Function at 0x1000a910
Capabilities:
Check for time delay via queryperformancecounter
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100756e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xab4
push esi
push edi
mov dword [ebp - 0x178], 0xfe7d8a87
push 2
lea ecx, [ebp - 0x820]
call fcn.10015404
and dword [ebp - 4], 0
mov dword [ebp - 0x17c], 0x4c3f4f88
mov dword [ebp - 0x4c], 0
jmp 0x1000a965
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x1000a97b
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xa78], 7
jmp 0x1000a95e
mov dword [ebp - 0x4c], 0
jmp 0x1000a98b
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1000a9a7
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x820]
call fcn.100154a2
mov dword [eax], 1
jmp 0x1000a984
mov dword [ebp - 0x178], 0
jmp 0x1000a9c0
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jg 0x1000abbf
mov dword [ebp - 0x29c], 0
jmp 0x1000a9e6
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 3
jge 0x1000aa02
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x73c], 0x4b25b3b9
jmp 0x1000a9d9
mov eax, dword [ebp - 0x178]
cmp dword [ebp + eax*4 - 0xa78], 0
je 0x1000aa17
jmp 0x1000abbf
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x73c], 3
jmp 0x1000aa45
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x73c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x73c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x73c], 0
jl 0x1000abba
mov dword [ebp - 0x294], 0x951ea66e
mov dword [ebp - 0x294], 3
jmp 0x1000aa7c
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
jl 0x1000ab91
push 3
lea ecx, [ebp - 0x678]
call fcn.10015404
mov byte [ebp - 4], 1
mov dword [ebp - 0x18c], 0
jmp 0x1000aab3
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x1000aad5
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x678]
call fcn.100154a2
mov dword [eax], 6
jmp 0x1000aaa6
push 1
lea ecx, [ebp - 0x678]
call fcn.100154a2
and dword [eax], 0
jmp 0x1000ab0b
push 1
lea ecx, [ebp - 0x678]
call fcn.100154a2
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3f4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x678]
call fcn.100154a2
cmp dword [eax], 3
jg 0x1000ab7d
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1000ab50
push 0x282
push 0
push 0
push 0x46
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1000ab78
push 0
push 0
push 0x8dc
push 0x18ea
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x1000aae7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x678]
call fcn.10015486
jmp 0x1000aa6f
push 0
lea ecx, [ebp - 0x820]
call fcn.100154a2
mov dword [eax], 7
or eax, 0xffffffff
imul eax, eax, 7
add eax, 0x1324
mov dword [ebp - 0x17c], eax
jmp 0x1000aa2a
jmp 0x1000a9b3
mov dword [ebp - 0x17c], 1
jmp 0x1000abd8
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x1000ac10
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x1000ac0e
push 0x1603
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x1000abcb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x820]
call fcn.10015486
mov dword [ebp - 0x154], 0x477862f
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1000ac43
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [ebp - 0x154], 0x12
jmp 0x1000ac5c
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jle 0x1000ac9b
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1000ac8e
push 0x19f3
push 0x1e76
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
cmp dword [ebp - 0x154], 0
je 0x1000ac99
jmp 0x1000ac9b
jmp 0x1000ac4f
mov dword [ebp - 0x22c], 0xfffffff8
mov dword [ebp - 0x6ac], 0xc0aa39ed
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x1000accc
push 0x113
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x22c], 7
jmp 0x1000ace5
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xc
jge 0x1000acfa
mov dword [ebp - 0x6ac], 0x22124f84
jmp 0x1000acd8
mov dword [ebp - 0xbc], 0x8ade19d2
mov dword [ebp - 0x8c], 0
jmp 0x1000ad1d
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1000ad39
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x5fc], 0x17571177
jmp 0x1000ad10
mov dword [ebp - 0x8c], 0
jmp 0x1000ad52
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1000ad6e
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x688], 0
jmp 0x1000ad45
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x688], 0
jmp 0x1000ad9c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x688]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x688], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x688], 1
jge 0x1000adc6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x688]
mov dword [ebp + eax*4 - 0x5fc], 4
jmp 0x1000ad81
push 2
lea ecx, [ebp - 0x2d0]
call fcn.10015404
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0xffb871c7
mov dword [ebp - 0x194], 0
jmp 0x1000adfa
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x1000ae1c
push dword [ebp - 0x194]
lea ecx, [ebp - 0x2d0]
call fcn.100154a2
mov dword [eax], 0xa684
jmp 0x1000aded
mov dword [ebp - 0x28], 0
jmp 0x1000ae2c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jg 0x1000b202
mov dword [ebp - 0x108], 0x440e708b
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2d0]
call fcn.100154a2
mov eax, dword [eax]
inc eax
cmp eax, 0x145ba13b
jle 0x1000ae64
mov dword [ebp - 0x560], 1
jmp 0x1000ae6b
and dword [ebp - 0x560], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2d0]
call fcn.100154a2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x560]
jle 0x1000b037
mov dword [ebp - 0x434], 0xd976
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x108], eax
mov esi, dword [ebp - 0x108]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2d0]
call fcn.100154a2
cmp esi, dword [eax]
jne 0x1000aec1
mov dword [ebp - 0x568], 1
jmp 0x1000aec8
and dword [ebp - 0x568], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2d0]
call fcn.100154a2
mov esi, dword [ebp - 0x568]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x2d0]
call fcn.100154a2
cmp esi, dword [eax]
jg 0x1000aefb
mov dword [ebp - 0x570], 1
jmp 0x1000af02
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x570], eax
jg 0x1000af19
mov dword [ebp - 0x55c], 1
jmp 0x1000af20
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x55c], eax
jle 0x1000af37
mov dword [ebp - 0x558], 1
jmp 0x1000af3e
and dword [ebp - 0x558], 0
push 1
lea ecx, [ebp - 0x2d0]
call fcn.100154a2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x558]
jle 0x1000af61
mov dword [ebp - 0x300], 1
jmp 0x1000af68
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 0xffffffff
ja 0x1000af7d
mov dword [ebp - 0x2f4], 1
jmp 0x1000af84
and dword [ebp - 0x2f4], 0
mov esi, dword [ebp - 0x2f4]
sub esi, dword [ebp - 0x434]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2d0]
call fcn.100154a2
mov eax, dword [eax]
lea eax, [esi + eax - 0x61ddbfe3]
imul eax, eax, 0xfffffffc
cmp eax, dword [ebp - 0x28]
jg 0x1000afbb
mov dword [ebp - 0x2fc], 1
jmp 0x1000afc2
and dword [ebp - 0x2fc], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.100154a2
mov eax, dword [eax]
sub eax, dword [ebp - 0x2fc]
jne 0x1000afe2
mov eax, 0xb1aa
test eax, eax
je 0x1000afef
cmp dword [ebp - 0x28], 0
je 0x1000afed
jmp 0x1000b202
jmp 0x1000b032
mov dword [ebp - 0x108], 0
jmp 0x1000b008
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xffffffe4
jle 0x1000b032
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x1000b030
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x1000affb
jmp 0x1000b1fd
push 1
lea ecx, [ebp - 0x698]
call fcn.10015404
mov byte [ebp - 4], 3
mov dword [ebp - 0x4d4], 0x75278539
mov dword [ebp - 0x604], 0xf96354d1
mov dword [ebp - 0x27c], 0
jmp 0x1000b075
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jge 0x1000b097
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x698]
call fcn.100154a2
mov dword [eax], 0xad31
jmp 0x1000b068
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2d0]
call fcn.100154a2
mov esi, eax
push 0
lea ecx, [ebp - 0x698]
call fcn.100154a2
mov ecx, dword [esi]
sub ecx, dword [eax]
mov dword [ebp - 0x4d4], ecx
mov esi, dword [ebp - 0x4d4]
push 0
lea ecx, [ebp - 0x2d0]
call fcn.100154a2
cmp dword [eax], esi
jg 0x1000b0e1
mov dword [ebp - 0x524], 1
jmp 0x1000b0e8
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x954], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jl 0x1000b108
mov dword [ebp - 0x304], 1
jmp 0x1000b10f
and dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 4
jge 0x1000b124
mov dword [ebp - 0x43c], 1
jmp 0x1000b12b
and dword [ebp - 0x43c], 0
push 0
lea ecx, [ebp - 0x698]
call fcn.100154a2
mov ecx, dword [ebp - 0x43c]
cmp ecx, dword [eax]
jl 0x1000b14e
mov dword [ebp - 0x30c], 1
jmp 0x1000b155
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0x4174aa7f
jle 0x1000b16d
mov dword [ebp - 0x314], 1
jmp 0x1000b174
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x524]
cmp eax, dword [ebp - 0x314]
jne 0x1000b18e
mov dword [ebp - 0x444], 1
jmp 0x1000b195
and dword [ebp - 0x444], 0
push 0
lea ecx, [ebp - 0x698]
call fcn.100154a2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x444]
jl 0x1000b1b8
mov dword [ebp - 0x31c], 1
jmp 0x1000b1bf
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x604], eax
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1000b1ee
push 0x2670
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x698]
call fcn.10015486
jmp 0x1000ae25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d0]
call fcn.10015486
mov dword [ebp - 0x52c], 0x2466e9f0
mov dword [ebp - 0x14], 0x2cb13638
mov dword [ebp - 0x160], 7
mov dword [ebp - 0x19c], 0
jmp 0x1000b245
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x1000b261
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x2b8], 0x3342eb9
jmp 0x1000b238
mov dword [ebp - 0x14], 1
jmp 0x1000b271
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1000b2dc
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x2b8], 0x565e
jne 0x1000b293
mov dword [ebp - 0x4dc], 1
jmp 0x1000b29a
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 8
jl 0x1000b2af
mov dword [ebp - 0x324], 1
jmp 0x1000b2b6
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x160], eax
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1000b2da
call dword [sym.imp.USER32.dll_CreatePopupMenu]
jmp 0x1000b26a
mov dword [ebp - 0x160], 0x15
jmp 0x1000b2f5
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x23
jle 0x1000b56f
mov dword [ebp - 0x234], 0xb4ef66b1
push 3
lea ecx, [ebp - 0x808]
call fcn.10015404
mov dword [ebp - 4], 4
push 2
lea ecx, [ebp - 0x7c0]
call fcn.10015404
mov byte [ebp - 4], 5
mov dword [ebp - 0x54], 0
jmp 0x1000b341
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x1000b35d
push dword [ebp - 0x54]
lea ecx, [ebp - 0x808]
call fcn.100154a2
mov dword [eax], 0x82f
jmp 0x1000b33a
mov dword [ebp - 0x54], 0
jmp 0x1000b36d
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1000b389
push dword [ebp - 0x54]
lea ecx, [ebp - 0x7c0]
call fcn.100154a2
mov dword [eax], 0x65835a7a
jmp 0x1000b366
mov dword [ebp - 0x14], 0
jmp 0x1000b399
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x1000b54c
mov dword [ebp - 0x234], 0x6c21
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2b8]
cmp dword [ebp - 0x14], eax
jge 0x1000b3c8
mov dword [ebp - 0x44c], 1
jmp 0x1000b3cf
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2b8]
imul eax, dword [ebp - 0x44c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2b8]
jne 0x1000b3fb
mov dword [ebp - 0x32c], 1
jmp 0x1000b402
and dword [ebp - 0x32c], 0
imul eax, dword [ebp - 0x32c], 0xfff7
cmp dword [ebp - 0x14], eax
jl 0x1000b41d
mov dword [ebp - 0x54c], 1
jmp 0x1000b424
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x54c], eax
jle 0x1000b43e
mov dword [ebp - 0x334], 1
jmp 0x1000b445
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2b8]
cmp eax, dword [ebp - 0x334]
jle 0x1000b463
mov dword [ebp - 0x454], 1
jmp 0x1000b46a
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x454], eax
jne 0x1000b484
mov dword [ebp - 0x33c], 1
jmp 0x1000b48b
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2b8]
cmp dword [ebp - 0x33c], eax
je 0x1000b4a9
mov dword [ebp - 0x4e4], 1
jmp 0x1000b4b0
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 6
jle 0x1000b4c5
mov dword [ebp - 0x60c], 1
jmp 0x1000b4cc
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2b8]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2b8]
cmp dword [ebp - 0x234], eax
je 0x1000b509
push 1
lea ecx, [ebp - 0x808]
call fcn.100154a2
cmp dword [eax], 0
jne 0x1000b509
and dword [ebp - 0x344], 0
jmp 0x1000b513
mov dword [ebp - 0x344], 1
cmp dword [ebp - 0x344], 0xd258
jl 0x1000b52b
mov dword [ebp - 0x45c], 1
jmp 0x1000b532
and dword [ebp - 0x45c], 0
push 1
lea ecx, [ebp - 0x7c0]
call fcn.100154a2
mov ecx, dword [ebp - 0x45c]
mov dword [eax], ecx
jmp 0x1000b392
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x7c0]
call fcn.10015486
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x808]
call fcn.10015486
jmp 0x1000b2e8
mov dword [ebp - 0x7c], 0
jmp 0x1000b57f
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000b595
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xa84], 0xfffffffe
jmp 0x1000b578
mov dword [ebp - 0x7c], 0
jmp 0x1000b5a5
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000b5bb
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xa9c], 0xfffffffc
jmp 0x1000b59e
mov dword [ebp - 0xbc], 0
jmp 0x1000b5d4
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jg 0x1000b5f4
mov dword [ebp - 0x614], 0x5db3
cmp dword [ebp - 0x614], 0
je 0x1000b5f2
jmp 0x1000b5f4
jmp 0x1000b5c7
mov dword [ebp - 0xbc], 2
jmp 0x1000b60d
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x1000b7a6
push 1
lea ecx, [ebp - 0x6a8]
call fcn.10015404
mov dword [ebp - 4], 6
mov dword [ebp - 0x8dc], 0xfffffff6
mov dword [ebp - 0xa30], 0
push 4
lea ecx, [ebp - 0x950]
call fcn.10015404
mov byte [ebp - 4], 7
mov dword [ebp - 0x44], 0
jmp 0x1000b663
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1000b67c
push dword [ebp - 0x44]
lea ecx, [ebp - 0x6a8]
call fcn.100154a2
and dword [eax], 0
jmp 0x1000b65c
mov dword [ebp - 0x44], 0
jmp 0x1000b68c
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1000b6a8
push dword [ebp - 0x44]
lea ecx, [ebp - 0x950]
call fcn.100154a2
mov dword [eax], 0x9646b8d9
jmp 0x1000b685
push 0
lea ecx, [ebp - 0x6a8]
call fcn.100154a2
mov dword [eax], 2
jmp 0x1000b6e1
push 0
lea ecx, [ebp - 0x6a8]
call fcn.100154a2
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x34c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6a8]
call fcn.100154a2
cmp dword [eax], 0
jl 0x1000b783
push 2
lea ecx, [ebp - 0x940]
call fcn.10015404
mov byte [ebp - 4], 8
mov dword [ebp - 0x1a4], 0
jmp 0x1000b721
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x1000b743
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x940]
call fcn.100154a2
mov dword [eax], 3
jmp 0x1000b714
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1000b76f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x940]
call fcn.10015486
jmp 0x1000b6bd
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x950]
call fcn.10015486
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6a8]
call fcn.10015486
jmp 0x1000b600
mov dword [ebp - 0xb4], 0x8ade19d2
mov dword [ebp - 0x464], 0x2466e9f0
mov dword [ebp - 0x9c], 0
jmp 0x1000b7d3
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1000b7ef
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xab4], 0xfffffffe
jmp 0x1000b7c6
mov dword [ebp - 0x9c], 0
jmp 0x1000b808
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1000b824
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xa90], 0xfffffffc
jmp 0x1000b7fb
mov dword [ebp - 0xb4], 0
jmp 0x1000b83d
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jg 0x1000b85d
mov dword [ebp - 0x61c], 0x5db3
cmp dword [ebp - 0x61c], 0
je 0x1000b85b
jmp 0x1000b85d
jmp 0x1000b830
mov dword [ebp - 0xb4], 2
jmp 0x1000b876
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x1000ba0f
push 1
lea ecx, [ebp - 0x6b8]
call fcn.10015404
mov dword [ebp - 4], 9
mov dword [ebp - 0x8e4], 0xfffffff6
mov dword [ebp - 0x9b4], 0
push 4
lea ecx, [ebp - 0x970]
call fcn.10015404
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x64], 0
jmp 0x1000b8cc
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1000b8e5
push dword [ebp - 0x64]
lea ecx, [ebp - 0x6b8]
call fcn.100154a2
and dword [eax], 0
jmp 0x1000b8c5
mov dword [ebp - 0x64], 0
jmp 0x1000b8f5
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x1000b911
push dword [ebp - 0x64]
lea ecx, [ebp - 0x970]
call fcn.100154a2
mov dword [eax], 0x9646b8d9
jmp 0x1000b8ee
push 0
lea ecx, [ebp - 0x6b8]
call fcn.100154a2
mov dword [eax], 2
jmp 0x1000b94a
push 0
lea ecx, [ebp - 0x6b8]
call fcn.100154a2
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x354]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6b8]
call fcn.100154a2
cmp dword [eax], 0
jl 0x1000b9ec
push 2
lea ecx, [ebp - 0x960]
call fcn.10015404
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x2a4], 0
jmp 0x1000b98a
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 2
jge 0x1000b9ac
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0x960]
call fcn.100154a2
mov dword [eax], 3
jmp 0x1000b97d
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x1000b9d8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x960]
call fcn.10015486
jmp 0x1000b926
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x970]
call fcn.10015486
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b8]
call fcn.10015486
jmp 0x1000b869
mov dword [ebp - 0xa4], 0x8ade19d2
mov dword [ebp - 0x4ec], 0x2466e9f0
mov dword [ebp - 0x84], 0
jmp 0x1000ba3c
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1000ba58
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xaa8], 0xfffffffe
jmp 0x1000ba2f
mov dword [ebp - 0x84], 0
jmp 0x1000ba71
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1000ba8d
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xac0], 0xfffffffc
jmp 0x1000ba64
mov dword [ebp - 0xa4], 0
jmp 0x1000baa6
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jg 0x1000bac6
mov dword [ebp - 0x640], 0x5db3
cmp dword [ebp - 0x640], 0
je 0x1000bac4
jmp 0x1000bac6
jmp 0x1000ba99
mov dword [ebp - 0xa4], 2
jmp 0x1000badf
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x1000bc78
push 1
lea ecx, [ebp - 0x6c8]
call fcn.10015404
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x8ec], 0xfffffff6
mov dword [ebp - 0xa34], 0
push 4
lea ecx, [ebp - 0x990]
call fcn.10015404
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x6c], 0
jmp 0x1000bb35
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1000bb4e
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x6c8]
call fcn.100154a2
and dword [eax], 0
jmp 0x1000bb2e
mov dword [ebp - 0x6c], 0
jmp 0x1000bb5e
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x1000bb7a
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x990]
call fcn.100154a2
mov dword [eax], 0x9646b8d9
jmp 0x1000bb57
push 0
lea ecx, [ebp - 0x6c8]
call fcn.100154a2
mov dword [eax], 2
jmp 0x1000bbb3
push 0
lea ecx, [ebp - 0x6c8]
call fcn.100154a2
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x35c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6c8]
call fcn.100154a2
cmp dword [eax], 0
jl 0x1000bc55
push 2
lea ecx, [ebp - 0x980]
call fcn.10015404
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x1ac], 0
jmp 0x1000bbf3
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jge 0x1000bc15
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x980]
call fcn.100154a2
mov dword [eax], 3
jmp 0x1000bbe6
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x1000bc41
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x980]
call fcn.10015486
jmp 0x1000bb8f
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x990]
call fcn.10015486
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c8]
call fcn.10015486
jmp 0x1000bad2
push 3
lea ecx, [ebp - 0x594]
call fcn.10015404
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x150], 0xc2039807
mov dword [ebp - 0x94], 0
jmp 0x1000bcaf
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1000bcd1
push dword [ebp - 0x94]
lea ecx, [ebp - 0x594]
call fcn.100154a2
mov dword [eax], 0x1e55
jmp 0x1000bca2
mov dword [ebp - 0x94], 0
jmp 0x1000bcea
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x1000bd06
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x5c0], 0xffffffff
jmp 0x1000bcdd
mov dword [ebp - 0x150], 2
jmp 0x1000bd1f
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x1000bf4b
mov dword [ebp - 0x3c], 0x74b666a7
mov dword [ebp - 0x658], 0xce3d9786
mov dword [ebp - 0x3c], 0
jmp 0x1000bd4d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x1000bf46
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x4f4], 0x355c0c8f
mov dword [ebp - 0x384], 0xffffffff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x594]
call fcn.100154a2
mov dword [ebp - 0x364], eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x594]
call fcn.100154a2
mov ecx, dword [ebp - 0x364]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
shl eax, 0
lea eax, [ebp + eax - 0x5c0]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0x364]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x46c]
add eax, dword [ecx]
je 0x1000bf06
cmp dword [ebp - 0x3c], 0
jne 0x1000bee5
mov esi, dword [ebp - 0x3c]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x594]
call fcn.100154a2
cmp esi, dword [eax]
jne 0x1000be03
mov dword [ebp - 0x36c], 1
jmp 0x1000be0a
and dword [ebp - 0x36c], 0
cmp dword [ebp - 0x36c], 1
jne 0x1000be1f
mov dword [ebp - 0x650], 1
jmp 0x1000be26
and dword [ebp - 0x650], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c0]
mov dword [ebp - 0x8f4], eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x594]
call fcn.100154a2
cmp dword [eax], 0x4d07
jl 0x1000be5b
mov dword [ebp - 0x56c], 1
jmp 0x1000be62
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x474], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x474]
mov dword [ebp + eax - 0x5c0], ecx
push 0xfffffffffffffff9
pop esi
sub esi, dword [ebp - 0x474]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x594]
call fcn.100154a2
cmp esi, dword [eax]
jne 0x1000beb4
mov dword [ebp - 0x37c], 1
jmp 0x1000bebb
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0
jne 0x1000bee5
and dword [ebp - 0x47c], 0
jmp 0x1000beef
mov dword [ebp - 0x47c], 1
mov eax, dword [ebp - 0x47c]
dec eax
neg eax
je 0x1000bf06
mov dword [ebp - 0x38c], 1
jmp 0x1000bf0d
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x38c], eax
jge 0x1000bf2b
push 3
pop eax
test eax, eax
jne 0x1000bf2b
and dword [ebp - 0x534], 0
jmp 0x1000bf35
mov dword [ebp - 0x534], 1
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x658], eax
jmp 0x1000bd46
jmp 0x1000bd12
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x594]
call fcn.10015486
push 3
lea ecx, [ebp - 0x588]
call fcn.10015404
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x144], 0xc2039807
mov dword [ebp - 0x74], 0
jmp 0x1000bf88
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1000bfa4
push dword [ebp - 0x74]
lea ecx, [ebp - 0x588]
call fcn.100154a2
mov dword [eax], 0x1e55
jmp 0x1000bf81
mov dword [ebp - 0x74], 0
jmp 0x1000bfb4
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1000bfca
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x5b8], 0xffffffff
jmp 0x1000bfad
mov dword [ebp - 0x144], 2
jmp 0x1000bfe3
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jl 0x1000c20f
mov dword [ebp - 0x40], 0x74b666a7
mov dword [ebp - 0x668], 0xce3d9786
mov dword [ebp - 0x40], 0
jmp 0x1000c011
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x1000c20a
mov dword [ebp - 0x3a4], 0
mov dword [ebp - 0x554], 0x355c0c8f
mov dword [ebp - 0x3b4], 0xffffffff
push dword [ebp - 0x40]
lea ecx, [ebp - 0x588]
call fcn.100154a2
mov dword [ebp - 0x394], eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x588]
call fcn.100154a2
mov ecx, dword [ebp - 0x394]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
shl eax, 0
lea eax, [ebp + eax - 0x5b8]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0x394]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x484]
add eax, dword [ecx]
je 0x1000c1ca
cmp dword [ebp - 0x40], 0
jne 0x1000c1a9
mov esi, dword [ebp - 0x40]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x588]
call fcn.100154a2
cmp esi, dword [eax]
jne 0x1000c0c7
mov dword [ebp - 0x39c], 1
jmp 0x1000c0ce
and dword [ebp - 0x39c], 0
cmp dword [ebp - 0x39c], 1
jne 0x1000c0e3
mov dword [ebp - 0x660], 1
jmp 0x1000c0ea
and dword [ebp - 0x660], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5b8]
mov dword [ebp - 0x9c4], eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x588]
call fcn.100154a2
cmp dword [eax], 0x4d07
jl 0x1000c11f
mov dword [ebp - 0x4fc], 1
jmp 0x1000c126
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x48c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x48c]
mov dword [ebp + eax - 0x5b8], ecx
push 0xfffffffffffffff9
pop esi
sub esi, dword [ebp - 0x48c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x588]
call fcn.100154a2
cmp esi, dword [eax]
jne 0x1000c178
mov dword [ebp - 0x3ac], 1
jmp 0x1000c17f
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0
jne 0x1000c1a9
and dword [ebp - 0x494], 0
jmp 0x1000c1b3
mov dword [ebp - 0x494], 1
mov eax, dword [ebp - 0x494]
dec eax
neg eax
je 0x1000c1ca
mov dword [ebp - 0x3bc], 1
jmp 0x1000c1d1
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x3bc], eax
jge 0x1000c1ef
push 3
pop eax
test eax, eax
jne 0x1000c1ef
and dword [ebp - 0x504], 0
jmp 0x1000c1f9
mov dword [ebp - 0x504], 1
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x668], eax
jmp 0x1000c00a
jmp 0x1000bfd6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x588]
call fcn.10015486
push 4
lea ecx, [ebp - 0x7d8]
call fcn.10015404
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x1b4], 0xdba76aab
mov dword [ebp - 0x23c], 0
jmp 0x1000c255
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 4
jge 0x1000c277
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x7d8]
call fcn.100154a2
mov dword [eax], 0x313d
jmp 0x1000c248
mov dword [ebp - 0x1b4], 3
jmp 0x1000c290
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jl 0x1000c393
mov dword [ebp - 0x284], 0xadae8c9f
mov dword [ebp - 0x284], 3
jmp 0x1000c2c0
mov eax, dword [ebp - 0x284]
dec eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
jl 0x1000c374
push 2
lea ecx, [ebp - 0x76c]
call fcn.10015404
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x1bc], 0
jmp 0x1000c2f7
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jge 0x1000c319
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x76c]
call fcn.100154a2
mov dword [eax], 3
jmp 0x1000c2ea
push 1
lea ecx, [ebp - 0x76c]
call fcn.100154a2
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x3c4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3c4]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x7d8]
call fcn.100154a2
cmp dword [eax], 0
je 0x1000c360
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x76c]
call fcn.10015486
jmp 0x1000c374
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x76c]
call fcn.10015486
jmp 0x1000c2b3
mov byte [ebp - 0xc2], 0
movzx eax, byte [ebp - 0xc2]
test eax, eax
je 0x1000c38e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x1000c283
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7d8]
call fcn.10015486
push 3
lea ecx, [ebp - 0x57c]
call fcn.10015404
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x13c], 0xc2039807
mov dword [ebp - 0x48], 0
jmp 0x1000c3d0
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1000c3ec
push dword [ebp - 0x48]
lea ecx, [ebp - 0x57c]
call fcn.100154a2
mov dword [eax], 0x1e55
jmp 0x1000c3c9
mov dword [ebp - 0x48], 0
jmp 0x1000c3fc
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1000c412
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x638], 0xffffffff
jmp 0x1000c3f5
mov dword [ebp - 0x13c], 2
jmp 0x1000c42b
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x1000c657
mov dword [ebp - 0x38], 0x74b666a7
mov dword [ebp - 0x62c], 0xce3d9786
mov dword [ebp - 0x38], 0
jmp 0x1000c459
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jg 0x1000c652
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x3e4], 0x355c0c8f
mov dword [ebp - 0x4ac], 0xffffffff
push dword [ebp - 0x38]
lea ecx, [ebp - 0x57c]
call fcn.100154a2
mov dword [ebp - 0x49c], eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x57c]
call fcn.100154a2
mov ecx, dword [ebp - 0x49c]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
shl eax, 0
lea eax, [ebp + eax - 0x638]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3cc]
mov ecx, dword [ebp - 0x49c]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x3cc]
add eax, dword [ecx]
je 0x1000c612
cmp dword [ebp - 0x38], 0
jne 0x1000c5f1
mov esi, dword [ebp - 0x38]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x57c]
call fcn.100154a2
cmp esi, dword [eax]
jne 0x1000c50f
mov dword [ebp - 0x53c], 1
jmp 0x1000c516
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 1
jne 0x1000c52b
mov dword [ebp - 0x5f4], 1
jmp 0x1000c532
and dword [ebp - 0x5f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x638]
mov dword [ebp - 0x8fc], eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x57c]
call fcn.100154a2
cmp dword [eax], 0x4d07
jl 0x1000c567
mov dword [ebp - 0x3d4], 1
jmp 0x1000c56e
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x3dc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp + eax - 0x638], ecx
push 0xfffffffffffffff9
pop esi
sub esi, dword [ebp - 0x3dc]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x57c]
call fcn.100154a2
cmp esi, dword [eax]
jne 0x1000c5c0
mov dword [ebp - 0x50c], 1
jmp 0x1000c5c7
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0
jne 0x1000c5f1
and dword [ebp - 0x3ec], 0
jmp 0x1000c5fb
mov dword [ebp - 0x3ec], 1
mov eax, dword [ebp - 0x3ec]
dec eax
neg eax
je 0x1000c612
mov dword [ebp - 0x564], 1
jmp 0x1000c619
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x564], eax
jge 0x1000c637
push 3
pop eax
test eax, eax
jne 0x1000c637
and dword [ebp - 0x2e4], 0
jmp 0x1000c641
mov dword [ebp - 0x2e4], 1
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x62c], eax
jmp 0x1000c452
jmp 0x1000c41e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x57c]
call fcn.10015486
mov dword [ebp - 0x2c], 0xeac8b13e
mov dword [ebp - 0x624], 0x7d266845
cmp dword [ebp - 0x2c], 0
je 0x1000c872
mov dword [ebp - 0xa8], 0x65e790e8
mov dword [ebp - 0x2c], 0xffffffe9
jmp 0x1000c69b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x14
jle 0x1000c870
mov dword [ebp - 0x50], 0xc90d
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x1000c6c6
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa54], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x1000c731
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x9d4], eax
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0xa8]
jne 0x1000c710
cmp dword [ebp - 0x50], 0
jne 0x1000c710
and dword [ebp - 0x4b4], 0
jmp 0x1000c71a
mov dword [ebp - 0x4b4], 1
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x4b4]
je 0x1000c731
mov dword [ebp - 0x3fc], 1
jmp 0x1000c738
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x3fc], eax
jge 0x1000c74f
mov dword [ebp - 0x514], 1
jmp 0x1000c756
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x514]
jne 0x1000c84e
push 4
lea ecx, [ebp - 0x754]
call fcn.10015404
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x244], 0
jmp 0x1000c792
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 4
jge 0x1000c7b4
push dword [ebp - 0x244]
lea ecx, [ebp - 0x754]
call fcn.100154a2
mov dword [eax], 6
jmp 0x1000c785
mov dword [ebp - 0x50], 0
jmp 0x1000c7c4
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jg 0x1000c826
mov dword [ebp - 0xa8], 0
jmp 0x1000c7e3
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jge 0x1000c805
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x754]
call fcn.100154a2
mov dword [eax], 0x5561
jmp 0x1000c7d6
mov byte [ebp - 0xc6], 0
movzx eax, byte [ebp - 0xc6]
test eax, eax
je 0x1000c824
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x1000c7bd
cmp dword [ebp - 0x2c], 0
je 0x1000c83d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x754]
call fcn.10015486
jmp 0x1000c870
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x754]
call fcn.10015486
jmp 0x1000c86b
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x1000c86b
push 0x1c48
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
jmp 0x1000c694
jmp 0x1000c88c
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1000c88c
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x1c4], 1
mov dword [ebp - 0x1c4], 0xfffffff9
jmp 0x1000c8b8
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0xfffffff3
je 0x1000c96f
mov dword [ebp - 0x28c], 0
jmp 0x1000c8de
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jge 0x1000c8fa
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0x1cc], 1
jmp 0x1000c8d1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1cc], 0x18
jmp 0x1000c928
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1cc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1cc], 0xd
jl 0x1000c96a
mov byte [ebp - 0xcc], 0
movzx eax, byte [ebp - 0xcc]
test eax, eax
je 0x1000c968
push 0x512
push 0
push 0x76a
push 0
push 0xc7
push 0x1aae
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x1000c90d
jmp 0x1000c8ab
push 4
lea ecx, [ebp - 0x838]
call fcn.10015404
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x1d4], 0xdba76aab
mov dword [ebp - 0x24c], 0
jmp 0x1000c9a6
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 4
jge 0x1000c9c8
push dword [ebp - 0x24c]
lea ecx, [ebp - 0x838]
call fcn.100154a2
mov dword [eax], 0x313d
jmp 0x1000c999
mov dword [ebp - 0x1d4], 3
jmp 0x1000c9e1
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jl 0x1000cae4
mov dword [ebp - 0x264], 0xadae8c9f
mov dword [ebp - 0x264], 3
jmp 0x1000ca11
mov eax, dword [ebp - 0x264]
dec eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jl 0x1000cac5
push 2
lea ecx, [ebp - 0x784]
call fcn.10015404
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x1dc], 0
jmp 0x1000ca48
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 2
jge 0x1000ca6a
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x784]
call fcn.100154a2
mov dword [eax], 3
jmp 0x1000ca3b
push 1
lea ecx, [ebp - 0x784]
call fcn.100154a2
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x404]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x838]
call fcn.100154a2
cmp dword [eax], 0
je 0x1000cab1
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x784]
call fcn.10015486
jmp 0x1000cac5
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x784]
call fcn.10015486
jmp 0x1000ca04
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1000cadf
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x1000c9d4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x838]
call fcn.10015486
push 4
lea ecx, [ebp - 0x7f0]
call fcn.10015404
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x1e4], 0xdba76aab
mov dword [ebp - 0x254], 0
jmp 0x1000cb2a
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 4
jge 0x1000cb4c
push dword [ebp - 0x254]
lea ecx, [ebp - 0x7f0]
call fcn.100154a2
mov dword [eax], 0x313d
jmp 0x1000cb1d
mov dword [ebp - 0x1e4], 3
jmp 0x1000cb65
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0
jl 0x1000cc68
mov dword [ebp - 0x268], 0xadae8c9f
mov dword [ebp - 0x268], 3
jmp 0x1000cb95
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jl 0x1000cc49
push 2
lea ecx, [ebp - 0x730]
call fcn.10015404
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x1ec], 0
jmp 0x1000cbcc
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 2
jge 0x1000cbee
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x730]
call fcn.100154a2
mov dword [eax], 3
jmp 0x1000cbbf
push 1
lea ecx, [ebp - 0x730]
call fcn.100154a2
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x4bc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4bc]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x7f0]
call fcn.100154a2
cmp dword [eax], 0
je 0x1000cc35
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x730]
call fcn.10015486
jmp 0x1000cc49
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x730]
call fcn.10015486
jmp 0x1000cb88
mov byte [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
test eax, eax
je 0x1000cc63
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x1000cb58
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7f0]
call fcn.10015486
push 1
lea ecx, [ebp - 0x9a0]
call fcn.10015404
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x58], 0
jmp 0x1000cc9b
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1000ccb7
push dword [ebp - 0x58]
lea ecx, [ebp - 0x9a0]
call fcn.100154a2
mov dword [eax], 0x1713b910
jmp 0x1000cc94
mov dword [ebp - 0x58], 0
jmp 0x1000ccc7
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1000ccdd
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x5a4], 0x81c2900
jmp 0x1000ccc0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x5a4], 0
jmp 0x1000cd0b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x5a4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5a4], 0
jl 0x1000ce2b
push 1
lea ecx, [ebp - 0x6d8]
call fcn.10015404
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x25c], 0
jmp 0x1000cd49
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 1
jge 0x1000cd6b
push dword [ebp - 0x25c]
lea ecx, [ebp - 0x6d8]
call fcn.100154a2
mov dword [eax], 0x6d7be7e5
jmp 0x1000cd3c
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x1000cd95
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0
lea ecx, [ebp - 0x6d8]
call fcn.100154a2
and dword [eax], 0
jmp 0x1000cdcb
push 0
lea ecx, [ebp - 0x6d8]
call fcn.100154a2
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x40c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6d8]
call fcn.100154a2
cmp dword [eax], 0
jg 0x1000ce17
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1000cdf7
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1000ce15
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1000cda7
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6d8]
call fcn.10015486
jmp 0x1000ccf0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9a0]
call fcn.10015486
mov dword [ebp - 0x34], 0xeac8b13e
mov dword [ebp - 0x5ec], 0x7d266845
cmp dword [ebp - 0x34], 0
je 0x1000d046
mov dword [ebp - 0xb0], 0x65e790e8
mov dword [ebp - 0x34], 0xffffffe9
jmp 0x1000ce6f
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x14
jle 0x1000d044
mov dword [ebp - 0x60], 0xc90d
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1000ce9a
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
je 0x1000cf05
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x914], eax
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x34]
add eax, dword [ebp - 0xb0]
jne 0x1000cee4
cmp dword [ebp - 0x60], 0
jne 0x1000cee4
and dword [ebp - 0x544], 0
jmp 0x1000ceee
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x544]
je 0x1000cf05
mov dword [ebp - 0x414], 1
jmp 0x1000cf0c
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x414], eax
jge 0x1000cf23
mov dword [ebp - 0x4c4], 1
jmp 0x1000cf2a
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x4c4]
jne 0x1000d022
push 4
lea ecx, [ebp - 0x748]
call fcn.10015404
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x1f4], 0
jmp 0x1000cf66
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 4
jge 0x1000cf88
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x748]
call fcn.100154a2
mov dword [eax], 6
jmp 0x1000cf59
mov dword [ebp - 0x60], 0
jmp 0x1000cf98
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jg 0x1000cffa
mov dword [ebp - 0xb0], 0
jmp 0x1000cfb7
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 4
jge 0x1000cfd9
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x748]
call fcn.100154a2
mov dword [eax], 0x5561
jmp 0x1000cfaa
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x1000cff8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x1000cf91
cmp dword [ebp - 0x34], 0
je 0x1000d011
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x748]
call fcn.10015486
jmp 0x1000d044
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x748]
call fcn.10015486
jmp 0x1000d03f
mov byte [ebp - 0xdc], 0
movzx eax, byte [ebp - 0xdc]
test eax, eax
je 0x1000d03f
push 0x1c48
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
jmp 0x1000ce68
jmp 0x1000d060
mov byte [ebp - 0xde], 0
movzx eax, byte [ebp - 0xde]
test eax, eax
je 0x1000d060
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x5ec], eax
movzx eax, byte [0x10668754]
test eax, eax
je 0x1000d087
mov esi, 0x1007c86c
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x100100f5
mov dword [ebp - 0x1fc], 0x9d29
mov dword [ebp - 0x270], 0
jmp 0x1000d0aa
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x1000d0c6
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x6dc], 1
jmp 0x1000d09d
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x9e4], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x91c], eax
xor eax, eax
inc eax
jne 0x1000d0ef
mov dword [ebp - 0x5d0], 1
jmp 0x1000d0f6
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0xa4c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1fc]
mov dword [ebp + eax - 0x6dc], ecx
mov byte [ebp - 0xe0], 0
movzx eax, byte [ebp - 0xe0]
test eax, eax
je 0x1000d134
push 0x201e
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x180], 0xfffffff9
jmp 0x1000d157
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xfffffff3
je 0x1000d20e
mov dword [ebp - 0x204], 0
jmp 0x1000d17d
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x1000d199
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x278], 1
jmp 0x1000d170
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x278], 0x18
jmp 0x1000d1c7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x278]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x278], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x278], 0xd
jl 0x1000d209
mov byte [ebp - 0xe2], 0
movzx eax, byte [ebp - 0xe2]
test eax, eax
je 0x1000d207
push 0x512
push 0
push 0x76a
push 0
push 0xc7
push 0x1aae
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x1000d1ac
jmp 0x1000d14a
mov dword [ebp - 0x214], 0x43b7c7ce
mov dword [ebp - 0x924], 0x4667120d
push 3
lea ecx, [ebp - 0x9b0]
call fcn.10015404
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x9f4], 0x8d535dd2
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x20c], 0
jmp 0x1000d263
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jge 0x1000d285
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x9b0]
call fcn.100154a2
mov dword [eax], 0xfffffff9
jmp 0x1000d256
cmp dword [ebp - 0x214], 0
je 0x1000d415
mov dword [ebp - 0x2e0], 0xfffffff6
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x864], 0xa6b42be1
mov dword [ebp - 0x860], 0xa6b42be1
mov dword [ebp - 0x85c], 0xa6b42be1
mov dword [ebp - 0x858], 0xa6b42be1
mov dword [ebp - 0x92c], 0xffffffff
mov dword [ebp - 0xa2c], 0
mov dword [ebp - 0x26c], 0
jmp 0x1000d2fb
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1000d317
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x934], 0x2d38ca8c
jmp 0x1000d2ee
cmp dword [ebp - 0x214], 0
jne 0x1000d32e
xor eax, eax
inc eax
jne 0x1000d32e
and dword [ebp - 0x41c], 0
jmp 0x1000d338
mov dword [ebp - 0x41c], 1
mov eax, dword [ebp - 0x41c]
add eax, 4
cmp eax, dword [ebp - 0x214]
jle 0x1000d355
mov dword [ebp - 0x5d8], 1
jmp 0x1000d35c
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0xa04], eax
mov eax, 0xa1e1c5a3
test eax, eax
jne 0x1000d37d
mov dword [ebp - 0x654], 1
jmp 0x1000d384
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x944], eax
cmp dword [ebp - 0x214], 9
jg 0x1000d3a5
mov dword [ebp - 0x51c], 1
jmp 0x1000d3ac
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x2e0]
add eax, dword [ebp - 0x51c]
cmp eax, dword [ebp - 0x424]
jg 0x1000d3cc
mov dword [ebp - 0x4cc], 1
jmp 0x1000d3d3
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x4cc], eax
jne 0x1000d3ed
mov dword [ebp - 0x42c], 1
jmp 0x1000d3f4
and dword [ebp - 0x42c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x42c]
mov dword [ebp + eax - 0x864], ecx
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
jmp 0x1000d450
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x1000d433
push 5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x1000d450
push 0x1bb6
call dword [sym.imp.USER32.dll_MessageBeep]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b0]
call fcn.10015486
mov dword [ebp - 0x30], 0xeac8b13e
mov dword [ebp - 0x5e0], 0x7d266845
cmp dword [ebp - 0x30], 0
je 0x1000d66b
mov dword [ebp - 0xb8], 0x65e790e8
mov dword [ebp - 0x30], 0xffffffe9
jmp 0x1000d494
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x14
jle 0x1000d669
mov dword [ebp - 0x68], 0xc90d
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1000d4bf
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
je 0x1000d52a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0xb8]
jne 0x1000d509
cmp dword [ebp - 0x68], 0
jne 0x1000d509
and dword [ebp - 0x2f0], 0
jmp 0x1000d513
mov dword [ebp - 0x2f0], 1
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2f0]
je 0x1000d52a
mov dword [ebp - 0x2f8], 1
jmp 0x1000d531
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x2f8], eax
jge 0x1000d548
mov dword [ebp - 0x2e8], 1
jmp 0x1000d54f
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2e8]
jne 0x1000d647
push 4
lea ecx, [ebp - 0x760]
call fcn.10015404
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x290], 0
jmp 0x1000d58b
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 4
jge 0x1000d5ad
push dword [ebp - 0x290]
lea ecx, [ebp - 0x760]
call fcn.100154a2
mov dword [eax], 6
jmp 0x1000d57e
mov dword [ebp - 0x68], 0
jmp 0x1000d5bd
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jg 0x1000d61f
mov dword [ebp - 0xb8], 0
jmp 0x1000d5dc
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 4
jge 0x1000d5fe
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x760]
call fcn.100154a2
mov dword [eax], 0x5561
jmp 0x1000d5cf
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1000d61d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x1000d5b6
cmp dword [ebp - 0x30], 0
je 0x1000d636
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x760]
call fcn.10015486
jmp 0x1000d669
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x760]
call fcn.10015486
jmp 0x1000d664
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1000d664
push 0x1c48
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
jmp 0x1000d48d
jmp 0x1000d685
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1000d685
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x5e0], eax
mov dword [ebp - 0x890], 0x1007c86c
mov dword [ebp - 0x14c], 0xfffffff6
push 4
lea ecx, [ebp - 0x7a8]
call fcn.10015404
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x21c], 0
jmp 0x1000d6cf
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 4
jge 0x1000d6f1
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x7a8]
call fcn.100154a2
mov dword [eax], 0x6dc660f7
jmp 0x1000d6c2
mov dword [ebp - 0x14c], 1
mov dword [ebp - 0x14c], 0xfffffff2
jmp 0x1000d714
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffec
jl 0x1000d799
mov dword [ebp - 0x5b0], 0x1ad67a4b
mov dword [ebp - 0x274], 0
jmp 0x1000d740
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 1
jge 0x1000d75c
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0x5e8], 0xfffffffb
jmp 0x1000d733
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x898], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x5e8], 0x37a3
mov esi, dword [ebp - 0x14c]
add esi, 0x37a3
push 0
lea ecx, [ebp - 0x7a8]
call fcn.100154a2
mov dword [eax], esi
jmp 0x1000d707
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7a8]
call fcn.10015486
push 1
lea ecx, [ebp - 0x9c0]
call fcn.10015404
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x70], 0
jmp 0x1000d7cc
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1000d7e8
push dword [ebp - 0x70]
lea ecx, [ebp - 0x9c0]
call fcn.100154a2
mov dword [eax], 0x1713b910
jmp 0x1000d7c5
mov dword [ebp - 0x70], 0
jmp 0x1000d7f8
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1000d80e
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x59c], 0x81c2900
jmp 0x1000d7f1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x59c], 0
jmp 0x1000d83c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x59c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x59c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x59c], 0
jl 0x1000d95c
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10015404
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x224], 0
jmp 0x1000d87a
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x1000d89c
push dword [ebp - 0x224]
lea ecx, [ebp - 0x6e8]
call fcn.100154a2
mov dword [eax], 0x6d7be7e5
jmp 0x1000d86d
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x1000d8c6
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0
lea ecx, [ebp - 0x6e8]
call fcn.100154a2
and dword [eax], 0
jmp 0x1000d8fc
push 0
lea ecx, [ebp - 0x6e8]
call fcn.100154a2
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x308]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6e8]
call fcn.100154a2
cmp dword [eax], 0
jg 0x1000d948
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x1000d928
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x1000d946
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1000d8d8
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x6e8]
call fcn.10015486
jmp 0x1000d821
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c0]
call fcn.10015486
mov dword [ebp - 0x184], 1
mov dword [ebp - 0x184], 0xfffffff9
jmp 0x1000d98e
mov eax, dword [ebp - 0x184]
dec eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0xfffffff3
je 0x1000da45
mov dword [ebp - 0x188], 0
jmp 0x1000d9b4
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jge 0x1000d9d0
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x190], 1
jmp 0x1000d9a7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x190], 0x18
jmp 0x1000d9fe
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x190], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x190], 0xd
jl 0x1000da40
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x1000da3e
push 0x512
push 0
push 0x76a
push 0
push 0xc7
push 0x1aae
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x1000d9e3
jmp 0x1000d981
mov dword [ebp - 0x8a0], 0x1007c870
mov dword [ebp - 0x8a8], 0xc789
mov dword [ebp - 0x8b0], 0x4a12b57e
mov dword [ebp - 0x8b8], 0
push 2
lea ecx, [ebp - 0x9d0]
call fcn.10015404
mov dword [ebp - 4], 0x21
push 3
lea ecx, [ebp - 0x7b4]
call fcn.10015404
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x78], 0
jmp 0x1000daa2
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1000dabe
push dword [ebp - 0x78]
lea ecx, [ebp - 0x9d0]
call fcn.100154a2
mov dword [eax], 0xfffffffd
jmp 0x1000da9b
mov dword [ebp - 0x78], 0
jmp 0x1000dace
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1000daea
push dword [ebp - 0x78]
lea ecx, [ebp - 0x7b4]
call fcn.100154a2
mov dword [eax], 0x4272ba7
jmp 0x1000dac7
push 0
lea ecx, [ebp - 0x7b4]
call fcn.100154a2
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x310]
mov dword [ecx], eax
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x7b4]
call fcn.10015486
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d0]
call fcn.10015486
mov dword [ebp - 0x1a0], 0x9d29
mov dword [ebp - 0x198], 0
jmp 0x1000db4f
cmp dword [ebp - 0x198], 1
jge 0x1000db6b
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x5f0], 1
jmp 0x1000db42
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x8c8], eax
xor eax, eax
inc eax
jne 0x1000db94
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret