Function at 0x1000c349
Capabilities:
Contain obfuscated stackstrings
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100863e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1124
call fcn.10070240
push esi
push edi
mov dword [ebp - 0x80], 0xf5720e83
push 4
lea ecx, [ebp - 0x36c]
call fcn.10018755
and dword [ebp - 4], 0
push 3
lea ecx, [ebp - 0xb70]
call fcn.10018755
mov byte [ebp - 4], 1
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x2a8], 1
mov dword [ebp - 0x940], 0x2a0c0e07
mov dword [ebp - 0xa70], 0xb458
push 4
lea ecx, [ebp - 0xcc0]
call fcn.10018755
mov byte [ebp - 4], 2
mov dword [ebp - 0x20], 0
jmp 0x1000c3df
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000c3fb
push dword [ebp - 0x20]
lea ecx, [ebp - 0x36c]
call fcn.100187f6
mov dword [eax], 0xfffffffe
jmp 0x1000c3d8
mov dword [ebp - 0x20], 0
jmp 0x1000c40b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000c427
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb70]
call fcn.100187f6
mov dword [eax], 4
jmp 0x1000c404
mov dword [ebp - 0x20], 0
jmp 0x1000c437
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000c44d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1054], 0x9e69c17
jmp 0x1000c430
mov dword [ebp - 0x20], 0
jmp 0x1000c45d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000c479
push dword [ebp - 0x20]
lea ecx, [ebp - 0xcc0]
call fcn.100187f6
mov dword [eax], 0xfffffffb
jmp 0x1000c456
mov esi, dword [ebp - 0x80]
push 3
lea ecx, [ebp - 0x36c]
call fcn.100187f6
mov dword [eax], esi
mov eax, 0x3a00d0e7
sub eax, dword [ebp - 0x80]
cmp eax, 0xfffffffc
jle 0x1000c4a4
mov dword [ebp - 0xa14], 1
jmp 0x1000c4ab
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xe0c], eax
push 3
lea ecx, [ebp - 0x36c]
call fcn.100187f6
cmp dword [eax], 6
je 0x1000c4d2
mov dword [ebp - 0x6e4], 1
jmp 0x1000c4d9
and dword [ebp - 0x6e4], 0
imul eax, dword [ebp - 0x6e4], 0x33a7
mov dword [ebp - 0x930], eax
push 1
lea ecx, [ebp - 0xb70]
call fcn.100187f6
mov ecx, dword [ebp - 0x930]
mov dword [eax], ecx
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x80]
cmp eax, 0x6aac8953
jge 0x1000c526
mov dword [ebp - 0x938], 1
jmp 0x1000c52d
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x2a8]
imul eax, dword [ebp - 0x938]
mov dword [ebp - 0x940], eax
mov esi, dword [ebp - 0x940]
sub esi, 0xfff7
push 0
lea ecx, [ebp - 0x36c]
call fcn.100187f6
cmp dword [eax], esi
jl 0x1000c569
mov dword [ebp - 0xa60], 1
jmp 0x1000c570
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x1040], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0xe7c], eax
push 3
lea ecx, [ebp - 0x36c]
call fcn.100187f6
mov esi, eax
push 1
lea ecx, [ebp - 0x36c]
call fcn.100187f6
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1000c5b6
mov dword [ebp - 0x948], 1
jmp 0x1000c5bd
and dword [ebp - 0x948], 0
cmp dword [ebp - 0x948], 0x11accbad
jg 0x1000c7cb
mov dword [ebp - 0xa68], 0xffffffff
mov dword [ebp - 0xa90], 0xabe3335a
push 2
lea ecx, [ebp - 0x36c]
call fcn.100187f6
mov ecx, dword [ebp - 0xf8]
cmp dword [eax], ecx
jg 0x1000c604
mov dword [ebp - 0x950], 1
jmp 0x1000c60b
and dword [ebp - 0x950], 0
cmp dword [ebp - 0x950], 0xb70d8ac5
jbe 0x1000c62c
cmp dword [ebp - 0xa68], 0
je 0x1000c62c
mov dword [ebp - 0x958], 1
jmp 0x1000c633
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0xa70]
cmp dword [ebp - 0x958], eax
jle 0x1000c64d
mov dword [ebp - 0x960], 1
jmp 0x1000c654
and dword [ebp - 0x960], 0
push 0
lea ecx, [ebp - 0xb70]
call fcn.100187f6
mov ecx, dword [ebp - 0x960]
mov dword [eax], ecx
mov esi, dword [ebp - 0x80]
add esi, 0x2629
push 3
lea ecx, [ebp - 0x36c]
call fcn.100187f6
cmp esi, dword [eax]
jle 0x1000c68f
mov dword [ebp - 0x968], 1
jmp 0x1000c696
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0xf8]
sub eax, dword [ebp - 0x968]
cmp eax, 7
jb 0x1000c6b3
mov dword [ebp - 0x970], 1
jmp 0x1000c6ba
and dword [ebp - 0x970], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1054]
cmp dword [ebp - 0x970], eax
jne 0x1000c6db
mov dword [ebp - 0x800], 1
jmp 0x1000c6e2
and dword [ebp - 0x800], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1054]
cmp dword [ebp - 0x800], eax
jge 0x1000c703
mov dword [ebp - 0x3a0], 1
jmp 0x1000c70a
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x3a0]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x80], eax
jle 0x1000c730
mov dword [ebp - 0x808], 1
jmp 0x1000c737
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x808]
sub eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0xa90]
jge 0x1000c75d
mov eax, 0xf3
test eax, eax
je 0x1000c75d
mov dword [ebp - 0x3a8], 1
jmp 0x1000c764
and dword [ebp - 0x3a8], 0
cmp dword [ebp - 0x3a8], 0x9fc2
jge 0x1000c77c
mov dword [ebp - 0x810], 1
jmp 0x1000c783
and dword [ebp - 0x810], 0
push 3
lea ecx, [ebp - 0x36c]
call fcn.100187f6
mov ecx, dword [ebp - 0x810]
cmp ecx, dword [eax]
jle 0x1000c7aa
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x1000c7aa
and dword [ebp - 0x3b0], 0
jmp 0x1000c7b4
mov dword [ebp - 0x3b0], 1
push 2
lea ecx, [ebp - 0xcc0]
call fcn.100187f6
mov ecx, dword [ebp - 0x3b0]
mov dword [eax], ecx
jmp 0x1000c7ec
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1000c7ec
push 0x3ac
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcc0]
call fcn.100187da
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb70]
call fcn.100187da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x36c]
call fcn.100187da
mov dword [ebp - 0x23c], 0xfffffffd
mov dword [ebp - 0x27c], 0x324ec2e0
mov dword [ebp - 0x27c], 0xfffffff1
jmp 0x1000c846
mov eax, dword [ebp - 0x27c]
dec eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0xffffffe7
je 0x1000c872
mov byte [ebp - 0x9a], 0
movzx eax, byte [ebp - 0x9a]
test eax, eax
je 0x1000c870
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
jmp 0x1000c839
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1000c88a
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0xf74], 1
push 3
lea ecx, [ebp - 0x384]
call fcn.10018755
mov dword [ebp - 4], 3
mov dword [ebp - 0xa8], 0xba9a9843
mov dword [ebp - 0x3f0], 0xffffffff
mov dword [ebp - 0x17c], 0
jmp 0x1000c8d5
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x1000c8f7
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x384]
call fcn.100187f6
mov dword [eax], 0x540d7f82
jmp 0x1000c8c8
push 0
lea ecx, [ebp - 0x384]
call fcn.100187f6
and dword [eax], 0
jmp 0x1000c92d
push 0
lea ecx, [ebp - 0x384]
call fcn.100187f6
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x818]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x384]
call fcn.100187f6
cmp dword [eax], 5
jle 0x1000cc04
mov dword [ebp - 0x54], 0x5ba77230
mov dword [ebp - 0x308], 0xbbc254e7
mov dword [ebp - 0x2b0], 0xfffffff6
mov dword [ebp - 0x54], 0
jmp 0x1000c96e
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 9
jle 0x1000cbff
mov dword [ebp - 0x1fc], 0xa4d91f06
mov byte [ebp - 0x9c], 0
movzx eax, byte [ebp - 0x9c]
test eax, eax
je 0x1000c9b4
push 0
push 0x1070
push 0xd90
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
cmp dword [ebp - 0x54], 0
je 0x1000cb59
cmp dword [ebp - 0x54], 0
jne 0x1000cb4d
or eax, 0xffffffff
je 0x1000cab6
cmp dword [ebp - 0x54], 0x9919
jge 0x1000c9e6
mov dword [ebp - 0x3b8], 1
jmp 0x1000c9ed
and dword [ebp - 0x3b8], 0
cmp dword [ebp - 0x3b8], 0
jae 0x1000ca02
mov dword [ebp - 0x820], 1
jmp 0x1000ca09
and dword [ebp - 0x820], 0
cmp dword [ebp - 0x820], 0
jl 0x1000ca1e
mov dword [ebp - 0x3c0], 1
jmp 0x1000ca25
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 4
jne 0x1000ca3a
mov dword [ebp - 0x828], 1
jmp 0x1000ca41
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x828], eax
jge 0x1000ca5b
mov dword [ebp - 0x3c8], 1
jmp 0x1000ca62
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
sub eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x54]
jg 0x1000ca7c
mov dword [ebp - 0x830], 1
jmp 0x1000ca83
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x1000caaa
cmp dword [ebp - 0x308], 0
jne 0x1000caaa
cmp dword [ebp - 0x1fc], 0
je 0x1000cab6
mov dword [ebp - 0x3d0], 1
jmp 0x1000cabd
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x2b0], eax
jg 0x1000cae3
mov dword [ebp - 0x838], 1
jmp 0x1000caea
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x838], 1
jae 0x1000caff
mov dword [ebp - 0x3d8], 1
jmp 0x1000cb06
and dword [ebp - 0x3d8], 0
push 0
lea ecx, [ebp - 0x384]
call fcn.100187f6
mov ecx, dword [ebp - 0x3d8]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x1fc]
jl 0x1000cb2f
mov dword [ebp - 0x840], 1
jmp 0x1000cb36
and dword [ebp - 0x840], 0
push 0
lea ecx, [ebp - 0x384]
call fcn.100187f6
mov ecx, dword [ebp - 0x840]
add ecx, dword [eax]
je 0x1000cb59
mov dword [ebp - 0x3e0], 1
jmp 0x1000cb60
and dword [ebp - 0x3e0], 0
push 2
lea ecx, [ebp - 0x384]
call fcn.100187f6
mov esi, dword [eax]
sub esi, dword [ebp - 0x3e0]
push 0
lea ecx, [ebp - 0x384]
call fcn.100187f6
cmp esi, dword [eax]
jge 0x1000cb92
mov dword [ebp - 0x848], 1
jmp 0x1000cb99
and dword [ebp - 0x848], 0
cmp dword [ebp - 0x848], 0x433c
je 0x1000cbb1
mov dword [ebp - 0x3e8], 1
jmp 0x1000cbb8
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x3e8]
test eax, eax
je 0x1000cbdb
cmp dword [ebp - 0x2b0], 0
je 0x1000cbdb
mov dword [ebp - 0x850], 1
jmp 0x1000cbe2
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x1fc], eax
jmp 0x1000c967
jmp 0x1000c909
mov dword [ebp - 0xa8], 0
jmp 0x1000cc1d
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jg 0x1000cc5d
cmp dword [ebp - 0xa8], 0
jge 0x1000cc3b
mov dword [ebp - 0x858], 1
jmp 0x1000cc42
and dword [ebp - 0x858], 0
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x384]
call fcn.100187f6
mov ecx, dword [ebp - 0x858]
mov dword [eax], ecx
jmp 0x1000cc10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x384]
call fcn.100187da
mov dword [ebp - 0x438], 0x9e63a5be
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x338], 0x66c4a87f
mov dword [ebp - 0xa98], 0x5610a143
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1000ccb7
push 0x2203
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0xb0], 0
jmp 0x1000ccd0
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xc
jge 0x1000ce1f
mov dword [ebp - 0x150], 0xffffffff
mov dword [ebp - 0x878], 0x284868fd
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x150], eax
jle 0x1000cd0b
mov dword [ebp - 0x3f8], 1
jmp 0x1000cd12
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x3f8], eax
jne 0x1000cd2c
mov dword [ebp - 0x860], 1
jmp 0x1000cd33
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
imul eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x150]
jge 0x1000cd69
cmp dword [ebp - 0xb0], 0
je 0x1000cd69
mov dword [ebp - 0x400], 1
jmp 0x1000cd70
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x400]
jle 0x1000cd91
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x1000cd91
mov dword [ebp - 0x868], 1
jmp 0x1000cd98
and dword [ebp - 0x868], 0
cmp dword [ebp - 0x868], 1
je 0x1000cdad
mov dword [ebp - 0x408], 1
jmp 0x1000cdb4
and dword [ebp - 0x408], 0
imul eax, dword [ebp - 0x408], 0xc8dd
imul eax, eax, 0xffffffff
test eax, eax
je 0x1000cdda
cmp dword [ebp - 0x338], 0
je 0x1000cdda
mov dword [ebp - 0x870], 1
jmp 0x1000cde1
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x870], eax
jg 0x1000cdfb
mov dword [ebp - 0x410], 1
jmp 0x1000ce02
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0xa98], eax
jmp 0x1000ccc3
mov dword [ebp - 0xe84], 6
mov dword [ebp - 0xff4], 0xac8b13ec
mov byte [ebp - 0x9e], 0
movzx eax, byte [ebp - 0x9e]
test eax, eax
je 0x1000ce50
push 0x1fa0
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1000ce76
push 0x262a
push 0
push 0x1941
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0xab0], 0x4f6b903c
mov dword [ebp - 0xe94], 0x1ee01e6e
mov dword [ebp - 0x130], 0xcd453606
mov dword [ebp - 0xf84], 8
mov dword [ebp - 0xe9c], 1
mov dword [ebp - 0x184], 0
jmp 0x1000cec1
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jge 0x1000cedd
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x1070], 3
jmp 0x1000ceb4
mov dword [ebp - 0x130], 2
jmp 0x1000cef6
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jl 0x1000d098
mov dword [ebp - 0x2b8], 8
mov byte [ebp - 0xa0], 0
movzx eax, byte [ebp - 0xa0]
test eax, eax
je 0x1000cf31
push 0x377
push 0x1fdb
push 0
call dword [sym.imp.USER32.dll_InflateRect]
mov eax, dword [ebp - 0x130]
cmp dword [ebp + eax*4 - 0x1070], 0
je 0x1000d06b
mov dword [ebp - 0x1008], 0xcaa7
mov dword [ebp - 0x60], 0
jmp 0x1000cf5f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1000cf75
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xee8], 0xd568d526
jmp 0x1000cf58
mov dword [ebp - 0x60], 0
jmp 0x1000cf85
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x1000cf9b
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xdc0], 0xbf48c443
jmp 0x1000cf7e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xee8], 0
je 0x1000cfb0
jmp 0x1000d098
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xdc0], 0
jmp 0x1000cfdb
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xdc0]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xdc0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xdc0], 2
jg 0x1000d069
mov dword [ebp - 0x148], 0x1c71bc7d
mov dword [ebp - 0xaa0], 0xffffffff
mov dword [ebp - 0x148], 2
jmp 0x1000d017
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jl 0x1000d064
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp + eax*4 - 0xee8]
sub eax, 0x5d3e9973
cmp eax, 0x62a04f77
jle 0x1000d045
mov dword [ebp - 0x418], 1
jmp 0x1000d04c
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0x2b8], 1
jmp 0x1000d00a
jmp 0x1000cfc2
jmp 0x1000d093
cmp dword [ebp - 0x2b8], 0xffffffff
jne 0x1000d080
mov dword [ebp - 0x880], 1
jmp 0x1000d087
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x2b8], eax
jmp 0x1000cee9
mov dword [ebp - 0xea4], 6
mov dword [ebp - 0xf8c], 0x9f71d691
mov dword [ebp - 0xeac], 0
mov dword [ebp - 0x100c], 0xffffffff
mov dword [ebp - 0xbf0], 0xd49acb08
mov dword [ebp - 0xbec], 0xd49acb08
mov dword [ebp - 0xbe8], 0xd49acb08
mov dword [ebp - 0xbe4], 0xd49acb08
lea ecx, [ebp - 0x33d]
call fcn.1000c103
push eax
lea eax, [ebp - 0xbe0]
push eax
lea eax, [ebp - 0xbf0]
push eax
lea ecx, [ebp - 0x10cc]
call fcn.10018805
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10a0]
call fcn.100187b4
mov dword [ebp - 4], 4
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x1000d145
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [ebp - 0x23c], 0
jmp 0x1000d15e
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 7
jg 0x1000d4e8
push 1
lea ecx, [ebp - 0xcf0]
call fcn.10018755
mov byte [ebp - 4], 5
mov dword [ebp - 0xeb4], 0x87a912e7
mov dword [ebp - 0xf94], 0
mov dword [ebp - 0xebc], 9
mov dword [ebp - 0x1014], 3
mov dword [ebp - 0x888], 0xfffffffe
mov dword [ebp - 0x448], 0xffffffff
mov dword [ebp - 0xfb4], 1
mov dword [ebp - 0xfb0], 1
mov dword [ebp - 0xfac], 1
mov dword [ebp - 0xfa8], 1
mov dword [ebp - 0x420], 1
mov dword [ebp - 0x18c], 0
jmp 0x1000d203
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x1000d222
push dword [ebp - 0x18c]
lea ecx, [ebp - 0xcf0]
call fcn.100187f6
and dword [eax], 0
jmp 0x1000d1f6
xor eax, eax
inc eax
je 0x1000d254
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x1000d24f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x1000d4d4
mov dword [ebp - 0xec4], 0xfffffff7
mov dword [ebp - 0xc40], 4
mov dword [ebp - 0xc3c], 4
mov dword [ebp - 0xc38], 4
mov dword [ebp - 0xc34], 4
lea ecx, [ebp - 0x345]
call fcn.1000c103
push eax
lea eax, [ebp - 0xc30]
push eax
lea eax, [ebp - 0xc40]
push eax
lea ecx, [ebp - 0x10d4]
call fcn.10018805
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa10]
call fcn.100187b4
mov byte [ebp - 4], 6
mov dword [ebp - 0xaa8], 0x2095d7c1
push 2
lea ecx, [ebp - 0xcd8]
call fcn.10018755
mov byte [ebp - 4], 7
mov dword [ebp - 0x204], 0
jmp 0x1000d2f3
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jge 0x1000d315
push dword [ebp - 0x204]
lea ecx, [ebp - 0xcd8]
call fcn.100187f6
mov dword [eax], 0x71e8ee62
jmp 0x1000d2e6
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0xf9c], eax
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0xecc], eax
mov esi, dword [ebp - 0xaa8]
push 1
lea ecx, [ebp - 0xa10]
call fcn.100187f6
cmp esi, dword [eax]
jg 0x1000d35d
mov dword [ebp - 0x428], 1
jmp 0x1000d364
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x448]
imul eax, dword [ebp - 0x428]
cmp eax, 0x9b1cc8ff
jne 0x1000d384
mov dword [ebp - 0x890], 1
jmp 0x1000d38b
and dword [ebp - 0x890], 0
cmp dword [ebp - 0x890], 1
jge 0x1000d3a0
mov dword [ebp - 0x430], 1
jmp 0x1000d3a7
and dword [ebp - 0x430], 0
cmp dword [ebp - 0x430], 0xb8af
jge 0x1000d3bf
mov dword [ebp - 0x898], 1
jmp 0x1000d3c6
and dword [ebp - 0x898], 0
push 1
lea ecx, [ebp - 0xa10]
call fcn.100187f6
mov eax, dword [eax]
imul eax, dword [ebp - 0x898]
mov dword [ebp - 0x438], eax
mov esi, dword [ebp - 0x438]
push 0
lea ecx, [ebp - 0xa10]
call fcn.100187f6
sub esi, dword [eax]
dec esi
imul eax, esi, 0
cmp eax, 1
jle 0x1000d40c
mov dword [ebp - 0x8a0], 1
jmp 0x1000d413
and dword [ebp - 0x8a0], 0
push 1
lea ecx, [ebp - 0xa10]
call fcn.100187f6
mov ecx, dword [ebp - 0x8a0]
sub ecx, dword [eax]
je 0x1000d43f
cmp dword [ebp - 0xab0], 0
je 0x1000d43f
mov dword [ebp - 0x440], 1
jmp 0x1000d446
and dword [ebp - 0x440], 0
push 0
lea ecx, [ebp - 0xcf0]
call fcn.100187f6
mov ecx, dword [ebp - 0x440]
cmp ecx, dword [eax]
jle 0x1000d469
mov dword [ebp - 0x8a8], 1
jmp 0x1000d470
and dword [ebp - 0x8a8], 0
imul eax, dword [ebp - 0x8a8], 0xfa4a
mov dword [ebp - 0x310], eax
push 2
lea ecx, [ebp - 0xa10]
call fcn.100187f6
mov ecx, dword [ebp - 0x310]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0xcd8]
call fcn.100187f6
mov ecx, dword [ebp - 0x310]
mov dword [eax], ecx
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x448], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xcd8]
call fcn.100187da
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa10]
call fcn.100187da
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xcf0]
call fcn.100187da
jmp 0x1000d151
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10a0]
call fcn.100187da
mov dword [ebp - 0x194], 0xfffffffd
mov dword [ebp - 0x1038], 1
mov dword [ebp - 0x8c8], 0x9e63a5be
mov dword [ebp - 0xed4], 6
mov dword [ebp - 0xa18], 0x4f6b903c
mov dword [ebp - 0xfa4], 0x1ee01e6e
mov dword [ebp - 0xedc], 6
mov dword [ebp - 0x1018], 0x9f71d691
mov dword [ebp - 0xdd8], 0
mov dword [ebp - 0xde0], 0xffffffff
mov dword [ebp - 0xbc8], 0xd49acb08
mov dword [ebp - 0xbc4], 0xd49acb08
mov dword [ebp - 0xbc0], 0xd49acb08
mov dword [ebp - 0xbbc], 0xd49acb08
lea ecx, [ebp - 0x295]
call fcn.1000c103
push eax
lea eax, [ebp - 0xbb8]
push eax
lea eax, [ebp - 0xbc8]
push eax
lea ecx, [ebp - 0x10ec]
call fcn.10018805
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x107c]
call fcn.100187b4
mov dword [ebp - 4], 8
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1000d5e0
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [ebp - 0x194], 0
jmp 0x1000d5f9
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 7
jg 0x1000d983
push 1
lea ecx, [ebp - 0xd38]
call fcn.10018755
mov byte [ebp - 4], 9
mov dword [ebp - 0xde8], 0x87a912e7
mov dword [ebp - 0xdf0], 0
mov dword [ebp - 0xdf8], 9
mov dword [ebp - 0xe00], 3
mov dword [ebp - 0x450], 0xfffffffe
mov dword [ebp - 0x8d8], 0xffffffff
mov dword [ebp - 0xfc8], 1
mov dword [ebp - 0xfc4], 1
mov dword [ebp - 0xfc0], 1
mov dword [ebp - 0xfbc], 1
mov dword [ebp - 0x8b0], 1
mov dword [ebp - 0x25c], 0
jmp 0x1000d69e
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 1
jge 0x1000d6bd
push dword [ebp - 0x25c]
lea ecx, [ebp - 0xd38]
call fcn.100187f6
and dword [eax], 0
jmp 0x1000d691
xor eax, eax
inc eax
je 0x1000d6ef
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x1000d6ea
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x1000d96f
mov dword [ebp - 0xe08], 0xfffffff7
mov dword [ebp - 0xbdc], 4
mov dword [ebp - 0xbd8], 4
mov dword [ebp - 0xbd4], 4
mov dword [ebp - 0xbd0], 4
lea ecx, [ebp - 0x2fd]
call fcn.1000c103
push eax
lea eax, [ebp - 0xbcc]
push eax
lea eax, [ebp - 0xbdc]
push eax
lea ecx, [ebp - 0x10fc]
call fcn.10018805
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9d4]
call fcn.100187b4
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xab8], 0x2095d7c1
push 2
lea ecx, [ebp - 0xd20]
call fcn.10018755
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x19c], 0
jmp 0x1000d78e
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x1000d7b0
push dword [ebp - 0x19c]
lea ecx, [ebp - 0xd20]
call fcn.100187f6
mov dword [eax], 0x71e8ee62
jmp 0x1000d781
mov eax, dword [ebp - 0x8b0]
inc eax
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0xe10], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0xe18], eax
mov esi, dword [ebp - 0xab8]
push 1
lea ecx, [ebp - 0x9d4]
call fcn.100187f6
cmp esi, dword [eax]
jg 0x1000d7f8
mov dword [ebp - 0x8b8], 1
jmp 0x1000d7ff
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8d8]
imul eax, dword [ebp - 0x8b8]
cmp eax, 0x9b1cc8ff
jne 0x1000d81f
mov dword [ebp - 0x458], 1
jmp 0x1000d826
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 1
jge 0x1000d83b
mov dword [ebp - 0x8c0], 1
jmp 0x1000d842
and dword [ebp - 0x8c0], 0
cmp dword [ebp - 0x8c0], 0xb8af
jge 0x1000d85a
mov dword [ebp - 0x460], 1
jmp 0x1000d861
and dword [ebp - 0x460], 0
push 1
lea ecx, [ebp - 0x9d4]
call fcn.100187f6
mov eax, dword [eax]
imul eax, dword [ebp - 0x460]
mov dword [ebp - 0x8c8], eax
mov esi, dword [ebp - 0x8c8]
push 0
lea ecx, [ebp - 0x9d4]
call fcn.100187f6
sub esi, dword [eax]
dec esi
imul eax, esi, 0
cmp eax, 1
jle 0x1000d8a7
mov dword [ebp - 0x468], 1
jmp 0x1000d8ae
and dword [ebp - 0x468], 0
push 1
lea ecx, [ebp - 0x9d4]
call fcn.100187f6
mov ecx, dword [ebp - 0x468]
sub ecx, dword [eax]
je 0x1000d8da
cmp dword [ebp - 0xa18], 0
je 0x1000d8da
mov dword [ebp - 0x8d0], 1
jmp 0x1000d8e1
and dword [ebp - 0x8d0], 0
push 0
lea ecx, [ebp - 0xd38]
call fcn.100187f6
mov ecx, dword [ebp - 0x8d0]
cmp ecx, dword [eax]
jle 0x1000d904
mov dword [ebp - 0x470], 1
jmp 0x1000d90b
and dword [ebp - 0x470], 0
imul eax, dword [ebp - 0x470], 0xfa4a
mov dword [ebp - 0x2c0], eax
push 2
lea ecx, [ebp - 0x9d4]
call fcn.100187f6
mov ecx, dword [ebp - 0x2c0]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0xd20]
call fcn.100187f6
mov ecx, dword [ebp - 0x2c0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x8d8], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xd20]
call fcn.100187da
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x9d4]
call fcn.100187da
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd38]
call fcn.100187da
jmp 0x1000d5ec
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x107c]
call fcn.100187da
mov dword [ebp - 0x20c], 0xfffffffd
mov dword [ebp - 0xe20], 1
mov dword [ebp - 0x490], 0x9e63a5be
mov dword [ebp - 0xe28], 6
mov dword [ebp - 0xad0], 0x4f6b903c
mov dword [ebp - 0xe30], 0x1ee01e6e
mov dword [ebp - 0xe38], 6
mov dword [ebp - 0xe40], 0x9f71d691
mov dword [ebp - 0xe48], 0
mov dword [ebp - 0xe50], 0xffffffff
mov dword [ebp - 0xc04], 0xd49acb08
mov dword [ebp - 0xc00], 0xd49acb08
mov dword [ebp - 0xbfc], 0xd49acb08
mov dword [ebp - 0xbf8], 0xd49acb08
lea ecx, [ebp - 0x321]
call fcn.1000c103
push eax
lea eax, [ebp - 0xbf4]
push eax
lea eax, [ebp - 0xc04]
push eax
lea ecx, [ebp - 0x110c]
call fcn.10018805
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1094]
call fcn.100187b4
mov dword [ebp - 4], 0xc
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x1000da7b
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [ebp - 0x20c], 0
jmp 0x1000da94
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 7
jg 0x1000de1e
push 1
lea ecx, [ebp - 0xd68]
call fcn.10018755
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xe58], 0x87a912e7
mov dword [ebp - 0xe60], 0
mov dword [ebp - 0xe68], 9
mov dword [ebp - 0xe70], 3
mov dword [ebp - 0x8e0], 0xfffffffe
mov dword [ebp - 0x4a0], 0xffffffff
mov dword [ebp - 0xfdc], 1
mov dword [ebp - 0xfd8], 1
mov dword [ebp - 0xfd4], 1
mov dword [ebp - 0xfd0], 1
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x1a4], 0
jmp 0x1000db39
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jge 0x1000db58
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0xd68]
call fcn.100187f6
and dword [eax], 0
jmp 0x1000db2c
xor eax, eax
inc eax
je 0x1000db8a
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1000db85
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x1000de0a
mov dword [ebp - 0xe78], 0xfffffff7
mov dword [ebp - 0xc2c], 4
mov dword [ebp - 0xc28], 4
mov dword [ebp - 0xc24], 4
mov dword [ebp - 0xc20], 4
lea ecx, [ebp - 0x32d]
call fcn.1000c103
push eax
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0xc2c]
push eax
lea ecx, [ebp - 0x10e4]
call fcn.10018805
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9ec]
call fcn.100187b4
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xac8], 0x2095d7c1
push 2
lea ecx, [ebp - 0xd50]
call fcn.10018755
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x244], 0
jmp 0x1000dc29
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jge 0x1000dc4b
push dword [ebp - 0x244]
lea ecx, [ebp - 0xd50]
call fcn.100187f6
mov dword [eax], 0x71e8ee62
jmp 0x1000dc1c
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0xe80], eax
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0xe88], eax
mov esi, dword [ebp - 0xac8]
push 1
lea ecx, [ebp - 0x9ec]
call fcn.100187f6
cmp esi, dword [eax]
jg 0x1000dc93
mov dword [ebp - 0x480], 1
jmp 0x1000dc9a
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x4a0]
imul eax, dword [ebp - 0x480]
cmp eax, 0x9b1cc8ff
jne 0x1000dcba
mov dword [ebp - 0x8e8], 1
jmp 0x1000dcc1
and dword [ebp - 0x8e8], 0
cmp dword [ebp - 0x8e8], 1
jge 0x1000dcd6
mov dword [ebp - 0x488], 1
jmp 0x1000dcdd
and dword [ebp - 0x488], 0
cmp dword [ebp - 0x488], 0xb8af
jge 0x1000dcf5
mov dword [ebp - 0x8f0], 1
jmp 0x1000dcfc
and dword [ebp - 0x8f0], 0
push 1
lea ecx, [ebp - 0x9ec]
call fcn.100187f6
mov eax, dword [eax]
imul eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x490], eax
mov esi, dword [ebp - 0x490]
push 0
lea ecx, [ebp - 0x9ec]
call fcn.100187f6
sub esi, dword [eax]
dec esi
imul eax, esi, 0
cmp eax, 1
jle 0x1000dd42
mov dword [ebp - 0x8f8], 1
jmp 0x1000dd49
and dword [ebp - 0x8f8], 0
push 1
lea ecx, [ebp - 0x9ec]
call fcn.100187f6
mov ecx, dword [ebp - 0x8f8]
sub ecx, dword [eax]
je 0x1000dd75
cmp dword [ebp - 0xad0], 0
je 0x1000dd75
mov dword [ebp - 0x498], 1
jmp 0x1000dd7c
and dword [ebp - 0x498], 0
push 0
lea ecx, [ebp - 0xd68]
call fcn.100187f6
mov ecx, dword [ebp - 0x498]
cmp ecx, dword [eax]
jle 0x1000dd9f
mov dword [ebp - 0x900], 1
jmp 0x1000dda6
and dword [ebp - 0x900], 0
imul eax, dword [ebp - 0x900], 0xfa4a
mov dword [ebp - 0x344], eax
push 2
lea ecx, [ebp - 0x9ec]
call fcn.100187f6
mov ecx, dword [ebp - 0x344]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0xd50]
call fcn.100187f6
mov ecx, dword [ebp - 0x344]
mov dword [eax], ecx
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x4a0], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xd50]
call fcn.100187da
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x9ec]
call fcn.100187da
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xd68]
call fcn.100187da
jmp 0x1000da87
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1094]
call fcn.100187da
push 4
lea ecx, [ebp - 0xd80]
call fcn.10018755
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x1ac], 0
jmp 0x1000de64
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 4
jge 0x1000de83
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0xd80]
call fcn.100187f6
or dword [eax], 0xffffffff
jmp 0x1000de57
mov dword [ebp - 0x138], 3
jmp 0x1000de9c
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jl 0x1000debf
push dword [ebp - 0x138]
lea ecx, [ebp - 0xd80]
call fcn.100187f6
cmp dword [eax], 0
je 0x1000debd
jmp 0x1000debf
jmp 0x1000de8f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd80]
call fcn.100187da
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x214], 0
jmp 0x1000def1
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jg 0x1000dfb4
mov dword [ebp - 0xc54], 0xafe0
mov dword [ebp - 0xc50], 0xafe0
mov dword [ebp - 0xc4c], 0xafe0
mov dword [ebp - 0xc48], 0xafe0
lea ecx, [ebp - 0x29d]
call fcn.1000c103
push eax
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xc54]
push eax
lea ecx, [ebp - 0x1104]
call fcn.10018805
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xef8]
call fcn.100187b4
mov dword [ebp - 4], 0x11
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x1000df7c
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
lea ecx, [ebp - 0xef8]
call fcn.100187f6
mov dword [ebp - 0x908], eax
mov eax, dword [ebp - 0x908]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x908]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xef8]
call fcn.100187da
jmp 0x1000dee4
push 4
lea ecx, [ebp - 0xd98]
call fcn.10018755
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x1b4], 0
jmp 0x1000dfeb
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 4
jge 0x1000e00a
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0xd98]
call fcn.100187f6
or dword [eax], 0xffffffff
jmp 0x1000dfde
mov dword [ebp - 0x158], 3
jmp 0x1000e023
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x1000e046
push dword [ebp - 0x158]
lea ecx, [ebp - 0xd98]
call fcn.100187f6
cmp dword [eax], 0
je 0x1000e044
jmp 0x1000e046
jmp 0x1000e016
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd98]
call fcn.100187da
mov dword [ebp - 0x100], 0x6b0f
mov dword [ebp - 0xf7c], 0xd089
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x100], 0xfffffff3
jmp 0x1000e08f
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x1d
jl 0x1000e301
mov dword [ebp - 0x1bc], 1
push 1
lea ecx, [ebp - 0xf08]
call fcn.10018755
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x26c], 0
jmp 0x1000e0d3
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1000e0f5
push dword [ebp - 0x26c]
lea ecx, [ebp - 0xf08]
call fcn.100187f6
mov dword [eax], 0xfc39
jmp 0x1000e0c6
mov dword [ebp - 0x1bc], 0
jmp 0x1000e10e
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xffffffed
jle 0x1000e2ed
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x21c], 6
jmp 0x1000e13e
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xf
je 0x1000e2e8
mov dword [ebp - 0x1c4], 0x74006310
mov dword [ebp - 0x1c4], 0
jmp 0x1000e16e
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jg 0x1000e2bd
mov dword [ebp - 0x24c], 0
jmp 0x1000e194
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x1000e1b0
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x9c8], 0
jmp 0x1000e187
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1000e1ca
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9c8], 0
jmp 0x1000e1f8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9c8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c8], 0
jg 0x1000e2b8
mov dword [ebp - 0x1cc], 0xbaef6e22
mov dword [ebp - 0x1cc], 0
jmp 0x1000e22f
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jl 0x1000e295
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x1000e293
push 0
push 0x26ac
push 0x1741
push 0x17a3
push 0x2129
push 0x1346
push 0x5d3
push 0xfcc
push 0x1ab5
push 0x1499
push 0xd4e
push 0x2a0
push 0x65a
push 0xc1b
call dword [sym.imp.GDI32.dll_CreateFontA]
jmp 0x1000e222
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1000e2b3
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1000e1dd
jmp 0x1000e161
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x1000e2e3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
jmp 0x1000e131
jmp 0x1000e101
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf08]
call fcn.100187da
jmp 0x1000e082
push 4
lea ecx, [ebp - 0xdb0]
call fcn.10018755
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x224], 0
jmp 0x1000e338
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 4
jge 0x1000e357
push dword [ebp - 0x224]
lea ecx, [ebp - 0xdb0]
call fcn.100187f6
or dword [eax], 0xffffffff
jmp 0x1000e32b
mov dword [ebp - 0x140], 3
jmp 0x1000e370
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jl 0x1000e393
push dword [ebp - 0x140]
lea ecx, [ebp - 0xdb0]
call fcn.100187f6
cmp dword [eax], 0
je 0x1000e391
jmp 0x1000e393
jmp 0x1000e363
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb0]
call fcn.100187da
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1d4], 0
jmp 0x1000e3c5
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jg 0x1000e488
mov dword [ebp - 0xc18], 0xafe0
mov dword [ebp - 0xc14], 0xafe0
mov dword [ebp - 0xc10], 0xafe0
mov dword [ebp - 0xc0c], 0xafe0
lea ecx, [ebp - 0x289]
call fcn.1000c103
push eax
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc18]
push eax
lea ecx, [ebp - 0x10f4]
call fcn.10018805
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf18]
call fcn.100187b4
mov dword [ebp - 4], 0x15
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1000e450
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
lea ecx, [ebp - 0xf18]
call fcn.100187f6
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4a8]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf18]
call fcn.100187da
jmp 0x1000e3b8
mov dword [ebp - 0x910], 0xffffffff
mov dword [ebp - 0x264], 0xad5befa1
mov dword [ebp - 0x920], 0xfffffff9
mov dword [ebp - 0xe8c], 7
mov dword [ebp - 0x4b0], 0x6193fe69
mov dword [ebp - 0x318], 0x2d50fa8f
mov dword [ebp - 0xad8], 8
mov dword [ebp - 0x8ec], 1
mov dword [ebp - 0x734], 2
push 4
lea ecx, [ebp - 0xcfc]
call fcn.10018755
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x70], 0
jmp 0x1000e506
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1000e51c
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x918], 0xd7f19125
jmp 0x1000e4ff
mov dword [ebp - 0x70], 0
jmp 0x1000e52c
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1000e548
push dword [ebp - 0x70]
lea ecx, [ebp - 0xcfc]
call fcn.100187f6
mov dword [eax], 0xfffffffb
jmp 0x1000e525
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1000e562
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [ebp - 0x920], 0xa3a6
jl 0x1000e57a
mov dword [ebp - 0x2c8], 1
jmp 0x1000e581
and dword [ebp - 0x2c8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp + eax - 0x918], ecx
cmp dword [ebp - 0x2c8], 0
jne 0x1000e5af
cmp dword [ebp - 0xad8], 0
jne 0x1000e5af
and dword [ebp - 0xae0], 0
jmp 0x1000e5b9
mov dword [ebp - 0xae0], 1
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0xe90], eax
mov eax, dword [ebp - 0x318]
dec eax
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x910], eax
jne 0x1000e5ec
mov dword [ebp - 0xae8], 1
jmp 0x1000e5f3
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xe98], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4b0]
cmp dword [ebp + eax - 0x918], ecx
jl 0x1000e620
mov dword [ebp - 0x4b8], 1
jmp 0x1000e627
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x4b8], eax
jg 0x1000e641
mov dword [ebp - 0x928], 1
jmp 0x1000e648
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x920]
cmp dword [ebp - 0x928], eax
jge 0x1000e662
mov dword [ebp - 0x4f0], 1
jmp 0x1000e669
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x8ec]
imul eax, dword [ebp - 0x4f0]
test eax, eax
jne 0x1000e687
xor eax, eax
jne 0x1000e687
and dword [ebp - 0x854], 0
jmp 0x1000e691
mov dword [ebp - 0x854], 1
mov eax, dword [ebp - 0x734]
cmp dword [ebp - 0x854], eax
jg 0x1000e6ab
mov dword [ebp - 0x4d4], 1
jmp 0x1000e6b2
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 0x6f2b
jg 0x1000e6d3
cmp dword [ebp - 0x264], 0
je 0x1000e6d3
mov dword [ebp - 0x72c], 1
jmp 0x1000e6da
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0xffffffff
ja 0x1000e6fb
mov dword [ebp - 0x4dc], 1
jmp 0x1000e702
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 0x891c
je 0x1000e71a
mov dword [ebp - 0x4e4], 1
jmp 0x1000e721
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x8ec]
imul eax, dword [ebp - 0x4e4]
test eax, eax
je 0x1000e73e
mov dword [ebp - 0x4ec], 1
jmp 0x1000e745
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x734]
imul eax, dword [ebp - 0x4ec]
test eax, eax
je 0x1000e766
xor eax, eax
je 0x1000e766
mov dword [ebp - 0x85c], 1
jmp 0x1000e76d
and dword [ebp - 0x85c], 0
mov esi, dword [ebp - 0x85c]
neg esi
push 2
lea ecx, [ebp - 0xcfc]
call fcn.100187f6
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcfc]
call fcn.100187da
push 2
lea ecx, [ebp - 0xa04]
call fcn.10018755
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x95c], 0x41449c9f
mov dword [ebp - 0x2d8], 0x800f
mov dword [ebp - 0x50c], 0x5fcc58a0
push 1
lea ecx, [ebp - 0x980]
call fcn.10018755
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x864], 0x3d783989
mov dword [ebp - 0x2d0], 1
mov dword [ebp - 0x4fc], 0xfffffff9
push 4
lea ecx, [ebp - 0xc84]
call fcn.10018755
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x8f4], 0x387c7a50
push 4
lea ecx, [ebp - 0xd8c]
call fcn.10018755
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x18], 0
jmp 0x1000e830
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1000e849
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa04]
call fcn.100187f6
or dword [eax], 0xffffffff
jmp 0x1000e829
mov dword [ebp - 0x18], 0
jmp 0x1000e859
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1000e872
push dword [ebp - 0x18]
lea ecx, [ebp - 0x980]
call fcn.100187f6
and dword [eax], 0
jmp 0x1000e852
mov dword [ebp - 0x18], 0
jmp 0x1000e882
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1000e89e
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc84]
call fcn.100187f6
mov dword [eax], 0xc10b42b8
jmp 0x1000e87b
mov dword [ebp - 0x18], 0
jmp 0x1000e8ae
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1000e8c4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10ac], 0x80d0e101
jmp 0x1000e8a7
mov dword [ebp - 0x18], 0
jmp 0x1000e8d4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1000e8f0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd8c]
call fcn.100187f6
mov dword [eax], 0x52ee
jmp 0x1000e8cd
push 1
lea ecx, [ebp - 0xa04]
call fcn.100187f6
cmp dword [eax], 0
je 0x1000e90b
mov eax, 0x67215912
test eax, eax
jne 0x1000e92b
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [ebp - 0x2d0]
inc ecx
mov dword [ebp - 0x2d0], ecx
test eax, eax
jne 0x1000e92b
and dword [ebp - 0x514], 0
jmp 0x1000e935
mov dword [ebp - 0x514], 1
push 1
lea ecx, [ebp - 0xa04]
call fcn.100187f6
cmp dword [eax], 0xdf47
jl 0x1000e956
mov dword [ebp - 0x4f4], 1
jmp 0x1000e95d
and dword [ebp - 0x4f4], 0
push 0
lea ecx, [ebp - 0x980]
call fcn.100187f6
mov eax, dword [eax]
imul eax, dword [ebp - 0x4f4]
test eax, eax
je 0x1000e98c
cmp dword [ebp - 0x95c], 0
je 0x1000e98c
mov dword [ebp - 0x73c], 1
jmp 0x1000e993
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x95c], eax
push 0
lea ecx, [ebp - 0x980]
call fcn.100187f6
mov esi, eax
push 0
lea ecx, [ebp - 0x980]
call fcn.100187f6
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1000e9d9
mov dword [ebp - 0x504], 1
jmp 0x1000e9e0
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x864], eax
imul esi, dword [ebp - 0x2d8], 0xadf8
push 1
lea ecx, [ebp - 0xa04]
call fcn.100187f6
add esi, dword [eax]
mov dword [ebp - 0x744], esi
push 2
lea ecx, [ebp - 0xc84]
call fcn.100187f6
mov ecx, dword [ebp - 0x744]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x980]
call fcn.100187f6
mov ecx, dword [ebp - 0x744]
imul ecx, dword [eax]
mov dword [ebp - 0x50c], ecx
mov eax, dword [ebp - 0x50c]
sub eax, dword [ebp - 0x2d8]
je 0x1000ea5f
cmp dword [ebp - 0x864], 0
je 0x1000ea5f
mov dword [ebp - 0x32c], 1
jmp 0x1000ea66
and dword [ebp - 0x32c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x32c]
mov dword [ebp + eax - 0x10ac], ecx
mov eax, dword [ebp - 0x8f4]
cmp dword [ebp - 0x32c], eax
jle 0x1000ea92
mov dword [ebp - 0xaf0], 1
jmp 0x1000ea99
and dword [ebp - 0xaf0], 0
push 0
lea ecx, [ebp - 0x980]
call fcn.100187f6
push 0
lea ecx, [ebp - 0x980]
call fcn.100187f6
push 1
lea ecx, [ebp - 0xa04]
call fcn.100187f6
mov esi, eax
push 0
lea ecx, [ebp - 0xd8c]
call fcn.100187f6
mov ecx, dword [esi]
sub ecx, dword [eax]
imul eax, ecx, 0
cmp eax, 6
jl 0x1000eae7
mov dword [ebp - 0x74c], 1
jmp 0x1000eaee
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0x74c]
jl 0x1000eb08
mov dword [ebp - 0x51c], 1
jmp 0x1000eb0f
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x2d8]
imul eax, dword [ebp - 0x51c]
mov dword [ebp - 0x8f4], eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xd8c]
call fcn.100187da
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xc84]
call fcn.100187da
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x980]
call fcn.100187da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa04]
call fcn.100187da
mov dword [ebp - 0x110], 0x6b0f
mov dword [ebp - 0xea0], 0xd089
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x110], 0xfffffff3
jmp 0x1000eb98
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x1d
jl 0x1000ee0a
mov dword [ebp - 0x22c], 1
push 1
lea ecx, [ebp - 0xf28]
call fcn.10018755
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x1dc], 0
jmp 0x1000ebdc
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x1000ebfe
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xf28]
call fcn.100187f6
mov dword [eax], 0xfc39
jmp 0x1000ebcf
mov dword [ebp - 0x22c], 0
jmp 0x1000ec17
mov eax, dword [ebp - 0x22c]
dec eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xffffffed
jle 0x1000edf6
mov dword [ebp - 0x1e4], 0xffffffff
mov dword [ebp - 0x1e4], 6
jmp 0x1000ec47
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xf
je 0x1000edf1
mov dword [ebp - 0x254], 0x74006310
mov dword [ebp - 0x254], 0
jmp 0x1000ec77
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
jg 0x1000edc6
mov dword [ebp - 0x1ec], 0
jmp 0x1000ec9d
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 2
jge 0x1000ecb9
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0x9b8], 0
jmp 0x1000ec90
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1000ecd3
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9b8], 0
jmp 0x1000ed01
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9b8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9b8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9b8], 0
jg 0x1000edc1
mov dword [ebp - 0x234], 0xbaef6e22
mov dword [ebp - 0x234], 0
jmp 0x1000ed38
mov eax, dword [ebp - 0x234]
dec eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jl 0x1000ed9e
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x1000ed9c
push 0
push 0x26ac
push 0x1741
push 0x17a3
push 0x2129
push 0x1346
push 0x5d3
push 0xfcc
push 0x1ab5
push 0x1499
push 0xd4e
push 0x2a0
push 0x65a
push 0xc1b
call dword [sym.imp.GDI32.dll_CreateFontA]
jmp 0x1000ed2b
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1000edbc
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1000ece6
jmp 0x1000ec6a
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x1000edec
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
jmp 0x1000ec3a
jmp 0x1000ec0a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf28]
call fcn.100187da
jmp 0x1000eb8b
mov dword [ebp - 0xea8], 0x39b642c7
mov dword [ebp - 0xb00], 0xd837bc75
mov dword [ebp - 0xeb0], 0xc0f8067e
mov dword [ebp - 0x524], 0xbe39e3cf
mov dword [ebp - 0xaf8], 1
mov dword [ebp - 0x1f4], 0
jmp 0x1000ee55
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jge 0x1000ee71
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x1130], 0x1d976ff5
jmp 0x1000ee48
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x168], 0
jmp 0x1000eead
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jg 0x1000ef70
mov dword [ebp - 0xbb4], 0xafe0
mov dword [ebp - 0xbb0], 0xafe0
mov dword [ebp - 0xbac], 0xafe0
mov dword [ebp - 0xba8], 0xafe0
lea ecx, [ebp - 0x33e]
call fcn.1000c103
push eax
lea eax, [ebp - 0xba4]
push eax
lea eax, [ebp - 0xbb4]
push eax
lea ecx, [ebp - 0x10dc]
call fcn.10018805
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf38]
call fcn.100187b4
mov dword [ebp - 4], 0x1c
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1000ef38
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
lea ecx, [ebp - 0xf38]
call fcn.100187f6
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x754]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x754]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf38]
call fcn.100187da
jmp 0x1000eea0
mov dword [ebp - 0x52c], 0xffffffff
mov dword [ebp - 0x178], 0xad5befa1
mov dword [ebp - 0x53c], 0xfffffff9
mov dword [ebp - 0xeb8], 7
mov dword [ebp - 0x86c], 0x6193fe69
mov dword [ebp - 0x2e0], 0x2d50fa8f
mov dword [ebp - 0xb08], 8
mov dword [ebp - 0x76c], 1
mov dword [ebp - 0x8fc], 2
push 4
lea ecx, [ebp - 0xd2c]
call fcn.10018755
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x58], 0
jmp 0x1000efee
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1000f004
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x534], 0xd7f19125
jmp 0x1000efe7
mov dword [ebp - 0x58], 0
jmp 0x1000f014
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x1000f030
push dword [ebp - 0x58]
lea ecx, [ebp - 0xd2c]
call fcn.100187f6
mov dword [eax], 0xfffffffb
jmp 0x1000f00d
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x1000f04a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [ebp - 0x53c], 0xa3a6
jl 0x1000f062
mov dword [ebp - 0x320], 1
jmp 0x1000f069
and dword [ebp - 0x320], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x320]
mov dword [ebp + eax - 0x534], ecx
cmp dword [ebp - 0x320], 0
jne 0x1000f097
cmp dword [ebp - 0xb08], 0
jne 0x1000f097
and dword [ebp - 0xb10], 0
jmp 0x1000f0a1
mov dword [ebp - 0xb10], 1
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0xec0], eax
mov eax, dword [ebp - 0x2e0]
dec eax
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x86c]
cmp dword [ebp - 0x52c], eax
jne 0x1000f0d4
mov dword [ebp - 0xb18], 1
jmp 0x1000f0db
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0xec8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x86c]
cmp dword [ebp + eax - 0x534], ecx
jl 0x1000f108
mov dword [ebp - 0x75c], 1
jmp 0x1000f10f
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x75c], eax
jg 0x1000f129
mov dword [ebp - 0x93c], 1
jmp 0x1000f130
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x53c]
cmp dword [ebp - 0x93c], eax
jge 0x1000f14a
mov dword [ebp - 0x544], 1
jmp 0x1000f151
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x76c]
imul eax, dword [ebp - 0x544]
test eax, eax
jne 0x1000f16f
xor eax, eax
jne 0x1000f16f
and dword [ebp - 0x764], 0
jmp 0x1000f179
mov dword [ebp - 0x764], 1
mov eax, dword [ebp - 0x8fc]
cmp dword [ebp - 0x764], eax
jg 0x1000f193
mov dword [ebp - 0x54c], 1
jmp 0x1000f19a
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0x6f2b
jg 0x1000f1bb
cmp dword [ebp - 0x178], 0
je 0x1000f1bb
mov dword [ebp - 0x874], 1
jmp 0x1000f1c2
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xffffffff
ja 0x1000f1e3
mov dword [ebp - 0x554], 1
jmp 0x1000f1ea
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0x891c
je 0x1000f202
mov dword [ebp - 0x55c], 1
jmp 0x1000f209
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x76c]
imul eax, dword [ebp - 0x55c]
test eax, eax
je 0x1000f226
mov dword [ebp - 0x564], 1
jmp 0x1000f22d
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x8fc]
imul eax, dword [ebp - 0x564]
test eax, eax
je 0x1000f24e
xor eax, eax
je 0x1000f24e
mov dword [ebp - 0x774], 1
jmp 0x1000f255
and dword [ebp - 0x774], 0
mov esi, dword [ebp - 0x774]
neg esi
push 2
lea ecx, [ebp - 0xd2c]
call fcn.100187f6
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd2c]
call fcn.100187da
mov dword [ebp - 0x108], 0x6b0f
mov dword [ebp - 0xed0], 0xd089
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x108], 0xfffffff3
jmp 0x1000f2b5
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x1d
jl 0x1000f527
mov dword [ebp - 0x188], 1
push 1
lea ecx, [ebp - 0xf48]
call fcn.10018755
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x180], 0
jmp 0x1000f2f9
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x1000f31b
push dword [ebp - 0x180]
lea ecx, [ebp - 0xf48]
call fcn.100187f6
mov dword [eax], 0xfc39
jmp 0x1000f2ec
mov dword [ebp - 0x188], 0
jmp 0x1000f334
cmp dword [ebp - 0x188], 0xffffffed
jle 0x1000f513
mov dword [ebp - 0x190], 0xffffffff
mov dword [ebp - 0x190], 6
jmp 0x1000f364
cmp dword [ebp - 0x190], 0xf
je 0x1000f50e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf48]
call fcn.100187da
jmp 0x1000f2a8
mov dword [ebp - 0x1b0], 0x7e2799ac
mov dword [ebp - 0x1b0], 0xa
jmp 0x1000f54a
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffe3
jle 0x1000f5a0
mov dword [ebp - 0xb60], 0xffffffff
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x1000f593
push 0x222b
push 0
push 0
push 0
push 0
push 0x203e
push 0xdef
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
cmp dword [ebp - 0xb60], 0
je 0x1000f59e
jmp 0x1000f5a0
jmp 0x1000f53d
push 2
lea ecx, [ebp - 0x9e0]
call fcn.10018755
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x77c], 0x41449c9f
mov dword [ebp - 0x328], 0x800f
mov dword [ebp - 0x584], 0x5fcc58a0
push 1
lea ecx, [ebp - 0x990]
call fcn.10018755
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x784], 0x3d783989
mov dword [ebp - 0x334], 1
mov dword [ebp - 0x574], 0xfffffff9
push 4
lea ecx, [ebp - 0xd74]
call fcn.10018755
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x78c], 0x387c7a50
push 4
lea ecx, [ebp - 0xc9c]
call fcn.10018755
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x10], 0
jmp 0x1000f63d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000f656
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9e0]
call fcn.100187f6
or dword [eax], 0xffffffff
jmp 0x1000f636
mov dword [ebp - 0x10], 0
jmp 0x1000f666
cmp dword [ebp - 0x10], 1
jge 0x1000f67f