Function at 0x1001615d
Capabilities:
Accept command line arguments
Connect pipe
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b95c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x118c
call fcn.10088de0
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 6
mov dword [ebp - 0xb98], 0x4a12b57e
push 1
lea ecx, [ebp - 0xdd8]
call fcn.10015795
and dword [ebp - 4], 0
mov dword [ebp - 0x1ac], 0
jmp 0x100161c0
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x100161e2
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0xdd8]
call fcn.10015802
mov dword [eax], 0xfffffffb
jmp 0x100161b3
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xb98], eax
mov dword [ebp - 0x10c], 0
jmp 0x10016207
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x10016229
push dword [ebp - 0x10c]
lea ecx, [ebp - 0xdd8]
call fcn.10015802
mov dword [eax], 0xc7555b7c
jmp 0x100161fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdd8]
call fcn.100157fd
mov dword [ebp - 0x188], 0x7dfa
push 1
lea ecx, [ebp - 0xda8]
call fcn.10015795
mov dword [ebp - 4], 1
mov dword [ebp - 0xeb8], 1
mov dword [ebp - 0x2f4], 0
jmp 0x10016279
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 1
jge 0x1001629b
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0xda8]
call fcn.10015802
mov dword [eax], 0xfb871c7b
jmp 0x1001626c
mov esi, dword [ebp - 0x188]
push 0
lea ecx, [ebp - 0xda8]
call fcn.10015802
mov dword [eax], esi
mov dword [ebp - 0x188], 0
jmp 0x100162c9
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jg 0x100163a7
mov dword [ebp - 0x1b4], 0x50e6da50
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x10016337
push 0x1823
push 0x23c0
push 0x1685
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x191
push 0x3ef
push 0x1bba
push 0x1ae8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x1b4], 0
jmp 0x10016350
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jl 0x100163a2
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x100163a0
push 0x1c3c
push 0x1753
push 0x261e
push 0x220d
push 0x10ec
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x10016343
jmp 0x100162bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xda8]
call fcn.100157fd
mov dword [ebp - 0x128], 6
mov dword [ebp - 0x150], 0x1bf506e6
push 3
lea ecx, [ebp - 0xb0c]
call fcn.10015795
mov dword [ebp - 4], 2
mov dword [ebp - 0x330], 2
mov dword [ebp - 0xc58], 0x2a42bbd4
mov dword [ebp - 0xa80], 0xffffffff
mov dword [ebp - 0xc2c], 0xe458c458
mov dword [ebp - 0x2a4], 0
jmp 0x1001641f
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 3
jge 0x10016441
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0xb0c]
call fcn.10015802
mov dword [eax], 1
jmp 0x10016412
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xe28], eax
mov esi, dword [ebp - 0x150]
push 0
lea ecx, [ebp - 0xb0c]
call fcn.10015802
cmp esi, dword [eax]
jl 0x10016475
xor eax, eax
inc eax
je 0x10016475
mov dword [ebp - 0xa3c], 1
jmp 0x1001647c
and dword [ebp - 0xa3c], 0
cmp dword [ebp - 0xa3c], 0x8de637c5
jbe 0x10016494
mov dword [ebp - 0xa40], 1
jmp 0x1001649b
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0xa40], eax
jl 0x100164b5
mov dword [ebp - 0xa48], 1
jmp 0x100164bc
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0xa48]
jg 0x100164d6
mov dword [ebp - 0xa50], 1
jmp 0x100164dd
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0x330]
add eax, dword [ebp - 0xa50]
jne 0x10016506
mov eax, 0x9ea7eb8e
test eax, eax
jne 0x10016506
mov eax, 0xdc99
test eax, eax
jne 0x10016506
and dword [ebp - 0xa58], 0
jmp 0x10016510
mov dword [ebp - 0xa58], 1
mov eax, dword [ebp - 0x330]
cmp dword [ebp - 0xa58], eax
jg 0x1001652a
mov dword [ebp - 0xa60], 1
jmp 0x10016531
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0xc58]
cmp dword [ebp - 0xa60], eax
jg 0x1001654b
mov dword [ebp - 0xa68], 1
jmp 0x10016552
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x330]
cmp dword [ebp - 0xa68], eax
jg 0x1001656c
mov dword [ebp - 0xa70], 1
jmp 0x10016573
and dword [ebp - 0xa70], 0
push 0
lea ecx, [ebp - 0xb0c]
call fcn.10015802
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa70]
jl 0x100165a5
push 1
lea ecx, [ebp - 0xb0c]
call fcn.10015802
cmp dword [eax], 0
jne 0x100165a5
and dword [ebp - 0xa78], 0
jmp 0x100165af
mov dword [ebp - 0xa78], 1
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0xa80]
cmp dword [ebp - 0x150], eax
jge 0x100165d5
mov dword [ebp - 0xa88], 1
jmp 0x100165dc
and dword [ebp - 0xa88], 0
push 0
lea ecx, [ebp - 0xb0c]
call fcn.10015802
mov esi, dword [ebp - 0xa88]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0xb0c]
call fcn.10015802
cmp esi, dword [eax]
jle 0x1001660f
mov dword [ebp - 0xa90], 1
jmp 0x10016616
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0xc2c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0c]
call fcn.100157fd
mov dword [ebp - 0xc4c], 0x4a12b57e
push 1
lea ecx, [ebp - 0xdc0]
call fcn.10015795
mov dword [ebp - 4], 3
mov dword [ebp - 0x28], 0x3df603fa
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x1bc], 0
jmp 0x10016676
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x10016692
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xcdc], 0xffffffff
jmp 0x10016669
cmp dword [ebp - 0x28], 0xd714f98c
ja 0x100166a7
mov dword [ebp - 0xa98], 1
jmp 0x100166ae
and dword [ebp - 0xa98], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xa98], eax
jg 0x100166c5
mov dword [ebp - 0xaa0], 1
jmp 0x100166cc
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xaa0], eax
je 0x100166e3
mov dword [ebp - 0xaa8], 1
jmp 0x100166ea
and dword [ebp - 0xaa8], 0
cmp dword [ebp - 0xaa8], 5
jge 0x100166ff
mov dword [ebp - 0xab0], 1
jmp 0x10016706
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0xab0]
neg eax
jns 0x1001671c
mov dword [ebp - 0xab8], 1
jmp 0x10016723
and dword [ebp - 0xab8], 0
cmp dword [ebp - 0xab8], 0xfffe
je 0x10016735
cmp dword [ebp - 0x28], 0
je 0x10016751
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xcdc], 0
je 0x10016751
mov dword [ebp - 0xac0], 1
jmp 0x10016758
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0xac0]
jle 0x10016775
cmp dword [ebp - 0x28], 0
je 0x10016775
mov dword [ebp - 0xac8], 1
jmp 0x1001677c
and dword [ebp - 0xac8], 0
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x28], eax
jge 0x100167a8
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcdc], 0
je 0x100167a8
mov dword [ebp - 0xc60], 1
jmp 0x100167af
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xe38], eax
cmp dword [ebp - 0x58], 0
je 0x10016b72
mov dword [ebp - 0x1c4], 0xadf890ba
mov dword [ebp - 0x64], 0
jmp 0x100167e5
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x100167fb
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x3f0], 0x39200279
jmp 0x100167de
mov dword [ebp - 0x64], 0
jmp 0x1001680b
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x10016821
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xd18], 0xaeaba4a2
jmp 0x10016804
mov dword [ebp - 0x28], 0
jmp 0x10016831
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xa
jl 0x10016b56
mov dword [ebp - 0x87c], 0x6d8f
mov dword [ebp - 0x2d4], 0
jmp 0x1001685e
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 3
jge 0x1001687a
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0xcf4], 0x66d9918c
jmp 0x10016851
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xcdc], 0
jne 0x10016929
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3f0]
cmp dword [ebp + eax - 0x3f0], ecx
jg 0x100168b6
mov dword [ebp - 0xc34], 1
jmp 0x100168bd
and dword [ebp - 0xc34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f0]
mov dword [ebp - 0xe40], eax
cmp dword [ebp - 0x87c], 0x9342
jge 0x100168e8
mov dword [ebp - 0x9b4], 1
jmp 0x100168ef
and dword [ebp - 0x9b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd18]
add eax, dword [ebp - 0x9b4]
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0x1c4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f0]
cmp eax, dword [ebp - 0x1c4]
jg 0x10016929
and dword [ebp - 0x350], 0
jmp 0x10016933
mov dword [ebp - 0x350], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x350]
mov dword [ebp + eax - 0xcf4], ecx
mov eax, dword [ebp - 0x350]
shl eax, 3
test eax, eax
je 0x10016b11
mov dword [ebp - 0xc70], 0xfffffffc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xcdc], 0
jne 0x1001697d
mov dword [ebp - 0xc68], 1
jmp 0x10016984
and dword [ebp - 0xc68], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcf4]
mov dword [ebp - 0xe48], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xe50], eax
cmp dword [ebp - 0x87c], 0xfffffff7
je 0x100169b5
mov dword [ebp - 0xc3c], 1
jmp 0x100169bc
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xe58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xe60], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xe68], eax
cmp dword [ebp - 0xc70], 0xfffffffb
jbe 0x100169ec
mov dword [ebp - 0x42c], 1
jmp 0x100169f3
and dword [ebp - 0x42c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f0]
cmp dword [ebp - 0x42c], eax
jge 0x10016a14
mov dword [ebp - 0x884], 1
jmp 0x10016a1b
and dword [ebp - 0x884], 0
cmp dword [ebp - 0x884], 0xfffffff6
jge 0x10016a30
mov dword [ebp - 0x434], 1
jmp 0x10016a37
and dword [ebp - 0x434], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd18]
cmp dword [ebp - 0x434], eax
jle 0x10016a58
mov dword [ebp - 0x88c], 1
jmp 0x10016a5f
and dword [ebp - 0x88c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd18]
cmp dword [ebp - 0x88c], eax
je 0x10016a80
mov dword [ebp - 0x43c], 1
jmp 0x10016a87
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0x1e9572ab
je 0x10016aac
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd18], 0
jne 0x10016aac
and dword [ebp - 0x894], 0
jmp 0x10016ab6
mov dword [ebp - 0x894], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f0]
imul eax, dword [ebp - 0x894]
sub eax, dword [ebp - 0x1c4]
jne 0x10016ae4
mov eax, 0x2cc37069
test eax, eax
jne 0x10016ae4
and dword [ebp - 0x444], 0
jmp 0x10016aee
mov dword [ebp - 0x444], 1
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x1c4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcf4], 0
je 0x10016b0f
jmp 0x1001682a
jmp 0x10016b51
mov dword [ebp - 0x58], 2
jmp 0x10016b21
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x10016b51
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x10016b41
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xcf4], 1
jmp 0x10016b1a
jmp 0x1001682a
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x10016b70
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
jmp 0x10016b96
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x10016b96
push 0xf80
push 0x1a96
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
mov dword [ebp - 0x2ac], 0
jmp 0x10016baf
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 1
jge 0x10016bd1
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0xdc0]
call fcn.10015802
mov dword [eax], 0xfffffffb
jmp 0x10016ba2
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0x128], 0
jmp 0x10016bf6
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x10016c18
push dword [ebp - 0x128]
lea ecx, [ebp - 0xdc0]
call fcn.10015802
mov dword [eax], 0xc7555b7c
jmp 0x10016be9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc0]
call fcn.100157fd
push 2
lea ecx, [ebp - 0x1024]
call fcn.10015795
mov dword [ebp - 4], 4
mov dword [ebp - 0x2ec], 0xffffffff
mov dword [ebp - 0x1cc], 0
jmp 0x10016c5e
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jge 0x10016c80
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x1024]
call fcn.10015802
mov dword [eax], 7
jmp 0x10016c51
mov dword [ebp - 0x2ec], 1
jmp 0x10016c99
mov eax, dword [ebp - 0x2ec]
dec eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jl 0x10016cd6
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x10016cd4
push 0
push 0x1ca
push 0x4d9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x10016c8c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1024]
call fcn.100157fd
mov dword [ebp - 0x1114], 1
mov dword [ebp - 0x1110], 1
mov dword [ebp - 0x110c], 1
mov dword [ebp - 0x1108], 1
mov dword [ebp - 0x1d4], 0xf94964a5
mov dword [ebp - 0x1d4], 0
jmp 0x10016d30
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jg 0x10016d6d
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x10016d6b
push 0
push 0x105
push 0x7d3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x10016d23
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x10016d87
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [ebp - 0xd4c], 0xfffffffb
mov dword [ebp - 0xd48], 0xfffffffb
mov dword [ebp - 0xd44], 0xfffffffb
mov dword [ebp - 0xd40], 0xfffffffb
lea ecx, [ebp - 0x339]
call fcn.10015811
push eax
lea eax, [ebp - 0xd3c]
push eax
lea eax, [ebp - 0xd4c]
push eax
lea ecx, [ebp - 0x116c]
call fcn.10015814
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1134]
call fcn.100157d7
mov dword [ebp - 4], 5
mov dword [ebp - 0xc54], 0x683648bd
mov dword [ebp - 0x2b4], 0
jmp 0x10016e0e
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 1
jge 0x10016e2a
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0x178], 0x5c8094a1
jmp 0x10016e01
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x178], 3
jmp 0x10016e58
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x178], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x178], 0
jl 0x10016fad
push 3
lea ecx, [ebp - 0xb94]
call fcn.10015795
mov byte [ebp - 4], 6
mov dword [ebp - 0xcb8], 0xfffffffd
mov dword [ebp - 0x44c], 0xe28de637
mov dword [ebp - 0xb9c], 0xd8c53784
mov dword [ebp - 0x1dc], 0
jmp 0x10016eb4
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x10016ed6
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xb94]
call fcn.10015802
mov dword [eax], 0x34d0069
jmp 0x10016ea7
push 0
lea ecx, [ebp - 0xb94]
call fcn.10015802
mov esi, dword [ebp - 0xcb8]
push 0
lea ecx, [ebp - 0xb94]
call fcn.10015802
mov edi, eax
push 0
lea ecx, [ebp - 0xb94]
call fcn.10015802
mov ecx, dword [edi]
add ecx, dword [eax]
imul eax, ecx, 0x37ac
cmp esi, eax
jl 0x10016f1f
mov dword [ebp - 0x89c], 1
jmp 0x10016f26
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x89c]
sub eax, dword [ebp - 0xc54]
mov dword [ebp - 0x44c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
cmp dword [ebp - 0x44c], eax
jg 0x10016f59
mov dword [ebp - 0x8a4], 1
jmp 0x10016f60
and dword [ebp - 0x8a4], 0
push 0
lea ecx, [ebp - 0xb94]
call fcn.10015802
xor ecx, ecx
inc ecx
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x8a4]
jne 0x10016f86
mov dword [ebp - 0x454], 1
jmp 0x10016f8d
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0xb9c], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb94]
call fcn.100157fd
jmp 0x10016e3d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1134]
call fcn.100157fd
mov dword [ebp - 0x120], 6
mov dword [ebp - 0xe70], 0xb4e1a362
mov dword [ebp - 0xe78], 0xfffffffe
mov dword [ebp - 0xe9c], 0
mov dword [ebp - 0xea4], 0xfffffffe
mov dword [ebp - 0xeac], 1
mov dword [ebp - 0xeb4], 0xb4ebb0cb
mov dword [ebp - 0xebc], 0xffffffff
mov dword [ebp - 0xec4], 0xa149cec7
mov dword [ebp - 0xecc], 0x3c0bf90a
mov dword [ebp - 0xed4], 0x47adf1ad
mov dword [ebp - 0xedc], 0xffffffff
mov dword [ebp - 0xee4], 4
mov dword [ebp - 0xeec], 0x12d2c87
mov dword [ebp - 0xef4], 0
mov dword [ebp - 0xefc], 0xf13e13a6
push 1
lea ecx, [ebp - 0x1034]
call fcn.10015795
mov dword [ebp - 4], 7
mov dword [ebp - 0xf04], 0xffffffff
mov dword [ebp - 0xf0c], 0x488a9733
mov dword [ebp - 0x8ac], 1
mov dword [ebp - 0x264], 0
jmp 0x100170a7
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 1
jge 0x100170c9
push dword [ebp - 0x264]
lea ecx, [ebp - 0x1034]
call fcn.10015802
mov dword [eax], 0xfbce008f
jmp 0x1001709a
mov eax, dword [ebp - 0x8ac]
dec eax
mov dword [ebp - 0x8ac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1034]
call fcn.100157fd
mov dword [ebp - 0xbc0], 0x4a12b57e
mov dword [ebp - 0x1e4], 1
mov dword [ebp - 0x1e4], 0xffffffeb
jmp 0x10017112
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jl 0x100171b1
mov dword [ebp - 0x260], 0
jmp 0x10017138
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 2
jge 0x10017154
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0xb28], 1
jmp 0x1001712b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb28], 0
jmp 0x10017182
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb28]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb28], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb28], 0x1a
jle 0x100171ac
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x100171aa
call dword [sym.imp.USER32.dll_GetCapture]
jmp 0x10017167
jmp 0x10017105
push 1
lea ecx, [ebp - 0xd84]
call fcn.10015795
mov dword [ebp - 4], 8
push 2
lea ecx, [ebp - 0xb34]
call fcn.10015795
mov byte [ebp - 4], 9
mov dword [ebp - 0xba0], 9
mov dword [ebp - 0x8dc], 0xfb656d4c
mov dword [ebp - 0x8c], 0
jmp 0x10017203
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x10017225
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xb34]
call fcn.10015802
mov dword [eax], 9
jmp 0x100171f6
mov dword [ebp - 0x8c], 0
jmp 0x1001723e
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1001725a
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x390], 0xf1febaee
jmp 0x10017231
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x390], 0
jmp 0x10017288
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x390]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x390], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x390], 1
jg 0x1001755d
mov dword [ebp - 0x370], 1
mov dword [ebp - 0x8b4], 0x5b689063
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x100172ca
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x390]
lea ecx, [ebp - 0xb34]
call fcn.10015802
mov eax, dword [eax]
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0
jne 0x10017300
mov eax, 0x64f1
test eax, eax
je 0x10017526
mov eax, 0x909b
test eax, eax
je 0x10017526
mov dword [ebp - 0x158], 2
mov dword [ebp - 0x8bc], 0xfffffff6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x390]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x390]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x390]
je 0x10017355
mov dword [ebp - 0x45c], 1
jmp 0x1001735c
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x8b4], eax
jg 0x10017382
mov dword [ebp - 0x464], 1
jmp 0x10017389
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xf14], eax
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0xf1c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x390]
mov dword [ebp - 0xf24], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xf2c], eax
imul esi, dword [ebp - 0x158], 0x796
push 0
lea ecx, [ebp - 0xb34]
call fcn.10015802
cmp esi, dword [eax]
jne 0x100173f8
mov eax, 0xff1eb7e5
test eax, eax
jne 0x100173f8
and dword [ebp - 0x46c], 0
jmp 0x10017402
mov dword [ebp - 0x46c], 1
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x46c], eax
je 0x1001741c
mov dword [ebp - 0x8c4], 1
jmp 0x10017423
and dword [ebp - 0x8c4], 0
push 0
lea ecx, [ebp - 0xb34]
call fcn.10015802
mov eax, dword [eax]
imul eax, dword [ebp - 0x8c4]
sub eax, 0x640f4466
cmp eax, dword [ebp - 0x158]
jle 0x10017452
mov dword [ebp - 0x474], 1
jmp 0x10017459
and dword [ebp - 0x474], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x390]
imul eax, dword [ebp - 0x474]
cmp eax, 0x1404
jne 0x10017480
mov dword [ebp - 0x8cc], 1
jmp 0x10017487
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x8cc], eax
jg 0x100174a1
mov dword [ebp - 0x47c], 1
jmp 0x100174a8
and dword [ebp - 0x47c], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x390]
lea ecx, [ebp - 0xb34]
call fcn.10015802
mov eax, dword [eax]
cmp eax, dword [ebp - 0x47c]
jge 0x100174d6
mov dword [ebp - 0x8d4], 1
jmp 0x100174dd
and dword [ebp - 0x8d4], 0
cmp dword [ebp - 0x8d4], 0xd55be984
je 0x100174f5
mov dword [ebp - 0x484], 1
jmp 0x100174fc
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x8dc], eax
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x10017524
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10017558
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1001754e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
mov dword [ebp - 0x8dc], 8
jmp 0x1001726d
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb34]
call fcn.100157fd
mov dword [ebp - 0x1ec], 0
jmp 0x10017585
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 1
jge 0x100175a7
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0xd84]
call fcn.10015802
mov dword [eax], 0xfffffffb
jmp 0x10017578
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x380], 0x85b5f732
mov dword [ebp - 0x278], 0
jmp 0x100175d1
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 4
jge 0x100175ed
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xae8], 0xfffffff9
jmp 0x100175c4
mov dword [ebp - 0x14], 0x12
jmp 0x100175fd
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe7
jg 0x10017836
mov dword [ebp - 0x30], 0x5ba7723
push 3
lea ecx, [ebp - 0xde4]
call fcn.10015795
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xba8], 1
mov dword [ebp - 0x1f4], 0
jmp 0x10017642
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jge 0x10017664
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0xde4]
call fcn.10015802
mov dword [eax], 0xf2e07230
jmp 0x10017635
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xf34], eax
mov eax, dword [ebp - 0x14]
sub eax, 0x58d8a66b
cmp eax, dword [ebp - 0x30]
jne 0x10017686
mov dword [ebp - 0x48c], 1
jmp 0x1001768d
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf3c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xf54], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x48c], eax
jne 0x100176c8
mov dword [ebp - 0x8e4], 1
jmp 0x100176cf
and dword [ebp - 0x8e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8e4]
mov dword [ebp + eax - 0xae8], ecx
mov dword [ebp - 0x30], 0
jmp 0x100176f2
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x10017822
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xae8]
sub eax, 5
cmp eax, 5
jbe 0x10017722
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xae8], 0
je 0x10017722
push 9
pop eax
test eax, eax
jne 0x10017732
push 6
pop eax
test eax, eax
jne 0x10017732
and dword [ebp - 0x378], 0
jmp 0x1001773c
mov dword [ebp - 0x378], 1
push 0
lea ecx, [ebp - 0xde4]
call fcn.10015802
mov ecx, dword [ebp - 0x378]
mov dword [eax], ecx
cmp dword [ebp - 0x378], 0
je 0x1001776d
push 9
pop eax
test eax, eax
je 0x1001776d
mov dword [ebp - 0x494], 1
jmp 0x10017774
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xae8]
cmp eax, dword [ebp - 0x494]
jge 0x100177a2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xae8], 0
je 0x100177a2
mov dword [ebp - 0x8ec], 1
jmp 0x100177a9
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xae8]
imul eax, dword [ebp - 0x8ec]
test eax, eax
je 0x100177ce
xor eax, eax
je 0x100177ce
mov dword [ebp - 0x49c], 1
jmp 0x100177d5
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xae8]
cmp dword [ebp - 0x49c], eax
je 0x100177f3
mov dword [ebp - 0x8f4], 1
jmp 0x100177fa
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xae8]
push 4
pop ecx
imul ecx, ecx, 3
sub eax, dword [ebp + ecx - 0xae8]
add eax, dword [ebp - 0x8f4]
mov dword [ebp - 0xba8], eax
jmp 0x100176eb
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xde4]
call fcn.100157fd
jmp 0x100175f6
mov dword [ebp - 0x14], 0xffffffe6
jmp 0x10017846
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe9
jl 0x10017ad5
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x280], 9
mov dword [ebp - 0x4dc], 0xbe30
mov eax, 0x6903
test eax, eax
je 0x10017a71
cmp dword [ebp - 0x6c], 0
jne 0x1001797d
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], eax
je 0x10017896
mov dword [ebp - 0x4a4], 1
jmp 0x1001789d
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0xfffffffa
jae 0x100178b2
mov dword [ebp - 0xbb0], 1
jmp 0x100178b9
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf5c], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x380], eax
jne 0x100178d9
mov dword [ebp - 0x8fc], 1
jmp 0x100178e0
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
add eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jge 0x10017909
mov dword [ebp - 0x4ac], 1
jmp 0x10017910
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
sub eax, 0x564f
cmp eax, dword [ebp - 0x4dc]
jg 0x10017934
or eax, 0xffffffff
je 0x10017934
mov dword [ebp - 0x904], 1
jmp 0x1001793b
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x4b4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4b4]
mov dword [ebp + eax - 0xae8], ecx
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
imul eax, dword [ebp - 0x4b4]
test eax, eax
jne 0x1001797d
and dword [ebp - 0x90c], 0
jmp 0x10017987
mov dword [ebp - 0x90c], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x90c], eax
je 0x1001799e
mov dword [ebp - 0x4bc], 1
jmp 0x100179a5
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4bc], eax
jge 0x100179bc
mov dword [ebp - 0x914], 1
jmp 0x100179c3
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x914]
cmp eax, dword [ebp - 0x14]
jle 0x100179dd
mov dword [ebp - 0x4c4], 1
jmp 0x100179e4
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 0xffffffff
jg 0x100179f9
mov dword [ebp - 0x91c], 1
jmp 0x10017a00
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x91c], eax
je 0x10017a17
mov dword [ebp - 0x4cc], 1
jmp 0x10017a1e
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4cc], eax
je 0x10017a35
mov dword [ebp - 0x924], 1
jmp 0x10017a3c
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x924], eax
jge 0x10017a53
mov dword [ebp - 0x4d4], 1
jmp 0x10017a5a
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x4d4]
je 0x10017a71
mov dword [ebp - 0x92c], 1
jmp 0x10017a78
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x92c], eax
jne 0x10017a8f
mov dword [ebp - 0xbb8], 1
jmp 0x10017a96
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0xf64], eax
cmp dword [ebp - 0x280], 0
je 0x10017ac0
cmp dword [ebp - 0x280], 0
je 0x10017ac0
mov dword [ebp - 0x934], 1
jmp 0x10017ac7
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x6c], eax
jmp 0x1001783f
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0x118], 0xd313dd33
mov dword [ebp - 0x160], 0x76d6092f
mov dword [ebp - 0x138], 0xffffffff
mov dword [ebp - 0x118], 0x16
jmp 0x10017b18
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 8
jl 0x10017e44
mov dword [ebp - 0x288], 0x9eeda585
mov dword [ebp - 0x198], 0xffffffff
mov dword [ebp - 0x338], 0xb807220
mov dword [ebp - 0x1fc], 0
jmp 0x10017b5c
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x10017b78
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0xd20], 0x8f28
jmp 0x10017b4f
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xf6c], eax
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x198]
cmp eax, dword [ebp - 0x160]
jne 0x10017ba4
mov dword [ebp - 0x4e4], 1
jmp 0x10017bab
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0xed7d4130
jbe 0x10017bc3
mov dword [ebp - 0x93c], 1
jmp 0x10017bca
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x93c], eax
je 0x10017be4
mov dword [ebp - 0x4ec], 1
jmp 0x10017beb
and dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x4ec], 0x59ff446c
jg 0x10017c03
mov dword [ebp - 0x944], 1
jmp 0x10017c0a
and dword [ebp - 0x944], 0
cmp dword [ebp - 0x944], 0x28f0
jl 0x10017c22
mov dword [ebp - 0x4f4], 1
jmp 0x10017c29
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x4f4]
je 0x10017c43
mov dword [ebp - 0xbc8], 1
jmp 0x10017c4a
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xf74], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xf7c], eax
cmp dword [ebp - 0x138], 0xda73
je 0x10017c7a
mov dword [ebp - 0x94c], 1
jmp 0x10017c81
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x198], eax
jg 0x10017cae
mov dword [ebp - 0x4fc], 1
jmp 0x10017cb5
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 0x39032f82
jl 0x10017ccd
mov dword [ebp - 0x954], 1
jmp 0x10017cd4
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x954]
jne 0x10017cee
mov dword [ebp - 0x504], 1
jmp 0x10017cf5
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
je 0x10017d1f
cmp dword [ebp - 0x160], 0
je 0x10017d1f
mov dword [ebp - 0x95c], 1
jmp 0x10017d26
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x95c], eax
jle 0x10017d41
xor eax, eax
jne 0x10017d41
and dword [ebp - 0x50c], 0
jmp 0x10017d4b
mov dword [ebp - 0x50c], 1
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0x50c]
jne 0x10017d72
mov dword [ebp - 0x964], 1
jmp 0x10017d79
and dword [ebp - 0x964], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd20]
cmp dword [ebp - 0x964], eax
jl 0x10017da0
cmp dword [ebp - 0x288], 0
jne 0x10017da0
and dword [ebp - 0x514], 0
jmp 0x10017daa
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x514], eax
jl 0x10017dc4
mov dword [ebp - 0x96c], 1
jmp 0x10017dcb
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x96c], eax
jg 0x10017de5
mov dword [ebp - 0x51c], 1
jmp 0x10017dec
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0xe06d
jge 0x10017e04
mov dword [ebp - 0x974], 1
jmp 0x10017e0b
and dword [ebp - 0x974], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd20]
cmp dword [ebp - 0x974], eax
jl 0x10017e2c
mov dword [ebp - 0x524], 1
jmp 0x10017e33
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x160], eax
jmp 0x10017b0b
mov dword [ebp - 0x120], 0
jmp 0x10017e5d
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x100180e1
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0xe00], 0x8d72a67f
mov dword [ebp - 0xdfc], 0x8d72a67f
mov dword [ebp - 0xdf8], 0x8d72a67f
mov dword [ebp - 0xdf4], 0x8d72a67f
mov dword [ebp - 0xbd0], 0x2e4ed383
mov dword [ebp - 0xf84], 0x8f1edd1e
mov dword [ebp - 0x204], 0
jmp 0x10017ec6
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x10017ee2
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0xb70], 2
jmp 0x10017eb9
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x10017efa
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x40], 0
jmp 0x10017f0a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x100180c5
xor eax, eax
inc eax
je 0x10017fde
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
je 0x10017f31
mov dword [ebp - 0x97c], 1
jmp 0x10017f38
and dword [ebp - 0x97c], 0
cmp dword [ebp - 0x97c], 0xffffffff
jl 0x10017f4d
mov dword [ebp - 0x52c], 1
jmp 0x10017f54
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x52c], eax
jne 0x10017f6b
mov dword [ebp - 0x984], 1
jmp 0x10017f72
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x984], eax
jle 0x10017f89
mov dword [ebp - 0x534], 1
jmp 0x10017f90
and dword [ebp - 0x534], 0
imul eax, dword [ebp - 0x534], 0xa8e5
mov dword [ebp - 0x98c], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x98c]
mov dword [ebp + eax - 0xe00], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0xb70]
cmp dword [ebp - 0x98c], eax
jge 0x10017fd2
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0xb70], 0
je 0x10017fde
mov dword [ebp - 0x53c], 1
jmp 0x10017fe5
and dword [ebp - 0x53c], 0
imul eax, dword [ebp - 0x53c], 0x2e58
mov ecx, dword [ebp - 0x40]
imul eax, dword [ebp + ecx*4 - 0xb70]
cmp eax, 0xffffffff
jle 0x1001800b
mov dword [ebp - 0x994], 1
jmp 0x10018012
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0xb70]
cmp dword [ebp - 0x994], eax
je 0x10018030
mov dword [ebp - 0x544], 1
jmp 0x10018037
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0xb70]
cmp eax, dword [ebp - 0x544]
jg 0x10018055
mov dword [ebp - 0x99c], 1
jmp 0x1001805c
and dword [ebp - 0x99c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb70]
imul eax, dword [ebp - 0x99c]
cmp eax, 1
jb 0x10018080
mov dword [ebp - 0x54c], 1
jmp 0x10018087
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0xbd0], eax
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x100180c0
push 0
push 0xb24
push 0x1803
push 0x1062
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x10017f03
push dword [ebp - 0x120]
lea ecx, [ebp - 0xd84]
call fcn.10015802
mov dword [eax], 0xc7555b7c
jmp 0x10017e50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd84]
call fcn.100157fd
push 2
lea ecx, [ebp - 0x1044]
call fcn.10015795
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x20c], 0xffffffff
mov dword [ebp - 0x290], 0
jmp 0x10018127
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 2
jge 0x10018149
push dword [ebp - 0x290]
lea ecx, [ebp - 0x1044]
call fcn.10015802
mov dword [eax], 7
jmp 0x1001811a
mov dword [ebp - 0x20c], 1
jmp 0x10018162
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jl 0x1001819f
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x1001819d
push 0
push 0x1ca
push 0x4d9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x10018155
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1044]
call fcn.100157fd
push 1
lea ecx, [ebp - 0x3a0]
call fcn.10015795
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x298], 0
jmp 0x100181db
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 1
jge 0x100181fd
push dword [ebp - 0x298]
lea ecx, [ebp - 0x3a0]
call fcn.10015802
mov dword [eax], 0xb26bdde0
jmp 0x100181ce
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10015802
mov dword [eax], 0xffffffee
jmp 0x10018236
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10015802
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x9a4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9a4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10015802
cmp dword [eax], 0x1b
jne 0x100184f9
push 3
lea ecx, [ebp - 0x410]
call fcn.10015795
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x574], 0xffffffff
mov dword [ebp - 0x214], 0
jmp 0x1001828a
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jge 0x100182ac
push dword [ebp - 0x214]
lea ecx, [ebp - 0x410]
call fcn.10015802
mov dword [eax], 0xd581
jmp 0x1001827d
mov dword [ebp - 0x94], 2
jmp 0x100182c5
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x100184cb
mov dword [ebp - 0x2a0], 0xffffffff
mov dword [ebp - 0x56c], 1
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xf8c], eax
mov dword [ebp - 0x2a0], 0x56ee9734
cmp dword [ebp - 0x2a0], 0xfffffffc
jb 0x10018311
mov dword [ebp - 0x554], 1
jmp 0x10018318
and dword [ebp - 0x554], 0
push dword [ebp - 0x94]
lea ecx, [ebp - 0x410]
call fcn.10015802
mov ecx, dword [ebp - 0x554]
cmp ecx, dword [eax]
jle 0x1001833f
mov dword [ebp - 0x9ac], 1
jmp 0x10018346
and dword [ebp - 0x9ac], 0
push dword [ebp - 0x94]
lea ecx, [ebp - 0x410]
call fcn.10015802
mov esi, dword [eax]
imul esi, dword [ebp - 0x9ac]
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10015802
add esi, dword [eax]
jne 0x1001837d
mov dword [ebp - 0x55c], 1
jmp 0x10018384
and dword [ebp - 0x55c], 0
push 1
lea ecx, [ebp - 0x410]
call fcn.10015802
mov ecx, dword [ebp - 0x55c]
cmp ecx, dword [eax]
jl 0x100183a7
mov dword [ebp - 0x9f8], 1
jmp 0x100183ae
and dword [ebp - 0x9f8], 0
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10015802
mov esi, dword [eax]
add esi, dword [ebp - 0x9f8]
push 0
lea ecx, [ebp - 0x410]
call fcn.10015802
cmp esi, dword [eax]
jne 0x100183e9
cmp dword [ebp - 0x2a0], 0
je 0x100183e9
mov dword [ebp - 0x564], 1
jmp 0x100183f0
and dword [ebp - 0x564], 0
push dword [ebp - 0x94]
lea ecx, [ebp - 0x410]
call fcn.10015802
mov eax, dword [eax]
cmp eax, dword [ebp - 0x564]
jg 0x10018417
mov dword [ebp - 0xa00], 1
jmp 0x1001841e
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0x56c], eax
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10015802
cmp dword [eax], 0
je 0x1001845e
push dword [ebp - 0x94]
lea ecx, [ebp - 0x410]
call fcn.10015802
cmp dword [eax], 0
je 0x1001845e
mov dword [ebp - 0xbd8], 1
jmp 0x10018465
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0xf94], eax
mov esi, dword [ebp - 0x56c]
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10015802
cmp esi, dword [eax]
je 0x10018494
mov dword [ebp - 0xa08], 1
jmp 0x1001849b
and dword [ebp - 0xa08], 0
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10015802
mov esi, dword [ebp - 0xa08]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10015802
sub esi, dword [eax]
mov dword [ebp - 0x574], esi
jmp 0x100182b8
cmp dword [ebp - 0x574], 0
je 0x100184e5
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x410]
call fcn.100157fd
jmp 0x100184f9
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x410]
call fcn.100157fd
jmp 0x10018212
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a0]
call fcn.100157fd
mov dword [ebp - 0x180], 0x7dfa
push 1
lea ecx, [ebp - 0xdcc]
call fcn.10015795
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xf9c], 1
mov dword [ebp - 0x21c], 0
jmp 0x10018549
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x1001856b
push dword [ebp - 0x21c]
lea ecx, [ebp - 0xdcc]
call fcn.10015802
mov dword [eax], 0xfb871c7b
jmp 0x1001853c
mov esi, dword [ebp - 0x180]
push 0
lea ecx, [ebp - 0xdcc]
call fcn.10015802
mov dword [eax], esi
mov dword [ebp - 0x180], 0
jmp 0x10018599
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jg 0x10018677
mov dword [ebp - 0x2a8], 0x50e6da50
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x10018607
push 0x1823
push 0x23c0
push 0x1685
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x191
push 0x3ef
push 0x1bba
push 0x1ae8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x2a8], 0
jmp 0x10018620
mov eax, dword [ebp - 0x2a8]
dec eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0
jl 0x10018672
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x10018670
push 0x1c3c
push 0x1753
push 0x261e
push 0x220d
push 0x10ec
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x10018613
jmp 0x1001858c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdcc]
call fcn.100157fd
push 2
lea ecx, [ebp - 0x1054]
call fcn.10015795
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x168], 0x1bf506e6
push 3
lea ecx, [ebp - 0xaf4]
call fcn.10015795
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x340], 2
mov dword [ebp - 0xbe0], 0x2a42bbd4
mov dword [ebp - 0xa38], 0xffffffff
mov dword [ebp - 0xbe8], 0xe458c458
mov dword [ebp - 0x224], 0
jmp 0x100186f6
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x10018718
push dword [ebp - 0x224]
lea ecx, [ebp - 0xaf4]
call fcn.10015802
mov dword [eax], 1
jmp 0x100186e9
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xfa4], eax
mov esi, dword [ebp - 0x168]
push 0
lea ecx, [ebp - 0xaf4]
call fcn.10015802
cmp esi, dword [eax]
jl 0x1001874c
xor eax, eax
inc eax
je 0x1001874c
mov dword [ebp - 0xa10], 1
jmp 0x10018753
and dword [ebp - 0xa10], 0
cmp dword [ebp - 0xa10], 0x8de637c5
jbe 0x1001876b
mov dword [ebp - 0x57c], 1
jmp 0x10018772
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x57c], eax
jl 0x1001878c
mov dword [ebp - 0xa18], 1
jmp 0x10018793
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0xa18]
jg 0x100187ad
mov dword [ebp - 0x584], 1
jmp 0x100187b4
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x340]
add eax, dword [ebp - 0x584]
jne 0x100187dd
mov eax, 0x9ea7eb8e
test eax, eax
jne 0x100187dd
mov eax, 0xdc99
test eax, eax
jne 0x100187dd
and dword [ebp - 0xa20], 0
jmp 0x100187e7
mov dword [ebp - 0xa20], 1
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0xa20], eax
jg 0x10018801
mov dword [ebp - 0x58c], 1
jmp 0x10018808
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0xbe0]
cmp dword [ebp - 0x58c], eax
jg 0x10018822
mov dword [ebp - 0xa28], 1
jmp 0x10018829
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0xa28], eax
jg 0x10018843
mov dword [ebp - 0x594], 1
jmp 0x1001884a
and dword [ebp - 0x594], 0
push 0
lea ecx, [ebp - 0xaf4]
call fcn.10015802
mov eax, dword [eax]
cmp eax, dword [ebp - 0x594]
jl 0x1001887c
push 1
lea ecx, [ebp - 0xaf4]
call fcn.10015802
cmp dword [eax], 0
jne 0x1001887c
and dword [ebp - 0xa30], 0
jmp 0x10018886
mov dword [ebp - 0xa30], 1
mov eax, dword [ebp - 0xa30]
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp - 0xa38]
cmp dword [ebp - 0x168], eax
jge 0x100188ac
mov dword [ebp - 0x5a0], 1
jmp 0x100188b3
and dword [ebp - 0x5a0], 0
push 0
lea ecx, [ebp - 0xaf4]
call fcn.10015802
mov esi, dword [ebp - 0x5a0]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0xaf4]
call fcn.10015802
cmp esi, dword [eax]
jle 0x100188e6
mov dword [ebp - 0x858], 1
jmp 0x100188ed
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xbe8], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xaf4]
call fcn.100157fd
mov dword [ebp - 0x2c0], 0xffffffff
mov dword [ebp - 0x2b0], 0
jmp 0x1001892b
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 2
jge 0x1001894d
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0x1054]
call fcn.10015802
mov dword [eax], 7
jmp 0x1001891e
mov dword [ebp - 0x24], 0x3df603fa
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x22c], 0
jmp 0x10018974
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x10018990
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xd0c], 0xffffffff
jmp 0x10018967
cmp dword [ebp - 0x24], 0xd714f98c
ja 0x100189a5
mov dword [ebp - 0x5a8], 1
jmp 0x100189ac
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x5a8], eax
jg 0x100189c3
mov dword [ebp - 0x9f0], 1
jmp 0x100189ca
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x9f0], eax
je 0x100189e1
mov dword [ebp - 0x5b0], 1
jmp 0x100189e8
and dword [ebp - 0x5b0], 0
cmp dword [ebp - 0x5b0], 5
jge 0x100189fd
mov dword [ebp - 0x860], 1
jmp 0x10018a04
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x860]
neg eax
jns 0x10018a1a
mov dword [ebp - 0x5b8], 1
jmp 0x10018a21
and dword [ebp - 0x5b8], 0
cmp dword [ebp - 0x5b8], 0xfffe
je 0x10018a33
cmp dword [ebp - 0x24], 0
je 0x10018a4f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd0c], 0
je 0x10018a4f
mov dword [ebp - 0xa84], 1
jmp 0x10018a56
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0xa84]
jle 0x10018a73
cmp dword [ebp - 0x24], 0
je 0x10018a73
mov dword [ebp - 0x5c0], 1
jmp 0x10018a7a
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x24], eax
jge 0x10018aa6
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd0c], 0
je 0x10018aa6
mov dword [ebp - 0xbf0], 1
jmp 0x10018aad
and dword [ebp - 0xbf0], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xfac], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xfb4], eax
cmp dword [ebp - 0x54], 0
je 0x10018e70
mov dword [ebp - 0x234], 0xadf890ba
mov dword [ebp - 0x74], 0
jmp 0x10018ae3
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10018af9
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x3f8], 0x39200279
jmp 0x10018adc
mov dword [ebp - 0x74], 0
jmp 0x10018b09
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x10018b1f
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xce8], 0xaeaba4a2
jmp 0x10018b02
mov dword [ebp - 0x24], 0
jmp 0x10018b2f
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xa
jl 0x10018e54
mov dword [ebp - 0x5c8], 0x6d8f
mov dword [ebp - 0x2b8], 0
jmp 0x10018b5c
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x10018b78
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0xd00], 0x66d9918c
jmp 0x10018b4f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd0c], 0
jne 0x10018c27
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3f8]
cmp dword [ebp + eax - 0x3f8], ecx
jg 0x10018bb4
mov dword [ebp - 0xbf8], 1
jmp 0x10018bbb
and dword [ebp - 0xbf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0xfbc], eax
cmp dword [ebp - 0x5c8], 0x9342
jge 0x10018be6
mov dword [ebp - 0x868], 1
jmp 0x10018bed
and dword [ebp - 0x868], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xce8]
add eax, dword [ebp - 0x868]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x234], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp eax, dword [ebp - 0x234]
jg 0x10018c27
and dword [ebp - 0x348], 0
jmp 0x10018c31
mov dword [ebp - 0x348], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x348]
mov dword [ebp + eax - 0xd00], ecx
mov eax, dword [ebp - 0x348]
shl eax, 3
test eax, eax
je 0x10018e0f
mov dword [ebp - 0xc10], 0xfffffffc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd0c], 0
jne 0x10018c7b
mov dword [ebp - 0xc00], 1
jmp 0x10018c82
and dword [ebp - 0xc00], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd00]
mov dword [ebp - 0xfc4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xfcc], eax
cmp dword [ebp - 0x5c8], 0xfffffff7
je 0x10018cb3
mov dword [ebp - 0xc08], 1
jmp 0x10018cba
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xfd4], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xfdc], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xfe4], eax
cmp dword [ebp - 0xc10], 0xfffffffb
jbe 0x10018cea
mov dword [ebp - 0x9bc], 1
jmp 0x10018cf1
and dword [ebp - 0x9bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x9bc], eax
jge 0x10018d12
mov dword [ebp - 0x5d0], 1
jmp 0x10018d19
and dword [ebp - 0x5d0], 0
cmp dword [ebp - 0x5d0], 0xfffffff6
jge 0x10018d2e
mov dword [ebp - 0x870], 1
jmp 0x10018d35
and dword [ebp - 0x870], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xce8]
cmp dword [ebp - 0x870], eax
jle 0x10018d56
mov dword [ebp - 0x5d8], 1
jmp 0x10018d5d
and dword [ebp - 0x5d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xce8]
cmp dword [ebp - 0x5d8], eax
je 0x10018d7e
mov dword [ebp - 0xa44], 1
jmp 0x10018d85
and dword [ebp - 0xa44], 0
cmp dword [ebp - 0xa44], 0x1e9572ab
je 0x10018daa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xce8], 0
jne 0x10018daa
mov dword [ebp - 0x5e0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
imul eax, dword [ebp - 0x5e0]
sub eax, dword [ebp - 0x234]
jne 0x10018de2
mov dword [ebp - 0x54], 2
jmp 0x10018e1f
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x10018e4f
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x10018e3f
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xd00], 1
jmp 0x10018e18
jmp 0x10018b28
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10018e6e
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
jmp 0x10018e94
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x10018e94
push 0xf80
push 0x1a96
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
mov dword [ebp - 0x2c0], 1
jmp 0x10018ead
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0
jl 0x10018eea
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x10018ee8
push 0
push 0x1ca
push 0x4d9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x10018ea0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1054]
call fcn.100157fd
push 1
lea ecx, [ebp - 0x3b0]
call fcn.10015795
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x23c], 0
jmp 0x10018f26
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jge 0x10018f48
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x3b0]
call fcn.10015802
mov dword [eax], 0xb26bdde0
jmp 0x10018f19
push 0
lea ecx, [ebp - 0x3b0]
call fcn.10015802
mov dword [eax], 0xffffffee
jmp 0x10018f81
push 0
lea ecx, [ebp - 0x3b0]
call fcn.10015802
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x5e8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5e8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3b0]
call fcn.10015802
cmp dword [eax], 0x1b
jne 0x10019226
push 3
lea ecx, [ebp - 0x41c]
call fcn.10015795
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x9cc], 0xffffffff
mov dword [ebp - 0x2c8], 0
jmp 0x10018fd2
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 3
jge 0x10018ff4
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0x41c]
call fcn.10015802
mov dword [eax], 0xd581
jmp 0x10018fc5
mov dword [ebp - 0x5c], 2
jmp 0x10019004
cmp dword [ebp - 0x5c], 0
jl 0x100191f8
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0x888], 1
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xfec], eax
mov dword [ebp - 0x244], 0x56ee9734
cmp dword [ebp - 0x244], 0xfffffffc
jb 0x1001904a
mov dword [ebp - 0x9c4], 1
jmp 0x10019051
and dword [ebp - 0x9c4], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x41c]
call fcn.10015802
mov ecx, dword [ebp - 0x9c4]
cmp ecx, dword [eax]
jle 0x10019075
mov dword [ebp - 0x5f0], 1
jmp 0x1001907c
and dword [ebp - 0x5f0], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x41c]
call fcn.10015802
mov esi, dword [eax]
imul esi, dword [ebp - 0x5f0]
push 0
lea ecx, [ebp - 0x3b0]
call fcn.10015802
add esi, dword [eax]
jne 0x100190b0
mov dword [ebp - 0x880], 1
jmp 0x100190b7
and dword [ebp - 0x880], 0
push 1
lea ecx, [ebp - 0x41c]
call fcn.10015802
mov ecx, dword [ebp - 0x880]
cmp ecx, dword [eax]
jl 0x100190da
mov dword [ebp - 0x5f8], 1
jmp 0x100190e1
and dword [ebp - 0x5f8], 0
push 0
lea ecx, [ebp - 0x3b0]
call fcn.10015802
mov esi, dword [eax]
add esi, dword [ebp - 0x5f8]
push 0
lea ecx, [ebp - 0x41c]
call fcn.10015802
cmp esi, dword [eax]
jne 0x1001911c
cmp dword [ebp - 0x244], 0
je 0x1001911c
mov dword [ebp - 0xac4], 1
jmp 0x10019123
and dword [ebp - 0xac4], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x41c]
call fcn.10015802
mov eax, dword [eax]
cmp eax, dword [ebp - 0xac4]
jg 0x10019147
mov dword [ebp - 0x600], 1
jmp 0x1001914e
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x888], eax
push 0
lea ecx, [ebp - 0x3b0]
call fcn.10015802
cmp dword [eax], 0
je 0x1001918b
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x41c]
call fcn.10015802
cmp dword [eax], 0
je 0x1001918b
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0xff4], eax
mov esi, dword [ebp - 0x888]
push 0
lea ecx, [ebp - 0x3b0]
call fcn.10015802
cmp esi, dword [eax]
je 0x100191c1
cmp dword [ebp - 0x9cc], 0
je 0x10019212
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x41c]
call fcn.100157fd
jmp 0x10019226
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x41c]
call fcn.100157fd
jmp 0x10018f5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b0]
call fcn.100157fd
mov dword [ebp - 0x2d0], 0
jmp 0x1001924e
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 1
jge 0x1001926a
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0x24c], 0x5b9b55bb
jmp 0x10019241
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x24c], 0
jmp 0x10019298
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x24c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24c], 3
jl 0x100192d5
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x100192d3
push 0x173a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
jmp 0x1001927d
push 1
lea ecx, [ebp - 0x3c0]
call fcn.10015795
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x2d8], 0
jmp 0x10019302
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jge 0x10019324
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0x3c0]
call fcn.10015802
mov dword [eax], 0xb26bdde0
jmp 0x100192f5
push 0
lea ecx, [ebp - 0x3c0]
call fcn.10015802
mov dword [eax], 0xffffffee
jmp 0x1001935d
push 0
lea ecx, [ebp - 0x3c0]
call fcn.10015802
cmp dword [eax], 0x1b
jne 0x10019602
push 3
lea ecx, [ebp - 0x404]
call fcn.10015795
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x8a0], 0xffffffff
mov dword [ebp - 0x254], 0
jmp 0x100193ae
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jge 0x100193d0
push dword [ebp - 0x254]
lea ecx, [ebp - 0x404]
call fcn.10015802
mov dword [eax], 0xd581
jmp 0x100193a1
mov dword [ebp - 0x7c], 2
jmp 0x100193e0
cmp dword [ebp - 0x7c], 0
jl 0x100195d4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c0]
call fcn.100157fd
movzx eax, byte [0x1067f514]
test eax, eax
je 0x1001962f
mov esi, 0x10093854
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1001e4d9
mov dword [ebp - 0x25c], 0
jmp 0x10019648
cmp dword [ebp - 0x25c], 1
jge 0x10019664
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0x2e8], 0x5b9b55bb
jmp 0x1001963b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2e8], 0
jmp 0x10019692
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret