ecx, [ebp - 0xe60]
call fcn.10018753
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xf08], 0xfffffff6
mov dword [ebp - 0xf10], 0xfffffffc
mov dword [ebp - 0x62c], 0xffffffff
mov dword [ebp - 0xf18], 0xd1d4
mov dword [ebp - 0x20], 0
jmp 0x1000b197
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000b1b3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x404]
call fcn.100187f4
mov dword [eax], 0x824a8c6a
jmp 0x1000b190
mov dword [ebp - 0x20], 0
jmp 0x1000b1c3
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000b1d9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc24], 0x6ccb0362
jmp 0x1000b1bc
mov dword [ebp - 0x20], 0
jmp 0x1000b1e9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000b205
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe60]
call fcn.100187f4
mov dword [eax], 8
jmp 0x1000b1e2
push 2
lea ecx, [ebp - 0x404]
call fcn.100187f4
and dword [eax], 0
jmp 0x1000b23b
push 2
lea ecx, [ebp - 0x404]
call fcn.100187f4
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5ec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5ec]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x404]
call fcn.100187f4
cmp dword [eax], 0x1c
je 0x1000b642
push 2
lea ecx, [ebp - 0x428]
call fcn.10018753
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x954], 0xa1a8
mov dword [ebp - 0x974], 5
mov dword [ebp - 0x97c], 0xffffffff
mov dword [ebp - 0x350], 0
jmp 0x1000b299
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 2
jge 0x1000b2bb
push dword [ebp - 0x350]
lea ecx, [ebp - 0x428]
call fcn.100187f4
mov dword [eax], 0xd225
jmp 0x1000b28c
push 1
lea ecx, [ebp - 0x428]
call fcn.100187f4
mov dword [ebp - 0x944], eax
mov eax, dword [ebp - 0x944]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x944]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x428]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x404]
call fcn.100187f4
push 0
lea ecx, [ebp - 0x428]
call fcn.100187f4
cmp dword [eax], 0
je 0x1000b35f
mov esi, dword [ebp - 0x954]
push 0
lea ecx, [ebp - 0x428]
call fcn.100187f4
cmp esi, dword [eax]
jge 0x1000b32e
mov dword [ebp - 0x5f4], 1
jmp 0x1000b335
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x5f4], eax
je 0x1000b34c
mov dword [ebp - 0x94c], 1
jmp 0x1000b353
and dword [ebp - 0x94c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc24]
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xc24]
add eax, dword [ebp + ecx - 0xc24]
mov dword [ebp - 0x5fc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5fc]
mov dword [ebp + eax - 0xc24], ecx
cmp dword [ebp - 0x5fc], 0
jne 0x1000b3ac
cmp dword [ebp - 0x954], 0
jne 0x1000b3ac
and dword [ebp - 0x604], 0
jmp 0x1000b3b6
mov dword [ebp - 0x604], 1
mov esi, dword [ebp - 0x44]
shl esi, 2
push 1
lea ecx, [ebp - 0x428]
call fcn.100187f4
cmp esi, dword [eax]
jle 0x1000b3d9
mov dword [ebp - 0x95c], 1
jmp 0x1000b3e0
and dword [ebp - 0x95c], 0
push 1
lea ecx, [ebp - 0x428]
call fcn.100187f4
mov ecx, dword [ebp - 0x95c]
cmp ecx, dword [eax]
jne 0x1000b403
mov dword [ebp - 0x60c], 1
jmp 0x1000b40a
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x44]
push 2
lea ecx, [ebp - 0x404]
call fcn.100187f4
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x404]
call fcn.100187f4
cmp esi, dword [eax]
jg 0x1000b443
mov dword [ebp - 0x964], 1
jmp 0x1000b44a
and dword [ebp - 0x964], 0
push 2
lea ecx, [ebp - 0x404]
call fcn.100187f4
mov ecx, dword [ebp - 0x964]
cmp ecx, dword [eax]
je 0x1000b46d
mov dword [ebp - 0xd3c], 1
jmp 0x1000b474
and dword [ebp - 0xd3c], 0
push 2
lea ecx, [ebp - 0x404]
call fcn.100187f4
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0xc24]
push 1
lea ecx, [ebp - 0x404]
call fcn.100187f4
cmp esi, dword [eax]
jle 0x1000b4aa
mov dword [ebp - 0x614], 1
jmp 0x1000b4b1
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0xfffffff9
jg 0x1000b4c6
mov dword [ebp - 0x96c], 1
jmp 0x1000b4cd
and dword [ebp - 0x96c], 0
cmp dword [ebp - 0x96c], 6
jbe 0x1000b5bf
mov dword [ebp - 0x270], 6
mov esi, dword [ebp - 0x270]
push 0
lea ecx, [ebp - 0x404]
call fcn.100187f4
add esi, dword [eax]
jne 0x1000b516
cmp dword [ebp - 0x270], 0
jne 0x1000b516
cmp dword [ebp - 0x270], 0
jne 0x1000b516
and dword [ebp - 0x61c], 0
jmp 0x1000b520
mov dword [ebp - 0x61c], 1
push 1
lea ecx, [ebp - 0x428]
call fcn.100187f4
mov esi, dword [ebp - 0x61c]
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0xe60]
call fcn.100187f4
cmp esi, dword [eax]
jne 0x1000b552
mov dword [ebp - 0xd44], 1
jmp 0x1000b559
and dword [ebp - 0xd44], 0
mov esi, dword [ebp - 0x270]
push 0
lea ecx, [ebp - 0x428]
call fcn.100187f4
imul esi, dword [eax]
mov dword [ebp - 0x974], esi
mov esi, dword [ebp - 0x974]
push 1
lea ecx, [ebp - 0x428]
call fcn.100187f4
cmp esi, dword [eax]
jle 0x1000b598
mov dword [ebp - 0x624], 1
jmp 0x1000b59f
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x97c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x97c]
mov dword [ebp + eax - 0xc24], ecx
jmp 0x1000b62e
mov dword [ebp - 0x44], 0xfffffffc
jmp 0x1000b5cf
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffff6
jle 0x1000b5f5
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1000b5f3
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x1000b5c8
mov dword [ebp - 0x44], 0xb
jmp 0x1000b605
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x19
jle 0x1000b62e
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x1000b62c
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x1000b5fe
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x428]
call fcn.100187d8
jmp 0x1000b217
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xe60]
call fcn.100187d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x404]
call fcn.100187d8
mov dword [ebp - 0x1b4], 0x7f6af112
mov dword [ebp - 0x644], 8
mov dword [ebp - 0x308], 0
jmp 0x1000b69a
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jge 0x1000b6b6
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0xe1c], 0xa75c
jmp 0x1000b68d
mov dword [ebp - 0x1b4], 0
jmp 0x1000b6cf
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0x19
jle 0x1000b854
mov dword [ebp - 0x278], 0xdd3f4672
mov dword [ebp - 0x984], 0x22db785b
mov dword [ebp - 0xd4c], 0x5429
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1000b714
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov dword [ebp - 0x278], 1
jmp 0x1000b72d
mov eax, dword [ebp - 0x278]
dec eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
jl 0x1000b84f
mov dword [ebp - 0x378], 0
jmp 0x1000b753
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 3
jge 0x1000b76f
mov eax, dword [ebp - 0x378]
mov dword [ebp + eax*4 - 0x1010], 0xb04800fa
jmp 0x1000b746
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1010]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1010], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x984], eax
cmp dword [ebp - 0x984], 0xafa3
jge 0x1000b7ae
mov dword [ebp - 0x634], 1
jmp 0x1000b7b5
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x634], eax
jl 0x1000b7cf
mov dword [ebp - 0x98c], 1
jmp 0x1000b7d6
and dword [ebp - 0x98c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe1c]
add eax, dword [ebp - 0x98c]
je 0x1000b807
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe1c], 0
je 0x1000b807
mov dword [ebp - 0x63c], 1
jmp 0x1000b80e
and dword [ebp - 0x63c], 0
imul eax, dword [ebp - 0x63c], 0x226c
cmp eax, 0xd238
je 0x1000b82b
mov dword [ebp - 0x994], 1
jmp 0x1000b832
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0xd4c], eax
jmp 0x1000b720
jmp 0x1000b6c2
mov byte [ebp - 0x138], 0
movzx eax, byte [ebp - 0x138]
test eax, eax
je 0x1000b86e
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x280], 0xad313dd3
mov dword [ebp - 0x280], 8
jmp 0x1000b891
mov eax, dword [ebp - 0x280]
dec eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xfffffff6
jge 0x1000b8f6
mov dword [ebp - 0x310], 0xffffffff
mov dword [ebp - 0xd54], 0xfffffffc
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1000b8c6
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebp - 0x310], 0
jmp 0x1000b8df
mov eax, dword [ebp - 0x310]
dec eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0xffffffeb
jl 0x1000b8f4
mov dword [ebp - 0xd54], 1
jmp 0x1000b8d2
jmp 0x1000b884
mov dword [ebp - 0x164], 0x7f6af112
mov dword [ebp - 0x65c], 8
mov dword [ebp - 0x288], 0
jmp 0x1000b923
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x1000b93f
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0xe2c], 0xa75c
jmp 0x1000b916
mov dword [ebp - 0x164], 0
jmp 0x1000b958
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x19
jle 0x1000badd
mov dword [ebp - 0x358], 0xdd3f4672
mov dword [ebp - 0x99c], 0x22db785b
mov dword [ebp - 0xd5c], 0x5429
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x1000b99d
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov dword [ebp - 0x358], 1
jmp 0x1000b9b6
mov eax, dword [ebp - 0x358]
dec eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
jl 0x1000bad8
mov dword [ebp - 0x290], 0
jmp 0x1000b9dc
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x1000b9f8
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x1020], 0xb04800fa
jmp 0x1000b9cf
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1020]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1020], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x99c], eax
cmp dword [ebp - 0x99c], 0xafa3
jge 0x1000ba37
mov dword [ebp - 0x64c], 1
jmp 0x1000ba3e
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x64c], eax
jl 0x1000ba58
mov dword [ebp - 0x9a4], 1
jmp 0x1000ba5f
and dword [ebp - 0x9a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe2c]
add eax, dword [ebp - 0x9a4]
je 0x1000ba90
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe2c], 0
je 0x1000ba90
mov dword [ebp - 0x654], 1
jmp 0x1000ba97
and dword [ebp - 0x654], 0
imul eax, dword [ebp - 0x654], 0x226c
cmp eax, 0xd238
je 0x1000bab4
mov dword [ebp - 0x9ac], 1
jmp 0x1000babb
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0xd5c], eax
jmp 0x1000b9a9
jmp 0x1000b94b
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1000baf7
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x19c], 0x7f6af112
mov dword [ebp - 0x674], 8
mov dword [ebp - 0x318], 0
jmp 0x1000bb24
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 2
jge 0x1000bb40
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0xe24], 0xa75c
jmp 0x1000bb17
mov dword [ebp - 0x19c], 0
jmp 0x1000bb59
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0x19
jle 0x1000bcde
mov dword [ebp - 0x298], 0xdd3f4672
mov dword [ebp - 0x9b4], 0x22db785b
mov dword [ebp - 0xd64], 0x5429
mov byte [ebp - 0x13c], 0
movzx eax, byte [ebp - 0x13c]
test eax, eax
je 0x1000bb9e
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov dword [ebp - 0x298], 1
jmp 0x1000bbb7
mov eax, dword [ebp - 0x298]
dec eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jl 0x1000bcd9
mov dword [ebp - 0x3a0], 0
jmp 0x1000bbdd
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 3
jge 0x1000bbf9
mov eax, dword [ebp - 0x3a0]
mov dword [ebp + eax*4 - 0x1030], 0xb04800fa
jmp 0x1000bbd0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1030]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1030], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x9b4], eax
cmp dword [ebp - 0x9b4], 0xafa3
jge 0x1000bc38
mov dword [ebp - 0x664], 1
jmp 0x1000bc3f
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x664], eax
jl 0x1000bc59
mov dword [ebp - 0x9bc], 1
jmp 0x1000bc60
and dword [ebp - 0x9bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe24]
add eax, dword [ebp - 0x9bc]
je 0x1000bc91
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe24], 0
je 0x1000bc91
mov dword [ebp - 0x66c], 1
jmp 0x1000bc98
and dword [ebp - 0x66c], 0
imul eax, dword [ebp - 0x66c], 0x226c
cmp eax, 0xd238
je 0x1000bcb5
mov dword [ebp - 0x9c4], 1
jmp 0x1000bcbc
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0xd64], eax
jmp 0x1000bbaa
jmp 0x1000bb4c
mov byte [ebp - 0x137], 0
movzx eax, byte [ebp - 0x137]
test eax, eax
je 0x1000bcf8
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x16c], 1
mov dword [ebp - 0x9e4], 0x38591b68
mov dword [ebp - 0x2a0], 0
jmp 0x1000bd25
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 4
jge 0x1000bd41
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x10f8], 0
jmp 0x1000bd18
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x16c], 0
jmp 0x1000bd67
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jg 0x1000bfde
mov dword [ebp - 0xbc], 1
mov dword [ebp - 0x1c4], 0xffffffff
mov dword [ebp - 0xbc], 0
jmp 0x1000bda1
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jg 0x1000bfd9
mov dword [ebp - 0x174], 0x5bfc88eb
mov dword [ebp - 0x1e8], 0x15169ff4
mov dword [ebp - 0x320], 0
jmp 0x1000bddb
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 2
jge 0x1000bdf7
mov eax, dword [ebp - 0x320]
mov dword [ebp + eax*4 - 0xc94], 1
jmp 0x1000bdce
cmp dword [ebp - 0xbc], 0xf871
jl 0x1000be0f
mov dword [ebp - 0x9cc], 1
jmp 0x1000be16
and dword [ebp - 0x9cc], 0
cmp dword [ebp - 0x9cc], 0xd5feaf86
je 0x1000be2e
mov dword [ebp - 0x67c], 1
jmp 0x1000be35
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 0xffff
jbe 0x1000be4d
mov dword [ebp - 0x9d4], 1
jmp 0x1000be54
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp + eax*4 - 0x10f8]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xc94]
cmp eax, dword [ebp - 0x9d4]
jne 0x1000be83
mov dword [ebp - 0x684], 1
jmp 0x1000be8a
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x684], eax
jg 0x1000bea4
mov dword [ebp - 0x9dc], 1
jmp 0x1000beab
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x9dc]
neg ecx
cmp dword [ebp + eax*4 - 0x10f8], ecx
jg 0x1000bece
mov dword [ebp - 0x68c], 1
jmp 0x1000bed5
and dword [ebp - 0x68c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc94]
imul eax, dword [ebp - 0x68c]
test eax, eax
je 0x1000bef6
cmp dword [ebp - 0xbc], 0
jne 0x1000bf0f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc94], 0
jne 0x1000bf0f
and dword [ebp - 0x694], 0
jmp 0x1000bf19
mov dword [ebp - 0x694], 1
mov dword [ebp - 0x174], 2
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x9e4], eax
mov eax, dword [ebp - 0x9e4]
imul eax, dword [ebp - 0x694]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1c4], 3
jmp 0x1000bf67
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jl 0x1000bfd4
mov dword [ebp - 0x174], 0
jmp 0x1000bf89
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jg 0x1000bfd2
mov dword [ebp - 0x1e8], 3
jmp 0x1000bfab
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x1000bfd0
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1000bfce
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1000bf9e
jmp 0x1000bf7c
jmp 0x1000bf5a
jmp 0x1000bd94
jmp 0x1000bd5a
mov dword [ebp - 0x2a8], 0xad313dd3
mov dword [ebp - 0x2a8], 8
jmp 0x1000c001
mov eax, dword [ebp - 0x2a8]
dec eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0xfffffff6
jge 0x1000c066
mov dword [ebp - 0x360], 0xffffffff
mov dword [ebp - 0xd6c], 0xfffffffc
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x1000c036
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebp - 0x360], 0
jmp 0x1000c04f
mov eax, dword [ebp - 0x360]
dec eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0xffffffeb
jl 0x1000c064
mov dword [ebp - 0xd6c], 1
jmp 0x1000c042
jmp 0x1000bff4
mov dword [ebp - 0x1a4], 1
mov dword [ebp - 0xa04], 0x38591b68
mov dword [ebp - 0x2b0], 0
jmp 0x1000c093
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 4
jge 0x1000c0af
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x1138], 0
jmp 0x1000c086
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a4], 0
jmp 0x1000c0d5
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jg 0x1000c34c
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x17c], 0xffffffff
mov dword [ebp - 0x84], 0
jmp 0x1000c10f
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jg 0x1000c347
mov dword [ebp - 0x1bc], 0x5bfc88eb
mov dword [ebp - 0x208], 0x15169ff4
mov dword [ebp - 0x328], 0
jmp 0x1000c149
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 2
jge 0x1000c165
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0xc48], 1
jmp 0x1000c13c
cmp dword [ebp - 0x84], 0xf871
jl 0x1000c17d
mov dword [ebp - 0x9ec], 1
jmp 0x1000c184
and dword [ebp - 0x9ec], 0
cmp dword [ebp - 0x9ec], 0xd5feaf86
je 0x1000c19c
mov dword [ebp - 0x69c], 1
jmp 0x1000c1a3
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 0xffff
jbe 0x1000c1bb
mov dword [ebp - 0x9f4], 1
jmp 0x1000c1c2
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0x1138]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xc48]
cmp eax, dword [ebp - 0x9f4]
jne 0x1000c1f1
mov dword [ebp - 0x6a4], 1
jmp 0x1000c1f8
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x6a4], eax
jg 0x1000c212
mov dword [ebp - 0x9fc], 1
jmp 0x1000c219
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x9fc]
neg ecx
cmp dword [ebp + eax*4 - 0x1138], ecx
jg 0x1000c23c
mov dword [ebp - 0x6ac], 1
jmp 0x1000c243
and dword [ebp - 0x6ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc48]
imul eax, dword [ebp - 0x6ac]
test eax, eax
je 0x1000c264
cmp dword [ebp - 0x84], 0
jne 0x1000c27d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc48], 0
jne 0x1000c27d
and dword [ebp - 0x6b4], 0
jmp 0x1000c287
mov dword [ebp - 0x6b4], 1
mov dword [ebp - 0x1bc], 2
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0xa04]
imul eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x17c], 3
jmp 0x1000c2d5
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x1000c342
mov dword [ebp - 0x1bc], 0
jmp 0x1000c2f7
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jg 0x1000c340
mov dword [ebp - 0x208], 3
jmp 0x1000c319
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jl 0x1000c33e
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1000c33c
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1000c30c
jmp 0x1000c2ea
jmp 0x1000c2c8
jmp 0x1000c102
jmp 0x1000c0c8
push 2
lea ecx, [ebp - 0x39c]
call fcn.10018753
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x184], 0xffffffff
mov dword [ebp - 0x6cc], 4
mov dword [ebp - 0x2b8], 0
jmp 0x1000c397
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 2
jge 0x1000c3b9
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
mov dword [eax], 0xfffb
jmp 0x1000c38a
mov dword [ebp - 0xac], 0
jmp 0x1000c3d2
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jg 0x1000c949
mov dword [ebp - 0x10], 0xf1dbeccc
mov dword [ebp - 0x330], 0xb6890635
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0xa3c], 0xd4e203d7
mov dword [ebp - 0x10], 0
jmp 0x1000c414
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x1000c47d
mov dword [ebp - 0xf4], 0xcdcb363f
mov dword [ebp - 0xf4], 0
jmp 0x1000c43d
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jg 0x1000c470
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
mov esi, eax
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000c430
cmp dword [ebp - 0xf4], 0
je 0x1000c47b
jmp 0x1000c47d
jmp 0x1000c40d
mov dword [ebp - 0x10], 0
jmp 0x1000c48d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x1000c944
mov dword [ebp - 0x218], 0x1b185749
push 1
lea ecx, [ebp - 0xd8c]
call fcn.10018753
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x380], 0
jmp 0x1000c4cb
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 1
jge 0x1000c4ed
push dword [ebp - 0x380]
lea ecx, [ebp - 0xd8c]
call fcn.100187f4
mov dword [eax], 0x8301
jmp 0x1000c4be
push dword [ebp - 0x10]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
cmp dword [eax], 1
jne 0x1000c50c
mov dword [ebp - 0xa0c], 1
jmp 0x1000c513
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xf20], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
mov ecx, dword [ebp - 0xa0c]
imul ecx, dword [eax]
imul eax, ecx, 0x94bb
test eax, eax
je 0x1000c55f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
cmp dword [eax], 0
je 0x1000c55f
mov dword [ebp - 0x6bc], 1
jmp 0x1000c566
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 0x3388
jge 0x1000c57e
mov dword [ebp - 0xa14], 1
jmp 0x1000c585
and dword [ebp - 0xa14], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
mov ecx, dword [ebp - 0xa14]
add ecx, 0x1932
imul ecx, dword [ebp - 0x184]
cmp dword [eax], ecx
je 0x1000c5b6
mov dword [ebp - 0x6c4], 1
jmp 0x1000c5bd
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x330], eax
mov esi, dword [ebp - 0x330]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
cmp dword [eax], esi
jle 0x1000c5ef
push dword [ebp - 0x10]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1f0], eax
je 0x1000c606
mov dword [ebp - 0xa1c], 1
jmp 0x1000c60d
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0xa1c]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x184], 0
jmp 0x1000c632
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jg 0x1000c930
mov dword [ebp - 0x488], 0x3c6d
mov dword [ebp - 0x490], 0
mov dword [ebp - 0xc7c], 0xa0ff8149
mov dword [ebp - 0x2c0], 0
jmp 0x1000c676
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 1
jge 0x1000c692
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x6f4], 0x39ab1b57
jmp 0x1000c669
mov dword [ebp - 0x1f0], 0
jmp 0x1000c6ab
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jg 0x1000c8fb
mov dword [ebp - 0xd7c], 0xffffffff
push dword [ebp - 0xac]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
mov dword [eax], 0xca7a
mov eax, 0xca7a
test eax, eax
je 0x1000c7bd
push dword [ebp - 0xac]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
mov eax, dword [eax]
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0xa24], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa24]
mov dword [ebp + eax - 0x6f4], ecx
mov eax, dword [ebp - 0xa24]
sub eax, dword [ebp - 0x330]
je 0x1000c73c
xor eax, eax
je 0x1000c73c
mov dword [ebp - 0x6d4], 1
jmp 0x1000c743
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
sub eax, 0x9ee5
cmp eax, dword [ebp - 0x184]
jne 0x1000c762
mov dword [ebp - 0xa2c], 1
jmp 0x1000c769
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0xa2c]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x490], eax
je 0x1000c799
push dword [ebp - 0x10]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
cmp dword [eax], 0
je 0x1000c799
mov dword [ebp - 0x6dc], 1
jmp 0x1000c7a0
and dword [ebp - 0x6dc], 0
push 0
lea ecx, [ebp - 0xd8c]
call fcn.100187f4
mov ecx, dword [ebp - 0x6dc]
add ecx, dword [eax]
jne 0x1000c7cf
cmp dword [ebp - 0x10], 0
jne 0x1000c7cf
mov eax, 0x3d96
test eax, eax
jne 0x1000c7cf
and dword [ebp - 0xa34], 0
jmp 0x1000c7d9
mov dword [ebp - 0xa34], 1
push 0
lea ecx, [ebp - 0xd8c]
call fcn.100187f4
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa34]
jne 0x1000c7fc
mov dword [ebp - 0x6e4], 1
jmp 0x1000c803
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp - 0xa3c]
cmp dword [ebp - 0x488], eax
jl 0x1000c829
mov dword [ebp - 0x6ec], 1
jmp 0x1000c830
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0x6ec], eax
jne 0x1000c84a
mov dword [ebp - 0xa44], 1
jmp 0x1000c851
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x488]
cmp eax, dword [ebp - 0xa44]
je 0x1000c86b
mov dword [ebp - 0xd74], 1
jmp 0x1000c872
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0xd7c]
mov dword [ebp - 0xf28], eax
push 0
lea ecx, [ebp - 0xd8c]
call fcn.100187f4
push dword [ebp - 0xac]
lea ecx, [ebp - 0x39c]
call fcn.100187f4
cmp dword [eax], 0
jne 0x1000c8ba
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6f4], 0
jne 0x1000c8ba
and dword [ebp - 0xa4c], 0
jmp 0x1000c8c4
mov dword [ebp - 0xa4c], 1
mov eax, dword [ebp - 0xa4c]
add eax, 0xfffe
cmp eax, dword [ebp - 0xac]
jg 0x1000c8e3
mov dword [ebp - 0x6fc], 1
jmp 0x1000c8ea
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0xc7c], eax
jmp 0x1000c69e
mov dword [ebp - 0x218], 1
jmp 0x1000c914
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x1000c92b
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x330], eax
jmp 0x1000c907
jmp 0x1000c625
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xd8c]
call fcn.100187d8
jmp 0x1000c486
jmp 0x1000c3c5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x39c]
call fcn.100187d8
mov dword [ebp - 0x2c8], 0xad313dd3
mov dword [ebp - 0x2c8], 8
jmp 0x1000c97b
mov eax, dword [ebp - 0x2c8]
dec eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0xfffffff6
jge 0x1000c9e0
mov dword [ebp - 0x368], 0xffffffff
mov dword [ebp - 0xc54], 0xfffffffc
mov byte [ebp - 0x13f], 0
movzx eax, byte [ebp - 0x13f]
test eax, eax
je 0x1000c9b0
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebp - 0x368], 0
jmp 0x1000c9c9
mov eax, dword [ebp - 0x368]
dec eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0xffffffeb
jl 0x1000c9de
mov dword [ebp - 0xc54], 1
jmp 0x1000c9bc
jmp 0x1000c96e
mov dword [ebp - 0x2d0], 0xfffffffe
mov byte [ebp - 0x140], 0
movzx eax, byte [ebp - 0x140]
test eax, eax
je 0x1000ca17
push 0x490
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
mov dword [ebp - 0x2d0], 0
jmp 0x1000ca30
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x1d
jl 0x1000ca52
mov dword [ebp - 0xa54], 1
mov eax, dword [ebp - 0xa54]
inc eax
mov dword [ebp - 0xa54], eax
jmp 0x1000ca23
mov dword [ebp - 0x1ac], 1
mov dword [ebp - 0x71c], 0x38591b68
mov dword [ebp - 0x338], 0
jmp 0x1000ca7f
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 4
jge 0x1000ca9b
mov eax, dword [ebp - 0x338]
mov dword [ebp + eax*4 - 0x1118], 0
jmp 0x1000ca72
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1ac], 0
jmp 0x1000cac1
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jg 0x1000cd38
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x18c], 0xffffffff
mov dword [ebp - 0x8c], 0
jmp 0x1000cafb
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jg 0x1000cd33
mov dword [ebp - 0x1cc], 0x5bfc88eb
mov dword [ebp - 0x1d4], 0x15169ff4
mov dword [ebp - 0x2d8], 0
jmp 0x1000cb35
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 2
jge 0x1000cb51
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0xc50], 1
jmp 0x1000cb28
cmp dword [ebp - 0x8c], 0xf871
jl 0x1000cb69
mov dword [ebp - 0x704], 1
jmp 0x1000cb70
and dword [ebp - 0x704], 0
cmp dword [ebp - 0x704], 0xd5feaf86
je 0x1000cb88
mov dword [ebp - 0xa5c], 1
jmp 0x1000cb8f
and dword [ebp - 0xa5c], 0
cmp dword [ebp - 0xa5c], 0xffff
jbe 0x1000cba7
mov dword [ebp - 0x70c], 1
jmp 0x1000cbae
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp + eax*4 - 0x1118]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xc50]
cmp eax, dword [ebp - 0x70c]
jne 0x1000cbdd
mov dword [ebp - 0xa64], 1
jmp 0x1000cbe4
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xa64], eax
jg 0x1000cbfe
mov dword [ebp - 0x714], 1
jmp 0x1000cc05
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x714]
neg ecx
cmp dword [ebp + eax*4 - 0x1118], ecx
jg 0x1000cc28
mov dword [ebp - 0xa6c], 1
jmp 0x1000cc2f
and dword [ebp - 0xa6c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc50]
imul eax, dword [ebp - 0xa6c]
test eax, eax
je 0x1000cc50
cmp dword [ebp - 0x8c], 0
jne 0x1000cc69
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc50], 0
jne 0x1000cc69
and dword [ebp - 0xa74], 0
jmp 0x1000cc73
mov dword [ebp - 0xa74], 1
mov dword [ebp - 0x1cc], 2
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x71c], eax
mov eax, dword [ebp - 0x71c]
imul eax, dword [ebp - 0xa74]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x18c], 3
jmp 0x1000ccc1
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jl 0x1000cd2e
mov dword [ebp - 0x1cc], 0
jmp 0x1000cce3
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jg 0x1000cd2c
mov dword [ebp - 0x1d4], 3
jmp 0x1000cd05
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jl 0x1000cd2a
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1000cd28
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1000ccf8
jmp 0x1000ccd6
jmp 0x1000ccb4
jmp 0x1000caee
jmp 0x1000cab4
push 3
lea ecx, [ebp - 0x3d0]
call fcn.10018753
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x498], 0xfffffffa
mov dword [ebp - 0xc9c], 0xb76eea53
mov dword [ebp - 0x734], 0xffffffff
push 2
lea ecx, [ebp - 0x1044]
call fcn.10018753
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xed0], 0x1152
mov dword [ebp - 0xecc], 0x1152
mov dword [ebp - 0xec8], 0x1152
mov dword [ebp - 0xec4], 0x1152
mov dword [ebp - 0x724], 6
mov dword [ebp - 0x60], 0
jmp 0x1000cdc4
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1000cde0
push dword [ebp - 0x60]
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
mov dword [eax], 0x8ec0
jmp 0x1000cdbd
mov dword [ebp - 0x60], 0
jmp 0x1000cdf0
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1000ce0c
push dword [ebp - 0x60]
lea ecx, [ebp - 0x1044]
call fcn.100187f4
mov dword [eax], 0xfadacd7d
jmp 0x1000cde9
mov dword [ebp - 0x38], 0
jmp 0x1000ce1c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jg 0x1000d1fa
mov dword [ebp - 0xca4], 1
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x390], 0
jmp 0x1000ce53
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 3
jge 0x1000ce6f
mov eax, dword [ebp - 0x390]
mov dword [ebp + eax*4 - 0x4e0], 0xbf5cd53b
jmp 0x1000ce46
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x4e0], 0
jmp 0x1000ce9d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4e0]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x4e0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4e0], 2
jg 0x1000cee5
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x4e0]
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x4e0]
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000ce82
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x724], eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
mov esi, eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1000cf22
mov dword [ebp - 0xa7c], 1
jmp 0x1000cf29
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0xa7c], eax
jle 0x1000cf43
mov dword [ebp - 0x754], 1
jmp 0x1000cf4a
and dword [ebp - 0x754], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xed0]
mov dword [ebp - 0xf30], eax
push 2
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
cmp dword [eax], 1
je 0x1000cf7a
mov dword [ebp - 0x72c], 1
jmp 0x1000cf81
and dword [ebp - 0x72c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4e0]
cmp dword [ebp - 0x72c], eax
je 0x1000cfa2
mov dword [ebp - 0xa84], 1
jmp 0x1000cfa9
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0xa84]
mov dword [ebp - 0x734], eax
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0x734], eax
jg 0x1000cfcf
mov dword [ebp - 0xa8c], 1
jmp 0x1000cfd6
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0xc9c]
cmp dword [ebp - 0xa8c], eax
jg 0x1000cff0
mov dword [ebp - 0x73c], 1
jmp 0x1000cff7
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x73c], eax
jle 0x1000d00e
mov dword [ebp - 0xc60], 1
jmp 0x1000d015
and dword [ebp - 0xc60], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
push dword [ebp - 0x38]
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
cmp dword [eax], 0
je 0x1000d04b
cmp dword [ebp - 0xca4], 0
je 0x1000d04b
mov dword [ebp - 0xa94], 1
jmp 0x1000d052
and dword [ebp - 0xa94], 0
cmp dword [ebp - 0xa94], 0x6c71
jg 0x1000d06a
mov dword [ebp - 0x744], 1
jmp 0x1000d071
and dword [ebp - 0x744], 0
push 2
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
mov ecx, dword [ebp - 0x744]
imul ecx, dword [eax]
test ecx, ecx
je 0x1000d0a0
mov eax, 0xe21d
test eax, eax
je 0x1000d0a0
mov dword [ebp - 0xa9c], 1
jmp 0x1000d0a7
and dword [ebp - 0xa9c], 0
cmp dword [ebp - 0xa9c], 0xf093
je 0x1000d0cc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4e0], 0
jne 0x1000d0cc
and dword [ebp - 0x74c], 0
jmp 0x1000d0d6
mov dword [ebp - 0x74c], 1
cmp dword [ebp - 0x74c], 0x31bc
je 0x1000d0ee
mov dword [ebp - 0xaa4], 1
jmp 0x1000d0f5
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x498]
imul eax, dword [ebp - 0xaa4]
test eax, eax
je 0x1000d117
xor eax, eax
inc eax
je 0x1000d117
mov dword [ebp - 0xaac], 1
jmp 0x1000d11e
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0x754]
cmp eax, dword [ebp - 0xaac]
jge 0x1000d138
mov dword [ebp - 0x75c], 1
jmp 0x1000d13f
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
add eax, 0xad58
je 0x1000d16b
push dword [ebp - 0x38]
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
cmp dword [eax], 0
je 0x1000d16b
mov dword [ebp - 0xab4], 1
jmp 0x1000d172
and dword [ebp - 0xab4], 0
cmp dword [ebp - 0xab4], 0xb336fde0
jbe 0x1000d18a
mov dword [ebp - 0x4a0], 1
jmp 0x1000d191
and dword [ebp - 0x4a0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4a0]
mov dword [ebp + eax - 0x4e0], ecx
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1f8], 2
jmp 0x1000d1c8
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jl 0x1000d1f5
push dword [ebp - 0x38]
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
mov esi, eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x3d0]
call fcn.100187f4
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000d1bb
jmp 0x1000ce15
mov byte [ebp - 0x142], 0
movzx eax, byte [ebp - 0x142]
test eax, eax
je 0x1000d216
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1044]
call fcn.100187d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d0]
call fcn.100187d8
movzx eax, byte [0x10681758]
test eax, eax
je 0x1000d252
mov esi, 0x100957d8
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10012550
mov dword [ebp - 0x150], 1
mov dword [ebp - 0x77c], 0x38591b68
mov dword [ebp - 0x2e0], 0
jmp 0x1000d27f
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 4
jge 0x1000d29b
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x1158], 0
jmp 0x1000d272
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x150], 0
jmp 0x1000d2c1
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jg 0x1000d538
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x158], 0xffffffff
mov dword [ebp - 0xcc], 0
jmp 0x1000d2fb
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jg 0x1000d533
mov dword [ebp - 0x160], 0x5bfc88eb
mov dword [ebp - 0x210], 0x15169ff4
mov dword [ebp - 0x340], 0
jmp 0x1000d335
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 2
jge 0x1000d351
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0xc5c], 1
jmp 0x1000d328
cmp dword [ebp - 0xcc], 0xf871
jl 0x1000d369
mov dword [ebp - 0x764], 1
jmp 0x1000d370
and dword [ebp - 0x764], 0
cmp dword [ebp - 0x764], 0xd5feaf86
je 0x1000d388
mov dword [ebp - 0xabc], 1
jmp 0x1000d38f
and dword [ebp - 0xabc], 0
cmp dword [ebp - 0xabc], 0xffff
jbe 0x1000d3a7
mov dword [ebp - 0x76c], 1
jmp 0x1000d3ae
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp + eax*4 - 0x1158]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xc5c]
cmp eax, dword [ebp - 0x76c]
jne 0x1000d3dd
mov dword [ebp - 0xac4], 1
jmp 0x1000d3e4
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xac4], eax
jg 0x1000d3fe
mov dword [ebp - 0x774], 1
jmp 0x1000d405
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x774]
neg ecx
cmp dword [ebp + eax*4 - 0x1158], ecx
jg 0x1000d428
mov dword [ebp - 0xacc], 1
jmp 0x1000d42f
and dword [ebp - 0xacc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc5c]
imul eax, dword [ebp - 0xacc]
test eax, eax
je 0x1000d450
cmp dword [ebp - 0xcc], 0
jne 0x1000d469
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc5c], 0
jne 0x1000d469
and dword [ebp - 0xad4], 0
jmp 0x1000d473
mov dword [ebp - 0xad4], 1
mov dword [ebp - 0x160], 2
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x77c], eax
mov eax, dword [ebp - 0x77c]
imul eax, dword [ebp - 0xad4]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x158], 3
jmp 0x1000d4c1
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x1000d52e
mov dword [ebp - 0x160], 0
jmp 0x1000d4e3
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jg 0x1000d52c
mov dword [ebp - 0x210], 3
jmp 0x1000d505
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jl 0x1000d52a
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1000d528
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1000d4f8
jmp 0x1000d4d6
jmp 0x1000d4b4
jmp 0x1000d2ee
jmp 0x1000d2b4
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x784], 0xbb2f1448
mov dword [ebp - 0xaf4], 1
mov dword [ebp - 0x7a4], 0x1d976d9
mov dword [ebp - 0xafc], 0x57440e70
mov dword [ebp - 0x64], 9
mov dword [ebp - 0xc78], 0x54f8d36f
mov dword [ebp - 0xb1c], 0xbadbefc7
mov dword [ebp - 0x508], 0xffffffff
mov dword [ebp - 0x2e8], 0
jmp 0x1000d5a5
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 1
jge 0x1000d5c1
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0x370], 1
jmp 0x1000d598
mov byte [ebp - 0x144], 0
movzx eax, byte [ebp - 0x144]
test eax, eax
je 0x1000d5e0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
cmp dword [ebp - 0x28], 0
jne 0x1000d5f5
cmp dword [ebp - 0x28], 0
jne 0x1000d5f5
and dword [ebp - 0xc6c], 0
jmp 0x1000d5ff
mov dword [ebp - 0xc6c], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x784], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x784], eax
jg 0x1000d61f
mov dword [ebp - 0xadc], 1
jmp 0x1000d626
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xadc], eax
jne 0x1000d63d
mov dword [ebp - 0x4a8], 1
jmp 0x1000d644
and dword [ebp - 0x4a8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp + eax - 0x370], ecx
cmp dword [ebp - 0x4a8], 0
je 0x1000d671
xor eax, eax
inc eax
je 0x1000d671
mov dword [ebp - 0x78c], 1
jmp 0x1000d678
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x78c], eax
jl 0x1000d68f
mov dword [ebp - 0xae4], 1
jmp 0x1000d696
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xae4], eax
jl 0x1000d6ad
mov dword [ebp - 0x794], 1
jmp 0x1000d6b4
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
add eax, 0x8c70a7b
cmp eax, 5
jg 0x1000d6d0
mov dword [ebp - 0xaec], 1
jmp 0x1000d6d7
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0xaec]
jne 0x1000d6ee
mov dword [ebp - 0x79c], 1
jmp 0x1000d6f5
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
neg eax
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xaf4]
add eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jle 0x1000d71d
mov dword [ebp - 0xcac], 1
jmp 0x1000d724
and dword [ebp - 0xcac], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xf38], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x370]
dec eax
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xafc], eax
jl 0x1000d764
mov dword [ebp - 0x7ac], 1
jmp 0x1000d76b
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jg 0x1000d785
mov dword [ebp - 0xb04], 1
jmp 0x1000d78c
and dword [ebp - 0xb04], 0
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x1000d7a7
mov dword [ebp - 0x7b4], 1
jmp 0x1000d7ae
and dword [ebp - 0x7b4], 0
cmp dword [ebp - 0x7b4], 0xfffffff7
je 0x1000d7c3
mov dword [ebp - 0xb0c], 1
jmp 0x1000d7ca
and dword [ebp - 0xb0c], 0
cmp dword [ebp - 0xb0c], 0x6ed55c5
jl 0x1000d7e2
mov dword [ebp - 0x7bc], 1
jmp 0x1000d7e9
and dword [ebp - 0x7bc], 0
cmp dword [ebp - 0x7bc], 4
jae 0x1000d7fe
mov dword [ebp - 0xb14], 1
jmp 0x1000d805
and dword [ebp - 0xb14], 0
cmp dword [ebp - 0xb14], 0xffff
jbe 0x1000d81d
mov dword [ebp - 0x7c4], 1
jmp 0x1000d824
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xf40], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0
je 0x1000d86a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x370], 0x5879a273
jmp 0x1000d890
mov dword [ebp - 0x64], 0
jmp 0x1000d87a
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1000d890
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x370], 0x94ad4db1
jmp 0x1000d873
mov dword [ebp - 0x168], 1
mov dword [ebp - 0xb3c], 0x38591b68
mov dword [ebp - 0x2f0], 0
jmp 0x1000d8bd
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 4
jge 0x1000d8d9
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x10e8], 0
jmp 0x1000d8b0
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x168], 0
jmp 0x1000d8ff
cmp dword [ebp - 0x168], 3
jg 0x1000db76
mov dword [ebp - 0x94], 1
mov dword [ebp - 0x170], 0xffffffff
mov dword [ebp - 0x94], 0
jmp 0x1000d939
push 2
lea ecx, [ebp - 0x3ac]
call fcn.10018753
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0x180], 0xffffffff
mov dword [ebp - 0xb10], 4
mov dword [ebp - 0x24c], 0
jmp 0x1000dbc1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret