Function at 0x10008db4
Capabilities:
Delete registry value
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007bebe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf4c
push esi
push edi
mov dword [ebp - 0x10], 0x5252cb13
mov dword [ebp - 0xc4], 0x5165352f
mov dword [ebp - 0x870], 0x6a205b29
mov dword [ebp - 0x80], 0xb17b
mov dword [ebp - 0xea0], 1
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 0
je 0x10008e27
cmp dword [ebp - 0x10], 0
je 0x10008e27
mov dword [ebp - 0x988], 1
jmp 0x10008e2e
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc4], eax
je 0x10008e45
mov dword [ebp - 0x9e0], 1
jmp 0x10008e4c
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xe1c], eax
cmp dword [ebp - 0x80], 1
jge 0x10008e6a
mov dword [ebp - 0x8b4], 1
jmp 0x10008e71
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x8b4], eax
jge 0x10008e88
mov dword [ebp - 0x8bc], 1
jmp 0x10008e8f
and dword [ebp - 0x8bc], 0
cmp dword [ebp - 0x8bc], 0xfffffff7
jle 0x10008ea4
mov dword [ebp - 0x98c], 1
jmp 0x10008eab
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xca8], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
je 0x100090de
and dword [ebp - 0xb48], 0
and dword [ebp - 0xb44], 0
and dword [ebp - 0xb40], 0
and dword [ebp - 0xb3c], 0
lea ecx, [ebp - 0x3c9]
call fcn.10008b73
push eax
lea eax, [ebp - 0xb38]
push eax
lea eax, [ebp - 0xb48]
push eax
lea ecx, [ebp - 0xf58]
call fcn.10015060
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x930]
call fcn.10015026
and dword [ebp - 4], 0
mov dword [ebp - 0x80], 0
jmp 0x10008f25
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x33
jne 0x10008f99
mov dword [ebp - 0xc4], 0
jmp 0x10008f44
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x34
jle 0x10008f97
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x10008f69
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x10], 0
jmp 0x10008f79
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xb
jge 0x10008f95
mov dword [ebp - 0x9f0], 0xf62c4df8
mov dword [ebp - 0x9f0], 0xfffffff6
jmp 0x10008f72
jmp 0x10008f37
jmp 0x10008f1e
mov dword [ebp - 0x10], 3
jmp 0x10008fa9
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x100090cd
push 4
lea ecx, [ebp - 0xbfc]
call fcn.10014fc7
mov byte [ebp - 4], 1
mov dword [ebp - 0x1b0], 0
jmp 0x10008fdd
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 4
jge 0x10008fff
push dword [ebp - 0x1b0]
lea ecx, [ebp - 0xbfc]
call fcn.10015051
mov dword [eax], 0x6eae1177
jmp 0x10008fd0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x930]
call fcn.10015051
cmp dword [ebp - 0x10], 0
je 0x10009023
mov esi, dword [ebp - 0x80]
push 2
lea ecx, [ebp - 0x930]
call fcn.10015051
cmp dword [ebp - 0x80], 0xf93be41b
jbe 0x10009038
mov dword [ebp - 0x8c4], 1
jmp 0x1000903f
and dword [ebp - 0x8c4], 0
imul esi, dword [ebp - 0x8c4], 0xbb30
push dword [ebp - 0x10]
lea ecx, [ebp - 0x930]
call fcn.10015051
add esi, dword [eax]
jne 0x1000906a
cmp dword [ebp - 0x10], 0
jne 0x1000906a
and dword [ebp - 0x8cc], 0
jmp 0x10009074
mov dword [ebp - 0x8cc], 1
push 1
lea ecx, [ebp - 0x930]
call fcn.10015051
mov esi, dword [ebp - 0x8cc]
sub esi, dword [eax]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x930]
call fcn.10015051
mov dword [eax], esi
push 3
lea ecx, [ebp - 0x930]
call fcn.10015051
mov esi, eax
push 1
lea ecx, [ebp - 0xbfc]
call fcn.10015051
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbfc]
call fcn.1001504c
jmp 0x10008fa2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x930]
call fcn.1001504c
jmp 0x100090f5
mov dword [ebp - 0x8d4], 0xd734895c
mov eax, dword [ebp - 0x8d4]
inc eax
mov dword [ebp - 0x8d4], eax
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1000910f
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [ebp - 0x14], 0x5252cb13
mov dword [ebp - 0xcc], 0x5165352f
mov dword [ebp - 0x8dc], 0x6a205b29
mov dword [ebp - 0x98], 0xb17b
mov dword [ebp - 0xe04], 1
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x8dc], eax
cmp dword [ebp - 0x8dc], 0
je 0x10009165
cmp dword [ebp - 0x14], 0
je 0x10009165
mov dword [ebp - 0xa08], 1
jmp 0x1000916c
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xcc], eax
je 0x10009183
mov dword [ebp - 0xa10], 1
jmp 0x1000918a
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xcb0], eax
cmp dword [ebp - 0x98], 1
jge 0x100091ab
mov dword [ebp - 0x8e4], 1
jmp 0x100091b2
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x8e4], eax
jge 0x100091cc
mov dword [ebp - 0x8f8], 1
jmp 0x100091d3
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 0xfffffff7
jle 0x100091e8
mov dword [ebp - 0xa18], 1
jmp 0x100091ef
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe24], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
je 0x1000943a
and dword [ebp - 0xb5c], 0
and dword [ebp - 0xb58], 0
and dword [ebp - 0xb54], 0
and dword [ebp - 0xb50], 0
lea ecx, [ebp - 0x3d9]
call fcn.10008b73
push eax
lea eax, [ebp - 0xb4c]
push eax
lea eax, [ebp - 0xb5c]
push eax
lea ecx, [ebp - 0xf38]
call fcn.10015060
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x93c]
call fcn.10015026
mov dword [ebp - 4], 2
mov dword [ebp - 0x98], 0
jmp 0x10009275
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x33
jne 0x100092ef
mov dword [ebp - 0xcc], 0
jmp 0x10009297
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x34
jle 0x100092ea
mov byte [ebp - 0x11f], 0
movzx eax, byte [ebp - 0x11f]
test eax, eax
je 0x100092bc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x14], 0
jmp 0x100092cc
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xb
jge 0x100092e8
mov dword [ebp - 0xa20], 0xf62c4df8
mov dword [ebp - 0xa20], 0xfffffff6
jmp 0x100092c5
jmp 0x1000928a
jmp 0x10009268
mov dword [ebp - 0x14], 3
jmp 0x100092ff
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10009429
push 4
lea ecx, [ebp - 0xb9c]
call fcn.10014fc7
mov byte [ebp - 4], 3
mov dword [ebp - 0x268], 0
jmp 0x10009333
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 4
jge 0x10009355
push dword [ebp - 0x268]
lea ecx, [ebp - 0xb9c]
call fcn.10015051
mov dword [eax], 0x6eae1177
jmp 0x10009326
push dword [ebp - 0x14]
lea ecx, [ebp - 0x93c]
call fcn.10015051
cmp dword [ebp - 0x14], 0
je 0x1000937c
mov esi, dword [ebp - 0x98]
push 2
lea ecx, [ebp - 0x93c]
call fcn.10015051
cmp dword [ebp - 0x98], 0xf93be41b
jbe 0x10009394
mov dword [ebp - 0x900], 1
jmp 0x1000939b
and dword [ebp - 0x900], 0
imul esi, dword [ebp - 0x900], 0xbb30
push dword [ebp - 0x14]
lea ecx, [ebp - 0x93c]
call fcn.10015051
add esi, dword [eax]
jne 0x100093c6
cmp dword [ebp - 0x14], 0
jne 0x100093c6
and dword [ebp - 0x908], 0
jmp 0x100093d0
mov dword [ebp - 0x908], 1
push 1
lea ecx, [ebp - 0x93c]
call fcn.10015051
mov esi, dword [ebp - 0x908]
sub esi, dword [eax]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x93c]
call fcn.10015051
mov dword [eax], esi
push 3
lea ecx, [ebp - 0x93c]
call fcn.10015051
mov esi, eax
push 1
lea ecx, [ebp - 0xb9c]
call fcn.10015051
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb9c]
call fcn.1001504c
jmp 0x100092f8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x93c]
call fcn.1001504c
jmp 0x10009451
mov dword [ebp - 0x910], 0xd734895c
mov eax, dword [ebp - 0x910]
inc eax
mov dword [ebp - 0x910], eax
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1000946b
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [ebp - 0x18], 0x5252cb13
mov dword [ebp - 0x2d0], 0xffffffff
mov dword [ebp - 0x1b8], 0
jmp 0x10009495
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 3
jge 0x100094b1
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0xee8], 0xfffffff6
jmp 0x10009488
mov dword [ebp - 0x2d0], 2
jmp 0x100094ca
mov eax, dword [ebp - 0x2d0]
dec eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0
jl 0x10009535
mov dword [ebp - 0x1c0], 0xfe77dd68
mov dword [ebp - 0x1c0], 2
jmp 0x100094f6
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x10009533
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x10009531
push 0
push 0xf4a
push 0x2673
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
jmp 0x100094e9
jmp 0x100094bd
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xee8], 0xf3d4210e
mov dword [ebp - 0xd4], 0x5165352f
mov dword [ebp - 0x270], 3
mov dword [ebp - 0x3e4], 0xcdead9ba
mov dword [ebp - 0x7b4], 1
mov dword [ebp - 0x350], 0xfffffff6
mov dword [ebp - 0x440], 1
mov dword [ebp - 0x450], 0x389a9b8
mov dword [ebp - 0x7cc], 0x2c39d5b6
mov dword [ebp - 0x458], 0xffffffff
mov dword [ebp - 0xa30], 0xdf8a
cmp dword [ebp - 0x270], 0
jne 0x100095c4
cmp dword [ebp - 0x3e4], 0
jne 0x100095c4
and dword [ebp - 0x448], 0
jmp 0x100095ce
mov dword [ebp - 0x448], 1
mov dword [ebp - 0x350], 9
mov eax, dword [ebp - 0x350]
imul eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0x270]
jge 0x100095f9
mov dword [ebp - 0x918], 1
jmp 0x10009600
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x918], eax
jl 0x1000961a
mov dword [ebp - 0x8ec], 1
jmp 0x10009621
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x8ec]
inc eax
jne 0x10009633
cmp dword [ebp - 0x270], 0
je 0x10009648
cmp dword [ebp - 0x350], 0
je 0x10009648
mov dword [ebp - 0x7a4], 1
jmp 0x1000964f
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x450]
cmp dword [ebp - 0x440], eax
jg 0x10009675
mov dword [ebp - 0x7ac], 1
jmp 0x1000967c
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7cc]
cmp dword [ebp - 0x7ac], eax
jne 0x10009696
mov dword [ebp - 0xa28], 1
jmp 0x1000969d
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xed8], eax
mov eax, dword [ebp - 0x270]
sub eax, dword [ebp - 0x458]
cmp eax, dword [ebp - 0x450]
jge 0x100096d5
mov dword [ebp - 0x7bc], 1
jmp 0x100096dc
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0xa30]
cmp dword [ebp - 0x7bc], eax
jl 0x100096f6
mov dword [ebp - 0x7c4], 1
jmp 0x100096fd
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x458]
imul eax, dword [ebp - 0x7c4]
imul eax, eax, 0
test eax, eax
jne 0x10009723
mov eax, 0x2ef7
test eax, eax
jne 0x10009723
and dword [ebp - 0x460], 0
jmp 0x1000972d
mov dword [ebp - 0x460], 1
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x7cc], eax
mov dword [ebp - 0x470], 0x6a205b29
mov dword [ebp - 0x304], 0x10c93b4e
mov dword [ebp - 0xcf4], 0xfffffff7
push 1
lea ecx, [ebp - 0xcd4]
call fcn.10014fc7
mov dword [ebp - 4], 4
mov dword [ebp - 0x7d4], 4
mov dword [ebp - 0x1c8], 0
jmp 0x1000978e
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jge 0x100097b0
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0xcd4]
call fcn.10015051
mov dword [eax], 0x17f75960
jmp 0x10009781
mov dword [ebp - 0x304], 0
jmp 0x100097c9
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0xc
je 0x100097eb
mov dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
dec eax
mov dword [ebp - 0x468], eax
jmp 0x100097bc
mov eax, dword [ebp - 0x7d4]
dec eax
mov dword [ebp - 0x7d4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcd4]
call fcn.1001504c
mov dword [ebp - 0x90], 0xb17b
push 1
lea ecx, [ebp - 0xe18]
call fcn.10014fc7
mov dword [ebp - 4], 5
mov dword [ebp - 0x278], 1
mov dword [ebp - 0x1d0], 0
jmp 0x10009848
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x1000986a
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xe18]
call fcn.10015051
mov dword [eax], 0xea7
jmp 0x1000983b
mov dword [ebp - 0x278], 0
jmp 0x10009883
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
jg 0x100098b6
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x100098b4
push 0
push 0
push 0x59d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x10009876
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe18]
call fcn.1001504c
mov dword [ebp - 0xe20], 1
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0
je 0x100098f6
cmp dword [ebp - 0x18], 0
je 0x100098f6
mov dword [ebp - 0xa38], 1
jmp 0x100098fd
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xd4], eax
je 0x10009914
mov dword [ebp - 0xa40], 1
jmp 0x1000991b
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd04], eax
cmp dword [ebp - 0x90], 1
jge 0x1000993c
mov dword [ebp - 0x7dc], 1
jmp 0x10009943
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x7dc], eax
jge 0x1000995d
mov dword [ebp - 0x478], 1
jmp 0x10009964
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 0xfffffff7
jle 0x10009979
mov dword [ebp - 0xa48], 1
jmp 0x10009980
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xe64], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x1000a0cc
mov dword [ebp - 0x180], 0x61928c17
mov dword [ebp - 0x4c], 0xc3099cf
mov dword [ebp - 0xd14], 0xfffffff7
mov dword [ebp - 0xe28], 0xdfe9f486
mov dword [ebp - 0xd24], 0xcb314b81
mov dword [ebp - 0xeb4], 0xffffffff
mov dword [ebp - 0x3c4], 5
mov dword [ebp - 0x180], 1
jmp 0x100099f1
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xffffffe2
jg 0x10009d46
mov dword [ebp - 0x12c], 0x66bc657e
mov dword [ebp - 0x1d8], 0
jmp 0x10009a21
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x10009a3d
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0xf00], 0xb6084edc
jmp 0x10009a14
cmp dword [ebp - 0x4c], 0
je 0x10009b7a
mov dword [ebp - 0x4c], 0
jmp 0x10009a57
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe2
jge 0x10009b75
mov dword [ebp - 0xb84], 0x4bc662a2
mov dword [ebp - 0xb80], 0x4bc662a2
mov dword [ebp - 0xb7c], 0x4bc662a2
mov dword [ebp - 0xb78], 0x4bc662a2
lea ecx, [ebp - 0x3d1]
call fcn.10008b73
push eax
lea eax, [ebp - 0xb74]
push eax
lea eax, [ebp - 0xb84]
push eax
lea ecx, [ebp - 0xf50]
call fcn.10015060
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa88]
call fcn.10015026
mov dword [ebp - 4], 6
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10009adf
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
push 2
lea ecx, [ebp - 0xa88]
call fcn.10015051
mov dword [eax], 0xffffffed
jmp 0x10009b18
push 2
lea ecx, [ebp - 0xa88]
call fcn.10015051
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0x7e4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7e4]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xa88]
call fcn.10015051
cmp dword [eax], 0xb
jne 0x10009b61
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x10009b4b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 2
lea ecx, [ebp - 0xa88]
call fcn.10015051
cmp dword [eax], 0
je 0x10009b5f
jmp 0x10009b61
jmp 0x10009af4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa88]
call fcn.1001504c
jmp 0x10009a50
jmp 0x10009d41
mov dword [ebp - 0x358], 0xf7c2f5a2
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x4c], 0xffffffe4
jmp 0x10009b9e
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe6
jne 0x10009ced
mov dword [ebp - 0x2cc], 0
jmp 0x10009bc1
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jge 0x10009bdd
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0xb18], 0xffffffff
jmp 0x10009bb4
cmp dword [ebp - 0x358], 0
je 0x10009c02
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb18], 0
je 0x10009c02
mov dword [ebp - 0xa50], 1
jmp 0x10009c09
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0x3c4]
dec eax
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0xd34], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x358]
cmp dword [ebp + eax - 0xb18], ecx
jle 0x10009c43
mov dword [ebp - 0x480], 1
jmp 0x10009c4a
and dword [ebp - 0x480], 0
imul eax, dword [ebp - 0x480], 0xcf5
neg eax
jne 0x10009c6a
cmp dword [ebp - 0x180], 0
jne 0x10009c6a
and dword [ebp - 0xa58], 0
jmp 0x10009c74
mov dword [ebp - 0xa58], 1
mov eax, dword [ebp - 0x12c]
inc eax
xor ecx, ecx
inc ecx
sub ecx, eax
cmp dword [ebp - 0x12c], ecx
jne 0x10009c94
mov dword [ebp - 0x7ec], 1
jmp 0x10009c9b
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x7ec], eax
jne 0x10009cb5
mov dword [ebp - 0x488], 1
jmp 0x10009cbc
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
neg eax
cmp eax, 0xffffffff
jge 0x10009cd5
mov dword [ebp - 0x7f4], 1
jmp 0x10009cdc
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x490], eax
jmp 0x10009b97
mov dword [ebp - 0x12c], 0
jmp 0x10009d06
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x17
je 0x10009d41
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x4c], eax
jl 0x10009d26
mov dword [ebp - 0x7fc], 1
jmp 0x10009d2d
and dword [ebp - 0x7fc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7fc]
mov dword [ebp + eax - 0xf00], ecx
jmp 0x10009cf9
jmp 0x100099e4
and dword [ebp - 0xb70], 0
and dword [ebp - 0xb6c], 0
and dword [ebp - 0xb68], 0
and dword [ebp - 0xb64], 0
lea ecx, [ebp - 0x345]
call fcn.10008b73
push eax
lea eax, [ebp - 0xb60]
push eax
lea eax, [ebp - 0xb70]
push eax
lea ecx, [ebp - 0xf40]
call fcn.10015060
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x924]
call fcn.10015026
mov dword [ebp - 4], 7
mov dword [ebp - 0x90], 0
jmp 0x10009db7
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x33
jne 0x10009e31
mov dword [ebp - 0xd4], 0
jmp 0x10009dd9
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x34
jle 0x10009e2c
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10009dfe
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x18], 0
jmp 0x10009e0e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jge 0x10009e2a
mov dword [ebp - 0xa60], 0xf62c4df8
mov dword [ebp - 0xa60], 0xfffffff6
jmp 0x10009e07
jmp 0x10009dcc
jmp 0x10009daa
mov dword [ebp - 0x168], 0x62d5e48d
mov dword [ebp - 0xe34], 1
mov dword [ebp - 0xa68], 0xbac04ee7
mov dword [ebp - 0xe74], 0x5b40194d
mov dword [ebp - 0xe70], 0x5b40194d
mov dword [ebp - 0xe6c], 0x5b40194d
mov dword [ebp - 0xe68], 0x5b40194d
push 3
lea ecx, [ebp - 0xcf0]
call fcn.10014fc7
mov byte [ebp - 4], 8
mov dword [ebp - 0x498], 0x42f3
mov dword [ebp - 0x1e0], 0
jmp 0x10009eab
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x10009ecd
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0xcf0]
call fcn.10015051
mov dword [eax], 0xfffffffb
jmp 0x10009e9e
mov dword [ebp - 0x168], 0
jmp 0x10009ee6
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x18
jg 0x10009f66
mov dword [ebp - 0xd44], 0x867b8f5f
push 3
lea ecx, [ebp - 0xce0]
call fcn.10014fc7
mov byte [ebp - 4], 9
mov dword [ebp - 0x280], 0
jmp 0x10009f23
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jge 0x10009f45
push dword [ebp - 0x280]
lea ecx, [ebp - 0xce0]
call fcn.10015051
mov dword [eax], 0x5fac1226
jmp 0x10009f16
mov eax, dword [ebp - 0x498]
inc eax
mov dword [ebp - 0x498], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xce0]
call fcn.1001504c
jmp 0x10009ed9
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0x168], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xcf0]
call fcn.1001504c
mov dword [ebp - 0x18], 3
jmp 0x10009f91
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1000a0bb
push 4
lea ecx, [ebp - 0xbb4]
call fcn.10014fc7
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1e8], 0
jmp 0x10009fc5
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 4
jge 0x10009fe7
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0xbb4]
call fcn.10015051
mov dword [eax], 0x6eae1177
jmp 0x10009fb8
push dword [ebp - 0x18]
lea ecx, [ebp - 0x924]
call fcn.10015051
cmp dword [ebp - 0x18], 0
je 0x1000a00e
mov esi, dword [ebp - 0x90]
push 2
lea ecx, [ebp - 0x924]
call fcn.10015051
cmp dword [ebp - 0x90], 0xf93be41b
jbe 0x1000a026
mov dword [ebp - 0x804], 1
jmp 0x1000a02d
and dword [ebp - 0x804], 0
imul esi, dword [ebp - 0x804], 0xbb30
push dword [ebp - 0x18]
lea ecx, [ebp - 0x924]
call fcn.10015051
add esi, dword [eax]
jne 0x1000a058
cmp dword [ebp - 0x18], 0
jne 0x1000a058
and dword [ebp - 0x4a0], 0
jmp 0x1000a062
mov dword [ebp - 0x4a0], 1
push 1
lea ecx, [ebp - 0x924]
call fcn.10015051
mov esi, dword [ebp - 0x4a0]
sub esi, dword [eax]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x924]
call fcn.10015051
mov dword [eax], esi
push 3
lea ecx, [ebp - 0x924]
call fcn.10015051
mov esi, eax
push 1
lea ecx, [ebp - 0xbb4]
call fcn.10015051
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xbb4]
call fcn.1001504c
jmp 0x10009f8a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x924]
call fcn.1001504c
jmp 0x1000a0e3
mov dword [ebp - 0x80c], 0xd734895c
mov eax, dword [ebp - 0x80c]
inc eax
mov dword [ebp - 0x80c], eax
push 1
lea ecx, [ebp - 0xa98]
call fcn.10014fc7
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x58], 0
jmp 0x1000a107
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1000a11d
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xe78], 1
jmp 0x1000a100
mov dword [ebp - 0x58], 0
jmp 0x1000a12d
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1000a149
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa98]
call fcn.10015051
mov dword [eax], 0xa32b1cec
jmp 0x1000a126
push 0
lea ecx, [ebp - 0xa98]
call fcn.10015051
and dword [eax], 0
jmp 0x1000a17f
push 0
lea ecx, [ebp - 0xa98]
call fcn.10015051
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4a8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa98]
call fcn.10015051
cmp dword [eax], 0
jl 0x1000a1df
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x1000a1b9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x1000a1da
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x1000a15b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa98]
call fcn.1001504c
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1000a208
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [ebp - 0x190], 0
mov dword [ebp - 0xa70], 0xbacd7953
mov dword [ebp - 0x190], 0xfffffff9
jmp 0x1000a235
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xfffffffb
jl 0x1000a27e
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xa70], eax
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1000a27c
push 0
push 0x1b85
push 0x490
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x1000a228
push 2
lea ecx, [ebp - 0xaf8]
call fcn.10014fc7
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x150], 1
mov dword [ebp - 0xd54], 0x43250e6d
mov dword [ebp - 0x2ec], 0
jmp 0x1000a2bf
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 2
jge 0x1000a2e1
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0xaf8]
call fcn.10015051
mov dword [eax], 0xa684
jmp 0x1000a2b2
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x1000a2fd
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x150], 1
jmp 0x1000a316
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x1000a349
push dword [ebp - 0x150]
lea ecx, [ebp - 0xaf8]
call fcn.10015051
mov esi, eax
push dword [ebp - 0x150]
lea ecx, [ebp - 0xaf8]
call fcn.10015051
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000a309
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf8]
call fcn.1001504c
mov dword [ebp - 0x170], 0
mov dword [ebp - 0xa78], 0xbacd7953
mov dword [ebp - 0x170], 0xfffffff9
jmp 0x1000a385
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xfffffffb
jl 0x1000a3ce
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xa78], eax
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000a3cc
push 0
push 0x1b85
push 0x490
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x1000a378
push 2
lea ecx, [ebp - 0xb10]
call fcn.10014fc7
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x138], 1
mov dword [ebp - 0xe3c], 0x43250e6d
mov dword [ebp - 0x1f0], 0
jmp 0x1000a40f
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x1000a431
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0xb10]
call fcn.10015051
mov dword [eax], 0xa684
jmp 0x1000a402
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1000a44d
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x138], 1
jmp 0x1000a466
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jl 0x1000a499
push dword [ebp - 0x138]
lea ecx, [ebp - 0xb10]
call fcn.10015051
mov esi, eax
push dword [ebp - 0x138]
lea ecx, [ebp - 0xb10]
call fcn.10015051
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000a459
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb10]
call fcn.1001504c
mov dword [ebp - 0x188], 0
mov dword [ebp - 0xae8], 0xbacd7953
mov dword [ebp - 0x188], 0xfffffff9
jmp 0x1000a4d5
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xfffffffb
jl 0x1000a51e
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xae8], eax
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1000a51c
push 0
push 0x1b85
push 0x490
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x1000a4c8
mov dword [ebp - 0x178], 0x62d5e48d
mov dword [ebp - 0xd64], 1
mov dword [ebp - 0x9fc], 0xbac04ee7
mov dword [ebp - 0xe88], 0x5b40194d
mov dword [ebp - 0xe84], 0x5b40194d
mov dword [ebp - 0xe80], 0x5b40194d
mov dword [ebp - 0xe7c], 0x5b40194d
push 3
lea ecx, [ebp - 0xd10]
call fcn.10014fc7
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x814], 0x42f3
mov dword [ebp - 0x288], 0
jmp 0x1000a59b
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 3
jge 0x1000a5bd
push dword [ebp - 0x288]
lea ecx, [ebp - 0xd10]
call fcn.10015051
mov dword [eax], 0xfffffffb
jmp 0x1000a58e
mov dword [ebp - 0x178], 0
jmp 0x1000a5d6
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x18
jg 0x1000a656
mov dword [ebp - 0xed0], 0x867b8f5f
push 3
lea ecx, [ebp - 0xd00]
call fcn.10014fc7
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x1f8], 0
jmp 0x1000a613
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x1000a635
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xd00]
call fcn.10015051
mov dword [eax], 0x5fac1226
jmp 0x1000a606
mov eax, dword [ebp - 0x814]
inc eax
mov dword [ebp - 0x814], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xd00]
call fcn.1001504c
jmp 0x1000a5c9
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0x178], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd10]
call fcn.1001504c
push 2
lea ecx, [ebp - 0xb04]
call fcn.10014fc7
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x148], 1
mov dword [ebp - 0xd74], 0x43250e6d
mov dword [ebp - 0x2d4], 0
jmp 0x1000a6b2
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 2
jge 0x1000a6d4
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0xb04]
call fcn.10015051
mov dword [eax], 0xa684
jmp 0x1000a6a5
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1000a6f0
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x148], 1
jmp 0x1000a709
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jl 0x1000a73c
push dword [ebp - 0x148]
lea ecx, [ebp - 0xb04]
call fcn.10015051
mov esi, eax
push dword [ebp - 0x148]
lea ecx, [ebp - 0xb04]
call fcn.10015051
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000a6fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb04]
call fcn.1001504c
push 3
lea ecx, [ebp - 0x338]
call fcn.10014fc7
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x974], 0xfffffff8
mov dword [ebp - 0x970], 0xfffffff8
mov dword [ebp - 0x96c], 0xfffffff8
mov dword [ebp - 0x968], 0xfffffff8
mov dword [ebp - 0x854], 0xffffffff
mov dword [ebp - 0x3c], 0xa55b90cb
push 3
lea ecx, [ebp - 0xc08]
call fcn.10014fc7
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x50], 0
jmp 0x1000a7c0
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1000a7dc
push dword [ebp - 0x50]
lea ecx, [ebp - 0x338]
call fcn.10015051
mov dword [eax], 0x7f825e7a
jmp 0x1000a7b9
mov dword [ebp - 0x50], 0
jmp 0x1000a7ec
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1000a808
push dword [ebp - 0x50]
lea ecx, [ebp - 0xc08]
call fcn.10015051
mov dword [eax], 1
jmp 0x1000a7e5
mov dword [ebp - 0x34], 2
jmp 0x1000a818
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1000acaa
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x4d8], 0xbe776e9f
mov dword [ebp - 0x200], 0
jmp 0x1000a84f
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 4
jge 0x1000a86b
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0xc48], 0x94d03572
jmp 0x1000a842
push 0
lea ecx, [ebp - 0x338]
call fcn.10015051
mov ecx, dword [ebp - 0x34]
cmp dword [eax], ecx
je 0x1000a88b
mov dword [ebp - 0x3d0], 1
jmp 0x1000a892
and dword [ebp - 0x3d0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0xc48], ecx
cmp dword [ebp - 0x3d0], 0x18d3
jne 0x1000a8bd
mov dword [ebp - 0x4b0], 1
jmp 0x1000a8c4
and dword [ebp - 0x4b0], 0
push 1
lea ecx, [ebp - 0x338]
call fcn.10015051
mov ecx, dword [ebp - 0x4b0]
cmp ecx, dword [eax]
jg 0x1000a8e7
mov dword [ebp - 0x81c], 1
jmp 0x1000a8ee
and dword [ebp - 0x81c], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x338]
call fcn.10015051
mov esi, dword [ebp - 0x81c]
imul esi, dword [eax]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x338]
call fcn.10015051
cmp esi, dword [eax]
jne 0x1000a923
mov dword [ebp - 0x4b8], 1
jmp 0x1000a92a
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 0xc2d6
je 0x1000a942
mov dword [ebp - 0x824], 1
jmp 0x1000a949
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x34], eax
jg 0x1000a96c
mov dword [ebp - 0x4c0], 1
jmp 0x1000a973
and dword [ebp - 0x4c0], 0
cmp dword [ebp - 0x4c0], 0xfffa
jne 0x1000a98b
mov dword [ebp - 0x82c], 1
jmp 0x1000a992
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x82c], 0xa6c84902
je 0x1000a9aa
mov dword [ebp - 0x4c8], 1
jmp 0x1000a9b1
and dword [ebp - 0x4c8], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x338]
call fcn.10015051
mov eax, dword [eax]
sub eax, dword [ebp - 0x4c8]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x974]
jle 0x1000ac52
mov dword [ebp - 0x360], 0
mov dword [ebp - 0x994], 0xb39
mov dword [ebp - 0x84], 0
jmp 0x1000aa06
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jg 0x1000ac50
mov dword [ebp - 0xdc], 0xc8a52b4b
mov dword [ebp - 0xdc], 0
jmp 0x1000aa36
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jg 0x1000aa62
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x1000aa60
push 0x1b44
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x1000aa29
cmp dword [ebp - 0xdc], 0
jne 0x1000ab8f
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xe44], eax
mov eax, dword [ebp - 0x360]
imul eax, dword [ebp - 0x360]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc48]
jl 0x1000aaa3
mov dword [ebp - 0x834], 1
jmp 0x1000aaaa
and dword [ebp - 0x834], 0
cmp dword [ebp - 0x834], 7
jne 0x1000aabf
mov dword [ebp - 0x4d0], 1
jmp 0x1000aac6
and dword [ebp - 0x4d0], 0
imul eax, dword [ebp - 0x4d0], 0x69a0
cmp eax, dword [ebp - 0x4d8]
jl 0x1000aae4
mov dword [ebp - 0x83c], 1
jmp 0x1000aaeb
and dword [ebp - 0x83c], 0
imul esi, dword [ebp - 0x83c], 5
push dword [ebp - 0x34]
lea ecx, [ebp - 0x338]
call fcn.10015051
add esi, dword [eax]
cmp esi, dword [ebp - 0x4d8]
jl 0x1000ab16
mov dword [ebp - 0x844], 1
jmp 0x1000ab1d
and dword [ebp - 0x844], 0
imul eax, dword [ebp - 0x844], 0xe487
cmp eax, dword [ebp - 0x360]
jle 0x1000ab3b
mov dword [ebp - 0x4e0], 1
jmp 0x1000ab42
and dword [ebp - 0x4e0], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x338]
call fcn.10015051
mov ecx, dword [ebp - 0x4e0]
add ecx, dword [eax]
push 4
pop eax
shl eax, 1
cmp ecx, dword [ebp + eax - 0x974]
jne 0x1000ab72
mov dword [ebp - 0x84c], 1
jmp 0x1000ab79
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x84c]
add eax, 0x1d1bedd5
jne 0x1000ab8f
and dword [ebp - 0x4e8], 0
jmp 0x1000ab99
mov dword [ebp - 0x4e8], 1
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0x994]
cmp dword [ebp - 0x854], eax
jle 0x1000abbf
mov dword [ebp - 0x4f0], 1
jmp 0x1000abc6
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x4f0], eax
je 0x1000abe0
mov dword [ebp - 0x85c], 1
jmp 0x1000abe7
and dword [ebp - 0x85c], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x338]
call fcn.10015051
mov ecx, dword [ebp - 0x85c]
sub ecx, dword [eax]
mov dword [ebp - 0x4f8], ecx
push dword [ebp - 0x84]
lea ecx, [ebp - 0x338]
call fcn.10015051
mov ecx, dword [ebp - 0x4f8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4f8]
sub eax, 0xa672
cmp eax, dword [ebp - 0xdc]
je 0x1000ac3b
mov dword [ebp - 0x864], 1
jmp 0x1000ac42
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x3c], eax
jmp 0x1000a9f9
jmp 0x1000ac94
mov dword [ebp - 0x3c], 0
jmp 0x1000ac62
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x11
jge 0x1000ac7f
mov dword [ebp - 0x9d8], 0xd727ab81
cmp dword [ebp - 0x9d8], 0
je 0x1000ac7d
jmp 0x1000ac7f
jmp 0x1000ac5b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc48], 0
je 0x1000ac94
jmp 0x1000a811
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc48], 0xfac86e89
jmp 0x1000a811
mov dword [ebp - 0x3c], 0
jmp 0x1000acba
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x1000adc1
push 2
lea ecx, [ebp - 0xbe4]
call fcn.10014fc7
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x9e8], 1
mov dword [ebp - 0x290], 0
jmp 0x1000acf8
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 2
jge 0x1000ad1a
push dword [ebp - 0x290]
lea ecx, [ebp - 0xbe4]
call fcn.10015051
mov dword [eax], 3
jmp 0x1000aceb
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x974], 0
je 0x1000ad84
push 0
lea ecx, [ebp - 0xc08]
call fcn.10015051
mov dword [eax], 0xfffffffd
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x974]
mov dword [ebp - 0x500], eax
push 0
lea ecx, [ebp - 0xbe4]
call fcn.10015051
mov ecx, dword [ebp - 0x500]
mov dword [eax], ecx
mov eax, dword [ebp - 0x500]
sub eax, 0x5ae2b100
mov ecx, dword [ebp - 0x3c]
cmp dword [ebp + ecx*4 - 0x974], eax
jg 0x1000ad84
mov dword [ebp - 0x86c], 1
jmp 0x1000ad8b
and dword [ebp - 0x86c], 0
push 2
lea ecx, [ebp - 0x338]
call fcn.10015051
mov eax, dword [eax]
mov ecx, dword [ebp - 0x86c]
lea eax, [ecx + eax - 0x226996dc]
mov dword [ebp - 0x9e8], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xbe4]
call fcn.1001504c
jmp 0x1000acb3
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xc08]
call fcn.1001504c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x338]
call fcn.1001504c
movzx eax, byte [0x1066eea8]
test eax, eax
je 0x1000adfd
mov esi, 0x100837c0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1000ffe4
mov dword [ebp - 0xd84], 0x100837c0
mov dword [ebp - 0x2fc], 5
mov dword [ebp - 0x3b8], 0xa831d26e
mov dword [ebp - 0x99c], 0xfffffff9
push 1
lea ecx, [ebp - 0xd20]
call fcn.10014fc7
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x510], 0
mov dword [ebp - 0x208], 0
jmp 0x1000ae5c
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jge 0x1000ae7e
push dword [ebp - 0x208]
lea ecx, [ebp - 0xd20]
call fcn.10015051
mov dword [eax], 0xfffffff6
jmp 0x1000ae4f
mov eax, dword [ebp - 0x2fc]
add eax, 0x6512
jmp 0x1000ae97
and dword [ebp - 0x508], 0
imul eax, dword [ebp - 0x2fc], 9
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
cmp dword [ebp - 0x508], eax
jne 0x1000aecb
mov eax, 0x85ce96b7
test eax, eax
jne 0x1000aecb
and dword [ebp - 0xa34], 0
jmp 0x1000aed5
mov dword [ebp - 0xa34], 1
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0xe8c], eax
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x3b8], eax
jle 0x1000aefb
mov dword [ebp - 0x874], 1
jmp 0x1000af02
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x99c], eax
mov eax, dword [ebp - 0x510]
inc eax
mov dword [ebp - 0x510], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd20]
call fcn.1001504c
mov dword [ebp - 0x198], 0x62d5e48d
mov dword [ebp - 0xd94], 1
mov dword [ebp - 0xacc], 0xbac04ee7
mov dword [ebp - 0xe9c], 0x5b40194d
mov dword [ebp - 0xe98], 0x5b40194d
mov dword [ebp - 0xe94], 0x5b40194d
mov dword [ebp - 0xe90], 0x5b40194d
push 3
lea ecx, [ebp - 0xd40]
call fcn.10014fc7
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x87c], 0x42f3
mov dword [ebp - 0x210], 0
jmp 0x1000afa7
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x1000afc9
push dword [ebp - 0x210]
lea ecx, [ebp - 0xd40]
call fcn.10015051
mov dword [eax], 0xfffffffb
jmp 0x1000af9a
mov dword [ebp - 0x198], 0
jmp 0x1000afe2
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0x18
jg 0x1000b062
mov dword [ebp - 0xe4c], 0x867b8f5f
push 3
lea ecx, [ebp - 0xd30]
call fcn.10014fc7
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x298], 0
jmp 0x1000b01f
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 3
jge 0x1000b041
push dword [ebp - 0x298]
lea ecx, [ebp - 0xd30]
call fcn.10015051
mov dword [eax], 0x5fac1226
jmp 0x1000b012
mov eax, dword [ebp - 0x87c]
inc eax
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xd30]
call fcn.1001504c
jmp 0x1000afd5
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0x198], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd40]
call fcn.1001504c
mov dword [ebp - 0x368], 0xffffffff
mov dword [ebp - 0x2dc], 0x7f5e
mov dword [ebp - 0x518], 0xbfb2c41a
mov dword [ebp - 0x9a4], 0
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1000b0c5
push 0
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, dword [ebp - 0x368]
sub eax, 0xa
je 0x1000b0f6
mov byte [ebp - 0x9e], 0
movzx eax, byte [ebp - 0x9e]
test eax, eax
je 0x1000b0f1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x1000b2b0
mov dword [ebp - 0x140], 0xffffffff
mov dword [ebp - 0x894], 0xf5ac3d6c
mov dword [ebp - 0x218], 0
jmp 0x1000b123
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 3
jge 0x1000b13f
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0xf18], 1
jmp 0x1000b116
mov dword [ebp - 0x518], 0xfffffffd
mov eax, dword [ebp - 0x518]
add eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x140]
jge 0x1000b169
mov dword [ebp - 0x884], 1
jmp 0x1000b170
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x884], eax
jg 0x1000b18a
mov dword [ebp - 0x520], 1
jmp 0x1000b191
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x520]
jge 0x1000b1ab
mov dword [ebp - 0x88c], 1
jmp 0x1000b1b2
and dword [ebp - 0x88c], 0
cmp dword [ebp - 0x88c], 0xfcdf
jge 0x1000b1ca
mov dword [ebp - 0x528], 1
jmp 0x1000b1d1
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x894], eax
jg 0x1000b1f7
mov dword [ebp - 0x530], 1
jmp 0x1000b1fe
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x9a4]
cmp dword [ebp - 0x530], eax
jg 0x1000b218
mov dword [ebp - 0x89c], 1
jmp 0x1000b21f
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x89c], eax
jne 0x1000b23f
cmp dword [ebp - 0x140], 0
jne 0x1000b23f
and dword [ebp - 0x538], 0
jmp 0x1000b249
mov dword [ebp - 0x538], 1
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x538], eax
jge 0x1000b263
mov dword [ebp - 0x8a4], 1
jmp 0x1000b26a
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
imul eax, dword [ebp - 0x2dc]
cmp eax, dword [ebp - 0x8a4]
jge 0x1000b297
mov dword [ebp - 0x8ac], 1
jmp 0x1000b29e
and dword [ebp - 0x8ac], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8ac]
mov dword [ebp + eax - 0xf18], ecx
mov dword [ebp - 0x15c], 0x62d5e48d
mov dword [ebp - 0xda4], 1
mov dword [ebp - 0xa3c], 0xbac04ee7
mov dword [ebp - 0xeb0], 0x5b40194d
mov dword [ebp - 0xeac], 0x5b40194d
mov dword [ebp - 0xea8], 0x5b40194d
mov dword [ebp - 0xea4], 0x5b40194d
push 3
lea ecx, [ebp - 0xd60]
call fcn.10014fc7
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x544], 0x42f3
mov dword [ebp - 0x220], 0
jmp 0x1000b32d
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jge 0x1000b34f
push dword [ebp - 0x220]
lea ecx, [ebp - 0xd60]
call fcn.10015051
mov dword [eax], 0xfffffffb
jmp 0x1000b320
mov dword [ebp - 0x15c], 0
jmp 0x1000b368
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x18
jg 0x1000b3e8
mov dword [ebp - 0xec8], 0x867b8f5f
push 3
lea ecx, [ebp - 0xd50]
call fcn.10014fc7
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x2a0], 0
jmp 0x1000b3a5
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 3
jge 0x1000b3c7
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xd50]
call fcn.10015051
mov dword [eax], 0x5fac1226
jmp 0x1000b398
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xd50]
call fcn.1001504c
jmp 0x1000b35b
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x15c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd60]
call fcn.1001504c
push 3
lea ecx, [ebp - 0x320]
call fcn.10014fc7
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x984], 0xfffffff8
mov dword [ebp - 0x980], 0xfffffff8
mov dword [ebp - 0x97c], 0xfffffff8
mov dword [ebp - 0x978], 0xfffffff8
mov dword [ebp - 0x584], 0xffffffff
mov dword [ebp - 0x40], 0xa55b90cb
push 3
lea ecx, [ebp - 0xc38]
call fcn.10014fc7
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x60], 0
jmp 0x1000b478
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1000b494
push dword [ebp - 0x60]
lea ecx, [ebp - 0x320]
call fcn.10015051
mov dword [eax], 0x7f825e7a
jmp 0x1000b471
mov dword [ebp - 0x60], 0
jmp 0x1000b4a4
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1000b4c0
push dword [ebp - 0x60]
lea ecx, [ebp - 0xc38]
call fcn.10015051
mov dword [eax], 1
jmp 0x1000b49d
mov dword [ebp - 0x30], 2
jmp 0x1000b4d0
cmp dword [ebp - 0x30], 0
jl 0x1000b962
mov dword [ebp - 0x8c], 0xffffffff
mov dword [ebp - 0x8b0], 0xbe776e9f
mov dword [ebp - 0x228], 0
jmp 0x1000b507
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 4
jge 0x1000b523
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xc58], 0x94d03572
jmp 0x1000b4fa
push 0
lea ecx, [ebp - 0x320]
call fcn.10015051
mov ecx, dword [ebp - 0x30]
cmp dword [eax], ecx
je 0x1000b543
mov dword [ebp - 0x3e0], 1
jmp 0x1000b54a
and dword [ebp - 0x3e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp + eax - 0xc58], ecx
cmp dword [ebp - 0x3e0], 0x18d3
jne 0x1000b575
mov dword [ebp - 0x74c], 1
jmp 0x1000b57c
and dword [ebp - 0x74c], 0
push 1
lea ecx, [ebp - 0x320]
call fcn.10015051
mov ecx, dword [ebp - 0x74c]
cmp ecx, dword [eax]
jg 0x1000b59f
mov dword [ebp - 0x54c], 1
jmp 0x1000b5a6
and dword [ebp - 0x54c], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x320]
call fcn.10015051
mov esi, dword [ebp - 0x54c]
imul esi, dword [eax]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x320]
call fcn.10015051
cmp esi, dword [eax]
jne 0x1000b5db
mov dword [ebp - 0x744], 1
jmp 0x1000b5e2
and dword [ebp - 0x744], 0
cmp dword [ebp - 0x744], 0xc2d6
je 0x1000b5fa
mov dword [ebp - 0x554], 1
jmp 0x1000b601
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x30], eax
jg 0x1000b624
mov dword [ebp - 0x748], 1
jmp 0x1000b62b
and dword [ebp - 0x748], 0
cmp dword [ebp - 0x748], 0xfffa
jne 0x1000b643
mov dword [ebp - 0x55c], 1
jmp 0x1000b64a
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0xa6c84902
je 0x1000b662
mov dword [ebp - 0x838], 1
jmp 0x1000b669
and dword [ebp - 0x838], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x320]
call fcn.10015051
mov eax, dword [eax]
sub eax, dword [ebp - 0x838]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x984]
jle 0x1000b90a
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x9ac], 0xb39
mov dword [ebp - 0x8c], 0
jmp 0x1000b6be
cmp dword [ebp - 0x8c], 2
jg 0x1000b908
mov dword [ebp - 0xe4], 0xc8a52b4b
mov dword [ebp - 0xe4], 0
jmp 0x1000b6ee
jmp 0x1000b94c
mov dword [ebp - 0x40], 0
jmp 0x1000b91a
cmp dword [ebp - 0x40], 0x11
jge 0x1000b937
mov dword [ebp - 0xa8c], 0xd727ab81
cmp dword [ebp - 0xa8c], 0
je 0x1000b935
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc58], 0
je 0x1000b94c
mov dword [ebp - 0x40], 0
jmp 0x1000b972
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x1000ba79
push 2
lea ecx, [ebp - 0xc20]
call fcn.10014fc7
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x9b4], 1
mov dword [ebp - 0x2f4], 0
jmp 0x1000b9b0
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 2
jge 0x1000b9d2
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0xc20]
call fcn.10015051
mov dword [eax], 3
jmp 0x1000b9a3
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x984], 0
je 0x1000ba3c
push 0
lea ecx, [ebp - 0xc38]
call fcn.10015051
mov dword [eax], 0xfffffffd
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x984]
mov dword [ebp - 0x768], eax
push 0
lea ecx, [ebp - 0xc20]
call fcn.10015051
mov ecx, dword [ebp - 0x768]
mov dword [eax], ecx
mov eax, dword [ebp - 0x768]
sub eax, 0x5ae2b100
mov ecx, dword [ebp - 0x40]
cmp dword [ebp + ecx*4 - 0x984], eax
jg 0x1000ba3c
mov dword [ebp - 0x59c], 1
jmp 0x1000ba43
and dword [ebp - 0x59c], 0
push 2
lea ecx, [ebp - 0x320]
call fcn.10015051
mov eax, dword [eax]
mov ecx, dword [ebp - 0x59c]
lea eax, [ecx + eax - 0x226996dc]
mov dword [ebp - 0x9b4], eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xc20]
call fcn.1001504c
jmp 0x1000b96b
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xc38]
call fcn.1001504c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x320]
call fcn.1001504c
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x9bc], 0xfffffff9
mov dword [ebp - 0x230], 0
jmp 0x1000bac1
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x1000badd
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x3fc], 9
jmp 0x1000bab4
mov dword [ebp - 0x28], 1
jmp 0x1000baed
cmp dword [ebp - 0x28], 0
jl 0x1000bd3a
mov dword [ebp - 0xec], 0xa75c19c5
mov dword [ebp - 0xa44], 0x9200
mov dword [ebp - 0xec], 1
jmp 0x1000bb24
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x1000bc17
mov dword [ebp - 0x2a8], 0x2491e29e
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x1000bb63
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
mov dword [ebp - 0x2a8], 0
jmp 0x1000bb7c
cmp dword [ebp - 0x2a8], 1
jg 0x1000bc12
mov dword [ebp - 0x238], 1
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x1000bbad
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x238], 1
jmp 0x1000bbc6
cmp dword [ebp - 0x238], 0
jl 0x1000bc0d
jmp 0x1000bb17
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xec]
sub ecx, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x3fc], ecx
jne 0x1000bc38
mov dword [ebp - 0x8b8], 1
jmp 0x1000bc3f
and dword [ebp - 0x8b8], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3fc], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x3fc], 0x3fc2
jl 0x1000bc69
mov dword [ebp - 0x848], 1
jmp 0x1000bc70
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul eax, dword [ebp + ecx*4 - 0x3fc]
cmp eax, dword [ebp - 0xec]
jge 0x1000bc98
mov dword [ebp - 0x5a4], 1
jmp 0x1000bc9f
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0xa44]
cmp dword [ebp - 0x5a4], eax
jle 0x1000bcb9
mov dword [ebp - 0x770], 1
jmp 0x1000bcc0
and dword [ebp - 0x770], 0
cmp dword [ebp - 0x770], 0xa4d3ec93
jb 0x1000bcd8
mov dword [ebp - 0x5ac], 1
jmp 0x1000bcdf
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x5ac]
sub eax, 0x6d5d64f6
imul eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x8b8]
sub ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, dword [ebp + eax*4 - 0x3fc]
jge 0x1000bd15
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x1000bd54
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov dword [ebp - 0xe54], 0x100837c4
push 3
lea ecx, [ebp - 0x32c]
call fcn.10014fc7
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x964], 0xfffffff8
mov dword [ebp - 0x960], 0xfffffff8
mov dword [ebp - 0x95c], 0xfffffff8
mov dword [ebp - 0x958], 0xfffffff8
mov dword [ebp - 0x5f4], 0xffffffff
mov dword [ebp - 0x44], 0xa55b90cb
push 3
lea ecx, [ebp - 0xba8]
call fcn.10014fc7
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x74], 0
jmp 0x1000bdd3
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1000bdef
push dword [ebp - 0x74]
lea ecx, [ebp - 0x32c]
call fcn.10015051
mov dword [eax], 0x7f825e7a
jmp 0x1000bdcc
mov dword [ebp - 0x74], 0
jmp 0x1000bdff
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1000be1b
push dword [ebp - 0x74]
lea ecx, [ebp - 0xba8]
call fcn.10015051
mov dword [eax], 1
jmp 0x1000bdf8
mov dword [ebp - 0x38], 2
jmp 0x1000be2b
cmp dword [ebp - 0x38], 0
jl 0x1000c2bd
mov dword [ebp - 0x94], 0xffffffff
mov dword [ebp - 0x858], 0xbe776e9f
mov dword [ebp - 0x2e4], 0
jmp 0x1000be62
mov dword [ebp - 0x44], 0
jmp 0x1000c2cd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret