Function at 0x10009f38
Capabilities:
Create process on windows
Enumerate files on windows
Enumerate gui resources
Get memory capacity
Get session user name
Log keystrokes via polling
Parse pe header
Terminate process

Disassembly:
mov eax, 0x10087f7b
call fcn.10087058
mov eax, 0x17fc
call fcn.10082960
push ebx
push esi
push edi
push 2
pop eax
mov edi, 0x25b0
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x58], 0xee1c
mov dword [ebp - 0xe38], eax
mov dword [ebp - 0xe34], eax
mov dword [ebp - 0xe30], eax
mov dword [ebp - 0xe2c], eax
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], 0x22d800f4
mov byte [ebp - 0x61], dl
mov dword [ebp - 0x1c], eax
jmp 0x10009faa
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1468], 0x42c78ef8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10009f99
mov eax, dword [ebp - 0x18]
xor eax, eax
mov esi, eax
push 1
pop ebx
cmp dword [ebp - 0x18], eax
je 0x10009fc0
mov esi, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
inc dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0xe38], eax
mov eax, dword [ebp - 0x58]
test eax, eax
setg cl
xor edx, edx
cmp ecx, 0x9f9034e1
setne dl
mov dword [ebp - 0x1460], edx
mov eax, dword [ebp - 0x18]
imul eax, edx
cmp esi, eax
jl 0x10009ffc
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x58], eax
je 0x10009ffe
mov ecx, ebx
mov eax, dword [ebp - 0x3c]
mov ebx, dword [sym.imp.USER32.dll_InflateRect]
imul eax, ecx
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1000a026
push 0x1d51
push 0x1e95
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x58], 0xee1c
push 2
pop ecx
mov dword [ebp - 0xe68], ecx
mov dword [ebp - 0xe64], ecx
mov dword [ebp - 0xe60], ecx
mov dword [ebp - 0xe5c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
push 3
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], 0x22d800f4
mov dword [ebp - 0x1c], eax
jmp 0x1000a074
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14c8], 0x42c78ef8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000a063
mov eax, dword [ebp - 0x18]
xor edi, edi
xor eax, eax
inc edi
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x1000a08a
mov esi, edi
mov eax, dword [ebp - 0x38]
xor ecx, ecx
inc dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0xe68], eax
mov eax, dword [ebp - 0x58]
test eax, eax
setg cl
xor edx, edx
cmp ecx, 0x9f9034e1
setne dl
mov dword [ebp - 0x14c0], edx
mov eax, dword [ebp - 0x18]
imul eax, edx
cmp esi, eax
jl 0x1000a0c6
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x58], eax
je 0x1000a0c8
mov ecx, edi
mov eax, dword [ebp - 0x3c]
imul eax, ecx
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1000a0ea
push 0x1d51
push 0x1e95
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x30], eax
mov edi, 0x998ab545
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x38], 0x12af0488
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1000a11f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x34c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000a107
xor eax, eax
xor edx, edx
mov dword [ebp - 0x30], eax
inc edx
cmp dword [ebp - 0x30], edx
jg 0x1000a1ba
mov dword [ebp - 0x3c], 0xfffffff8
or eax, 0xffffffff
mov dword [ebp - 0x18], 0x1465ee6
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x348]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x34c], 0
je 0x1000a164
mov eax, dword [ebp - 0x34c]
inc dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x348]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x34c]
test eax, eax
sete cl
sub ecx, dword [ebp - 0x58]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x3c]
jne 0x1000a195
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1000a197
mov eax, edx
imul eax, eax, 7
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000a1a6
mov eax, edx
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jle 0x1000a12e
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x18], 0x25b0
mov dword [ebp - 0x58], 0xee1c
mov dword [ebp - 0xe48], ecx
mov dword [ebp - 0xe44], ecx
mov dword [ebp - 0xe40], ecx
mov dword [ebp - 0xe3c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
push 3
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], 0x22d800f4
mov dword [ebp - 0x1c], eax
jmp 0x1000a209
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1480], 0x42c78ef8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000a1f8
mov eax, dword [ebp - 0x18]
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x1000a21c
mov esi, edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
inc dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0xe48], eax
mov eax, dword [ebp - 0x58]
test eax, eax
setg cl
xor edx, edx
cmp ecx, 0x9f9034e1
setne dl
mov dword [ebp - 0x1478], edx
mov eax, dword [ebp - 0x18]
imul eax, edx
cmp esi, eax
jl 0x1000a25a
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x1000a25a
mov ecx, eax
jmp 0x1000a25f
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x3c]
imul eax, ecx
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1000a281
push 0x1d51
push 0x1e95
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x38], 0x12af0488
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000a2b0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3c8], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000a297
xor eax, eax
xor edx, edx
mov dword [ebp - 0x30], eax
inc edx
or esi, 0xffffffff
cmp dword [ebp - 0x30], edx
jg 0x1000a344
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x18], 0x1465ee6
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c4]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x3c8], 0
je 0x1000a2f5
mov eax, dword [ebp - 0x3c8]
inc dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c4]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x3c8]
test eax, eax
sete cl
sub ecx, dword [ebp - 0x58]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x3c]
jne 0x1000a326
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1000a328
mov eax, edx
imul eax, eax, 7
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000a337
mov eax, edx
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jle 0x1000a2c2
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x58], esi
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000a374
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x894], 0xe971
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a35c
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1000a394
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf0c], 0xd1b9849b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a37c
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1000a3cf
push eax
push 0x19a1
push eax
push eax
push 0x198d
push 0x1315
push 0x22fc
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
xor edx, edx
xor eax, eax
inc edx
cmp dword [ebp - 0x88c], eax
je 0x1000a43e
mov dword [ebp - 0x28], 0x17779a7
mov dword [ebp - 0x3c], 0xb84c
cmp dword [ebp - 0x88c], eax
je 0x1000a426
mov eax, dword [ebp - 0xf08]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x88c]
mov eax, dword [ebp - 0x28]
sub eax, 0x7b5b
neg eax
sbb eax, eax
inc eax
cmp eax, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x88c]
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffff8
jge 0x1000a430
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0xf08], eax
je 0x1000a432
mov ecx, edx
xor eax, eax
cmp ecx, esi
setg al
mov dword [ebp - 0x3c], eax
jmp 0x1000a451
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1000a451
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov dword [ebp - 0x24], 0xf6af1124
mov dword [ebp - 0x40], 0xfddd3f46
mov dword [ebp - 0x3c], 0x12e1dfe0
mov dword [ebp - 0x24], 2
jmp 0x1000a4da
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0xffffffef
jmp 0x1000a4d1
push 3
lea ecx, [ebp - 0xda4]
call fcn.100097db
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
jmp 0x1000a4a6
push dword [ebp - 0x1c]
call fcn.10009879
mov dword [eax], 0x4800fa72
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
lea ecx, [ebp - 0xda4]
jl 0x1000a495
xor eax, eax
inc eax
push eax
call fcn.10009879
lea ecx, [ebp - 0xda4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], esi
call fcn.1000985d
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xfffffff3
jne 0x1000a47e
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffeb
jl 0x1000a46f
xor esi, esi
mov dword [ebp - 0x38], 0x25b0
inc esi
lea ecx, [ebp - 0xdbc]
mov dword [ebp - 0x20], esi
xor eax, eax
mov dword [ebp - 0x44], 0x6c849023
mov dword [ebp - 0x24], eax
push 2
call fcn.100097db
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x1c], 0x48110cbb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000a536
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xdbc]
call fcn.10009879
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000a51b
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1000a572
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x20]
je 0x1000a572
xor eax, eax
mov esi, eax
xor eax, eax
lea ecx, [ebp - 0xdbc]
inc eax
push eax
call fcn.10009879
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
setge dl
xor ecx, ecx
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp - 0x20]
inc edx
add eax, 0x4d91f06e
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, edx
setg cl
xor eax, eax
sub ecx, dword [ebp - 0x20]
je 0x1000a5fe
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], 0xfffffff2
cmp dword [ebp - 0x24], 0xfffffff5
jne 0x1000a5dd
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x30], eax
jmp 0x1000a5d3
cmp dword [ebp - 0x30], eax
jne 0x1000a5d8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jle 0x1000a5cb
inc dword [ebp - 0x24]
jmp 0x1000a5b9
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1000a64d
push 0x1977
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x1000a64d
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x20], eax
jmp 0x1000a647
mov dword [ebp - 0x18], 8
or eax, 0xffffffff
mov dword [ebp - 0x3c], 0x6e20b395
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
jne 0x1000a62b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
cmp eax, edx
setle cl
mov dword [ebp - 0x58], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x31
je 0x1000a606
or eax, 0xffffffff
lea ecx, [ebp - 0xdbc]
mov dword [ebp - 4], eax
call fcn.1000985d
mov dword [ebp - 0x28], 0xee1c
xor esi, esi
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xb168f928
inc esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], 0x3997
mov dword [ebp - 0x40], 0x31966c47
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x54], 0x14d8
mov dword [ebp - 0x1c], eax
jmp 0x1000a6ae
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x978], 0x4df8e3bf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000a69d
mov ecx, dword [ebp - 0x30]
xor edx, edx
add ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setge dl
imul eax, edx
test eax, eax
jne 0x1000a6d9
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x1000a6db
mov edx, esi
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x978]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
imul eax, dword [ebp - 0x44], 0x5342
cmp eax, dword [ebp - 0x4c]
jge 0x1000a752
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1000a824
push 0x12d9
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x1000a824
or eax, 0xffffffff
mov dword [ebp - 0x24], 0x8d7c584e
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x1000a824
jmp 0x1000a771
xor eax, eax
mov dword [ebp - 0x18], 0xae11
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1000a7b2
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x978]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1000a7ab
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
dec dword [ebp - 0x14]
jns 0x1000a783
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000a7be
mov ecx, esi
cmp dword [ebp - 0x24], eax
jne 0x1000a7c0
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
sub edx, 0xb83d
mov dword [ebp - 0x40], edx
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setle dl
mov dword [ebp - 0x58], edx
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
jne 0x1000a816
cmp dword [ebp - 0x4c], eax
je 0x1000a818
mov eax, esi
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x2c]
jns 0x1000a76f
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x12dc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
push 2
pop eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0xe58], eax
mov dword [ebp - 0xe54], eax
mov dword [ebp - 0xe50], eax
mov dword [ebp - 0xe4c], eax
mov dword [ebp - 0x34], 8
push eax
call fcn.100097db
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xdd4]
mov dword [ebp - 0x34], 0x7bf5cd53
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x34], 0xfffffff8
push esi
call fcn.100097db
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1000a8c3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x12dc]
call fcn.10009879
mov dword [eax], 0x56915a13
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000a8a4
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x20], eax
inc ecx
cmp dword [ebp - 0x20], ecx
jge 0x1000a8e6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x418], 0x37d7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000a8ce
xor eax, eax
xor esi, esi
mov dword [ebp - 0x20], eax
inc esi
cmp dword [ebp - 0x20], ecx
jge 0x1000a90f
push dword [ebp - 0x20]
lea ecx, [ebp - 0xdd4]
call fcn.10009879
mov dword [eax], 0x44262821
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000a8f1
xor eax, eax
inc dword [ebp - 0x418]
lea ecx, [ebp - 0xdd4]
push eax
call fcn.10009879
lea ecx, [ebp - 0xdd4]
dec dword [eax]
call fcn.1000985d
or eax, 0xffffffff
lea ecx, [ebp - 0x12dc]
mov dword [ebp - 4], eax
call fcn.1000985d
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x58], 0xa3d7f191
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000a976
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15ec], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000a95d
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000a98c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf8c], 0x9bca7b5c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000a97b
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x40]
jge 0x1000a9c2
mov dword [ebp - 0x18], 0xd6b65720
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setge dl
add edx, 0x4320e32c
cmp edx, 0x10ec3203
jne 0x1000a9c2
xor eax, eax
mov ecx, eax
jmp 0x1000a9c4
mov ecx, esi
mov eax, dword [ebp - 0x40]
add eax, ecx
cmp dword [ebp - 0x40], eax
jne 0x1000a9d7
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1000a9d9
mov ecx, esi
mov dword [ebp - 0x15e8], ecx
mov eax, dword [ebp - 0x40]
sub ecx, eax
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xf8c], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1000aa12
push 0x103a
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
xor eax, eax
mov dword [ebp - 0x58], 0xdd9cd443
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x54], 0xe75cb554
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x1c], eax
jmp 0x1000aa43
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x804], 0xffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000aa32
mov eax, dword [ebp - 0x58]
xor ecx, ecx
test eax, eax
setns cl
add ecx, 0xf0d1ce0c
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x3e2f7c62
setl al
imul eax, eax, 0xfffb
dec eax
neg eax
sbb eax, eax
or esi, 0xffffffff
neg eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], eax
jl 0x1000ab3f
push 3
lea ecx, [ebp - 0xdec]
call fcn.100097db
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x1c], eax
jmp 0x1000aab6
push dword [ebp - 0x1c]
call fcn.10009879
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
lea ecx, [ebp - 0xdec]
jl 0x1000aaa9
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x800]
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.10009879
mov esi, dword [ebp - 0x54]
mov edi, eax
mov ecx, dword [ebp - 0x54]
sub esi, 0xe12fd89d
mov eax, dword [ebp - 0x24]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [ebp + eax*4 - 0x804]
mov eax, dword [ebp - 0x24]
setne dl
sub ecx, edx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x804]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xdec]
setge dl
or esi, 0xffffffff
imul edx, dword [ebp + eax*4 - 0x804]
mov dword [ebp - 4], esi
mov dword [edi], edx
call fcn.1000985d
dec dword [ebp - 0x24]
jns 0x1000aa8e
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x58], 3
inc ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000ab6e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x111c], 0x8901f2c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000ab55
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1000ab94
push 0x6d8
push 0x1292
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x3c], 0x22d800f4
mov dword [ebp - 0x40], 0x8a1f9496
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000abcf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1574], 0x9ac70c30
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000abb6
xor eax, eax
mov dword [ebp - 0x40], 0x61928c17
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ecx
jg 0x1000ac4b
push 4
lea ecx, [ebp - 0xe28]
call fcn.100097db
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x1c], eax
jmp 0x1000ac0a
push dword [ebp - 0x1c]
call fcn.10009879
mov dword [eax], 0x811f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
lea ecx, [ebp - 0xe28]
jl 0x1000abf9
push 3
call fcn.10009879
inc dword [eax]
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1000ac30
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
lea ecx, [ebp - 0xe28]
mov dword [ebp - 4], esi
call fcn.1000985d
inc dword [ebp - 0x40]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x40], ecx
jle 0x1000abde
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1000ac73
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf24], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000ac5e
xor eax, eax
mov dword [ebp - 0x48], 0xffffffed
jmp 0x1000ad4e
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x40], 2
cmp dword [ebp - 0x40], eax
jl 0x1000ad33
movdqa xmm0, xmmword [0x10008410]
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x1428]
push eax
lea ecx, [ebp - 0x1584]
movdqu xmmword [ebp - 0x1428], xmm0
call fcn.1000988b
lea ecx, [ebp - 0x159]
mov esi, eax
call fcn.10009888
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1140]
push dword [esi]
call fcn.10009837
push 3
lea ecx, [ebp - 0x1140]
mov dword [ebp - 4], 6
call fcn.10009879
dec dword [eax]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000ad11
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp + eax*4 - 0xf24]
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xf24], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1000acfa
or eax, 0xffffffff
lea ecx, [ebp - 0x1140]
mov dword [ebp - 4], eax
call fcn.1000985d
dec dword [ebp - 0x40]
jns 0x1000ac96
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1000ad4b
push eax
push 0x230b
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x13
jle 0x1000ac7f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1000ad7a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14f8], 0x42c78ef8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000ad61
xor eax, eax
mov dword [ebp - 0x40], 0x17571177
mov dword [ebp - 0x40], eax
jmp 0x1000ada9
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1000ad9d
push 0x1fe2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x40]
push 0
pop eax
cmp dword [ebp - 0x40], 0xfffffff2
je 0x1000ad86
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1000adbd
mov esi, eax
jmp 0x1000adc2
xor eax, eax
lea esi, [eax + 1]
mov eax, dword [ebp - 0x44]
xor ecx, ecx
inc dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0xe58], eax
mov eax, dword [ebp - 0x28]
test eax, eax
setg cl
xor edx, edx
cmp ecx, 0x9f9034e1
setne dl
mov dword [ebp - 0x14f0], edx
mov eax, dword [ebp - 0x38]
imul eax, edx
cmp esi, eax
jl 0x1000ae03
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1000ae03
xor esi, esi
mov ecx, eax
inc esi
jmp 0x1000ae08
xor esi, esi
inc esi
mov ecx, esi
mov eax, dword [ebp - 0x58]
imul eax, ecx
lea ecx, [ebp - 0xea4]
push 9
mov dword [ebp - 0x3c], eax
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
pop eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x8aa2d34c
mov dword [ebp - 0x34], 0x44198d72
push 2
call fcn.100097db
or eax, 0xffffffff
mov dword [ebp - 4], 7
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000ae6c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15a4], 0xb03629aa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000ae53
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000ae96
or esi, 0xffffffff
push dword [ebp - 0x14]
lea ecx, [ebp - 0xea4]
call fcn.10009879
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000ae78
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x14], 0xfffffff2
jmp 0x1000af22
mov dword [ebp - 0x1c], 0x51d69f42
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1000aec1
push eax
push 0x230b
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff2
jmp 0x1000af19
mov dword [ebp - 0x38], 0xb283066c
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], eax
jl 0x1000af16
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1000aeff
push eax
push 0x15d6
push 0x1cc2
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1000af11
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
dec dword [ebp - 0x38]
jns 0x1000aed9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xc
jge 0x1000aeca
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
jg 0x1000aea2
mov dword [ebp - 0x14], eax
jmp 0x1000af69
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xa3187110
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xe5809974
mov dword [ebp - 0x34], 0x84257392
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x14]
imul eax, eax, 0x61fc
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x28]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
je 0x1000af31
or eax, 0xffffffff
lea ecx, [ebp - 0xea4]
mov dword [ebp - 4], eax
call fcn.1000985d
mov dword [ebp - 0x30], 0xe948708e
xor eax, eax
mov dword [ebp - 0x40], 0x556123d4
mov dword [ebp - 0x28], 0xc90c63b8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x58], 0xb56bf5ee
mov dword [ebp - 0x28], 0xe56979f9
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1000afbb
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setge dl
add edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x30]
jl 0x1000afdd
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
dec eax
jne 0x1000afe6
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov edx, esi
sub edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x38]
cmp dword [ebp - 0x30], eax
je 0x1000b014
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x1000b022
cmp dword [ebp - 0x38], eax
je 0x1000b022
mov eax, esi
xor ecx, ecx
cmp eax, 0x373c9468
mov eax, dword [ebp - 0x38]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
push 9
setle dl
neg eax
pop esi
sbb eax, eax
inc eax
add edx, eax
xor eax, eax
cmp edx, 0x9757
setne al
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x38], 0x68dee21a
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], esi
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1000b080
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
imul ecx, dword [ebp - 0x1c]
cmp ecx, 0xf3c3
setl al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
cmp byte [ebp - 0xd], 0
je 0x1000b272
or eax, 0xffffffff
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0xe78], eax
xor edx, edx
mov dword [ebp - 0xe74], eax
mov dword [ebp - 0xe70], eax
mov dword [ebp - 0xe6c], eax
mov dword [ebp - 0x24], 0x530c4e2b
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xf0bde8af
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
push 0xfffffffffffffffd
pop ecx
sub ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, 0xf12f
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
imul ecx, edx, 0xffff
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
mov dword [ebp - 0xe70], edx
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
neg eax
xor edx, edx
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jl 0x1000b265
mov dword [ebp - 0x28], 0x54d8
lea ecx, [ebp - 0xa08]
mov dword [ebp - 0x34], 0xbc75b167
push 2
call fcn.100097db
xor eax, eax
mov dword [ebp - 4], 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000b1e6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x17c4], 0x20c256fa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000b1cd
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000b20e
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa08]
call fcn.10009879
mov dword [eax], 0xcc3231a2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000b1ef
xor eax, eax
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x28], ecx
jne 0x1000b21d
mov esi, ecx
cmp dword [ebp - 0x24], eax
jne 0x1000b21f
mov esi, eax
push ecx
lea ecx, [ebp - 0xa08]
call fcn.10009879
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x28]
cmp esi, eax
sete cl
xor eax, eax
cmp ecx, 0x104dbc0b
lea ecx, [ebp - 0xa08]
setle al
mov dword [ebp - 0x3c], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1000985d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 9
jge 0x1000b1a0
xor eax, eax
push 0x1d51
push 0x1e95
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0x998ab545
mov dword [ebp - 0x38], 0x12af0488
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000b2a7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x360], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000b28e
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x30], eax
inc ebx
or esi, 0xffffffff
cmp dword [ebp - 0x30], ebx
jg 0x1000b339
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x18], 0x1465ee6
mov dword [ebp - 0x58], esi
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x35c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x360], 0
je 0x1000b2ec
mov eax, dword [ebp - 0x360]
inc dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x35c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x360]
test eax, eax
sete cl
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x3c]
jne 0x1000b31d
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1000b31f
mov eax, ebx
imul eax, eax, 7
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000b32e
mov eax, ebx
mov dword [ebp - 0x58], eax
inc dword [ebp - 0x30]
jmp 0x1000b2b0
push 2
lea ecx, [ebp - 0x474]
call fcn.100097db
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000b385
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x474]
call fcn.10009879
mov dword [eax], 0xdf99ff60
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000b366
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1000b4ad
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], eax
jl 0x1000b49f
push ebx
lea ecx, [ebp - 0xc48]
call fcn.100097db
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1c], eax
jmp 0x1000b3d5
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc48]
call fcn.10009879
mov dword [eax], 0x6aa1c33
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1000b3be
push dword [ebp - 0x30]
lea ecx, [ebp - 0x474]
call fcn.10009879
cmp dword [eax], 0
jne 0x1000b43c
xor eax, eax
lea ecx, [ebp - 0x474]
push eax
call fcn.10009879
xor ecx, ecx
cmp dword [eax], 0xb713
sete cl
xor eax, eax
imul esi, ecx, 0xc164
lea ecx, [ebp - 0xc48]
push eax
add esi, 0x6361599c
call fcn.10009879
lea ecx, [ebp - 0x474]
mov dword [eax], esi
mov eax, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x24], eax
push eax
call fcn.10009879
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
push ebx
lea ecx, [ebp - 0x474]
call fcn.10009879
xor eax, eax
lea ecx, [ebp - 0x474]
push eax
call fcn.10009879
mov ecx, dword [ebp - 0x40]
mov eax, dword [eax]
sub eax, ecx
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1000b47c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b479
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff9
jge 0x1000b467
lea ecx, [ebp - 0xc48]
mov byte [ebp - 4], 9
call fcn.1000985d
dec dword [ebp - 0x40]
jns 0x1000b3a7
xor eax, eax
or esi, 0xffffffff
cmp dword [ebp - 0x24], eax
jne 0x1000b4ad
dec dword [ebp - 0x30]
jns 0x1000b391
lea ecx, [ebp - 0x474]
mov dword [ebp - 4], esi
call fcn.1000985d
push 2
lea ecx, [ebp - 0x4ec]
call fcn.100097db
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000b507
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x4ec]
call fcn.10009879
mov dword [eax], 0xdf99ff60
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000b4e8
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1000b62f
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], eax
jl 0x1000b621
push ebx
lea ecx, [ebp - 0xa20]
call fcn.100097db
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x1c], eax
jmp 0x1000b557
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa20]
call fcn.10009879
mov dword [eax], 0x6aa1c33
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1000b540
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4ec]
call fcn.10009879
cmp dword [eax], 0
jne 0x1000b5be
xor eax, eax
lea ecx, [ebp - 0x4ec]
push eax
call fcn.10009879
xor ecx, ecx
cmp dword [eax], 0xb713
sete cl
xor eax, eax
imul esi, ecx, 0xc164
lea ecx, [ebp - 0xa20]
push eax
add esi, 0x6361599c
call fcn.10009879
lea ecx, [ebp - 0x4ec]
mov dword [eax], esi
mov eax, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x24], eax
push eax
call fcn.10009879
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
push ebx
lea ecx, [ebp - 0x4ec]
call fcn.10009879
xor eax, eax
lea ecx, [ebp - 0x4ec]
push eax
call fcn.10009879
mov ecx, dword [ebp - 0x40]
mov eax, dword [eax]
sub eax, ecx
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1000b5fe
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b5fb
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff9
jge 0x1000b5e9
lea ecx, [ebp - 0xa20]
mov byte [ebp - 4], 0xb
call fcn.1000985d
dec dword [ebp - 0x40]
jns 0x1000b529
xor eax, eax
or esi, 0xffffffff
cmp dword [ebp - 0x24], eax
jne 0x1000b62f
dec dword [ebp - 0x30]
jns 0x1000b513
lea ecx, [ebp - 0x4ec]
mov dword [ebp - 4], esi
call fcn.1000985d
push 3
pop ebx
mov dword [ebp - 0x14], 0x105fa2ef
lea ecx, [ebp - 0x22c]
push ebx
call fcn.100097db
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x74c]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], ebx
push ebx
call fcn.100097db
push 4
lea ecx, [ebp - 0xd68]
mov byte [ebp - 4], 0xe
call fcn.100097db
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000b6a7
push dword [ebp - 0x20]
lea ecx, [ebp - 0x22c]
call fcn.10009879
mov dword [eax], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000b68d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000b6cd
push dword [ebp - 0x20]
lea ecx, [ebp - 0x74c]
call fcn.10009879
mov dword [eax], 0xd978029
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000b6af
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000b6e9
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd68]
call fcn.10009879
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000b6d2
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x22c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
push 2
call fcn.10009879
push 2
lea ecx, [ebp - 0x22c]
call fcn.10009879
mov esi, eax
lea ecx, [ebp - 0x22c]
xor eax, eax
push eax
call fcn.10009879
xor ebx, ebx
push 2
mov ecx, dword [eax]
cmp ecx, dword [esi]
lea ecx, [ebp - 0x22c]
setge bl
add ebx, 0x636c1cd8
call fcn.10009879
mov ecx, dword [ebp - 0x14]
mov esi, eax
xor eax, eax
cmp ecx, ebx
mov ecx, dword [ebp - 0x14]
setne al
xor edx, edx
cmp eax, ecx
mov eax, dword [esi]
push 2
setle dl
xor esi, esi
sub eax, edx
xor ecx, ecx
sub eax, 0x7935
inc esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp eax, esi
setle cl
lea esi, [ecx + 3]
lea ecx, [ebp - 0x74c]
call fcn.10009879
push 2
lea ecx, [ebp - 0x22c]
mov dword [eax], esi
call fcn.10009879
xor ebx, ebx
lea ecx, [ebp - 0x22c]
push 2
cmp esi, dword [eax]
setle bl
call fcn.10009879
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x22c]
push 2
setg dl
imul edx, dword [eax]
imul esi, edx, 0xfffb
call fcn.10009879
xor ecx, ecx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x1c]
setle cl
sub ecx, eax
cmp ecx, dword [ebp - 0x14]
jne 0x1000b7f4
xor eax, eax
lea ecx, [ebp - 0x74c]
push eax
call fcn.10009879
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x22c]
push 2
call fcn.10009879
xor ebx, ebx
lea ecx, [ebp - 0xd68]
inc ebx
mov esi, eax
push ebx
call fcn.10009879
mov ecx, dword [esi]
push 2
pop esi
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1000b839
push dword [ebp - 0x24]
lea ecx, [ebp - 0x74c]
call fcn.10009879
cmp dword [eax], 0
jne 0x1000b83e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1000b823
lea ecx, [ebp - 0xd68]
call fcn.1000985d
lea ecx, [ebp - 0x74c]
call fcn.1000985d
or eax, 0xffffffff
lea ecx, [ebp - 0x22c]
mov dword [ebp - 4], eax
call fcn.1000985d
push 3
lea ecx, [ebp - 0xf3c]
call fcn.100097db
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1000b8a3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf3c]
call fcn.10009879
mov dword [eax], 0xfffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000b884
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b8bb
push eax
push 0x2f4
push eax
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b8df
push eax
push 0x13e0
push 0x162e
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
or eax, 0xffffffff
lea ecx, [ebp - 0xf3c]
mov dword [ebp - 4], eax
call fcn.1000985d
or eax, 0xffffffff
lea ecx, [ebp - 0x90c]
mov dword [ebp - 0x24], eax
push 3
call fcn.100097db
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1000b934
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x90c]
call fcn.10009879
mov dword [eax], 0xb8f3d421
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000b915
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff0
jge 0x1000b9ec
push esi
lea ecx, [ebp - 0x59c]
call fcn.100097db
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1000b979
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x59c]
call fcn.10009879
mov dword [eax], 0xfda0e60f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000b95b
xor eax, eax
push eax
lea ecx, [ebp - 0x59c]
call fcn.10009879
mov dword [eax], 0xfffffff1
jmp 0x1000b9bb
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000b9ad
push eax
push eax
push eax
push eax
push 0x17a
push ebx
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
push eax
lea ecx, [ebp - 0x59c]
call fcn.10009879
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x59c]
push eax
call fcn.10009879
cmp dword [eax], 0xf
jge 0x1000b98d
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0x11
call fcn.1000985d
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff0
jl 0x1000b941
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x1000ba4b
mov dword [ebp - 0x40], 0x36b16b47
mov dword [ebp - 0x40], eax
jmp 0x1000ba41
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1000ba3e
push dword [ebp - 0x40]
lea ecx, [ebp - 0x90c]
call fcn.10009879
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x90c]
mov esi, eax
call fcn.10009879
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x1c]
jns 0x1000ba12
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ecx
jle 0x1000ba03
dec dword [ebp - 0x24]
jns 0x1000b9f7
or eax, 0xffffffff
lea ecx, [ebp - 0x90c]
mov dword [ebp - 4], eax
call fcn.1000985d
xor eax, eax
lea ecx, [ebp - 0x81c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x14], eax
push 2
call fcn.100097db
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x1c], eax
jmp 0x1000ba9a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x81c]
call fcn.10009879
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000ba86
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
push ebx
setle dl
lea ecx, [ebp - 0x81c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
call fcn.10009879
cmp dword [eax], 0
jne 0x1000bae0
xor eax, eax
lea ecx, [ebp - 0x81c]
push eax
call fcn.10009879
cmp dword [eax], 0
jne 0x1000bae0
xor eax, eax
mov esi, eax
jmp 0x1000bae2
mov esi, ebx
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
setle dl
xor eax, eax
cmp edx, esi
setne al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [ebp - 0x24], ecx
jge 0x1000bc59
mov dword [ebp - 0x3c], 0x41ac
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000bb32
push 0xa51
push 0x1ea9
call dword [sym.imp.USER32.dll_SetCaretPos]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000bb50
push 0x18c4
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
or eax, 0xffffffff
lea ecx, [ebp - 0x81c]
mov dword [ebp - 4], eax
call fcn.1000985d
push 4
pop edi
mov dword [ebp - 0x4c], 0x998ab545
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x18], 0x9229a275
push edi
call fcn.100097db
mov dword [ebp - 4], 0x14
lea ecx, [ebp - 0x8ac]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], 0x2499e68f
push 3
call fcn.100097db
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000bbcb
mov dword [ebp - 0x28], 0xde450bb1
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x14], eax
jmp 0x1000bcb5
mov dword [ebp - 0x3c], 0xac3d
cmp dword [ebp - 0x3c], eax
jne 0x1000bcbb
cmp dword [ebp - 0x14], 0xf
je 0x1000bc6e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffec
jg 0x1000bb30