Function at 0x100094cb
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf5c
push esi
push edi
mov dword [ebp - 0x1e0], 0xe46a6f4d
mov dword [ebp - 0x9f0], 0
mov dword [ebp - 0x68], 0
jmp 0x100094fa
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x10009510
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x1fc], 0xcbad
jmp 0x100094f3
mov dword [ebp - 0x68], 0
jmp 0x10009520
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x10009536
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x92c], 0x52487223
jmp 0x10009519
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1fc], 0
jne 0x10009552
mov dword [ebp - 0x990], 1
jmp 0x10009559
and dword [ebp - 0x990], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1fc], 0
je 0x10009585
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1fc], 0
je 0x10009585
mov dword [ebp - 0x964], 1
jmp 0x1000958c
and dword [ebp - 0x964], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1fc]
jne 0x100095bf
mov eax, 0x746e
test eax, eax
je 0x100095bf
mov dword [ebp - 0x6a4], 1
jmp 0x100095c6
and dword [ebp - 0x6a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
add eax, dword [ebp - 0x6a4]
cmp eax, 0x99a5671
jne 0x100095ec
mov dword [ebp - 0x96c], 1
jmp 0x100095f3
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x964]
cmp eax, dword [ebp - 0x96c]
jne 0x1000960d
mov dword [ebp - 0x974], 1
jmp 0x10009614
and dword [ebp - 0x974], 0
imul eax, dword [ebp - 0x974], 0x859b
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x92c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x92c]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x1fc]
imul eax, eax, 0x2a0c
test eax, eax
je 0x1000966c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1fc], 0
je 0x1000966c
mov dword [ebp - 0x97c], 1
jmp 0x10009673
and dword [ebp - 0x97c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
cmp eax, dword [ebp - 0x97c]
je 0x100096a4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1fc], 0
je 0x100096a4
mov dword [ebp - 0x984], 1
jmp 0x100096ab
and dword [ebp - 0x984], 0
cmp dword [ebp - 0x984], 0xcbc21b07
jne 0x100096c3
mov dword [ebp - 0x950], 1
jmp 0x100096ca
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x990]
cmp eax, dword [ebp - 0x950]
jg 0x100096e4
mov dword [ebp - 0x91c], 1
jmp 0x100096eb
and dword [ebp - 0x91c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fc]
add eax, dword [ebp - 0x91c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x1fc]
je 0x10009750
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x10009725
call dword [sym.imp.USER32.dll_CreateMenu]
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1000974b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x100099d7
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0xa54], 5
mov dword [ebp - 0x388], 0
jmp 0x1000977a
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 1
jge 0x10009796
mov eax, dword [ebp - 0x388]
mov dword [ebp + eax*4 - 0x468], 0x54ba4fda
jmp 0x1000976d
mov dword [ebp - 0x2c], 1
jmp 0x100097a6
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x100099d7
mov dword [ebp - 0x390], 0x9d38951f
mov dword [ebp - 0x460], 0x54f618e1
mov dword [ebp - 0x390], 1
jmp 0x100097dd
mov eax, dword [ebp - 0x390]
dec eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0
jl 0x1000990f
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
je 0x100097fe
mov dword [ebp - 0x7f0], 1
jmp 0x10009805
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0xffffffff
jl 0x1000981a
mov dword [ebp - 0x448], 1
jmp 0x10009821
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x92c]
cmp dword [ebp - 0x448], eax
jle 0x10009845
mov eax, 0xbd3d
test eax, eax
jne 0x10009845
and dword [ebp - 0x7f8], 0
jmp 0x1000984f
mov dword [ebp - 0x7f8], 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x1f8]
cmp eax, dword [ebp - 0x7f8]
je 0x1000986d
mov dword [ebp - 0x450], 1
jmp 0x10009874
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
add eax, 8
cmp eax, dword [ebp - 0x1e0]
jne 0x10009891
mov dword [ebp - 0x800], 1
jmp 0x10009898
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x1fc]
cmp eax, dword [ebp - 0x800]
jne 0x100098b6
mov dword [ebp - 0x458], 1
jmp 0x100098bd
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
sub eax, dword [ebp - 0x2c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x468]
jg 0x100098e1
mov dword [ebp - 0x808], 1
jmp 0x100098e8
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x92c]
imul eax, dword [ebp - 0x808]
mov ecx, 0xc6200d40
sub ecx, eax
mov dword [ebp - 0x460], ecx
je 0x1000990a
jmp 0x1000990f
jmp 0x100097d0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x92c], 0x35a02a90
jle 0x1000992b
mov dword [ebp - 0x810], 1
jmp 0x10009932
and dword [ebp - 0x810], 0
cmp dword [ebp - 0x810], 0xf3bc9f
je 0x1000994a
mov dword [ebp - 0x818], 1
jmp 0x10009951
and dword [ebp - 0x818], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x468]
inc eax
cmp eax, 8
jbe 0x10009970
mov dword [ebp - 0x470], 1
jmp 0x10009977
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x818]
sub eax, dword [ebp - 0x470]
cmp eax, dword [ebp - 0x9f0]
jge 0x10009997
mov dword [ebp - 0x820], 1
jmp 0x1000999e
and dword [ebp - 0x820], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
cmp dword [ebp - 0x820], eax
jl 0x100099bf
mov dword [ebp - 0x478], 1
jmp 0x100099c6
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xa54], eax
jmp 0x1000979f
mov dword [ebp - 0x1e0], 0xffffffe9
jmp 0x100099f0
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 8
jle 0x10009a23
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x10009a21
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x100099e3
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x1d8], 1
mov dword [ebp - 0x150], 0xd5b611fb
mov dword [ebp - 0x858], 2
mov dword [ebp - 0xa74], 0
mov dword [ebp - 0x6c], 0
jmp 0x10009a65
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x10009a7b
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xd94], 0xb999fb02
jmp 0x10009a5e
mov dword [ebp - 0x6c], 0
jmp 0x10009a8b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10009aa1
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xe6c], 0xffffffff
jmp 0x10009a84
mov dword [ebp - 0x190], 0
jmp 0x10009aba
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jl 0x10009fd8
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x838], 1
mov dword [ebp - 0x488], 0x2603
mov dword [ebp - 0x840], 9
mov dword [ebp - 0x398], 0
jmp 0x10009b08
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 1
jge 0x10009b24
mov eax, dword [ebp - 0x398]
mov dword [ebp + eax*4 - 0x1cc], 0
jmp 0x10009afb
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d8]
mov dword [ebp + eax - 0xd94], ecx
mov dword [ebp - 0x1d8], 0xfffffff7
jmp 0x10009b50
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
jle 0x10009fd3
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0xac], 0
jmp 0x10009b80
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x10009b9c
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x9b4], 3
jmp 0x10009b73
mov dword [ebp - 0xac], 0
jmp 0x10009bb5
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x10009bd1
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0xebc], 0xfffffff8
jmp 0x10009ba8
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x148]
cmp dword [ebp + eax - 0x9b4], ecx
je 0x10009bf2
mov dword [ebp - 0x828], 1
jmp 0x10009bf9
and dword [ebp - 0x828], 0
cmp dword [ebp - 0x828], 0x63090707
jne 0x10009c11
mov dword [ebp - 0x480], 1
jmp 0x10009c18
and dword [ebp - 0x480], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9b4]
imul eax, dword [ebp - 0x480]
cmp eax, dword [ebp - 0x150]
jl 0x10009c40
mov dword [ebp - 0x830], 1
jmp 0x10009c47
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x830], eax
jg 0x10009c61
mov dword [ebp - 0xa5c], 1
jmp 0x10009c68
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0xcb0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe6c]
dec eax
mov dword [ebp - 0xa64], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa64]
mov dword [ebp + eax - 0xe6c], ecx
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x838], eax
imul eax, dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x838], eax
jl 0x10009cdd
push 8
pop eax
test eax, eax
jne 0x10009cdd
and dword [ebp - 0x490], 0
jmp 0x10009ce7
mov dword [ebp - 0x490], 1
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x840], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x840]
imul ecx, dword [ebp + eax - 0xebc]
sub ecx, dword [ebp - 0x190]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9b4], ecx
jg 0x10009d28
mov dword [ebp - 0x498], 1
jmp 0x10009d2f
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
add eax, 0x64ba389f
cmp eax, dword [ebp - 0x148]
jg 0x10009d4e
mov dword [ebp - 0xa6c], 1
jmp 0x10009d55
and dword [ebp - 0xa6c], 0
imul eax, dword [ebp - 0x858], 0xc02d
cmp eax, dword [ebp - 0x148]
jge 0x10009d73
mov dword [ebp - 0x848], 1
jmp 0x10009d7a
and dword [ebp - 0x848], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x848]
mov dword [ebp + eax - 0x1cc], ecx
mov dword [ebp - 0x150], 0
jmp 0x10009da6
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xfffffff8
jl 0x10009fce
mov dword [ebp - 0x36c], 0
jmp 0x10009dcc
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 1
jge 0x10009de8
mov eax, dword [ebp - 0x36c]
mov dword [ebp + eax*4 - 0x3f0], 0xffffffff
jmp 0x10009dbf
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xc8c], eax
cmp dword [ebp - 0x190], 0
jne 0x10009eed
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0xffffffff
jne 0x10009e29
mov dword [ebp - 0x4a0], 1
jmp 0x10009e30
and dword [ebp - 0x4a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f0]
cmp dword [ebp - 0x4a0], eax
jg 0x10009e57
mov eax, 0x6b9b
test eax, eax
jne 0x10009e57
and dword [ebp - 0x850], 0
jmp 0x10009e61
mov dword [ebp - 0x850], 1
mov eax, dword [ebp - 0x850]
neg eax
cmp eax, dword [ebp - 0xa74]
jl 0x10009e7d
mov dword [ebp - 0x4a8], 1
jmp 0x10009e84
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
add eax, 0x6ec25aed
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1cc]
jl 0x10009eaa
mov dword [ebp - 0xa7c], 1
jmp 0x10009eb1
and dword [ebp - 0xa7c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
mov dword [ebp - 0xc94], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3f0], 0
je 0x10009edd
mov eax, 0x8509ef6e
test eax, eax
jne 0x10009eed
push 4
pop eax
test eax, eax
jne 0x10009eed
and dword [ebp - 0x4b0], 0
jmp 0x10009ef7
mov dword [ebp - 0x4b0], 1
mov eax, dword [ebp - 0x858]
cmp dword [ebp - 0x4b0], eax
jle 0x10009f11
mov dword [ebp - 0x860], 1
jmp 0x10009f18
and dword [ebp - 0x860], 0
cmp dword [ebp - 0x860], 0xb3bd
jg 0x10009f30
mov dword [ebp - 0x4b8], 1
jmp 0x10009f37
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 5
jae 0x10009f4c
mov dword [ebp - 0x3e8], 1
jmp 0x10009f53
and dword [ebp - 0x3e8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3e8]
mov dword [ebp + eax - 0xd94], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
cmp dword [ebp - 0x3e8], eax
jle 0x10009f87
mov dword [ebp - 0x868], 1
jmp 0x10009f8e
and dword [ebp - 0x868], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9b4]
cmp dword [ebp - 0x868], eax
je 0x10009faf
mov dword [ebp - 0x4c0], 1
jmp 0x10009fb6
and dword [ebp - 0x4c0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4c0]
mov dword [ebp + eax - 0x3f0], ecx
jmp 0x10009d99
jmp 0x10009b43
jmp 0x10009aad
mov dword [ebp - 0x30c], 0x1928c176
mov dword [ebp - 0x30c], 0
jmp 0x10009ffb
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0xa
jl 0x1000a0a2
mov dword [ebp - 0x218], 0
jmp 0x1000a021
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 3
jge 0x1000a03d
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0xc04], 4
jmp 0x1000a014
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xc04], 0
jmp 0x1000a06b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc04]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc04], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc04], 0xfffffff1
jle 0x1000a09d
mov dword [ebp - 0xa84], 0xfffffff7
mov dword [ebp - 0xa8c], 0xbc662a2b
mov eax, dword [ebp - 0xa84]
mov dword [ebp - 0xa8c], eax
jmp 0x1000a050
jmp 0x10009fee
mov dword [ebp - 0xc60], 0xf118c84b
mov dword [ebp - 0xc5c], 0xf118c84b
mov dword [ebp - 0xc58], 0xf118c84b
mov dword [ebp - 0xc54], 0xf118c84b
mov dword [ebp - 0x74], 0
jmp 0x1000a0da
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1000a0f0
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xc28], 0x3342eb90
jmp 0x1000a0d3
mov dword [ebp - 0x74], 0
jmp 0x1000a100
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1000a116
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x3b0], 0xfffffff7
jmp 0x1000a0f9
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3b0], 2
jmp 0x1000a144
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3b0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3b0], 0
jl 0x1000a311
mov dword [ebp - 0xc8], 0xfffffffe
mov dword [ebp - 0xc8], 0
jmp 0x1000a17b
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jg 0x1000a19b
mov dword [ebp - 0xa94], 0xa956
cmp dword [ebp - 0xa94], 0
je 0x1000a199
jmp 0x1000a19b
jmp 0x1000a16e
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3b0]
mov eax, dword [ebp + eax - 0x3b0]
mov dword [ebp + ecx*4 - 0xc28], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b0]
cmp dword [ebp + eax*4 - 0xc28], 1
jg 0x1000a1df
mov dword [ebp - 0x870], 1
jmp 0x1000a1e6
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x870]
jge 0x1000a200
mov dword [ebp - 0x4c8], 1
jmp 0x1000a207
and dword [ebp - 0x4c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b0]
mov eax, dword [ebp + eax*4 - 0xc28]
cmp dword [ebp - 0x4c8], eax
jne 0x1000a22f
mov dword [ebp - 0x878], 1
jmp 0x1000a236
and dword [ebp - 0x878], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b0]
mov ecx, dword [ebp - 0x878]
lea eax, [eax + ecx + 0xd9ba]
cmp eax, dword [ebp - 0xc8]
jge 0x1000a264
mov dword [ebp - 0x4d0], 1
jmp 0x1000a26b
and dword [ebp - 0x4d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b0]
imul eax, dword [ebp - 0x4d0]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3b0]
jl 0x1000a29a
mov dword [ebp - 0x880], 1
jmp 0x1000a2a1
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0xc8]
imul eax, dword [ebp - 0x880]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x3b0]
je 0x1000a2c9
mov dword [ebp - 0xa9c], 1
jmp 0x1000a2d0
and dword [ebp - 0xa9c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3b0], 0x37d02268
jl 0x1000a2ef
mov dword [ebp - 0x4d8], 1
jmp 0x1000a2f6
and dword [ebp - 0x4d8], 0
push 2
pop eax
sub eax, dword [ebp - 0x4d8]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc60], eax
jmp 0x1000a129
mov dword [ebp - 0x1ac], 0xe46a6f4d
mov dword [ebp - 0xaac], 0
mov dword [ebp - 0x30], 0x632667a8
mov dword [ebp - 0x888], 0xfffffff8
mov dword [ebp - 0x4f0], 1
mov dword [ebp - 0xaa4], 0
mov dword [ebp - 0xc9c], 0x2aa787d3
mov dword [ebp - 0xc], 0
jmp 0x1000a364
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x1000a37a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x158], 0x99ff
jmp 0x1000a35d
mov dword [ebp - 0xc], 0
jmp 0x1000a38a
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x1000a3a0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc40], 0x91ba8027
jmp 0x1000a383
mov dword [ebp - 0xc], 0
jmp 0x1000a3b0
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x1000a3c6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xacc], 0xb88dcfd8
jmp 0x1000a3a9
mov dword [ebp - 0x30], 0
jmp 0x1000a3d6
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1000a65c
mov dword [ebp - 0x354], 0xfffffff6
mov dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x158]
mov dword [ebp - 0xca4], eax
mov dword [ebp - 0x888], 0xfffffffb
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x158]
cmp dword [ebp - 0x888], eax
jl 0x1000a463
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x158]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp + ecx*4 - 0x158]
cmp dword [ebp + eax*4 - 0x158], ecx
je 0x1000a452
mov dword [ebp - 0x4e0], 1
jmp 0x1000a459
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc88], eax
mov eax, dword [ebp - 0x4f0]
add eax, 0x37e0d1b7
cmp eax, 0x48dc
jne 0x1000a493
mov dword [ebp - 0x890], 1
jmp 0x1000a49a
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0xaa4]
cmp dword [ebp - 0x890], eax
jge 0x1000a4ba
mov eax, 0x6091
test eax, eax
jne 0x1000a4ba
and dword [ebp - 0x3f8], 0
jmp 0x1000a4c4
mov dword [ebp - 0x3f8], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp + eax - 0xc40], ecx
cmp dword [ebp - 0x3f8], 0
jne 0x1000a4f0
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x1000a4f0
and dword [ebp - 0x4e8], 0
jmp 0x1000a4fa
mov dword [ebp - 0x4e8], 1
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x898], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x898]
mov dword [ebp + eax - 0xacc], ecx
mov eax, dword [ebp - 0x898]
sub eax, 0x622b
je 0x1000a541
cmp dword [ebp - 0x354], 0
je 0x1000a53f
jmp 0x1000a65c
jmp 0x1000a57e
mov dword [ebp - 0xb8], 0xa
jmp 0x1000a55a
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffec
jl 0x1000a57e
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xc40]
mov dword [ebp + ecx - 0xacc], eax
jmp 0x1000a54d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xacc], 0
jne 0x1000a635
cmp dword [ebp - 0xb8], 1
jne 0x1000a5a7
mov dword [ebp - 0x400], 1
jmp 0x1000a5ae
and dword [ebp - 0x400], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x400]
mov dword [ebp + eax - 0xc40], ecx
cmp dword [ebp - 0x400], 0
je 0x1000a5f8
mov eax, dword [ebp - 0x4f0]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0xacc]
cmp dword [ebp - 0x354], eax
jle 0x1000a5f8
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1000a5f8
mov dword [ebp - 0x8a0], 1
jmp 0x1000a5ff
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0xffff
je 0x1000a617
mov dword [ebp - 0x4f8], 1
jmp 0x1000a61e
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x354]
cmp dword [ebp - 0x4f8], eax
jne 0x1000a635
and dword [ebp - 0x8a8], 0
jmp 0x1000a63f
mov dword [ebp - 0x8a8], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8a8]
sub ecx, dword [ebp + eax - 0xacc]
mov dword [ebp - 0xb8], ecx
jmp 0x1000a3cf
mov dword [ebp - 0x94], 0
jmp 0x1000a675
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1000a691
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x208], 0xcbad
jmp 0x1000a668
mov dword [ebp - 0x94], 0
jmp 0x1000a6aa
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x1000a6c6
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x938], 0x52487223
jmp 0x1000a69d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x208], 0
jne 0x1000a6e2
mov dword [ebp - 0x518], 1
jmp 0x1000a6e9
and dword [ebp - 0x518], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x208], 0
je 0x1000a715
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x208], 0
je 0x1000a715
mov dword [ebp - 0x8b0], 1
jmp 0x1000a71c
and dword [ebp - 0x8b0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x208]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x208]
jne 0x1000a74f
mov eax, 0x746e
test eax, eax
je 0x1000a74f
mov dword [ebp - 0x500], 1
jmp 0x1000a756
and dword [ebp - 0x500], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x208]
add eax, dword [ebp - 0x500]
cmp eax, 0x99a5671
jne 0x1000a77c
mov dword [ebp - 0x508], 1
jmp 0x1000a783
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x8b0]
cmp eax, dword [ebp - 0x508]
jne 0x1000a79d
mov dword [ebp - 0x8b8], 1
jmp 0x1000a7a4
and dword [ebp - 0x8b8], 0
imul eax, dword [ebp - 0x8b8], 0x859b
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x938], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x938]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x208]
imul eax, eax, 0x2a0c
test eax, eax
je 0x1000a7fc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x208], 0
je 0x1000a7fc
mov dword [ebp - 0x510], 1
jmp 0x1000a803
and dword [ebp - 0x510], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x208]
cmp eax, dword [ebp - 0x510]
je 0x1000a834
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x208], 0
je 0x1000a834
mov dword [ebp - 0x8c0], 1
jmp 0x1000a83b
and dword [ebp - 0x8c0], 0
cmp dword [ebp - 0x8c0], 0xcbc21b07
jne 0x1000a853
mov dword [ebp - 0x8c8], 1
jmp 0x1000a85a
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0x8c8]
jg 0x1000a874
mov dword [ebp - 0x520], 1
jmp 0x1000a87b
and dword [ebp - 0x520], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x208]
add eax, dword [ebp - 0x520]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x208]
je 0x1000a8e0
mov byte [ebp - 0x144], 0
movzx eax, byte [ebp - 0x144]
test eax, eax
je 0x1000a8b5
call dword [sym.imp.USER32.dll_CreateMenu]
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x1000a8db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x1000ab67
mov dword [ebp - 0x34], 3
mov dword [ebp - 0xab4], 5
mov dword [ebp - 0x220], 0
jmp 0x1000a90a
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x1000a926
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x548], 0x54ba4fda
jmp 0x1000a8fd
mov dword [ebp - 0x34], 1
jmp 0x1000a936
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1000ab67
mov dword [ebp - 0x314], 0x9d38951f
mov dword [ebp - 0x540], 0x54f618e1
mov dword [ebp - 0x314], 1
jmp 0x1000a96d
mov eax, dword [ebp - 0x314]
dec eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
jl 0x1000aa9f
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
je 0x1000a98e
mov dword [ebp - 0x8d0], 1
jmp 0x1000a995
and dword [ebp - 0x8d0], 0
cmp dword [ebp - 0x8d0], 0xffffffff
jl 0x1000a9aa
mov dword [ebp - 0x528], 1
jmp 0x1000a9b1
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x938]
cmp dword [ebp - 0x528], eax
jle 0x1000a9d5
mov eax, 0xbd3d
test eax, eax
jne 0x1000a9d5
and dword [ebp - 0x8d8], 0
jmp 0x1000a9df
mov dword [ebp - 0x8d8], 1
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x204]
cmp eax, dword [ebp - 0x8d8]
je 0x1000a9fd
mov dword [ebp - 0x530], 1
jmp 0x1000aa04
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
add eax, 8
cmp eax, dword [ebp - 0x1ac]
jne 0x1000aa21
mov dword [ebp - 0x8e0], 1
jmp 0x1000aa28
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x208]
cmp eax, dword [ebp - 0x8e0]
jne 0x1000aa46
mov dword [ebp - 0x538], 1
jmp 0x1000aa4d
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
sub eax, dword [ebp - 0x34]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x548]
jg 0x1000aa71
mov dword [ebp - 0x8e8], 1
jmp 0x1000aa78
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x938]
imul eax, dword [ebp - 0x8e8]
mov ecx, 0xc6200d40
sub ecx, eax
mov dword [ebp - 0x540], ecx
je 0x1000aa9a
jmp 0x1000aa9f
jmp 0x1000a960
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x938], 0x35a02a90
jle 0x1000aabb
mov dword [ebp - 0x8f0], 1
jmp 0x1000aac2
and dword [ebp - 0x8f0], 0
cmp dword [ebp - 0x8f0], 0xf3bc9f
je 0x1000aada
mov dword [ebp - 0x8f8], 1
jmp 0x1000aae1
and dword [ebp - 0x8f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x548]
inc eax
cmp eax, 8
jbe 0x1000ab00
mov dword [ebp - 0x550], 1
jmp 0x1000ab07
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x8f8]
sub eax, dword [ebp - 0x550]
cmp eax, dword [ebp - 0xaac]
jge 0x1000ab27
mov dword [ebp - 0x900], 1
jmp 0x1000ab2e
and dword [ebp - 0x900], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x208]
cmp dword [ebp - 0x900], eax
jl 0x1000ab4f
mov dword [ebp - 0x558], 1
jmp 0x1000ab56
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0xab4], eax
jmp 0x1000a92f
mov dword [ebp - 0x1ac], 0xffffffe9
jmp 0x1000ab80
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 8
jle 0x1000abb3
mov byte [ebp - 0x133], 0
movzx eax, byte [ebp - 0x133]
test eax, eax
je 0x1000abb1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x1000ab73
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x228], 0
jmp 0x1000abd6
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x1000abf2
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xee8], 0x7f5aee0c
jmp 0x1000abc9
mov dword [ebp - 0xd0], 0
jmp 0x1000ac0b
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jne 0x1000ae23
mov dword [ebp - 0x230], 0x75286e87
mov dword [ebp - 0xb4c], 0x88b92280
mov dword [ebp - 0x394], 0
jmp 0x1000ac45
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 1
jge 0x1000ac61
mov eax, dword [ebp - 0x394]
mov dword [ebp + eax*4 - 0xcbc], 0xc9dffbe5
jmp 0x1000ac38
mov dword [ebp - 0x230], 0xb
jmp 0x1000ac7a
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xffffffff
jl 0x1000ae1e
mov dword [ebp - 0x178], 0xf8067e3
mov dword [ebp - 0xb44], 0x4142b919
mov dword [ebp - 0xcfc], 4
mov dword [ebp - 0x31c], 0
jmp 0x1000acbe
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 1
jge 0x1000acda
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0xd04], 0x6ce1a812
jmp 0x1000acb1
mov dword [ebp - 0x178], 0x19
jmp 0x1000acf3
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 9
jg 0x1000ae19
mov dword [ebp - 0xb54], 0x277ebd00
mov dword [ebp - 0x918], 0xcd17
mov dword [ebp - 0x238], 0
jmp 0x1000ad2d
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x1000ad49
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xef0], 0x85734cb4
jmp 0x1000ad20
cmp dword [ebp - 0xd0], 0
je 0x1000ada9
cmp dword [ebp - 0x178], 0
jne 0x1000ad69
xor eax, eax
inc eax
jne 0x1000ad69
and dword [ebp - 0x908], 0
jmp 0x1000ad73
mov dword [ebp - 0x908], 1
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x908]
jg 0x1000ad8d
mov dword [ebp - 0xabc], 1
jmp 0x1000ad94
and dword [ebp - 0xabc], 0
cmp dword [ebp - 0x178], 0
je 0x1000ada9
mov dword [ebp - 0x560], 1
jmp 0x1000adb0
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x560], eax
jne 0x1000adca
mov dword [ebp - 0x910], 1
jmp 0x1000add1
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0xb44]
cmp dword [ebp - 0x910], eax
jne 0x1000adf1
cmp dword [ebp - 0xb4c], 0
je 0x1000adf1
and dword [ebp - 0x568], 0
jmp 0x1000adfb
mov dword [ebp - 0x568], 1
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0x918]
inc eax
mov dword [ebp - 0x918], eax
jmp 0x1000ace6
jmp 0x1000ac6d
jmp 0x1000abfe
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x1000ae42
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x10], 0xc64a6847
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x35c], 0
jmp 0x1000ae69
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 4
jge 0x1000ae85
mov eax, dword [ebp - 0x35c]
mov dword [ebp + eax*4 - 0x9ec], 0xfff6
jmp 0x1000ae5c
mov dword [ebp - 0x10], 0
jmp 0x1000ae95
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x15
jle 0x1000b06b
mov dword [ebp - 0x794], 0x95031536
mov dword [ebp - 0x594], 0xffffffff
mov dword [ebp - 0x57c], 0x284868fd
mov dword [ebp - 0x3f4], 0x95610a1
mov dword [ebp - 0xb5c], 0xfffffff6
cmp dword [ebp - 0x794], 0
jne 0x1000afda
mov eax, 0x9d44c039
test eax, eax
je 0x1000af8a
cmp dword [ebp - 0x594], 0
jne 0x1000aefd
mov eax, 0x4ccfd66c
test eax, eax
je 0x1000af01
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jg 0x1000af15
mov dword [ebp - 0x920], 1
jmp 0x1000af1c
and dword [ebp - 0x920], 0
cmp dword [ebp - 0x920], 0
jne 0x1000af31
mov dword [ebp - 0x574], 1
jmp 0x1000af38
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0xdae4f9db
jae 0x1000af50
mov dword [ebp - 0x790], 1
jmp 0x1000af57
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
je 0x1000af8a
mov dword [ebp - 0x584], 1
jmp 0x1000af91
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x794]
cmp dword [ebp - 0x584], eax
je 0x1000afab
mov dword [ebp - 0x89c], 1
jmp 0x1000afb2
and dword [ebp - 0x89c], 0
cmp dword [ebp - 0x89c], 0xdfe924f6
ja 0x1000afca
mov dword [ebp - 0x58c], 1
jmp 0x1000afd1
and dword [ebp - 0x58c], 0
cmp dword [ebp - 0x58c], 2
jae 0x1000afef
mov eax, 0x491d
test eax, eax
je 0x1000afef
mov dword [ebp - 0x79c], 1
jmp 0x1000aff6
and dword [ebp - 0x79c], 0
cmp dword [ebp - 0x79c], 4
jle 0x1000b011
cmp dword [ebp - 0x3f4], 0
jne 0x1000b011
and dword [ebp - 0x994], 0
jmp 0x1000b01b
mov dword [ebp - 0x994], 1
mov eax, dword [ebp - 0x594]
cmp dword [ebp - 0x994], eax
je 0x1000b035
mov dword [ebp - 0x59c], 1
jmp 0x1000b03c
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x59c]
jle 0x1000b053
mov dword [ebp - 0x7a4], 1
jmp 0x1000b05a
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0xb5c], eax
jmp 0x1000ae8e
mov dword [ebp - 0x10], 1
jmp 0x1000b07b
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffee
jle 0x1000b351
mov dword [ebp - 0x58], 0xfffffffc
mov dword [ebp - 0x7bc], 0xdfc7a8f6
mov dword [ebp - 0xa4c], 0x736453d1
mov dword [ebp - 0x44], 0
jmp 0x1000b0b0
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x1000b34c
mov byte [ebp - 0x143], 0
movzx eax, byte [ebp - 0x143]
test eax, eax
je 0x1000b0e3
push 0x222c
push 0
push 0x15f4
push 0x9e4
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x9ec]
mov dword [ebp - 0xd0c], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x9ec], 0
mov eax, dword [ebp - 0x44]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x9ec]
cmp dword [ebp + eax*4 - 0x9ec], ecx
je 0x1000b123
mov dword [ebp - 0x5a4], 1
jmp 0x1000b12a
and dword [ebp - 0x5a4], 0
xor eax, eax
sub eax, dword [ebp - 0x5a4]
imul eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x58]
jge 0x1000b14b
mov dword [ebp - 0x8a4], 1
jmp 0x1000b152
and dword [ebp - 0x8a4], 0
cmp dword [ebp - 0x8a4], 4
jge 0x1000b167
mov dword [ebp - 0xb64], 1
jmp 0x1000b16e
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xd14], eax
cmp dword [ebp - 0x58], 0x55505f45
jge 0x1000b18c
mov dword [ebp - 0x5ac], 1
jmp 0x1000b193
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x5ac], eax
jle 0x1000b1aa
mov dword [ebp - 0x7ac], 1
jmp 0x1000b1b1
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x7ac], eax
jge 0x1000b1c8
mov dword [ebp - 0x5b4], 1
jmp 0x1000b1cf
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x9ec]
cmp dword [ebp - 0x5b4], eax
jl 0x1000b1ed
mov dword [ebp - 0x924], 1
jmp 0x1000b1f4
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x924], eax
jle 0x1000b20b
mov dword [ebp - 0x5bc], 1
jmp 0x1000b212
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x5bc], eax
je 0x1000b229
mov dword [ebp - 0x7b4], 1
jmp 0x1000b230
and dword [ebp - 0x7b4], 0
cmp dword [ebp - 0x7b4], 4
je 0x1000b245
mov dword [ebp - 0x5c4], 1
jmp 0x1000b24c
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x5c4]
cmp eax, 1
jae 0x1000b267
mov dword [ebp - 0x8ac], 1
jmp 0x1000b26e
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x8ac], eax
jg 0x1000b285
mov dword [ebp - 0x5cc], 1
jmp 0x1000b28c
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x7bc], eax
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0xd1c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9ec]
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x9ec], 0
jne 0x1000b2d0
mov dword [ebp - 0x5d4], 1
jmp 0x1000b2d7
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0xa4c]
cmp dword [ebp - 0x5d4], eax
jge 0x1000b2f1
mov dword [ebp - 0x970], 1
jmp 0x1000b2f8
and dword [ebp - 0x970], 0
cmp dword [ebp - 0x970], 0x14a1
je 0x1000b335
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x1000b333
push 0
push 0x2367
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x1000b347
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9ec], 0
je 0x1000b347
jmp 0x1000b34c
jmp 0x1000b0a9
jmp 0x1000b074
mov dword [ebp - 0x1c4], 0xe46a6f4d
mov dword [ebp - 0xb58], 0
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x240], 0
jmp 0x1000b388
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 1
jge 0x1000b3a4
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xd2c], 0xffffffff
jmp 0x1000b37b
mov dword [ebp - 0x324], 0
jmp 0x1000b3bd
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
jg 0x1000b40a
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x248], 0
jmp 0x1000b3e9
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x1000b408
mov dword [ebp - 0x9fc], 0xfffc
mov dword [ebp - 0x9fc], 0x7e55059b
jmp 0x1000b3dc
jmp 0x1000b3b0
mov dword [ebp - 0x1b4], 0x2d5e48d3
mov dword [ebp - 0x1b4], 0x19
jmp 0x1000b42d
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0xfffffff2
jg 0x1000b4ef
mov dword [ebp - 0x7c], 0
jmp 0x1000b44a
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1000b460
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xa00], 9
jmp 0x1000b443
mov dword [ebp - 0x7c], 0
jmp 0x1000b470
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1000b486
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x1e4], 0xfffffffc
jmp 0x1000b469
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1e4], 0
jmp 0x1000b4b4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e4], 0
jl 0x1000b4ea
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e4]
cmp dword [ebp + eax*4 - 0xa00], 0
je 0x1000b4dd
jmp 0x1000b4ea
cmp dword [ebp - 0x1b4], 0
je 0x1000b4e8
jmp 0x1000b499
jmp 0x1000b499
jmp 0x1000b420
mov dword [ebp - 0x5c], 0
jmp 0x1000b4ff
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1000b515
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x1f0], 0xcbad
jmp 0x1000b4f8
mov dword [ebp - 0x250], 0x9bdba76a
mov dword [ebp - 0x37c], 0
jmp 0x1000b538
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 2
jge 0x1000b554
mov eax, dword [ebp - 0x37c]
mov dword [ebp + eax*4 - 0xf00], 7
jmp 0x1000b52b
mov dword [ebp - 0x250], 0
jmp 0x1000b56d
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jg 0x1000b597
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1000b595
push 0x12c7
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x1000b560
mov dword [ebp - 0x5c], 0
jmp 0x1000b5a7
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1000b5bd
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x944], 0x52487223
jmp 0x1000b5a0
mov dword [ebp - 0x32c], 0
jmp 0x1000b5d6
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 2
jge 0x1000b5f2
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0x9c4], 3
jmp 0x1000b5c9
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x9c4], 0
jmp 0x1000b620
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9c4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x9c4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9c4], 5
jle 0x1000b658
mov byte [ebp - 0xc2], 0
movzx eax, byte [ebp - 0xc2]
test eax, eax
je 0x1000b656
push 0
push 0x64b
push 0xdfc
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
jmp 0x1000b605
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f0], 0
jne 0x1000b674
mov dword [ebp - 0x5f4], 1
jmp 0x1000b67b
and dword [ebp - 0x5f4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f0], 0
je 0x1000b6a7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f0], 0
je 0x1000b6a7
mov dword [ebp - 0x7c4], 1
jmp 0x1000b6ae
and dword [ebp - 0x7c4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f0]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1f0]
jne 0x1000b6e1
mov eax, 0x746e
test eax, eax
je 0x1000b6e1
mov dword [ebp - 0x5dc], 1
jmp 0x1000b6e8
and dword [ebp - 0x5dc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f0]
add eax, dword [ebp - 0x5dc]
cmp eax, 0x99a5671
jne 0x1000b70e
mov dword [ebp - 0x5e4], 1
jmp 0x1000b715
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x7c4]
cmp eax, dword [ebp - 0x5e4]
jne 0x1000b72f
mov dword [ebp - 0x8b4], 1
jmp 0x1000b736
and dword [ebp - 0x8b4], 0
imul eax, dword [ebp - 0x8b4], 0x859b
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x944], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x944]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x1f0]
imul eax, eax, 0x2a0c
test eax, eax
je 0x1000b78e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f0], 0
je 0x1000b78e
mov dword [ebp - 0x5ec], 1
jmp 0x1000b795
and dword [ebp - 0x5ec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f0]
cmp eax, dword [ebp - 0x5ec]
je 0x1000b7c6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f0], 0
je 0x1000b7c6
mov dword [ebp - 0x7cc], 1
jmp 0x1000b7cd
and dword [ebp - 0x7cc], 0
cmp dword [ebp - 0x7cc], 0xcbc21b07
jne 0x1000b7e5
mov dword [ebp - 0x930], 1
jmp 0x1000b7ec
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x5f4]
cmp eax, dword [ebp - 0x930]
jg 0x1000b806
mov dword [ebp - 0x5fc], 1
jmp 0x1000b80d
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f0]
add eax, dword [ebp - 0x5fc]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x1f0]
je 0x1000c4df
mov dword [ebp - 0x258], 0x1928c176
mov dword [ebp - 0x258], 0
jmp 0x1000b856
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xa
jl 0x1000b8fd
mov dword [ebp - 0x364], 0
jmp 0x1000b87c
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 3
jge 0x1000b898
mov eax, dword [ebp - 0x364]
mov dword [ebp + eax*4 - 0xc10], 4
jmp 0x1000b86f
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xc10], 0
jmp 0x1000b8c6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc10]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc10], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc10], 0xfffffff1
jle 0x1000b8f8
mov dword [ebp - 0xac0], 0xfffffff7
mov dword [ebp - 0xa08], 0xbc662a2b
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0xa08], eax
jmp 0x1000b8ab
jmp 0x1000b849
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1000bba6
mov dword [ebp - 0xc50], 0xf118c84b
mov dword [ebp - 0xc4c], 0xf118c84b
mov dword [ebp - 0xc48], 0xf118c84b
mov dword [ebp - 0xc44], 0xf118c84b
mov dword [ebp - 0xa4], 0
jmp 0x1000b954
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1000b970
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xc1c], 0x3342eb90
jmp 0x1000b947
mov dword [ebp - 0xa4], 0
jmp 0x1000b989
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1000b9a5
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x3a4], 0xfffffff7
jmp 0x1000b97c
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3a4], 2
jmp 0x1000b9d3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3a4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3a4], 0
jl 0x1000bba0
mov dword [ebp - 0xd8], 0xfffffffe
mov dword [ebp - 0xd8], 0
jmp 0x1000ba0a
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jg 0x1000ba2a
mov dword [ebp - 0xb50], 0xa956
cmp dword [ebp - 0xb50], 0
je 0x1000ba28
jmp 0x1000ba2a
jmp 0x1000b9fd
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3a4]
mov eax, dword [ebp + eax - 0x3a4]
mov dword [ebp + ecx*4 - 0xc1c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp + eax*4 - 0xc1c], 1
jg 0x1000ba6e
mov dword [ebp - 0x7d4], 1
jmp 0x1000ba75
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x7d4]
jge 0x1000ba8f
mov dword [ebp - 0x604], 1
jmp 0x1000ba96
and dword [ebp - 0x604], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a4]
mov eax, dword [ebp + eax*4 - 0xc1c]
cmp dword [ebp - 0x604], eax
jne 0x1000babe
mov dword [ebp - 0x8bc], 1
jmp 0x1000bac5
and dword [ebp - 0x8bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a4]
mov ecx, dword [ebp - 0x8bc]
lea eax, [eax + ecx + 0xd9ba]
cmp eax, dword [ebp - 0xd8]
jge 0x1000baf3
mov dword [ebp - 0x60c], 1
jmp 0x1000bafa
and dword [ebp - 0x60c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a4]
imul eax, dword [ebp - 0x60c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3a4]
jl 0x1000bb29
mov dword [ebp - 0x7dc], 1
jmp 0x1000bb30
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0x7dc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x3a4]
je 0x1000bb58
mov dword [ebp - 0xa10], 1
jmp 0x1000bb5f
and dword [ebp - 0xa10], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3a4], 0x37d02268
jl 0x1000bb7e
mov dword [ebp - 0x614], 1
jmp 0x1000bb85
and dword [ebp - 0x614], 0
push 2
pop eax
sub eax, dword [ebp - 0x614]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc50], eax
jmp 0x1000b9b8
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 0x188], 0xd5b611fb
mov dword [ebp - 0x8cc], 2
mov dword [ebp - 0xa20], 0
mov dword [ebp - 0x84], 0
jmp 0x1000bbf1
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1000bc0d
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xda4], 0xb999fb02
jmp 0x1000bbe4
mov dword [ebp - 0x84], 0
jmp 0x1000bc26
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1000bc42
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xe8c], 0xffffffff
jmp 0x1000bc19
mov dword [ebp - 0x168], 0
jmp 0x1000bc5b
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jl 0x1000c179
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x8c4], 1
mov dword [ebp - 0x624], 0x2603
mov dword [ebp - 0x7ec], 9
mov dword [ebp - 0x260], 0
jmp 0x1000bca9
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jge 0x1000bcc5
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0x1dc], 0
jmp 0x1000bc9c
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d4]
mov dword [ebp + eax - 0xda4], ecx
mov dword [ebp - 0x1d4], 0xfffffff7
jmp 0x1000bcf1
cmp dword [ebp - 0x1d4], 0
jle 0x1000c174
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x9c], 0
jmp 0x1000bd21
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x1000bd3d
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x9bc], 3
jmp 0x1000bd14
mov dword [ebp - 0x9c], 0
jmp 0x1000bd56
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1000bd72
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xea4], 0xfffffff8
jmp 0x1000bd49
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x160]
cmp dword [ebp + eax - 0x9bc], ecx
je 0x1000bd93
mov dword [ebp - 0x988], 1
jmp 0x1000bd9a
and dword [ebp - 0x988], 0
cmp dword [ebp - 0x988], 0x63090707
jne 0x1000bdb2
mov dword [ebp - 0x61c], 1
jmp 0x1000bdb9
and dword [ebp - 0x61c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9bc]
imul eax, dword [ebp - 0x61c]
cmp eax, dword [ebp - 0x188]
jl 0x1000bde1
mov dword [ebp - 0x7e4], 1
jmp 0x1000bde8
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x7e4], eax
jg 0x1000be02
mov dword [ebp - 0xad0], 1
jmp 0x1000be09
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0xd34], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe8c]
dec eax
mov dword [ebp - 0xa18], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa18]
mov dword [ebp + eax - 0xe8c], ecx
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x8c4], eax
imul eax, dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x8c4], eax
jl 0x1000be7e
push 8
pop eax
test eax, eax
jne 0x1000be7e
and dword [ebp - 0x62c], 0
jmp 0x1000be88
mov dword [ebp - 0x62c], 1
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x7ec], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7ec]
imul ecx, dword [ebp + eax - 0xea4]
sub ecx, dword [ebp - 0x168]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9bc], ecx
jg 0x1000bec9
mov dword [ebp - 0x634], 1
jmp 0x1000bed0
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
add eax, 0x64ba389f
cmp eax, dword [ebp - 0x160]
jg 0x1000beef
mov dword [ebp - 0xb7c], 1
jmp 0x1000bef6
and dword [ebp - 0xb7c], 0
imul eax, dword [ebp - 0x8cc], 0xc02d
cmp eax, dword [ebp - 0x160]
jge 0x1000bf14
mov dword [ebp - 0x93c], 1
jmp 0x1000bf1b
and dword [ebp - 0x93c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x93c]
mov dword [ebp + eax - 0x1dc], ecx
mov dword [ebp - 0x188], 0
jmp 0x1000bf47
cmp dword [ebp - 0x188], 0xfffffff8
jl 0x1000c16f
mov dword [ebp - 0x334], 0
jmp 0x1000bf6d
jmp 0x1000bce4
jmp 0x1000bc4e
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x1000c4da
mov dword [ebp - 0x3c], 0x632667a8
mov dword [ebp - 0x804], 0xfffffff8
mov dword [ebp - 0x674], 1
mov dword [ebp - 0xa28], 0
mov dword [ebp - 0xd4c], 0x2aa787d3
mov dword [ebp - 0x24], 0
jmp 0x1000c1ce
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000c1e4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x180], 0x99ff
jmp 0x1000c1c7
mov dword [ebp - 0x24], 0
jmp 0x1000c1f4
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000c20a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc34], 0x91ba8027
jmp 0x1000c1ed
mov dword [ebp - 0x24], 0
jmp 0x1000c21a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000c230
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xadc], 0xb88dcfd8
jmp 0x1000c213
mov dword [ebp - 0x3c], 0
jmp 0x1000c240
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1000c4c6
mov dword [ebp - 0x268], 0xfffffff6
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x180]
mov dword [ebp - 0xd54], eax
mov dword [ebp - 0x804], 0xfffffffb
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x180]
cmp dword [ebp - 0x804], eax
jl 0x1000c2cd
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x180]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp + ecx*4 - 0x180]
cmp dword [ebp + eax*4 - 0x180], ecx
je 0x1000c2bc
mov dword [ebp - 0x664], 1
jmp 0x1000c2c3
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x180]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd5c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd64], eax
mov eax, dword [ebp - 0x674]
add eax, 0x37e0d1b7
cmp eax, 0x48dc
jne 0x1000c2fd
mov dword [ebp - 0x8d4], 1
jmp 0x1000c304
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0xa28]
cmp dword [ebp - 0x8d4], eax
jge 0x1000c324
mov eax, 0x6091
test eax, eax
jne 0x1000c324
and dword [ebp - 0x3e4], 0
jmp 0x1000c32e
mov dword [ebp - 0x3e4], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp + eax - 0xc34], ecx
cmp dword [ebp - 0x3e4], 0
jne 0x1000c35a
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x1000c35a
and dword [ebp - 0x66c], 0
jmp 0x1000c364
mov dword [ebp - 0x66c], 1
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x80c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x80c]
mov dword [ebp + eax - 0xadc], ecx
mov eax, dword [ebp - 0x80c]
sub eax, 0x622b
je 0x1000c3ab
cmp dword [ebp - 0x268], 0
je 0x1000c3a9
jmp 0x1000c4c6
jmp 0x1000c3e8
mov dword [ebp - 0xb4], 0xa
jmp 0x1000c3c4
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xffffffec
jl 0x1000c3e8
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xc34]
mov dword [ebp + ecx - 0xadc], eax
jmp 0x1000c3b7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xadc], 0
jne 0x1000c49f
cmp dword [ebp - 0xb4], 1
jne 0x1000c411
mov dword [ebp - 0x3c4], 1
jmp 0x1000c418
and dword [ebp - 0x3c4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + eax - 0xc34], ecx
cmp dword [ebp - 0x3c4], 0
je 0x1000c462
mov dword [ebp - 0x814], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x814]
sub ecx, dword [ebp + eax - 0xadc]
mov dword [ebp - 0xb4], ecx
jmp 0x1000c239
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x1000c766
mov dword [ebp - 0x38], 3
mov dword [ebp - 0xa30], 5
mov dword [ebp - 0x38c], 0
jmp 0x1000c509
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 1
jge 0x1000c525
mov eax, dword [ebp - 0x38c]
mov dword [ebp + eax*4 - 0x8e4], 0x54ba4fda
jmp 0x1000c4fc
mov dword [ebp - 0x38], 1
jmp 0x1000c535
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1000c766
mov dword [ebp - 0x270], 0x9d38951f
mov dword [ebp - 0x824], 0x54f618e1
mov dword [ebp - 0x270], 1
jmp 0x1000c56c
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jl 0x1000c69e
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
je 0x1000c58d
mov dword [ebp - 0x684], 1
jmp 0x1000c594
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0xffffffff
jl 0x1000c5a9
mov dword [ebp - 0x8dc], 1
jmp 0x1000c5b0
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x944]
cmp dword [ebp - 0x8dc], eax
jle 0x1000c5d4
mov eax, 0xbd3d
test eax, eax
jne 0x1000c5d4
and dword [ebp - 0x68c], 0
jmp 0x1000c5de
mov dword [ebp - 0x68c], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1ec]
cmp eax, dword [ebp - 0x68c]
je 0x1000c5fc
mov dword [ebp - 0x81c], 1
jmp 0x1000c603
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x81c]
add eax, 8
cmp eax, dword [ebp - 0x1c4]
jne 0x1000c620
mov dword [ebp - 0x694], 1
jmp 0x1000c627
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1f0]
cmp eax, dword [ebp - 0x694]
jne 0x1000c645
mov dword [ebp - 0x954], 1
jmp 0x1000c64c
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x954]
sub eax, dword [ebp - 0x38]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x8e4]
jg 0x1000c670
mov dword [ebp - 0x69c], 1
jmp 0x1000c677
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x944]
imul eax, dword [ebp - 0x69c]
mov ecx, 0xc6200d40
sub ecx, eax
mov dword [ebp - 0x824], ecx
je 0x1000c699
jmp 0x1000c69e
jmp 0x1000c55f
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x944], 0x35a02a90
jle 0x1000c6ba
mov dword [ebp - 0x43c], 1
jmp 0x1000c6c1
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0xf3bc9f
je 0x1000c6d9
mov dword [ebp - 0x6ac], 1
jmp 0x1000c6e0
and dword [ebp - 0x6ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8e4]
inc eax
cmp eax, 8
jbe 0x1000c6ff
mov dword [ebp - 0x82c], 1
jmp 0x1000c706
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x6ac]
sub eax, dword [ebp - 0x82c]
cmp eax, dword [ebp - 0xb58]
jge 0x1000c726
mov dword [ebp - 0x6b4], 1
jmp 0x1000c72d
and dword [ebp - 0x6b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f0]
cmp dword [ebp - 0x6b4], eax
jl 0x1000c74e
mov dword [ebp - 0x95c], 1
jmp 0x1000c755
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0xa30], eax
jmp 0x1000c52e
mov dword [ebp - 0x1c4], 0xffffffe9
jmp 0x1000c77f
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 8
jle 0x1000c7b2
mov byte [ebp - 0x137], 0
movzx eax, byte [ebp - 0x137]
test eax, eax
je 0x1000c7b0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x1000c772
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0x33c], 0
jmp 0x1000c7d5
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 2
jge 0x1000c7f1
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0xf10], 0x7f5aee0c
jmp 0x1000c7c8
mov dword [ebp - 0xe0], 0
jmp 0x1000c80a
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jne 0x1000ca22
mov dword [ebp - 0x2e4], 0x75286e87
mov dword [ebp - 0xb14], 0x88b92280
mov dword [ebp - 0x278], 0
jmp 0x1000c844
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 1
jge 0x1000c860
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xd6c], 0xc9dffbe5
jmp 0x1000c837
mov dword [ebp - 0x2e4], 0xb
jmp 0x1000c879
mov eax, dword [ebp - 0x2e4]
dec eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0xffffffff
jl 0x1000ca1d
mov dword [ebp - 0x170], 0xf8067e3
mov dword [ebp - 0xa38], 0x4142b919
mov dword [ebp - 0xd74], 4
mov dword [ebp - 0x280], 0
jmp 0x1000c8bd
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 1
jge 0x1000c8d9
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0xd7c], 0x6ce1a812
jmp 0x1000c8b0
mov dword [ebp - 0x170], 0x19
jmp 0x1000c8f2
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 9
jg 0x1000ca18
mov dword [ebp - 0xa40], 0x277ebd00
mov dword [ebp - 0x6cc], 0xcd17
mov dword [ebp - 0x2e8], 0
jmp 0x1000c92c
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 2
jge 0x1000c948
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0xf18], 0x85734cb4
jmp 0x1000c91f
cmp dword [ebp - 0xe0], 0
je 0x1000c9a8
cmp dword [ebp - 0x170], 0
jne 0x1000c968
xor eax, eax
inc eax
jne 0x1000c968
and dword [ebp - 0x6bc], 0
jmp 0x1000c972
mov dword [ebp - 0x6bc], 1
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0x6bc]
jg 0x1000c98c
mov dword [ebp - 0xaf0], 1
jmp 0x1000c993
and dword [ebp - 0xaf0], 0
cmp dword [ebp - 0x170], 0
je 0x1000c9a8
mov dword [ebp - 0x834], 1
jmp 0x1000c9af
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x834], eax
jne 0x1000c9c9
mov dword [ebp - 0x6c4], 1
jmp 0x1000c9d0
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0xa38]
cmp dword [ebp - 0x6c4], eax
jne 0x1000c9f0
cmp dword [ebp - 0xb14], 0
je 0x1000c9f0
and dword [ebp - 0x8ec], 0
jmp 0x1000c9fa
mov dword [ebp - 0x8ec], 1
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0xa40], eax
mov eax, dword [ebp - 0x6cc]
inc eax
mov dword [ebp - 0x6cc], eax
jmp 0x1000c8e5
jmp 0x1000c86c
jmp 0x1000c7fd
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1000ca41
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0xe8], 1
mov dword [ebp - 0x288], 0
jmp 0x1000ca64
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x1000ca80
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0xf28], 0x7f5aee0c
jmp 0x1000ca57
mov dword [ebp - 0xe8], 0
jmp 0x1000ca99
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jne 0x1000ccb1
mov dword [ebp - 0x290], 0x75286e87
mov dword [ebp - 0xb2c], 0x88b92280
mov dword [ebp - 0x2f0], 0
jmp 0x1000cad3
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 1
jge 0x1000caef
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0xd84], 0xc9dffbe5
jmp 0x1000cac6
mov dword [ebp - 0x290], 0xb
jmp 0x1000cb08
mov eax, dword [ebp - 0x290]
dec eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0xffffffff
jl 0x1000ccac
mov dword [ebp - 0x14c], 0xf8067e3
mov dword [ebp - 0xa48], 0x4142b919
mov dword [ebp - 0xddc], 4
mov dword [ebp - 0x2f8], 0
jmp 0x1000cb4c
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x1000cb68
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0xde4], 0x6ce1a812
jmp 0x1000cb3f
mov dword [ebp - 0x14c], 0x19
jmp 0x1000cb81
cmp dword [ebp - 0x14c], 9
jg 0x1000cca7
mov dword [ebp - 0xa50], 0x277ebd00
mov dword [ebp - 0x844], 0xcd17
mov dword [ebp - 0x298], 0
jmp 0x1000cbbb
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 2
jge 0x1000cbd7
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0xf38], 0x85734cb4
jmp 0x1000cbae
cmp dword [ebp - 0xe8], 0
je 0x1000cc37
cmp dword [ebp - 0x14c], 0
jne 0x1000cbf7
xor eax, eax
inc eax
jne 0x1000cbf7
mov dword [ebp - 0x83c], 1
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x83c]
jg 0x1000cc1b
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x6d4], eax
jne 0x1000cc58
mov dword [ebp - 0x978], 1
jmp 0x1000cc5f
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0xa48]
cmp dword [ebp - 0x978], eax
jne 0x1000cc7f
jmp 0x1000cafb
jmp 0x1000ca8c
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1000ccd0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x18], 0x97f6af11
mov dword [ebp - 0xb10], 0x629342bb
mov dword [ebp - 0xdec], 1
mov dword [ebp - 0x18], 0x12
jmp 0x1000ccfb
cmp dword [ebp - 0x18], 0xffffffe5
jne 0x1000d062
mov dword [ebp - 0xf0], 0xdd3f4672
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x300], 0
jmp 0x1000cd32
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 3
jge 0x1000cd4e
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0xdb4], 1
jmp 0x1000cd25
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp + eax - 0xdb4], ecx
cmp dword [ebp - 0x18], 0
jne 0x1000cd76
mov eax, 0x3026
test eax, eax
jne 0x1000cd76
and dword [ebp - 0x6ec], 0
jmp 0x1000cd80
mov dword [ebp - 0x6ec], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jne 0x1000cd94
mov dword [ebp - 0x6e4], 1
jmp 0x1000cd9b
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x6e4]
imul eax, dword [ebp - 0x18]
cmp eax, 0xfffffffe
je 0x1000cdbf
cmp dword [ebp - 0xf0], 0
jne 0x1000cdbf
and dword [ebp - 0x8f4], 0
jmp 0x1000cdc9
mov dword [ebp - 0x8f4], 1
cmp dword [ebp - 0x8f4], 6
je 0x1000cdde
mov dword [ebp - 0x84c], 1
jmp 0x1000cde5
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x6ec]
cmp eax, dword [ebp - 0x84c]
jle 0x1000ce05
cmp dword [ebp - 0x18], 0
je 0x1000ce05
mov dword [ebp - 0x6f4], 1
jmp 0x1000ce0c
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x19c]
imul eax, dword [ebp - 0x6f4]
cmp eax, dword [ebp - 0x18]
jg 0x1000ce2a
mov dword [ebp - 0x958], 1
jmp 0x1000ce31
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0xf0]
imul eax, dword [ebp - 0x958]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x19c], 2
jmp 0x1000ce5d
cmp dword [ebp - 0x19c], 0
jl 0x1000d05d
mov dword [ebp - 0x2b0], 0xcecb4571
mov dword [ebp - 0x310], 0
jmp 0x1000d085
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 3
jge 0x1000d0a1
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0xf50], 0xb3c6
jmp 0x1000d078
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x1000d0bd
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov dword [ebp - 0x2b0], 2
jmp 0x1000d0d6
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0
jl 0x1000d141
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x1000d10d
push 0
push 0x381
push 0x143e
push 0x2294
push 0x1855
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov byte [ebp - 0x13f], 0
movzx eax, byte [ebp - 0x13f]
test eax, eax
je 0x1000d13f
push 0
push 0xb73
push 0x1a19
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x1000d0c9
mov dword [ebp - 0x28], 0x97f6af11
mov dword [ebp - 0xa58], 0x629342bb
mov dword [ebp - 0xdf4], 1
mov dword [ebp - 0x28], 0x12
jmp 0x1000d16c
cmp dword [ebp - 0x28], 0xffffffe5
jne 0x1000d4d3
mov dword [ebp - 0xf8], 0xdd3f4672
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x318], 0
jmp 0x1000d1a3
cmp dword [ebp - 0x318], 3
jge 0x1000d1bf
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0xdc4], 1
jmp 0x1000d196
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp + eax - 0xdc4], ecx
cmp dword [ebp - 0x28], 0
jne 0x1000d1e7
mov dword [ebp - 0x20], 0x97f6af11
mov dword [ebp - 0xb34], 0x629342bb
mov dword [ebp - 0xdfc], 1
mov dword [ebp - 0x20], 0x12
jmp 0x1000d4fe
cmp dword [ebp - 0x20], 0xffffffe5
jne 0x1000d865
mov dword [ebp - 0x100], 0xdd3f4672
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x328], 0
jmp 0x1000d535
mov dword [ebp - 0x338], 2
mov dword [ebp - 0x64], 0
jmp 0x1000d87f