Function at 0x1004f171
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007dfd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2d4
push esi
push edi
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x70], 7
mov dword [ebp - 0x7c], 0x20dd
mov dword [ebp - 0x204], 7
mov dword [ebp - 0x200], 7
mov dword [ebp - 0x1fc], 7
mov dword [ebp - 0x1f8], 7
lea ecx, [ebp - 0x95]
call fcn.1000a663
push eax
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x2d4]
call fcn.100181a7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x248]
call fcn.10018169
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
jmp 0x1004f217
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xf
je 0x1004f300
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x44], 0
jmp 0x1004f242
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffffc
jge 0x1004f2fb
mov dword [ebp - 0x1d8], 0xa9bca7b5
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x44], 0
je 0x1004f276
xor eax, eax
inc eax
je 0x1004f276
mov dword [ebp - 0xdc], 1
jmp 0x1004f27d
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xdc]
lea eax, [ecx + eax - 0x2eb32b6b]
cmp eax, dword [ebp - 0x70]
jle 0x1004f29e
mov dword [ebp - 0x110], 1
jmp 0x1004f2a5
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x110], eax
jl 0x1004f2bc
mov dword [ebp - 0x174], 1
jmp 0x1004f2c3
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x174], eax
je 0x1004f2da
mov dword [ebp - 0x184], 1
jmp 0x1004f2e1
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1d4], eax
jmp 0x1004f23b
jmp 0x1004f210
mov dword [ebp - 0x18], 0xffffffe3
jmp 0x1004f310
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x14
jg 0x1004f3fd
mov dword [ebp - 0x4c], 0x8aac1e0f
mov dword [ebp - 0x198], 0xa7967268
cmp dword [ebp - 0x7c], 0
je 0x1004f3c5
cmp dword [ebp - 0x4c], 0
je 0x1004f341
cmp dword [ebp - 0x70], 0
jne 0x1004f37b
mov eax, 0xa3a6
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0xa8], eax
push 2
lea ecx, [ebp - 0x248]
call fcn.10018198
mov ecx, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x4c]
jg 0x1004f37b
and dword [ebp - 0x148], 0
jmp 0x1004f385
mov dword [ebp - 0x148], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x148], eax
jl 0x1004f39c
mov dword [ebp - 0x1c8], 1
jmp 0x1004f3a3
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x274], eax
xor eax, eax
je 0x1004f3c5
mov dword [ebp - 0xb0], 1
jmp 0x1004f3cc
and dword [ebp - 0xb0], 0
cmp dword [ebp - 0xb0], 0xffffffff
je 0x1004f3e1
mov dword [ebp - 0x118], 1
jmp 0x1004f3e8
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x118]
mov dword [ebp - 0x198], eax
jmp 0x1004f309
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.10018193
push 1
lea eax, [ebp - 0x2e0]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.1004a883
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x2b4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2b4]
lea edi, [ebp - 0x1e4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x48], 0xfffffff5
jmp 0x1004f452
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffe7
jle 0x1004f642
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x48], 0xea6801fc
jbe 0x1004f478
mov dword [ebp - 0xb8], 1
jmp 0x1004f47f
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xb8]
inc eax
je 0x1004f5c2
mov dword [ebp - 0x170], 0xdbbe5689
push 2
lea ecx, [ebp - 0x1f0]
call fcn.1001810a
mov dword [ebp - 4], 1
mov dword [ebp - 0x19c], 0xebbd4856
mov dword [ebp - 0x68], 0
jmp 0x1004f4c4
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1004f4dd
push dword [ebp - 0x68]
lea ecx, [ebp - 0x1f0]
call fcn.10018198
or dword [eax], 0xffffffff
jmp 0x1004f4bd
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x194], eax
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018198
mov ecx, dword [ebp - 0x194]
mov dword [eax], ecx
cmp dword [ebp - 0x1c], 0x5714ffd8
je 0x1004f51f
mov dword [ebp - 0x1bc], 1
jmp 0x1004f526
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x230], eax
mov esi, dword [ebp - 0x1c]
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018198
cmp esi, dword [eax]
jne 0x1004f558
mov dword [ebp - 0xc0], 1
jmp 0x1004f55f
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0xc0]
jl 0x1004f576
mov dword [ebp - 0x120], 1
jmp 0x1004f57d
and dword [ebp - 0x120], 0
cmp dword [ebp - 0x120], 0xe360
jl 0x1004f59b
mov eax, 0x4131
test eax, eax
jne 0x1004f59b
and dword [ebp - 0xc8], 0
jmp 0x1004f5a5
mov dword [ebp - 0xc8], 1
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x19c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f0]
call fcn.10018193
jmp 0x1004f63d
push 2
lea ecx, [ebp - 0x21c]
call fcn.1001810a
mov dword [ebp - 4], 2
mov dword [ebp - 0x60], 0
jmp 0x1004f5e6
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1004f602
push dword [ebp - 0x60]
lea ecx, [ebp - 0x21c]
call fcn.10018198
mov dword [eax], 0x963ec58f
jmp 0x1004f5df
mov dword [ebp - 0x1c], 0
jmp 0x1004f612
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1004f62e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x21c]
call fcn.10018198
mov dword [eax], 0x7f39cee2
jmp 0x1004f60b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.10018193
jmp 0x1004f44b
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x58], 0
jmp 0x1004f659
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1004f66f
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x180], 0xcd16652d
jmp 0x1004f652
mov dword [ebp - 0x3c], 0
jmp 0x1004f67f
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffe3
jg 0x1004f7e3
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x1d0], 0x6edad94e
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x298], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x180], 0x2443
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x180], 1
jle 0x1004f6d6
mov dword [ebp - 0x150], 1
jmp 0x1004f6dd
and dword [ebp - 0x150], 0
push 9
pop eax
sub eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x3c]
je 0x1004f6f7
mov dword [ebp - 0xd0], 1
jmp 0x1004f6fe
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0xd0]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x290], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x180]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x94], 6
jl 0x1004f742
mov dword [ebp - 0x128], 1
jmp 0x1004f749
and dword [ebp - 0x128], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x180]
cmp eax, dword [ebp - 0x128]
jne 0x1004f76a
mov dword [ebp - 0xd8], 1
jmp 0x1004f771
and dword [ebp - 0xd8], 0
cmp dword [ebp - 0xd8], 0x5d76
jle 0x1004f789
mov dword [ebp - 0x168], 1
jmp 0x1004f790
and dword [ebp - 0x168], 0
cmp dword [ebp - 0x168], 0x53f3
jg 0x1004f7a8
mov dword [ebp - 0xe0], 1
jmp 0x1004f7af
and dword [ebp - 0xe0], 0
cmp dword [ebp - 0xe0], 0xffffffff
jb 0x1004f7c4
mov dword [ebp - 0x130], 1
jmp 0x1004f7cb
and dword [ebp - 0x130], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x130]
mov dword [ebp + eax - 0x180], ecx
jmp 0x1004f678
mov dword [ebp - 0x1a8], 0xd5e48d32
mov dword [ebp - 0x1c4], 0xf390
push 1
lea ecx, [ebp - 0x210]
call fcn.1001810a
mov dword [ebp - 4], 3
mov dword [ebp - 0x14], 0
jmp 0x1004f81b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1004f831
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a4], 5
jmp 0x1004f814
mov dword [ebp - 0x14], 0
jmp 0x1004f841
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1004f857
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2a8], 0xfffffffb
jmp 0x1004f83a
mov dword [ebp - 0x14], 0
jmp 0x1004f867
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1004f883
push dword [ebp - 0x14]
lea ecx, [ebp - 0x210]
call fcn.10018198
mov dword [eax], 0x6173948b
jmp 0x1004f860
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a4]
cmp dword [ebp - 0x1c4], eax
jle 0x1004f8ad
mov eax, 0xea12
test eax, eax
je 0x1004f8ad
mov dword [ebp - 0xe8], 1
jmp 0x1004f8b4
and dword [ebp - 0xe8], 0
imul eax, dword [ebp - 0xe8], 0x8e46
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2a8], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x2a8]
add esi, 0x6a5527ad
push 0
lea ecx, [ebp - 0x210]
call fcn.10018198
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x210]
call fcn.10018193
mov dword [ebp - 0x54], 0xfffffff9
push 4
lea ecx, [ebp - 0x258]
call fcn.1001810a
mov dword [ebp - 4], 4
mov dword [ebp - 0x5c], 0
jmp 0x1004f927
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x1004f943
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x258]
call fcn.10018198
mov dword [eax], 0xb57e
jmp 0x1004f920
mov dword [ebp - 0x54], 0
jmp 0x1004f953
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x18
jne 0x1004f9c8
mov dword [ebp - 0x64], 0x4d2edc75
mov dword [ebp - 0x64], 0
jmp 0x1004f970
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jg 0x1004f9c6
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1004f99b
push 0x1806
push 0
push 0xd73
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x1004f9c4
push 0x1ba5
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
jmp 0x1004f969
jmp 0x1004f94c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.10018193
mov byte [ebp - 0x35], 0
mov dword [ebp - 0x28], 0
jmp 0x1004f9eb
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1004fa01
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x268], 0x648261f9
jmp 0x1004f9e4
mov dword [ebp - 0x28], 0
jmp 0x1004fa11
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1004fa24
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x40], 0x9be1d925
jmp 0x1004fa0a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x40], 2
jmp 0x1004fa49
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x40], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
jl 0x1004fad3
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x50], 2
jmp 0x1004fa6d
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x1004face
mov dword [ebp - 0x1ac], 7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov eax, dword [ebp + eax*4 - 0x268]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x268], ecx
cmp dword [ebp - 0x158], 0
jl 0x1004fab9
mov dword [ebp - 0xf0], 1
jmp 0x1004fac0
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x1ac], eax
jmp 0x1004fa66
jmp 0x1004fa34
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x40], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x1004fd25
push 4
lea ecx, [ebp - 0x8c]
call fcn.1001810a
mov dword [ebp - 4], 5
mov dword [ebp - 0xa0], 9
mov dword [ebp - 0x140], 3
mov dword [ebp - 0x1cc], 0xffffffff
mov dword [ebp - 0x20], 0
jmp 0x1004fb2f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1004fb4b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x8c]
call fcn.10018198
mov dword [eax], 3
jmp 0x1004fb28
mov dword [ebp - 0x20], 0
jmp 0x1004fb5b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1004fb71
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2c0], 6
jmp 0x1004fb54
mov byte [ebp - 0x34], 0
movzx eax, byte [ebp - 0x34]
test eax, eax
je 0x1004fb88
push 0x1ea1
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 2
lea ecx, [ebp - 0x8c]
call fcn.10018198
push 3
lea ecx, [ebp - 0x8c]
call fcn.10018198
mov esi, eax
push 3
lea ecx, [ebp - 0x8c]
call fcn.10018198
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1004fbc3
mov dword [ebp - 0x138], 1
jmp 0x1004fbca
and dword [ebp - 0x138], 0
mov esi, 0x100c
sub esi, dword [ebp - 0x138]
push 3
lea ecx, [ebp - 0x8c]
call fcn.10018198
cmp esi, dword [eax]
jg 0x1004fbef
mov dword [ebp - 0x74], 1
jmp 0x1004fbf3
and dword [ebp - 0x74], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x74]
mov dword [ebp + eax - 0x2c0], ecx
cmp dword [ebp - 0x74], 3
jae 0x1004fc15
mov dword [ebp - 0xf8], 1
jmp 0x1004fc1c
and dword [ebp - 0xf8], 0
push 2
lea ecx, [ebp - 0x8c]
call fcn.10018198
mov ecx, dword [ebp - 0xf8]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1004fc48
cmp dword [ebp - 0xa0], 0
jne 0x1004fc48
and dword [ebp - 0x178], 0
jmp 0x1004fc52
mov dword [ebp - 0x178], 1
push 2
lea ecx, [ebp - 0x8c]
call fcn.10018198
mov eax, dword [eax]
cmp eax, dword [ebp - 0x178]
jge 0x1004fc75
mov dword [ebp - 0x100], 1
jmp 0x1004fc7c
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xeb9ae77a
jbe 0x1004fca0
mov dword [ebp - 0x108], 1
jmp 0x1004fca7
and dword [ebp - 0x108], 0
push 2
lea ecx, [ebp - 0x8c]
call fcn.10018198
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [eax]
jle 0x1004fcca
mov dword [ebp - 0x160], 1
jmp 0x1004fcd1
and dword [ebp - 0x160], 0
mov esi, dword [ebp - 0x160]
sub esi, 0x20225169
sub esi, dword [ebp - 0xa0]
push 2
lea ecx, [ebp - 0x8c]
call fcn.10018198
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x8c]
call fcn.10018198
imul esi, dword [eax]
mov dword [ebp - 0x1cc], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.10018193
push 0x379e
push 0
call fcn.1004b02d
pop ecx
pop ecx
mov dword [ebp - 0x10], 0x7865
mov dword [ebp - 0x78], 0x23279329
mov dword [ebp - 0x30], 0xc609e820
mov dword [ebp - 0x80], 0x2fe868e0
mov dword [ebp - 0x114], 0xcb070fcb
mov dword [ebp - 0x90], 0x573c098b
mov dword [ebp - 0x18c], 0xe137c2b4
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x12c], 0xfffffffa
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x214c
jne 0x1004fdab
mov dword [ebp - 0xa4], 1
jmp 0x1004fdb2
and dword [ebp - 0xa4], 0
cmp dword [ebp - 0xa4], 1
jg 0x1004fdc7
mov dword [ebp - 0xac], 1
jmp 0x1004fdce
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xac]
cmp dword [ebp - 0x10], eax
jg 0x1004fde8
mov dword [ebp - 0xb4], 1
jmp 0x1004fdef
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xb4], eax
jg 0x1004fe0c
cmp dword [ebp - 0x78], 0
je 0x1004fe0c
mov dword [ebp - 0xbc], 1
jmp 0x1004fe13
and dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xbc], eax
jne 0x1004fe2d
cmp dword [ebp - 0x10], 0
jne 0x1004fe2d
and dword [ebp - 0xc4], 0
jmp 0x1004fe37
mov dword [ebp - 0xc4], 1
mov eax, dword [ebp - 0xc4]
add eax, 0x43be4445
cmp eax, dword [ebp - 0x10]
jle 0x1004fe53
mov dword [ebp - 0xcc], 1
jmp 0x1004fe5a
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xcc], eax
jge 0x1004fe71
mov dword [ebp - 0xd4], 1
jmp 0x1004fe78
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xd4], eax
jl 0x1004fe92
cmp dword [ebp - 0x10], 0
jne 0x1004fe92
and dword [ebp - 0x9c], 0
jmp 0x1004fe9c
mov dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x9c], eax
jge 0x1004feb3
mov dword [ebp - 0xe4], 1
jmp 0x1004feba
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1004fed5
mov dword [ebp - 0xec], 1
jmp 0x1004fedc
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xec], eax
jge 0x1004fef6
cmp dword [ebp - 0x80], 0
jne 0x1004fef6
and dword [ebp - 0x1b4], 0
jmp 0x1004ff00
mov dword [ebp - 0x1b4], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x30]
add eax, 0xffff
cmp eax, dword [ebp - 0x30]
je 0x1004ff29
push 8
pop eax
test eax, eax
je 0x1004ff29
mov dword [ebp - 0xf4], 1
jmp 0x1004ff30
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0xf4]
sub eax, dword [ebp - 0x30]
cmp eax, 0x96add890
jbe 0x1004ff50
mov dword [ebp - 0xfc], 1
jmp 0x1004ff57
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xfc]
jne 0x1004ff6e
mov dword [ebp - 0x104], 1
jmp 0x1004ff75
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x104], eax
jle 0x1004ff8c
mov dword [ebp - 0x10c], 1
jmp 0x1004ff93
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x3725ac95
jle 0x1004ffb7
mov dword [ebp - 0x11c], 1
jmp 0x1004ffbe
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x90], eax
jne 0x1004fff3
cmp dword [ebp - 0x30], 0
jne 0x1004fff3
and dword [ebp - 0x124], 0
jmp 0x1004fffd
mov dword [ebp - 0x124], 1
mov eax, dword [ebp - 0x124]
add eax, 0x139a850
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x12c]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xfff6
jbe 0x10050035
mov dword [ebp - 0x13c], 1
jmp 0x1005003c
and dword [ebp - 0x13c], 0
cmp dword [ebp - 0x13c], 0x207
jg 0x10050054
mov dword [ebp - 0x144], 1
jmp 0x1005005b
and dword [ebp - 0x144], 0
cmp dword [ebp - 0x144], 0xfffffffb
jae 0x10050070
mov dword [ebp - 0x188], 1
jmp 0x10050077
and dword [ebp - 0x188], 0
mov eax, 0x428f
cmp eax, 0xffff
jbe 0x1005008f
mov dword [ebp - 0x14c], 1
jmp 0x10050096
and dword [ebp - 0x14c], 0
cmp dword [ebp - 0x14c], 1
jbe 0x100500ab
mov dword [ebp - 0x154], 1
jmp 0x100500b2
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x1a8]
push eax
push 1
call fcn.1004b02d
pop ecx
pop ecx
mov dword [ebp - 0x1b0], 0xfffffffb
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x16c], 1
mov dword [ebp - 0x24], 0
jmp 0x100500f9
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1005010f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x22c], 0xa136951a
jmp 0x100500f2
mov dword [ebp - 0x24], 0
jmp 0x1005011f
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10050135
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2cc], 0xd1b9849b
jmp 0x10050118
mov byte [ebp - 0x36], 0
movzx eax, byte [ebp - 0x36]
test eax, eax
je 0x10050157
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x22c], 0
jne 0x100501f6
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x2c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x22c]
cmp eax, dword [ebp - 0x2c]
jg 0x10050192
mov dword [ebp - 0x1b8], 1
jmp 0x10050199
and dword [ebp - 0x1b8], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x22c]
cmp dword [ebp + eax - 0x22c], ecx
jne 0x100501c1
mov dword [ebp - 0x15c], 1
jmp 0x100501c8
and dword [ebp - 0x15c], 0
cmp dword [ebp - 0x15c], 0x7d0fa516
jne 0x100501e0
mov dword [ebp - 0x1c0], 1
jmp 0x100501e7
and dword [ebp - 0x1c0], 0
cmp dword [ebp - 0x2c], 0
jne 0x100501f6
and dword [ebp - 0x164], 0
jmp 0x10050200
mov dword [ebp - 0x164], 1
cmp dword [ebp - 0x164], 0
je 0x10050285
mov dword [ebp - 0x24c], 0xd9cd
mov dword [ebp - 0x294], 1
mov dword [ebp - 0x25c], 0x75cb5542
push 3
lea ecx, [ebp - 0x280]
call fcn.1001810a
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0
jmp 0x1005024b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x10050267
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x280]
call fcn.10018198
mov dword [eax], 0x7b445ace
jmp 0x10050244
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x280]
call fcn.10018193
jmp 0x100502ca
mov dword [ebp - 0x2c], 2
jmp 0x10050295
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x100502ca
mov byte [ebp - 0x33], 0
movzx eax, byte [ebp - 0x33]
test eax, eax
je 0x100502b9
push 0xfbc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x2cc], 0
je 0x100502c8
jmp 0x100502ca
jmp 0x1005028e
cmp dword [ebp - 0x1e4], 0
je 0x100502e7
push 3
push dword [ebp - 0x1dc]
push dword [ebp - 0x1e0]
call dword [ebp - 0x1e4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret