Function at 0x10009814
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100880c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1344
call fcn.100835c0
push esi
push edi
mov dword [ebp - 0x178], 1
mov dword [ebp - 0xf98], 8
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x1b4], 0
jmp 0x1000986f
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x1000988b
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x110c], 0xffffffff
jmp 0x10009862
mov dword [ebp - 0x178], 2
jmp 0x100098a4
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jl 0x100098fc
mov dword [ebp - 0x10d0], 0xffffffff
mov dword [ebp - 0x11d4], 1
mov dword [ebp - 0x10d8], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp + eax*4 - 0x110c], 1
jl 0x100098e7
mov dword [ebp - 0x5b4], 1
jmp 0x100098ee
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0xfc], eax
jmp 0x10009897
mov dword [ebp - 0xfc], 0
jmp 0x10009915
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jge 0x10009931
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x110c], 0x9d94
jmp 0x10009908
mov dword [ebp - 0xa08], 0xffffffff
mov dword [ebp - 0x12c], 0x7d8e
mov dword [ebp - 0x104], 0xe8f21009
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0xbac], 0x13db
cmp dword [ebp - 0x12c], 0
jne 0x100099c6
cmp dword [ebp - 0x12c], 0x44b0bf2
jl 0x10009981
mov dword [ebp - 0xa18], 1
jmp 0x10009988
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0xa18]
sub eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x12c]
jg 0x100099a8
mov dword [ebp - 0xa20], 1
jmp 0x100099af
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0xa20]
jne 0x100099c6
and dword [ebp - 0xae4], 0
jmp 0x100099d0
mov dword [ebp - 0xae4], 1
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x1228], eax
xor eax, eax
cmp eax, 0xf4d3
jne 0x100099f1
mov dword [ebp - 0xb7c], 1
jmp 0x100099f8
and dword [ebp - 0xb7c], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xf84], eax
cmp dword [ebp - 0x104], 0xf8651162
je 0x10009a1c
mov dword [ebp - 0xb84], 1
jmp 0x10009a23
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xf8c], eax
mov dword [ebp - 0x28], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x10009a96
mov dword [ebp - 0xb8c], 0x5c22c920
mov dword [ebp - 0x28], 0
jmp 0x10009a56
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffe
je 0x10009a91
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x10009a84
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebp - 0xb8c], 0
je 0x10009a8f
jmp 0x10009a91
jmp 0x10009a4f
jmp 0x10009de8
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0x30], 0xbdf9020c
mov dword [ebp - 0x10c], 0x34572090
mov dword [ebp - 0xbb4], 0xba006696
mov dword [ebp - 0x220], 0
jmp 0x10009ad4
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x10009af0
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x224], 0xeba4
jmp 0x10009ac7
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp + eax - 0x224], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
mov dword [ebp - 0xf94], eax
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0x28]
cmp eax, 0xfffffffa
ja 0x10009b2d
mov dword [ebp - 0xa28], 1
jmp 0x10009b34
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
add eax, 0x6e90
sub eax, dword [ebp - 0x30]
jne 0x10009b5f
cmp dword [ebp - 0x28], 0
jne 0x10009b5f
and dword [ebp - 0xa48], 0
jmp 0x10009b69
mov dword [ebp - 0xa48], 1
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0xa48]
imul eax, eax, 0xf002
cmp eax, dword [ebp - 0x30]
jle 0x10009b8a
mov dword [ebp - 0xb94], 1
jmp 0x10009b91
and dword [ebp - 0xb94], 0
push 0xfffffffffffffffc
pop eax
imul eax, eax, 0x1915
test eax, eax
jne 0x10009bad
cmp dword [ebp - 0x28], 0
jne 0x10009bad
and dword [ebp - 0xa50], 0
jmp 0x10009bb7
mov dword [ebp - 0xa50], 1
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0xa50], eax
jl 0x10009bd1
mov dword [ebp - 0xa58], 1
jmp 0x10009bd8
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0xa58]
sub eax, dword [ebp - 0x30]
cmp eax, 0xffff
jb 0x10009bf4
mov dword [ebp - 0xb9c], 1
jmp 0x10009bfb
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xf9c], eax
mov eax, 0x4768
sub eax, dword [ebp - 0x30]
cmp dword [ebp - 0x28], eax
jg 0x10009c1d
mov dword [ebp - 0xa60], 1
jmp 0x10009c24
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xa60], eax
jl 0x10009c3b
mov dword [ebp - 0xa68], 1
jmp 0x10009c42
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xa68], eax
jge 0x10009c59
mov dword [ebp - 0xa70], 1
jmp 0x10009c60
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0xa70]
shl eax, 3
test eax, eax
jne 0x10009c7c
mov dword [ebp - 0xa78], 1
jmp 0x10009c83
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xa78], eax
je 0x10009c9a
mov dword [ebp - 0x990], 1
jmp 0x10009ca1
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x12c], eax
jle 0x10009cc1
mov dword [ebp - 0x3c8], 1
jmp 0x10009cc8
and dword [ebp - 0x3c8], 0
cmp dword [ebp - 0x3c8], 0x9123ebaa
jb 0x10009ce0
mov dword [ebp - 0x998], 1
jmp 0x10009ce7
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x998]
sub eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x28]
jne 0x10009ddc
mov dword [ebp - 0x1bc], 0
jmp 0x10009d15
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 1
jge 0x10009d31
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xba4], 0x865d4863
jmp 0x10009d08
mov dword [ebp - 0xb8], 0
jmp 0x10009d4a
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x10009da8
mov dword [ebp - 0x30], 0
jmp 0x10009d63
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x10009da6
mov dword [ebp - 0x10c], 0
jmp 0x10009d82
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jl 0x10009da4
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x224]
mov dword [ebp + ecx*4 - 0x224], eax
jmp 0x10009d75
jmp 0x10009d5c
jmp 0x10009d3d
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0xba4], 0
cmp dword [ebp - 0xbac], eax
jge 0x10009dca
mov dword [ebp - 0x3d0], 1
jmp 0x10009dd1
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x28], eax
jmp 0x10009de8
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xbb4], eax
push 3
lea ecx, [ebp - 0xae0]
call fcn.10017bbe
and dword [ebp - 4], 0
mov dword [ebp - 0x9a0], 0x99333c7d
mov dword [ebp - 0x1c4], 6
mov dword [ebp - 0xbd4], 0xf0ef
mov dword [ebp - 0x5c], 0
jmp 0x10009e27
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10009e40
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xae0]
call fcn.10017c2b
and dword [eax], 0
jmp 0x10009e20
mov dword [ebp - 0x5c], 0
jmp 0x10009e50
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10009e66
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2b0], 0
jmp 0x10009e49
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2b0], 2
jmp 0x10009e91
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2b0]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2b0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2b0], 0
jl 0x1000a0fc
mov dword [ebp - 0x9c8], 6
mov dword [ebp - 0xf78], 0xffffffff
mov dword [ebp - 0x2bc], 0xffffffff
mov dword [ebp - 0xf7c], 0
mov dword [ebp - 0xfbc], 0x495761be
mov dword [ebp - 0xbcc], 6
mov dword [ebp - 0xbc4], 1
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2b0]
lea ecx, [ebp - 0xae0]
call fcn.10017c2b
mov esi, eax
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2b0]
lea ecx, [ebp - 0xae0]
call fcn.10017c2b
mov ecx, dword [esi]
mov dword [eax], ecx
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2b0]
lea ecx, [ebp - 0xae0]
call fcn.10017c2b
mov dword [eax], 0xfffffffc
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2b0]
lea ecx, [ebp - 0xae0]
call fcn.10017c2b
mov ecx, dword [ebp - 0x9c8]
cmp dword [eax], ecx
jl 0x10009f68
mov dword [ebp - 0x9b8], 1
jmp 0x10009f6f
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2b0]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x2b0]
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x9a0]
cmp dword [ebp - 0x1c4], eax
jle 0x10009fb5
mov dword [ebp - 0x3d8], 1
jmp 0x10009fbc
and dword [ebp - 0x3d8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2b0]
cmp dword [ebp - 0x3d8], eax
jle 0x10009fdc
mov dword [ebp - 0x9a8], 1
jmp 0x10009fe3
and dword [ebp - 0x9a8], 0
cmp dword [ebp - 0x9a8], 1
jbe 0x10009ff8
mov dword [ebp - 0x3e0], 1
jmp 0x10009fff
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x3e0], eax
jge 0x1000a019
mov dword [ebp - 0xbbc], 1
jmp 0x1000a020
and dword [ebp - 0xbbc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2b0]
mov dword [ebp - 0xfc4], eax
mov eax, dword [ebp - 0xbc4]
mov dword [ebp - 0xfcc], eax
cmp dword [ebp - 0x1c4], 0
jne 0x1000a059
cmp dword [ebp - 0xbcc], 0
jne 0x1000a059
and dword [ebp - 0x9b0], 0
jmp 0x1000a063
mov dword [ebp - 0x9b0], 1
mov eax, dword [ebp - 0xbd4]
cmp dword [ebp - 0x9b0], eax
jle 0x1000a07d
mov dword [ebp - 0x3e8], 1
jmp 0x1000a084
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x3e8], eax
jge 0x1000a09e
mov dword [ebp - 0x3f0], 1
jmp 0x1000a0a5
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x9b8]
sub eax, dword [ebp - 0x3f0]
je 0x1000a0c3
xor eax, eax
je 0x1000a0c3
mov dword [ebp - 0x9c0], 1
jmp 0x1000a0ca
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x9c0], eax
jl 0x1000a0e4
mov dword [ebp - 0x3f8], 1
jmp 0x1000a0eb
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x9c8], eax
jmp 0x10009e78
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae0]
call fcn.10017c26
mov dword [ebp - 0x254], 0
jmp 0x1000a124
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 2
jge 0x1000a140
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0x12f8], 0xb1cecb45
jmp 0x1000a117
push 2
lea ecx, [ebp - 0x3b8]
call fcn.10017bbe
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0xa66fe7d8
mov dword [ebp - 0x9d8], 0xf5ebec5
mov dword [ebp - 0x80], 0xfffffffe
mov dword [ebp - 0xbe4], 0xffff
mov dword [ebp - 0xfd4], 0x216d7279
mov dword [ebp - 0x1cc], 0
jmp 0x1000a199
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jge 0x1000a1bb
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x3b8]
call fcn.10017c2b
mov dword [eax], 6
jmp 0x1000a18c
mov dword [ebp - 0x1c], 0
jmp 0x1000a1cb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x1000a65d
mov dword [ebp - 0x114], 0xfffc
mov dword [ebp - 0x14c], 0xfffffff6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3b8]
call fcn.10017c2b
cmp dword [eax], 0xfffffffc
jae 0x1000a208
mov dword [ebp - 0x400], 1
jmp 0x1000a20f
and dword [ebp - 0x400], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3b8]
call fcn.10017c2b
mov ecx, dword [ebp - 0x400]
cmp ecx, dword [eax]
je 0x1000a233
mov dword [ebp - 0x9d0], 1
jmp 0x1000a23a
and dword [ebp - 0x9d0], 0
cmp dword [ebp - 0x9d0], 0xfffc
je 0x1000a252
mov dword [ebp - 0x408], 1
jmp 0x1000a259
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x9d8], eax
mov esi, dword [ebp - 0x9d8]
push 0
lea ecx, [ebp - 0x3b8]
call fcn.10017c2b
imul esi, dword [eax]
mov dword [ebp - 0x80], esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3b8]
call fcn.10017c2b
cmp dword [eax], 0xfffc
jne 0x1000a2a0
mov dword [ebp - 0x410], 1
jmp 0x1000a2a7
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x410]
jne 0x1000a2c0
xor eax, eax
inc eax
jne 0x1000a2c0
and dword [ebp - 0x9e0], 0
jmp 0x1000a2ca
mov dword [ebp - 0x9e0], 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3b8]
call fcn.10017c2b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x9e0]
jne 0x1000a2f7
cmp dword [ebp - 0x114], 0
je 0x1000a2f7
mov dword [ebp - 0x418], 1
jmp 0x1000a2fe
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x418]
jne 0x1000a319
mov dword [ebp - 0x9e8], 1
jmp 0x1000a320
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x9e8]
mov dword [ebp - 0x14c], eax
mov esi, dword [ebp - 0x14c]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3b8]
call fcn.10017c2b
cmp dword [eax], esi
je 0x1000a350
mov dword [ebp - 0xbdc], 1
jmp 0x1000a357
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xfdc], eax
push 0xfffffffffffffffb
pop eax
neg eax
cmp eax, 0x6f9a4d91
jne 0x1000a378
mov dword [ebp - 0x2b4], 1
jmp 0x1000a37f
and dword [ebp - 0x2b4], 0
push 0
lea ecx, [ebp - 0x3b8]
call fcn.10017c2b
mov ecx, dword [ebp - 0x2b4]
mov dword [eax], ecx
cmp dword [ebp - 0x2b4], 0
je 0x1000a614
mov dword [ebp - 0x22c], 0xbe67e784
mov dword [ebp - 0xbfc], 0xfffffff6
mov dword [ebp - 0xa00], 2
mov dword [ebp - 0x80], 0
jmp 0x1000a3cf
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x18
jge 0x1000a612
mov dword [ebp - 0xc0], 0xfffffffe
mov dword [ebp - 0x114], 0
jmp 0x1000a3fc
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x38
jge 0x1000a41e
mov dword [ebp - 0xfe4], 0x57218670
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
jmp 0x1000a3ef
mov dword [ebp - 0xc0], 0x16
jmp 0x1000a437
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x19
je 0x1000a60d
mov dword [ebp - 0xbec], 5
mov dword [ebp - 0x14c], 0
jmp 0x1000a467
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xfffffff3
jge 0x1000a608
mov dword [ebp - 0xd70], 0xdee6ee3e
mov dword [ebp - 0xd6c], 0xdee6ee3e
mov dword [ebp - 0xd68], 0xdee6ee3e
mov dword [ebp - 0xd64], 0xdee6ee3e
mov dword [ebp - 0x22c], 0xffffffed
jmp 0x1000a4b5
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xfffffffd
je 0x1000a603
mov dword [ebp - 0x2c4], 0x27ab8100
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd70]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xd70], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xfec], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xff4], eax
cmp dword [ebp - 0xbe4], 0
jne 0x1000a50f
mov dword [ebp - 0x420], 1
jmp 0x1000a516
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0xbec]
cmp dword [ebp - 0x420], eax
jge 0x1000a530
mov dword [ebp - 0x9f0], 1
jmp 0x1000a537
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x9f0], eax
jle 0x1000a551
mov dword [ebp - 0x428], 1
jmp 0x1000a558
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x428], 0xfffffffb
jne 0x1000a586
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xd70], 0
je 0x1000a586
cmp dword [ebp - 0xa00], 0
je 0x1000a586
mov dword [ebp - 0x9f8], 1
jmp 0x1000a58d
and dword [ebp - 0x9f8], 0
push 1
lea ecx, [ebp - 0x3b8]
call fcn.10017c2b
mov ecx, dword [ebp - 0x9f8]
add ecx, dword [eax]
jns 0x1000a5b6
cmp dword [ebp - 0x2c4], 0
jne 0x1000a5b6
and dword [ebp - 0x430], 0
jmp 0x1000a5c0
mov dword [ebp - 0x430], 1
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x430], eax
jne 0x1000a5da
mov dword [ebp - 0xbf4], 1
jmp 0x1000a5e1
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0xffc], eax
mov eax, dword [ebp - 0xa00]
add eax, 0x308ddd80
mov dword [ebp - 0xbfc], eax
jmp 0x1000a4a8
jmp 0x1000a45a
jmp 0x1000a42a
jmp 0x1000a3c8
jmp 0x1000a643
mov dword [ebp - 0x80], 0
jmp 0x1000a624
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jg 0x1000a643
mov dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
jmp 0x1000a61d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3b8]
call fcn.10017c2b
cmp dword [eax], 0
je 0x1000a658
jmp 0x1000a65d
jmp 0x1000a1c4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b8]
call fcn.10017c26
mov eax, dword [ebp - 0xa08]
inc eax
mov dword [ebp - 0xa08], eax
push 2
lea ecx, [ebp - 0xdc4]
call fcn.10017bbe
mov dword [ebp - 4], 2
mov dword [ebp - 0xd14], 0xcccddd1d
mov dword [ebp - 0xd10], 0xcccddd1d
mov dword [ebp - 0xd0c], 0xcccddd1d
mov dword [ebp - 0xd08], 0xcccddd1d
push 1
lea ecx, [ebp - 0xdac]
call fcn.10017bbe
mov byte [ebp - 4], 3
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x190], 0xfffffff7
mov dword [ebp - 0x1004], 0xb9628eaf
mov dword [ebp - 0x60], 0
jmp 0x1000a6f4
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1000a710
push dword [ebp - 0x60]
lea ecx, [ebp - 0xdc4]
call fcn.10017c2b
mov dword [eax], 0x2eac
jmp 0x1000a6ed
mov dword [ebp - 0x60], 0
jmp 0x1000a720
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1000a73c
push dword [ebp - 0x60]
lea ecx, [ebp - 0xdac]
call fcn.10017c2b
mov dword [eax], 0x22ba7b7e
jmp 0x1000a719
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xd14], 0xffffffff
xor esi, esi
dec esi
push 1
lea ecx, [ebp - 0xdc4]
call fcn.10017c2b
cmp dword [eax], esi
jge 0x1000a7e0
push 1
lea ecx, [ebp - 0xdc4]
call fcn.10017c2b
push 0
lea ecx, [ebp - 0xdac]
call fcn.10017c2b
mov eax, 0x5589
sub eax, 0xfffffff9
mov dword [ebp - 0x134], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x134]
imul ecx, dword [ebp + eax - 0xd14]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd14], ecx
jg 0x1000a7b8
mov dword [ebp - 0xa10], 1
jmp 0x1000a7bf
and dword [ebp - 0xa10], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa10]
sub ecx, dword [ebp + eax - 0xd14]
je 0x1000a7e0
mov dword [ebp - 0x444], 1
jmp 0x1000a7e7
and dword [ebp - 0x444], 0
push 0
lea ecx, [ebp - 0xdac]
call fcn.10017c2b
mov ecx, dword [ebp - 0x444]
cmp ecx, dword [eax]
jne 0x1000a80a
mov dword [ebp - 0x448], 1
jmp 0x1000a811
and dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 0xfffffffd
jg 0x1000a826
mov dword [ebp - 0x788], 1
jmp 0x1000a82d
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x134], 0
jmp 0x1000a852
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x10
je 0x1000a8b6
mov dword [ebp - 0x450], 0xffffffff
mov dword [ebp - 0x190], 3
jmp 0x1000a87e
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jl 0x1000a8b4
mov dword [ebp - 0x100c], 0xf118c84b
mov dword [ebp - 0x1014], 0x6c4779d4
mov dword [ebp - 0x101c], 1
mov eax, dword [ebp - 0x450]
dec eax
mov dword [ebp - 0x450], eax
jmp 0x1000a871
jmp 0x1000a845
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdac]
call fcn.10017c26
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc4]
call fcn.10017c26
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x1000a8ec
call dword [sym.imp.KERNEL32.dll_GetACP]
movzx eax, byte [0x1067cd80]
test eax, eax
je 0x1000a90a
mov esi, 0x10090620
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10011acc
mov dword [ebp - 0xa74], 0xffffffff
mov dword [ebp - 0x1d4], 0
jmp 0x1000a92d
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jge 0x1000a949
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x1320], 0xb1cecb45
jmp 0x1000a920
mov eax, dword [ebp - 0xa74]
inc eax
mov dword [ebp - 0xa74], eax
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1000a96e
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0x458], 0xffffffff
mov dword [ebp - 0x26c], 0
jmp 0x1000a991
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x1000a9ad
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x1330], 0xb1cecb45
jmp 0x1000a984
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x1000a9d2
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0x1024], 0x10090620
mov dword [ebp - 0x8fc], 0xca7b5cf1
mov dword [ebp - 0xc04], 6
mov dword [ebp - 0x78c], 0xffffffff
mov dword [ebp - 0xc0c], 0x120d
mov dword [ebp - 0x2d4], 0x5bb08661
mov dword [ebp - 0xc14], 0xfffffffa
mov dword [ebp - 0x1dc], 0
jmp 0x1000aa31
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 2
jge 0x1000aa4d
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x160], 0xcf415d72
jmp 0x1000aa24
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x160]
neg ecx
cmp dword [ebp + eax - 0x160], ecx
je 0x1000aa77
mov dword [ebp - 0x77c], 1
jmp 0x1000aa7e
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x160]
cmp eax, dword [ebp - 0x77c]
je 0x1000aa9f
mov dword [ebp - 0x460], 1
jmp 0x1000aaa6
and dword [ebp - 0x460], 0
cmp dword [ebp - 0x460], 3
jl 0x1000aabb
mov dword [ebp - 0x468], 1
jmp 0x1000aac2
and dword [ebp - 0x468], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x160]
mov dword [ebp - 0x102c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x160]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x160]
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x8fc]
cmp dword [ebp - 0x468], eax
jg 0x1000ab10
mov dword [ebp - 0x394], 1
jmp 0x1000ab17
and dword [ebp - 0x394], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x394]
mov dword [ebp + eax - 0x160], ecx
cmp dword [ebp - 0x394], 0
je 0x1000ab4f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x160], 0
je 0x1000ab4f
mov dword [ebp - 0x784], 1
jmp 0x1000ab56
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0xc04]
cmp dword [ebp - 0x784], eax
jl 0x1000ab70
mov dword [ebp - 0x470], 1
jmp 0x1000ab77
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
neg eax
cmp eax, 0xffffffff
jge 0x1000ab90
mov dword [ebp - 0x9bc], 1
jmp 0x1000ab97
and dword [ebp - 0x9bc], 0
cmp dword [ebp - 0x9bc], 0
jg 0x1000abac
mov dword [ebp - 0x478], 1
jmp 0x1000abb3
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
sub eax, dword [ebp - 0x78c]
cmp eax, dword [ebp - 0xc0c]
jge 0x1000abd4
cmp dword [ebp - 0x2d4], 0
je 0x1000ace1
mov dword [ebp - 0x2cc], 0x50fa
mov dword [ebp - 0x488], 0xfffffff7
mov dword [ebp - 0xc1c], 0x3d975123
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x1000ac1c
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x480], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x480]
mov dword [ebp + eax - 0x160], ecx
cmp dword [ebp - 0x480], 0x2e91
jge 0x1000ac53
mov dword [ebp - 0x794], 1
jmp 0x1000ac5a
and dword [ebp - 0x794], 0
cmp dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x2cc], eax
jle 0x1000ac7b
mov dword [ebp - 0x904], 1
jmp 0x1000ac82
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0x794], eax
jge 0x1000aca8
mov dword [ebp - 0x490], 1
jmp 0x1000acaf
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x490], eax
jl 0x1000acc9
mov dword [ebp - 0xa1c], 1
jmp 0x1000acd0
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0xa1c]
mov dword [ebp - 0xc1c], eax
jmp 0x1000aefb
mov dword [ebp - 0x180], 0xfffffff9
mov dword [ebp - 0xc2c], 0xfffffffe
mov dword [ebp - 0xb74], 0xef6f1ac2
mov dword [ebp - 0xcf0], 0xfffffffe
mov dword [ebp - 0xa0], 0
jmp 0x1000ad22
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1000ad3e
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xac8], 1
jmp 0x1000ad15
mov dword [ebp - 0xa0], 0
jmp 0x1000ad57
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1000ad73
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x1290], 0xfffffffb
jmp 0x1000ad4a
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x1034], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x103c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x180]
mov dword [ebp + eax - 0xac8], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac8]
mov dword [ebp - 0x1044], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac8]
cmp dword [ebp - 0x180], eax
jge 0x1000add2
mov dword [ebp - 0x498], 1
jmp 0x1000add9
and dword [ebp - 0x498], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x160]
cmp dword [ebp - 0x498], eax
jge 0x1000adfa
mov dword [ebp - 0x79c], 1
jmp 0x1000ae01
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
sub eax, dword [ebp - 0x180]
cmp eax, 1
jb 0x1000ae1e
mov dword [ebp - 0xc24], 1
jmp 0x1000ae25
and dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0xc2c]
mov dword [ebp - 0x104c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x160], 0
jbe 0x1000ae4d
mov dword [ebp - 0x4a0], 1
jmp 0x1000ae54
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0xb74], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x160]
cmp dword [ebp + eax - 0xac8], ecx
jg 0x1000ae88
mov dword [ebp - 0x33c], 1
jmp 0x1000ae8f
and dword [ebp - 0x33c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x33c]
mov dword [ebp + eax - 0x1290], ecx
cmp dword [ebp - 0x33c], 0x6429
jg 0x1000aeba
xor eax, eax
jne 0x1000aeba
and dword [ebp - 0xaf0], 0
jmp 0x1000aec4
mov dword [ebp - 0xaf0], 1
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x1054], eax
cmp dword [ebp - 0x180], 0x91bf520f
je 0x1000aee8
mov dword [ebp - 0x90c], 1
jmp 0x1000aeef
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0xcf0], eax
mov dword [ebp - 0x4b0], 0xca7b5cf1
mov dword [ebp - 0xaf8], 6
mov dword [ebp - 0x4c8], 0xffffffff
mov dword [ebp - 0xca0], 0x120d
mov dword [ebp - 0x2e4], 0x5bb08661
mov dword [ebp - 0xb00], 0xfffffffa
mov dword [ebp - 0x234], 0
jmp 0x1000af50
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jge 0x1000af6c
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x168], 0xcf415d72
jmp 0x1000af43
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x168]
neg ecx
cmp dword [ebp + eax - 0x168], ecx
je 0x1000af96
mov dword [ebp - 0x4a8], 1
jmp 0x1000af9d
and dword [ebp - 0x4a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x168]
cmp eax, dword [ebp - 0x4a8]
je 0x1000afbe
mov dword [ebp - 0x7a4], 1
jmp 0x1000afc5
and dword [ebp - 0x7a4], 0
cmp dword [ebp - 0x7a4], 3
jl 0x1000afda
mov dword [ebp - 0x9c4], 1
jmp 0x1000afe1
and dword [ebp - 0x9c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x168]
mov dword [ebp - 0x105c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x168]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x168]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x9c4], eax
jg 0x1000b02f
mov dword [ebp - 0x374], 1
jmp 0x1000b036
and dword [ebp - 0x374], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x374]
mov dword [ebp + eax - 0x168], ecx
cmp dword [ebp - 0x374], 0
je 0x1000b06e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x168], 0
je 0x1000b06e
mov dword [ebp - 0x4b8], 1
jmp 0x1000b075
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0xaf8]
cmp dword [ebp - 0x4b8], eax
jl 0x1000b08f
mov dword [ebp - 0x7ac], 1
jmp 0x1000b096
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
neg eax
cmp eax, 0xffffffff
jge 0x1000b0af
mov dword [ebp - 0x4c0], 1
jmp 0x1000b0b6
and dword [ebp - 0x4c0], 0
cmp dword [ebp - 0x4c0], 0
jg 0x1000b0cb
mov dword [ebp - 0x914], 1
jmp 0x1000b0d2
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x914]
sub eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0xca0]
jge 0x1000b0f3
cmp dword [ebp - 0x2e4], 0
je 0x1000b200
mov dword [ebp - 0x2dc], 0x50fa
mov dword [ebp - 0xa54], 0xfffffff7
mov dword [ebp - 0xcec], 0x3d975123
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1000b13b
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x7b4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7b4]
mov dword [ebp + eax - 0x168], ecx
cmp dword [ebp - 0x7b4], 0x2e91
jge 0x1000b172
mov dword [ebp - 0x4d8], 1
jmp 0x1000b179
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x2dc], eax
jle 0x1000b19a
mov dword [ebp - 0x4d0], 1
jmp 0x1000b1a1
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa54], eax
mov eax, dword [ebp - 0xa54]
cmp dword [ebp - 0x4d8], eax
jge 0x1000b1c7
mov dword [ebp - 0x7bc], 1
jmp 0x1000b1ce
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x7bc], eax
jl 0x1000b1e8
mov dword [ebp - 0x4e0], 1
jmp 0x1000b1ef
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0xcec], eax
jmp 0x1000b3fc
mov dword [ebp - 0x1a0], 0xfffffff9
mov dword [ebp - 0xc6c], 0xfffffffe
mov dword [ebp - 0xb10], 0xef6f1ac2
mov dword [ebp - 0xb18], 0xfffffffe
mov dword [ebp - 0x68], 0
jmp 0x1000b238
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1000b24e
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xaa8], 1
jmp 0x1000b231
mov dword [ebp - 0x68], 0
jmp 0x1000b25e
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1000b274
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x12a8], 0xfffffffb
jmp 0x1000b257
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x106c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1a0]
mov dword [ebp + eax - 0xaa8], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaa8]
mov dword [ebp - 0x1074], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaa8]
cmp dword [ebp - 0x1a0], eax
jge 0x1000b2d3
mov dword [ebp - 0x91c], 1
jmp 0x1000b2da
and dword [ebp - 0x91c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x168]
cmp dword [ebp - 0x91c], eax
jge 0x1000b2fb
mov dword [ebp - 0x4e8], 1
jmp 0x1000b302
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
sub eax, dword [ebp - 0x1a0]
cmp eax, 1
jb 0x1000b31f
mov dword [ebp - 0xb08], 1
jmp 0x1000b326
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0xc6c]
mov dword [ebp - 0x107c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x168], 0
jbe 0x1000b34e
mov dword [ebp - 0x7c4], 1
jmp 0x1000b355
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0xb10], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x168]
cmp dword [ebp + eax - 0xaa8], ecx
jg 0x1000b389
mov dword [ebp - 0x344], 1
jmp 0x1000b390
and dword [ebp - 0x344], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x344]
mov dword [ebp + eax - 0x12a8], ecx
cmp dword [ebp - 0x344], 0x6429
jg 0x1000b3bb
xor eax, eax
jne 0x1000b3bb
and dword [ebp - 0xcc4], 0
jmp 0x1000b3c5
mov dword [ebp - 0xcc4], 1
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x1084], eax
cmp dword [ebp - 0x1a0], 0x91bf520f
je 0x1000b3e9
mov dword [ebp - 0x4f0], 1
jmp 0x1000b3f0
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x7d4], 0
mov dword [ebp - 0x88], 1
jmp 0x1000b429
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x16
jle 0x1000b6c6
mov dword [ebp - 0xac], 0x6ec7
push 1
lea ecx, [ebp - 0xc3c]
call fcn.10017bbe
mov dword [ebp - 4], 4
mov dword [ebp - 0xb20], 0xffffffff
mov dword [ebp - 0x48], 0
jmp 0x1000b46e
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1000b48a
push dword [ebp - 0x48]
lea ecx, [ebp - 0xc3c]
call fcn.10017c2b
mov dword [eax], 0xfffffffd
jmp 0x1000b467
mov dword [ebp - 0x48], 0
jmp 0x1000b49a
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1000b4b0
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x12c0], 0
jmp 0x1000b493
cmp dword [ebp - 0x88], 0
je 0x1000b4cd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc3c]
call fcn.10017c26
jmp 0x1000b6c6
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x108c], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1094], eax
mov eax, 0xc587
cmp eax, 3
je 0x1000b4fb
mov dword [ebp - 0xc74], 1
jmp 0x1000b502
and dword [ebp - 0xc74], 0
cmp dword [ebp - 0x88], 0
jne 0x1000b517
mov dword [ebp - 0x9cc], 1
jmp 0x1000b51e
and dword [ebp - 0x9cc], 0
cmp dword [ebp - 0x9cc], 0x928d9ba5
jae 0x1000b536
mov dword [ebp - 0x4f8], 1
jmp 0x1000b53d
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 4
jge 0x1000b552
mov dword [ebp - 0x7cc], 1
jmp 0x1000b559
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x7cc], eax
jge 0x1000b57c
cmp dword [ebp - 0xac], 0
je 0x1000b57c
mov dword [ebp - 0x500], 1
jmp 0x1000b583
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x88]
add eax, dword [ebp - 0x500]
sub eax, dword [ebp - 0xac]
mov dword [ebp - 0x924], eax
push 0
lea ecx, [ebp - 0xc3c]
call fcn.10017c2b
mov ecx, dword [ebp - 0x924]
mov dword [eax], ecx
mov eax, dword [ebp - 0x924]
mov dword [ebp - 0xb20], eax
push 0
lea ecx, [ebp - 0xc3c]
call fcn.10017c2b
mov ecx, dword [ebp - 0xac]
cmp dword [eax], ecx
jle 0x1000b5df
mov dword [ebp - 0x508], 1
jmp 0x1000b5e6
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp - 0x7d4]
cmp dword [ebp - 0xac], eax
jle 0x1000b60c
mov dword [ebp - 0x510], 1
jmp 0x1000b613
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
neg eax
cmp eax, 0x8ccc
jge 0x1000b62e
mov dword [ebp - 0xa24], 1
jmp 0x1000b635
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xa24], eax
je 0x1000b64f
mov dword [ebp - 0x518], 1
jmp 0x1000b656
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0x6c4779d4
jge 0x1000b66e
mov dword [ebp - 0x7dc], 1
jmp 0x1000b675
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x7dc]
je 0x1000b68f
mov dword [ebp - 0xd18], 1
jmp 0x1000b696
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x109c], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x12c0], 0xc8af9534
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc3c]
call fcn.10017c26
jmp 0x1000b41c
mov dword [ebp - 0x528], 0xca7b5cf1
mov dword [ebp - 0xb28], 6
mov dword [ebp - 0x540], 0xffffffff
mov dword [ebp - 0xc7c], 0x120d
mov dword [ebp - 0x2f4], 0x5bb08661
mov dword [ebp - 0xb30], 0xfffffffa
mov dword [ebp - 0x1e4], 0
jmp 0x1000b71b
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x1000b737
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x158], 0xcf415d72
jmp 0x1000b70e
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x158]
neg ecx
cmp dword [ebp + eax - 0x158], ecx
je 0x1000b761
mov dword [ebp - 0x520], 1
jmp 0x1000b768
and dword [ebp - 0x520], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x158]
cmp eax, dword [ebp - 0x520]
je 0x1000b789
mov dword [ebp - 0x92c], 1
jmp 0x1000b790
and dword [ebp - 0x92c], 0
cmp dword [ebp - 0x92c], 3
jl 0x1000b7a5
mov dword [ebp - 0x7e4], 1
jmp 0x1000b7ac
and dword [ebp - 0x7e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x158]
mov dword [ebp - 0x10a4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x158]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x158]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x528]
cmp dword [ebp - 0x7e4], eax
jg 0x1000b7fa
mov dword [ebp - 0x3a4], 1
jmp 0x1000b801
and dword [ebp - 0x3a4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3a4]
mov dword [ebp + eax - 0x158], ecx
cmp dword [ebp - 0x3a4], 0
je 0x1000b839
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x158], 0
je 0x1000b839
mov dword [ebp - 0x530], 1
jmp 0x1000b840
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0xb28]
cmp dword [ebp - 0x530], eax
jl 0x1000b85a
mov dword [ebp - 0x9d4], 1
jmp 0x1000b861
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x9d4]
neg eax
cmp eax, 0xffffffff
jge 0x1000b87a
mov dword [ebp - 0x538], 1
jmp 0x1000b881
and dword [ebp - 0x538], 0
cmp dword [ebp - 0x538], 0
jg 0x1000b896
mov dword [ebp - 0x7ec], 1
jmp 0x1000b89d
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x7ec]
sub eax, dword [ebp - 0x540]
cmp eax, dword [ebp - 0xc7c]
jge 0x1000b8be
cmp dword [ebp - 0x2f4], 0
je 0x1000b9cb
mov dword [ebp - 0x2ec], 0x50fa
mov dword [ebp - 0x7f4], 0xfffffff7
mov dword [ebp - 0xccc], 0x3d975123
mov byte [ebp - 0xe2], 0
movzx eax, byte [ebp - 0xe2]
test eax, eax
je 0x1000b906
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x934], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x934]
mov dword [ebp + eax - 0x158], ecx
cmp dword [ebp - 0x934], 0x2e91
jge 0x1000b93d
mov dword [ebp - 0x550], 1
jmp 0x1000b944
and dword [ebp - 0x550], 0
cmp dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp - 0x2ec], eax
jle 0x1000b965
mov dword [ebp - 0x548], 1
jmp 0x1000b96c
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x7f4], eax
mov eax, dword [ebp - 0x7f4]
cmp dword [ebp - 0x550], eax
jge 0x1000b992
mov dword [ebp - 0xa6c], 1
jmp 0x1000b999
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp - 0xa6c], eax
jl 0x1000b9b3
mov dword [ebp - 0x558], 1
jmp 0x1000b9ba
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0xccc], eax
jmp 0x1000bbc7
mov dword [ebp - 0x188], 0xfffffff9
mov dword [ebp - 0xc84], 0xfffffffe
mov dword [ebp - 0xb40], 0xef6f1ac2
mov dword [ebp - 0xb48], 0xfffffffe
mov dword [ebp - 0x70], 0
jmp 0x1000ba03
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1000ba19
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xab0], 1
jmp 0x1000b9fc
mov dword [ebp - 0x70], 0
jmp 0x1000ba29
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1000ba3f
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x12d8], 0xfffffffb
jmp 0x1000ba22
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x10ac], eax
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x10b4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x188]
mov dword [ebp + eax - 0xab0], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xab0]
mov dword [ebp - 0x10bc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xab0]
cmp dword [ebp - 0x188], eax
jge 0x1000ba9e
mov dword [ebp - 0x7fc], 1
jmp 0x1000baa5
and dword [ebp - 0x7fc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x158]
cmp dword [ebp - 0x7fc], eax
jge 0x1000bac6
mov dword [ebp - 0x560], 1
jmp 0x1000bacd
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
sub eax, dword [ebp - 0x188]
cmp eax, 1
jb 0x1000baea
mov dword [ebp - 0xb38], 1
jmp 0x1000baf1
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0x10c4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x158], 0
jbe 0x1000bb19
mov dword [ebp - 0x93c], 1
jmp 0x1000bb20
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0xb40], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x158]
cmp dword [ebp + eax - 0xab0], ecx
jg 0x1000bb54
mov dword [ebp - 0x34c], 1
jmp 0x1000bb5b
and dword [ebp - 0x34c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x34c]
mov dword [ebp + eax - 0x12d8], ecx
cmp dword [ebp - 0x34c], 0x6429
jg 0x1000bb86
xor eax, eax
jne 0x1000bb86
and dword [ebp - 0xcf4], 0
jmp 0x1000bb90
mov dword [ebp - 0xcf4], 1
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x10cc], eax
cmp dword [ebp - 0x188], 0x91bf520f
je 0x1000bbb4
mov dword [ebp - 0x568], 1
jmp 0x1000bbbb
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0xb48], eax
mov dword [ebp - 0xe74], 0x1a049fe3
mov dword [ebp - 0xe70], 0x1a049fe3
mov dword [ebp - 0xe6c], 0x1a049fe3
mov dword [ebp - 0xe68], 0x1a049fe3
lea ecx, [ebp - 0x375]
call fcn.100095d3
push eax
lea eax, [ebp - 0xe64]
push eax
lea eax, [ebp - 0xe74]
push eax
lea ecx, [ebp - 0x1340]
call fcn.10017c3a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x12f0]
call fcn.10017c00
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x1000bc4a
push 0x12a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x1000bc67
push 0x38f
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x12f0]
call fcn.10017c26
mov dword [ebp - 0x10d4], 0x10090624
mov dword [ebp - 0x1ec], 1
mov dword [ebp - 0x10dc], 0xffffffff
mov dword [ebp - 0x10e4], 0xfffffffd
mov dword [ebp - 0x25c], 0
jmp 0x1000bcb3
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 4
jge 0x1000bccf
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0x1224], 0x3c69
jmp 0x1000bca6
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1224]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1224], eax
mov dword [ebp - 0x1ec], 7
jmp 0x1000bd01
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 5
jl 0x1000bdd8
mov dword [ebp - 0x10ec], 0xd0657689
mov dword [ebp - 0xc8c], 0xce96f8f9
push 2
lea ecx, [ebp - 0xef0]
call fcn.10017bbe
mov dword [ebp - 4], 5
mov dword [ebp - 0x23c], 0
jmp 0x1000bd4f
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x1000bd71
push dword [ebp - 0x23c]
lea ecx, [ebp - 0xef0]
call fcn.10017c2b
mov dword [eax], 0xfff8
jmp 0x1000bd42
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1224], 2
jg 0x1000bd8d
mov dword [ebp - 0x804], 1
jmp 0x1000bd94
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0xc8c], eax
push 0
lea ecx, [ebp - 0xef0]
call fcn.10017c2b
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x570]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x570]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xef0]
call fcn.10017c26
jmp 0x1000bcf4
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x78], 1
jmp 0x1000bdf9
cmp dword [ebp - 0x78], 0x16
jle 0x1000c0a2
mov dword [ebp - 0xb0], 0x6ec7
push 1
lea ecx, [ebp - 0xc4c]
call fcn.10017bbe
mov dword [ebp - 4], 6
mov dword [ebp - 0xcd4], 0xffffffff
mov dword [ebp - 0x98], 0
jmp 0x1000be44
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1000be66
push dword [ebp - 0x98]
lea ecx, [ebp - 0xc4c]
call fcn.10017c2b
mov dword [eax], 0xfffffffd
jmp 0x1000be37
mov dword [ebp - 0x98], 0
jmp 0x1000be7f
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1000be9b
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x12cc], 0
jmp 0x1000be72
cmp dword [ebp - 0x78], 0
je 0x1000beb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4c]
call fcn.10017c26
jmp 0x1000c0a2
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x10f4], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x10fc], eax
mov eax, 0xc587
cmp eax, 3
je 0x1000bee3
mov dword [ebp - 0xb50], 1
jmp 0x1000beea
and dword [ebp - 0xb50], 0
cmp dword [ebp - 0x78], 0
jne 0x1000befc
mov dword [ebp - 0x9dc], 1
jmp 0x1000bf03
and dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x9dc], 0x928d9ba5
jae 0x1000bf1b
mov dword [ebp - 0x578], 1
jmp 0x1000bf22
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 4
jge 0x1000bf37
mov dword [ebp - 0x80c], 1
jmp 0x1000bf3e
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x80c], eax
jge 0x1000bf61
cmp dword [ebp - 0xb0], 0
je 0x1000bf61
mov dword [ebp - 0x580], 1
jmp 0x1000bf68
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x580]
sub eax, dword [ebp - 0xb0]
mov dword [ebp - 0x944], eax
push 0
lea ecx, [ebp - 0xc4c]
call fcn.10017c2b
mov ecx, dword [ebp - 0x944]
mov dword [eax], ecx
mov eax, dword [ebp - 0x944]
mov dword [ebp - 0xcd4], eax
push 0
lea ecx, [ebp - 0xc4c]
call fcn.10017c2b
mov ecx, dword [ebp - 0xb0]
cmp dword [eax], ecx
jle 0x1000bfc1
mov dword [ebp - 0x588], 1
jmp 0x1000bfc8
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x814]
cmp dword [ebp - 0xb0], eax
jle 0x1000bfee
mov dword [ebp - 0x590], 1
jmp 0x1000bff5
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
neg eax
cmp eax, 0x8ccc
jge 0x1000c010
mov dword [ebp - 0xd40], 0x184c
mov dword [ebp - 0x37c], 2
mov dword [ebp - 0x824], 0x7b1c2a2c
mov dword [ebp - 0x354], 0x950ba1bf
mov dword [ebp - 0x11d8], 0x49dfcf09
mov dword [ebp - 0xc94], 0xfef9d786
mov dword [ebp - 0xd28], 4
mov dword [ebp - 0xd24], 4
mov dword [ebp - 0xd20], 4
mov dword [ebp - 0xd1c], 4
mov dword [ebp - 0x2fc], 0x8ab5457d
cmp dword [ebp - 0x354], 0
jae 0x1000c125
mov dword [ebp - 0x5a0], 1
jmp 0x1000c12c
and dword [ebp - 0x5a0], 0
cmp dword [ebp - 0x5a0], 0xfffffffc
je 0x1000c141
mov dword [ebp - 0x94c], 1
jmp 0x1000c148
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0xc94]
cmp dword [ebp - 0x94c], eax
jg 0x1000c162
mov dword [ebp - 0x5a8], 1
jmp 0x1000c169
and dword [ebp - 0x5a8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd28]
cmp dword [ebp - 0x5a8], eax
jl 0x1000c18a
mov dword [ebp - 0xb60], 1
jmp 0x1000c191
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x11e0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd28]
mov dword [ebp - 0x11e8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd28]
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 0x60be6286
jne 0x1000c1da
mov dword [ebp - 0x5b0], 1
jmp 0x1000c1e1
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x37c]
cmp dword [ebp - 0x5b0], eax
jne 0x1000c1fb
mov dword [ebp - 0x9e4], 1
jmp 0x1000c202
and dword [ebp - 0x9e4], 0
mov eax, 0xc6b7
sub eax, dword [ebp - 0x37c]
add eax, dword [ebp - 0x9e4]
jne 0x1000c227
cmp dword [ebp - 0x354], 0
jne 0x1000c227
and dword [ebp - 0x5b8], 0
jmp 0x1000c231
mov dword [ebp - 0x5b8], 1
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0xd40]
add eax, dword [ebp - 0x5b8]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xd28]
cmp dword [ebp - 0x2fc], eax
jle 0x1000c26c
mov dword [ebp - 0x82c], 1
jmp 0x1000c273
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x5d8], 0
mov dword [ebp - 0x54], 1
jmp 0x1000c2a0
cmp dword [ebp - 0x54], 0x16
jle 0x1000c549
mov dword [ebp - 0xa8], 0x6ec7
push 1
lea ecx, [ebp - 0xd00]
call fcn.10017bbe
mov dword [ebp - 4], 7
mov dword [ebp - 0xc9c], 0xffffffff
mov dword [ebp - 0x90], 0
jmp 0x1000c2eb
cmp dword [ebp - 0x90], 1
jge 0x1000c30d
push dword [ebp - 0x90]
lea ecx, [ebp - 0xd00]
call fcn.10017c2b
mov dword [eax], 0xfffffffd
jmp 0x1000c2de
mov dword [ebp - 0x90], 0
jmp 0x1000c326
mov dword [ebp - 0x1208], 9
mov dword [ebp - 0x1210], 0xdba76aab
mov dword [ebp - 0x1254], 0xfe01bd97
mov dword [ebp - 0x125c], 0xfffffffc
mov dword [ebp - 0x1264], 0xffffffff
mov dword [ebp - 0x126c], 0xfffffffc
mov dword [ebp - 0x1274], 0xa20bd035
mov dword [ebp - 0x127c], 0x4b7834d8
mov dword [ebp - 0x1284], 0x6d6092f6
push 3
lea ecx, [ebp - 0x112c]
call fcn.10017bbe
mov dword [ebp - 4], 8
mov dword [ebp - 0xec4], 0xaa0a5dec
mov dword [ebp - 0xec0], 0xaa0a5dec
mov dword [ebp - 0xebc], 0xaa0a5dec
mov dword [ebp - 0xeb8], 0xaa0a5dec
lea ecx, [ebp - 0x3a5]
call fcn.100095d3
push eax
lea eax, [ebp - 0xeb4]
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0x1350]
call fcn.10017c3a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x111c]
call fcn.10017c00
mov byte [ebp - 4], 9
mov dword [ebp - 0x1f4], 0
jmp 0x1000c631
cmp dword [ebp - 0x1f4], 3
jge 0x1000c653
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x112c]
call fcn.10017c2b
mov dword [eax], 0x4ce55459
jmp 0x1000c624
push 1
lea ecx, [ebp - 0x111c]
call fcn.10017c2b
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x844]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x844]
mov dword [ecx], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x111c]
call fcn.10017c26
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x112c]
call fcn.10017c26
mov dword [ebp - 0xe4c], 0x1a049fe3
mov dword [ebp - 0xe48], 0x1a049fe3
mov dword [ebp - 0xe44], 0x1a049fe3
mov dword [ebp - 0xe40], 0x1a049fe3
lea ecx, [ebp - 0x38d]
call fcn.100095d3
push eax
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xe4c]
push eax
lea ecx, [ebp - 0x1308]
call fcn.10017c3a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x12e4]
call fcn.10017c00
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1000c718
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret