Function at 0x1000b3e9
Capabilities:
Delete file
Delete registry key
Delete registry value
Extract resource via kernel32 functions
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b8b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd64
push esi
push edi
mov dword [ebp - 0x84c], 0x2071b18d
mov dword [ebp - 0x7e8], 0xffffffff
cmp dword [ebp - 0x84c], 0
je 0x1000b445
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x1000b440
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1000b4e5
push 2
lea ecx, [ebp - 0x96c]
call fcn.10016f88
and dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
jmp 0x1000b46f
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jge 0x1000b491
push dword [ebp - 0x220]
lea ecx, [ebp - 0x96c]
call fcn.10016ff9
mov dword [eax], 0xfffffffe
jmp 0x1000b462
push 1
lea ecx, [ebp - 0x96c]
call fcn.10016ff9
mov esi, dword [eax]
add esi, 0x51c76d7b
push 1
lea ecx, [ebp - 0x96c]
call fcn.10016ff9
cmp esi, dword [eax]
jle 0x1000b4c3
mov dword [ebp - 0x378], 1
jmp 0x1000b4ca
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x7e8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x96c]
call fcn.10016ff4
mov dword [ebp - 0x7f0], 0x2071b18d
mov dword [ebp - 0x844], 0xffffffff
cmp dword [ebp - 0x7f0], 0
je 0x1000b521
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1000b51c
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1000b5c4
push 2
lea ecx, [ebp - 0x984]
call fcn.10016f88
mov dword [ebp - 4], 1
mov dword [ebp - 0x160], 0
jmp 0x1000b54e
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 2
jge 0x1000b570
push dword [ebp - 0x160]
lea ecx, [ebp - 0x984]
call fcn.10016ff9
mov dword [eax], 0xfffffffe
jmp 0x1000b541
push 1
lea ecx, [ebp - 0x984]
call fcn.10016ff9
mov esi, dword [eax]
add esi, 0x51c76d7b
push 1
lea ecx, [ebp - 0x984]
call fcn.10016ff9
cmp esi, dword [eax]
jle 0x1000b5a2
mov dword [ebp - 0x6bc], 1
jmp 0x1000b5a9
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x844], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x984]
call fcn.10016ff4
mov dword [ebp - 0x1d0], 0
jmp 0x1000b5dd
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x1000b5f9
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x168], 5
jmp 0x1000b5d0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x168], 0xb
jmp 0x1000b627
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x168]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x168], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x168], 0xffffffea
je 0x1000b67b
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x1000b65f
push 0
push 0
push 0x148
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1000b679
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
jmp 0x1000b60c
mov dword [ebp - 0x1c], 1
push 2
lea ecx, [ebp - 0x744]
call fcn.10016f88
mov dword [ebp - 4], 2
mov dword [ebp - 0x208], 0
jmp 0x1000b6af
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x1000b6d1
push dword [ebp - 0x208]
lea ecx, [ebp - 0x744]
call fcn.10016ff9
mov dword [eax], 0xfffffffa
jmp 0x1000b6a2
cmp dword [ebp - 0x1c], 5
jge 0x1000b6e3
mov dword [ebp - 0x6c4], 1
jmp 0x1000b6ea
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x6c4], eax
jl 0x1000b706
or eax, 0xffffffff
je 0x1000b706
mov dword [ebp - 0x6cc], 1
jmp 0x1000b70d
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0xffffffff
je 0x1000b722
mov dword [ebp - 0x6d4], 1
jmp 0x1000b729
and dword [ebp - 0x6d4], 0
cmp dword [ebp - 0x6d4], 0xffffffff
jne 0x1000b73e
mov dword [ebp - 0x6dc], 1
jmp 0x1000b745
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x6dc]
inc eax
jne 0x1000b75d
cmp dword [ebp - 0x1c], 0
jne 0x1000b75d
and dword [ebp - 0x6b4], 0
jmp 0x1000b767
mov dword [ebp - 0x6b4], 1
cmp dword [ebp - 0x6b4], 1
jne 0x1000b77c
mov dword [ebp - 0x2d4], 1
jmp 0x1000b783
and dword [ebp - 0x2d4], 0
push 1
lea ecx, [ebp - 0x744]
call fcn.10016ff9
mov dword [eax], 0xfffffffe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2d4]
lea eax, [eax + ecx - 2]
cmp eax, dword [ebp - 0x1c]
je 0x1000b7ac
cmp dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 1
jl 0x1000b7c1
cmp dword [ebp - 0x1c], 0
jne 0x1000b7c1
and dword [ebp - 0x52c], 0
jmp 0x1000b7cb
mov dword [ebp - 0x52c], 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x52c]
lea eax, [ecx + eax + 0x7a42ad5e]
test eax, eax
je 0x1000b8ff
mov dword [ebp - 0x170], 0xa885c82f
mov dword [ebp - 0x2a8], 0x17854c3e
mov dword [ebp - 0x7d8], 1
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
je 0x1000b82e
push 1
lea ecx, [ebp - 0x744]
call fcn.10016ff9
cmp dword [eax], 0
je 0x1000b82e
mov dword [ebp - 0x2dc], 1
jmp 0x1000b835
and dword [ebp - 0x2dc], 0
push 1
lea ecx, [ebp - 0x744]
call fcn.10016ff9
mov ecx, dword [ebp - 0x2dc]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1000b875
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x1c], eax
jg 0x1000b875
push 1
lea ecx, [ebp - 0x744]
call fcn.10016ff9
cmp dword [eax], 0
jne 0x1000b875
and dword [ebp - 0x524], 0
jmp 0x1000b87f
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x524], eax
je 0x1000b899
mov dword [ebp - 0x2e4], 1
jmp 0x1000b8a0
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x2e4], eax
jg 0x1000b8ba
mov dword [ebp - 0x510], 1
jmp 0x1000b8c1
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x510], eax
jne 0x1000b8db
mov dword [ebp - 0x2ec], 1
jmp 0x1000b8e2
and dword [ebp - 0x2ec], 0
mov esi, dword [ebp - 0x2ec]
sub esi, dword [ebp - 0x7d8]
push 1
lea ecx, [ebp - 0x744]
call fcn.10016ff9
mov dword [eax], esi
jmp 0x1000b929
mov dword [ebp - 0x610], 0x1d70
mov dword [ebp - 0x854], 0x24d8f3b1
mov dword [ebp - 0x610], 0xae69ed99
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x854], eax
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x1000b95b
push 0
push 0x2091
push 0x884
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x744]
call fcn.10016ff4
mov dword [ebp - 0x86c], 0x2071b18d
mov dword [ebp - 0x89c], 0xffffffff
mov dword [ebp - 0x2c], 0x76820624
push 1
lea ecx, [ebp - 0xa58]
call fcn.10016f88
mov dword [ebp - 4], 3
mov dword [ebp - 0xfc], 0x79c4185a
mov dword [ebp - 0x1d8], 0
jmp 0x1000b9bc
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x1000b9de
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0xa58]
call fcn.10016ff9
mov dword [eax], 0xf55e
jmp 0x1000b9af
mov dword [ebp - 0x2c], 0
jmp 0x1000b9ee
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 9
jl 0x1000b9fe
cmp dword [ebp - 0x2c], 0
je 0x1000b9fc
jmp 0x1000b9fe
jmp 0x1000b9e7
mov dword [ebp - 0x2c], 0
jmp 0x1000ba0e
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1000bb5b
mov dword [ebp - 0x138], 6
mov dword [ebp - 0x85c], 0xffffffff
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa58]
call fcn.10016ff9
mov eax, dword [eax]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0xfc], 0xffffffed
jmp 0x1000ba67
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xb
jne 0x1000bb56
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x864], 0xfffffffc
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0xf4], 0
jmp 0x1000baab
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xd
jl 0x1000bb51
mov dword [ebp - 0x138], 0xffffffe7
jmp 0x1000bad1
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xffffffee
jle 0x1000bb4c
cmp dword [ebp - 0xf4], 7
jne 0x1000baef
mov dword [ebp - 0x518], 1
jmp 0x1000baf6
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x85c], 0x8064
jle 0x1000bb0e
mov dword [ebp - 0x2f4], 1
jmp 0x1000bb15
and dword [ebp - 0x2f4], 0
cmp dword [ebp - 0x2f4], 0x193c1de6
jl 0x1000bb2d
mov dword [ebp - 0x2fc], 1
jmp 0x1000bb34
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x518]
imul eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x864], eax
jmp 0x1000bac4
jmp 0x1000ba9e
jmp 0x1000ba5a
jmp 0x1000ba07
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa58]
call fcn.10016ff4
cmp dword [ebp - 0x86c], 0
je 0x1000c261
push 1
lea ecx, [ebp - 0x6ec]
call fcn.10016f88
mov dword [ebp - 4], 4
mov dword [ebp - 0x87c], 0xfd52a42b
mov dword [ebp - 0x178], 0
jmp 0x1000bbae
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x1000bbd0
push dword [ebp - 0x178]
lea ecx, [ebp - 0x6ec]
call fcn.10016ff9
mov dword [eax], 0x9f9b3198
jmp 0x1000bba1
push 0
lea ecx, [ebp - 0x6ec]
call fcn.10016ff9
mov dword [eax], 0xffffffe3
jmp 0x1000bc09
push 0
lea ecx, [ebp - 0x6ec]
call fcn.10016ff9
mov dword [ebp - 0x690], eax
mov eax, dword [ebp - 0x690]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x690]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6ec]
call fcn.10016ff9
cmp dword [eax], 0xe
jl 0x1000bdc5
mov dword [ebp - 0x230], 0
jmp 0x1000bc38
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x1000bc54
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0xc0], 0xf506e60b
jmp 0x1000bc2b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc0], 0
jmp 0x1000bc82
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc0], 0xffffffff
jg 0x1000bdc0
mov dword [ebp - 0x10c], 0x3a3f
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10c]
cmp dword [ebp + eax - 0xc0], ecx
jge 0x1000bcc1
mov dword [ebp - 0x304], 1
jmp 0x1000bcc8
and dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 0x5b1510af
jle 0x1000bce9
cmp dword [ebp - 0x10c], 0
je 0x1000bce9
mov dword [ebp - 0x520], 1
jmp 0x1000bcf0
and dword [ebp - 0x520], 0
mov esi, dword [ebp - 0x10c]
mov eax, 0x89b1ab44
sub eax, dword [ebp - 0x520]
sub esi, eax
push 0
lea ecx, [ebp - 0x6ec]
call fcn.10016ff9
cmp esi, dword [eax]
jle 0x1000bd20
mov dword [ebp - 0x30c], 1
jmp 0x1000bd27
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0xffffffff
jg 0x1000bd3c
mov dword [ebp - 0x874], 1
jmp 0x1000bd43
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xbb0], eax
push 0
lea ecx, [ebp - 0x6ec]
call fcn.10016ff9
mov eax, dword [eax]
add eax, 8
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc0]
jl 0x1000bd7c
mov dword [ebp - 0x618], 1
jmp 0x1000bd83
and dword [ebp - 0x618], 0
push 0
lea ecx, [ebp - 0x6ec]
call fcn.10016ff9
mov ecx, dword [ebp - 0x618]
imul ecx, dword [eax]
imul ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x87c], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc0], 0
je 0x1000bdbb
jmp 0x1000bc67
jmp 0x1000bc67
jmp 0x1000bbe5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6ec]
call fcn.10016ff4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x84], 0xe8b01213
mov dword [ebp - 0x180], 0
jmp 0x1000be08
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jge 0x1000be24
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x240], 0x5683
jmp 0x1000bdfb
mov dword [ebp - 0x20], 1
jmp 0x1000be34
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1000c117
mov dword [ebp - 0x9ec], 0xc2076acb
mov dword [ebp - 0x9e8], 0xc2076acb
mov dword [ebp - 0x9e4], 0xc2076acb
mov dword [ebp - 0x9e0], 0xc2076acb
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x240]
mov edx, dword [ebp - 0x20]
imul ecx, dword [ebp + edx*4 - 0x240]
cmp dword [ebp + eax*4 - 0x240], ecx
jge 0x1000be93
mov dword [ebp - 0x314], 1
jmp 0x1000be9a
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x314]
sub ecx, dword [ebp + eax*4 - 0x240]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x240]
je 0x1000bec5
mov dword [ebp - 0x528], 1
jmp 0x1000becc
and dword [ebp - 0x528], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x528]
sub ecx, dword [ebp + eax - 0x240]
push 4
pop eax
shl eax, 1
cmp ecx, dword [ebp + eax - 0x9ec]
jne 0x1000bef9
mov dword [ebp - 0x31c], 1
jmp 0x1000bf00
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x240]
cmp eax, dword [ebp - 0x31c]
jle 0x1000bf1e
mov dword [ebp - 0x6d0], 1
jmp 0x1000bf25
and dword [ebp - 0x6d0], 0
cmp dword [ebp - 0x6d0], 1
jne 0x1000bf3a
mov dword [ebp - 0x324], 1
jmp 0x1000bf41
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x324], eax
je 0x1000bf5b
mov dword [ebp - 0x530], 1
jmp 0x1000bf62
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x240]
cmp dword [ebp - 0x530], eax
jl 0x1000bf8d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9ec], 0
jne 0x1000bf8d
and dword [ebp - 0x32c], 0
jmp 0x1000bf97
mov dword [ebp - 0x32c], 1
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1000bfbc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x240], 0
je 0x1000bfec
mov dword [ebp - 0x884], 0
mov dword [ebp - 0x88c], 0xfffffffc
cmp dword [ebp - 0x884], 0
je 0x1000bfde
jmp 0x1000c117
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x88c], eax
jmp 0x1000c00d
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x1000c00d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x84], 0x19
jmp 0x1000c026
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xfffffff0
jne 0x1000c112
mov dword [ebp - 0x1e0], 0
jmp 0x1000c04c
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 4
jge 0x1000c068
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0xd3c], 0
jmp 0x1000c03f
mov dword [ebp - 0x130], 0
jmp 0x1000c081
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jg 0x1000c0f3
mov dword [ebp - 0x188], 0
jmp 0x1000c0a3
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jge 0x1000c0bf
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x894], 0xfffffff7
jmp 0x1000c096
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x620], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x620]
mov dword [ebp + eax - 0x894], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x620]
mov dword [ebp + eax - 0xd3c], ecx
jmp 0x1000c074
mov byte [ebp - 0xa6], 0
movzx eax, byte [ebp - 0xa6]
test eax, eax
je 0x1000c10d
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000c019
jmp 0x1000be2d
mov byte [ebp - 0x8d], 0
push 2
lea ecx, [ebp - 0x8dc]
call fcn.10016f88
mov dword [ebp - 4], 5
mov dword [ebp - 0x3c], 0
jmp 0x1000c142
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1000c158
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xcc0], 0
jmp 0x1000c13b
mov dword [ebp - 0x3c], 0
jmp 0x1000c168
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1000c184
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x8dc]
call fcn.10016ff9
mov dword [eax], 0xfffffffc
jmp 0x1000c161
push 1
lea ecx, [ebp - 0x8dc]
call fcn.10016ff9
and dword [eax], 0
jmp 0x1000c1ba
push 1
lea ecx, [ebp - 0x8dc]
call fcn.10016ff9
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x334]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x8dc]
call fcn.10016ff9
cmp dword [eax], 0
jg 0x1000c200
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1000c1fe
push 0
push 0x1de
push 0x1698
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x1000c196
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x1000c23a
push 0x1704
push 0x3df
push 0x1f50
push 0x2694
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8dc]
call fcn.10016ff4
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1000c25c
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1000c3e5
push 2
lea ecx, [ebp - 0x99c]
call fcn.10016f88
mov dword [ebp - 4], 6
mov dword [ebp - 0xb88], 0x6b0f7383
mov dword [ebp - 0xc40], 0x964a53aa
mov dword [ebp - 0xb90], 0xfffffff6
push 1
lea ecx, [ebp - 0xbfc]
call fcn.10016f88
mov byte [ebp - 4], 7
mov dword [ebp - 0xa90], 0x2b3b7bed
mov dword [ebp - 0xa94], 0
push 3
lea ecx, [ebp - 0xbec]
call fcn.10016f88
mov byte [ebp - 4], 8
mov dword [ebp - 0x538], 0x21f7d967
mov dword [ebp - 0x64], 0
jmp 0x1000c2e3
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1000c2ff
push dword [ebp - 0x64]
lea ecx, [ebp - 0xbfc]
call fcn.10016ff9
mov dword [eax], 0x6580849f
jmp 0x1000c2dc
mov dword [ebp - 0x64], 0
jmp 0x1000c30f
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1000c32b
push dword [ebp - 0x64]
lea ecx, [ebp - 0xbec]
call fcn.10016ff9
mov dword [eax], 1
jmp 0x1000c308
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xbec]
call fcn.10016ff4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xbfc]
call fcn.10016ff4
mov dword [ebp - 0x210], 0
jmp 0x1000c36f
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x1000c391
push dword [ebp - 0x210]
lea ecx, [ebp - 0x99c]
call fcn.10016ff9
mov dword [eax], 0xfffffffe
jmp 0x1000c362
push 1
lea ecx, [ebp - 0x99c]
call fcn.10016ff9
mov esi, dword [eax]
add esi, 0x51c76d7b
push 1
lea ecx, [ebp - 0x99c]
call fcn.10016ff9
cmp esi, dword [eax]
jle 0x1000c3c3
mov dword [ebp - 0x33c], 1
jmp 0x1000c3ca
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x89c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x99c]
call fcn.10016ff4
mov dword [ebp - 0x7c4], 0xb4e1a362
mov dword [ebp - 0x7c0], 0xb4e1a362
mov dword [ebp - 0x7bc], 0xb4e1a362
mov dword [ebp - 0x7b8], 0xb4e1a362
mov dword [ebp - 0x548], 0x5f84255e
mov dword [ebp - 0xa9c], 0x656540f2
mov dword [ebp - 0xaa4], 1
mov dword [ebp - 0xab4], 0
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1000c44f
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c4], 0
je 0x1000c661
mov dword [ebp - 0x120], 0x28405cef
mov dword [ebp - 0x364], 0x90ae735
mov dword [ebp - 0x36c], 4
mov dword [ebp - 0x8ac], 0xffff
mov dword [ebp - 0x8b4], 0xffffffff
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1000c4b2
push 0x26bd
call dword [sym.imp.USER32.dll_GetKeyboardType]
xor eax, eax
jne 0x1000c61c
mov eax, dword [ebp - 0x120]
add eax, 0xa165
cmp eax, dword [ebp - 0x120]
jne 0x1000c4d9
mov dword [ebp - 0x698], 1
jmp 0x1000c4e0
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x698], eax
jle 0x1000c4fa
mov dword [ebp - 0x344], 1
jmp 0x1000c501
and dword [ebp - 0x344], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7c4]
cmp dword [ebp - 0x344], eax
je 0x1000c522
mov dword [ebp - 0x540], 1
jmp 0x1000c529
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x548]
cmp dword [ebp - 0x540], eax
je 0x1000c543
mov dword [ebp - 0x34c], 1
jmp 0x1000c54a
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x34c], 2
je 0x1000c55f
mov dword [ebp - 0x628], 1
jmp 0x1000c566
and dword [ebp - 0x628], 0
cmp dword [ebp - 0x628], 8
jbe 0x1000c57b
mov dword [ebp - 0x354], 1
jmp 0x1000c582
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x354], eax
jg 0x1000c59c
mov dword [ebp - 0x35c], 1
jmp 0x1000c5a3
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x548]
cmp dword [ebp - 0x35c], eax
jl 0x1000c5cd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c4], 0
je 0x1000c5cd
mov dword [ebp - 0x700], 1
jmp 0x1000c5d4
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x120]
add eax, dword [ebp - 0x700]
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xca3c0bf9
jae 0x1000c5fe
mov dword [ebp - 0x550], 1
jmp 0x1000c605
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0x550], eax
jne 0x1000c61c
and dword [ebp - 0x8a4], 0
jmp 0x1000c626
mov dword [ebp - 0x8a4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c4]
mov dword [ebp - 0xabc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c4]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x8ac]
imul eax, dword [ebp - 0x36c]
mov dword [ebp - 0x8b4], eax
jmp 0x1000c69d
mov dword [ebp - 0x630], 0xffff
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x1000c690
push 0
push 0
push 0x233c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x630]
dec eax
mov dword [ebp - 0x630], eax
mov dword [ebp - 0xacc], 0
mov dword [ebp - 0xad4], 0
mov dword [ebp - 0xadc], 0x2a2c7c8a
mov dword [ebp - 0xae4], 0xa1bf2b29
mov dword [ebp - 0xaec], 0xf09cc25f
push 2
lea ecx, [ebp - 0xc0c]
call fcn.10016f88
mov dword [ebp - 4], 9
mov dword [ebp - 0xaf4], 0
mov dword [ebp - 0x374], 0xab5457d6
mov dword [ebp - 0x44], 0
jmp 0x1000c707
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1000c71d
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xd70], 0xffffffff
jmp 0x1000c700
mov dword [ebp - 0x44], 0
jmp 0x1000c72d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1000c749
push dword [ebp - 0x44]
lea ecx, [ebp - 0xc0c]
call fcn.10016ff9
mov dword [eax], 1
jmp 0x1000c726
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0c]
call fcn.10016ff4
mov dword [ebp - 0x7d4], 0xb4e1a362
mov dword [ebp - 0x7d0], 0xb4e1a362
mov dword [ebp - 0x7cc], 0xb4e1a362
mov dword [ebp - 0x7c8], 0xb4e1a362
mov dword [ebp - 0x638], 0x5f84255e
mov dword [ebp - 0xafc], 0x656540f2
mov dword [ebp - 0xb04], 1
mov dword [ebp - 0xb0c], 0
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1000c7cf
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7d4], 0
je 0x1000c9e1
mov dword [ebp - 0x140], 0x28405cef
mov dword [ebp - 0x39c], 0x90ae735
mov dword [ebp - 0x3a4], 4
mov dword [ebp - 0x8c4], 0xffff
mov dword [ebp - 0x8cc], 0xffffffff
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x1000c832
push 0x26bd
call dword [sym.imp.USER32.dll_GetKeyboardType]
xor eax, eax
jne 0x1000c99c
mov eax, dword [ebp - 0x140]
add eax, 0xa165
cmp eax, dword [ebp - 0x140]
jne 0x1000c859
mov dword [ebp - 0x558], 1
jmp 0x1000c860
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x558], eax
jle 0x1000c87a
mov dword [ebp - 0x37c], 1
jmp 0x1000c881
and dword [ebp - 0x37c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7d4]
cmp dword [ebp - 0x37c], eax
je 0x1000c8a2
mov dword [ebp - 0x6a0], 1
jmp 0x1000c8a9
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x638]
cmp dword [ebp - 0x6a0], eax
je 0x1000c8c3
mov dword [ebp - 0x384], 1
jmp 0x1000c8ca
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 2
je 0x1000c8df
mov dword [ebp - 0x560], 1
jmp 0x1000c8e6
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 8
jbe 0x1000c8fb
mov dword [ebp - 0x38c], 1
jmp 0x1000c902
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x38c], eax
jg 0x1000c91c
mov dword [ebp - 0x394], 1
jmp 0x1000c923
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x638]
cmp dword [ebp - 0x394], eax
jl 0x1000c94d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7d4], 0
je 0x1000c94d
mov dword [ebp - 0x568], 1
jmp 0x1000c954
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x140]
add eax, dword [ebp - 0x568]
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0xca3c0bf9
jae 0x1000c97e
mov dword [ebp - 0x6d8], 1
jmp 0x1000c985
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x6d8], eax
jne 0x1000c99c
and dword [ebp - 0x8bc], 0
jmp 0x1000c9a6
mov dword [ebp - 0x8bc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7d4]
mov dword [ebp - 0xb14], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7d4]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0x8c4]
imul eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x8cc], eax
jmp 0x1000ca1d
mov dword [ebp - 0x570], 0xffff
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1000ca10
push 0
push 0
push 0x233c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x570]
dec eax
mov dword [ebp - 0x570], eax
mov dword [ebp - 0x7b4], 0xb4e1a362
mov dword [ebp - 0x7b0], 0xb4e1a362
mov dword [ebp - 0x7ac], 0xb4e1a362
mov dword [ebp - 0x7a8], 0xb4e1a362
mov dword [ebp - 0x3c4], 0x5f84255e
mov dword [ebp - 0xb24], 0x656540f2
mov dword [ebp - 0xb2c], 1
mov dword [ebp - 0xb34], 0
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x1000ca87
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7b4], 0
je 0x1000cc99
mov dword [ebp - 0x128], 0x28405cef
mov dword [ebp - 0x648], 0x90ae735
mov dword [ebp - 0x588], 4
mov dword [ebp - 0x954], 0xffff
mov dword [ebp - 0x94c], 0xffffffff
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1000caea
push 0x26bd
call dword [sym.imp.USER32.dll_GetKeyboardType]
xor eax, eax
jne 0x1000cc54
mov eax, dword [ebp - 0x128]
add eax, 0xa165
cmp eax, dword [ebp - 0x128]
jne 0x1000cb11
mov dword [ebp - 0x3ac], 1
jmp 0x1000cb18
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x3ac], eax
jle 0x1000cb32
mov dword [ebp - 0x640], 1
jmp 0x1000cb39
and dword [ebp - 0x640], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7b4]
cmp dword [ebp - 0x640], eax
je 0x1000cb5a
mov dword [ebp - 0x3b4], 1
jmp 0x1000cb61
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3c4]
cmp dword [ebp - 0x3b4], eax
je 0x1000cb7b
mov dword [ebp - 0x578], 1
jmp 0x1000cb82
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 2
je 0x1000cb97
mov dword [ebp - 0x3bc], 1
jmp 0x1000cb9e
and dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 8
jbe 0x1000cbb3
mov dword [ebp - 0x6a8], 1
jmp 0x1000cbba
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x6a8], eax
jg 0x1000cbd4
mov dword [ebp - 0x580], 1
jmp 0x1000cbdb
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x3c4]
cmp dword [ebp - 0x580], eax
jl 0x1000cc05
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7b4], 0
je 0x1000cc05
mov dword [ebp - 0x3cc], 1
jmp 0x1000cc0c
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x128]
add eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0xca3c0bf9
jae 0x1000cc36
mov dword [ebp - 0x3d4], 1
jmp 0x1000cc3d
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x588]
cmp dword [ebp - 0x3d4], eax
jne 0x1000cc54
and dword [ebp - 0x960], 0
jmp 0x1000cc5e
mov dword [ebp - 0x960], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b4]
mov dword [ebp - 0xb3c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b4]
mov dword [ebp - 0xb44], eax
mov eax, dword [ebp - 0x954]
imul eax, dword [ebp - 0x588]
mov dword [ebp - 0x94c], eax
jmp 0x1000ccd5
mov dword [ebp - 0x3dc], 0xffff
mov byte [ebp - 0x9f], 0
movzx eax, byte [ebp - 0x9f]
test eax, eax
je 0x1000ccc8
push 0
push 0
push 0x233c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x3dc]
dec eax
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0xb4c], 0
mov dword [ebp - 0xb54], 0
mov dword [ebp - 0xb5c], 0x2a2c7c8a
mov dword [ebp - 0xb64], 0xa1bf2b29
mov dword [ebp - 0xb6c], 0xf09cc25f
push 2
lea ecx, [ebp - 0xc1c]
call fcn.10016f88
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xb74], 0
mov dword [ebp - 0x720], 0xab5457d6
mov dword [ebp - 0x70], 0
jmp 0x1000cd3f
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1000cd55
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xd58], 0xffffffff
jmp 0x1000cd38
mov dword [ebp - 0x70], 0
jmp 0x1000cd65
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1000cd81
push dword [ebp - 0x70]
lea ecx, [ebp - 0xc1c]
call fcn.10016ff9
mov dword [eax], 1
jmp 0x1000cd5e
mov eax, dword [ebp - 0x720]
inc eax
mov dword [ebp - 0x720], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc1c]
call fcn.10016ff4
push 1
lea ecx, [ebp - 0x6fc]
call fcn.10016f88
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x7e4], 0xfd52a42b
mov dword [ebp - 0x190], 0
jmp 0x1000cdd4
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jge 0x1000cdf6
push dword [ebp - 0x190]
lea ecx, [ebp - 0x6fc]
call fcn.10016ff9
mov dword [eax], 0x9f9b3198
jmp 0x1000cdc7
push 0
lea ecx, [ebp - 0x6fc]
call fcn.10016ff9
mov dword [eax], 0xffffffe3
jmp 0x1000ce2f
push 0
lea ecx, [ebp - 0x6fc]
call fcn.10016ff9
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3e4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6fc]
call fcn.10016ff9
cmp dword [eax], 0xe
jl 0x1000cfeb
mov dword [ebp - 0x1e8], 0
jmp 0x1000ce5e
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x1000ce7a
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0xc8], 0xf506e60b
jmp 0x1000ce51
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc8], 0
jmp 0x1000cea8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc8], 0xffffffff
jg 0x1000cfe6
mov dword [ebp - 0x110], 0x3a3f
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x110]
cmp dword [ebp + eax - 0xc8], ecx
jge 0x1000cee7
mov dword [ebp - 0x590], 1
jmp 0x1000ceee
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0x5b1510af
jle 0x1000cf0f
cmp dword [ebp - 0x110], 0
je 0x1000cf0f
mov dword [ebp - 0x3ec], 1
jmp 0x1000cf16
and dword [ebp - 0x3ec], 0
mov esi, dword [ebp - 0x110]
mov eax, 0x89b1ab44
sub eax, dword [ebp - 0x3ec]
sub esi, eax
push 0
lea ecx, [ebp - 0x6fc]
call fcn.10016ff9
cmp esi, dword [eax]
jle 0x1000cf46
mov dword [ebp - 0x650], 1
jmp 0x1000cf4d
and dword [ebp - 0x650], 0
cmp dword [ebp - 0x650], 0xffffffff
jg 0x1000cf62
mov dword [ebp - 0x7e0], 1
jmp 0x1000cf69
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xb7c], eax
push 0
lea ecx, [ebp - 0x6fc]
call fcn.10016ff9
mov eax, dword [eax]
add eax, 8
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc8]
jl 0x1000cfa2
mov dword [ebp - 0x3f4], 1
jmp 0x1000cfa9
and dword [ebp - 0x3f4], 0
push 0
lea ecx, [ebp - 0x6fc]
call fcn.10016ff9
mov ecx, dword [ebp - 0x3f4]
imul ecx, dword [eax]
imul ecx, dword [ebp - 0x110]
mov dword [ebp - 0x7e4], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc8], 0
je 0x1000cfe1
jmp 0x1000ce8d
jmp 0x1000ce8d
jmp 0x1000ce0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6fc]
call fcn.10016ff4
mov dword [ebp - 0xb84], 0
mov dword [ebp - 0xb8c], 0
mov dword [ebp - 0xb94], 0x2a2c7c8a
mov dword [ebp - 0xb9c], 0xa1bf2b29
mov dword [ebp - 0xba4], 0xf09cc25f
push 2
lea ecx, [ebp - 0xc2c]
call fcn.10016f88
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xbac], 0
mov dword [ebp - 0x598], 0xab5457d6
mov dword [ebp - 0x4c], 0
jmp 0x1000d064
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1000d07a
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xd64], 0xffffffff
jmp 0x1000d05d
mov dword [ebp - 0x4c], 0
jmp 0x1000d08a
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1000d0a6
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xc2c]
call fcn.10016ff9
mov dword [eax], 1
jmp 0x1000d083
mov eax, dword [ebp - 0x598]
inc eax
mov dword [ebp - 0x598], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc2c]
call fcn.10016ff4
movzx eax, byte [0x14b29e90]
test eax, eax
je 0x1000d0e0
mov esi, 0x10094684
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10011508
mov dword [ebp - 0xbb4], 0x6b0f7383
mov dword [ebp - 0xbbc], 0x964a53aa
mov dword [ebp - 0xbc4], 0xfffffff6
push 1
lea ecx, [ebp - 0xc4c]
call fcn.10016f88
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xbcc], 0x2b3b7bed
mov dword [ebp - 0xbd4], 0
push 3
lea ecx, [ebp - 0xc3c]
call fcn.10016f88
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x3fc], 0x21f7d967
mov dword [ebp - 0x34], 0
jmp 0x1000d151
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1000d16d
push dword [ebp - 0x34]
lea ecx, [ebp - 0xc4c]
call fcn.10016ff9
mov dword [eax], 0x6580849f
jmp 0x1000d14a
mov dword [ebp - 0x34], 0
jmp 0x1000d17d
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1000d199
push dword [ebp - 0x34]
lea ecx, [ebp - 0xc3c]
call fcn.10016ff9
mov dword [eax], 1
jmp 0x1000d176
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc3c]
call fcn.10016ff4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4c]
call fcn.10016ff4
push 1
lea ecx, [ebp - 0x70c]
call fcn.10016f88
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x7ec], 0xfd52a42b
mov dword [ebp - 0x198], 0
jmp 0x1000d1fb
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x1000d21d
push dword [ebp - 0x198]
lea ecx, [ebp - 0x70c]
call fcn.10016ff9
mov dword [eax], 0x9f9b3198
jmp 0x1000d1ee
push 0
lea ecx, [ebp - 0x70c]
call fcn.10016ff9
mov dword [eax], 0xffffffe3
jmp 0x1000d256
push 0
lea ecx, [ebp - 0x70c]
call fcn.10016ff9
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x6b0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x6b0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x70c]
call fcn.10016ff9
cmp dword [eax], 0xe
jl 0x1000d412
mov dword [ebp - 0x228], 0
jmp 0x1000d285
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x1000d2a1
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xd0], 0xf506e60b
jmp 0x1000d278
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd0], 0
jmp 0x1000d2cf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 0xffffffff
jg 0x1000d40d
mov dword [ebp - 0x114], 0x3a3f
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x114]
cmp dword [ebp + eax - 0xd0], ecx
jge 0x1000d30e
mov dword [ebp - 0x404], 1
jmp 0x1000d315
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0x5b1510af
jle 0x1000d336
cmp dword [ebp - 0x114], 0
je 0x1000d336
mov dword [ebp - 0x5a0], 1
jmp 0x1000d33d
and dword [ebp - 0x5a0], 0
mov esi, dword [ebp - 0x114]
mov eax, 0x89b1ab44
sub eax, dword [ebp - 0x5a0]
sub esi, eax
push 0
lea ecx, [ebp - 0x70c]
call fcn.10016ff9
cmp esi, dword [eax]
jle 0x1000d36d
mov dword [ebp - 0x40c], 1
jmp 0x1000d374
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 0xffffffff
jg 0x1000d389
mov dword [ebp - 0x824], 1
jmp 0x1000d390
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xbdc], eax
push 0
lea ecx, [ebp - 0x70c]
call fcn.10016ff9
mov eax, dword [eax]
add eax, 8
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xd0]
jl 0x1000d3c9
mov dword [ebp - 0x658], 1
jmp 0x1000d3d0
and dword [ebp - 0x658], 0
push 0
lea ecx, [ebp - 0x70c]
call fcn.10016ff9
mov ecx, dword [ebp - 0x658]
imul ecx, dword [eax]
imul ecx, dword [ebp - 0x114]
mov dword [ebp - 0x7ec], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 0
je 0x1000d408
jmp 0x1000d2b4
jmp 0x1000d2b4
jmp 0x1000d232
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70c]
call fcn.10016ff4
mov dword [ebp - 0xce4], 0xa049fe38
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1000d453
push 0
push 0
push 0x885
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 0xa3], 0
movzx eax, byte [ebp - 0xa3]
test eax, eax
je 0x1000d46f
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
push 1
lea ecx, [ebp - 0x71c]
call fcn.10016f88
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x7f4], 0xfd52a42b
mov dword [ebp - 0x1a0], 0
jmp 0x1000d4a6
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 1
jge 0x1000d4c8
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x71c]
call fcn.10016ff9
mov dword [eax], 0x9f9b3198
jmp 0x1000d499
push 0
lea ecx, [ebp - 0x71c]
call fcn.10016ff9
mov dword [eax], 0xffffffe3
jmp 0x1000d501
push 0
lea ecx, [ebp - 0x71c]
call fcn.10016ff9
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x414]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x414]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x71c]
call fcn.10016ff9
cmp dword [eax], 0xe
jl 0x1000d6bd
mov dword [ebp - 0x1f0], 0
jmp 0x1000d530
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x1000d54c
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0xd8], 0xf506e60b
jmp 0x1000d523
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd8], 0
jmp 0x1000d57a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd8], 0xffffffff
jg 0x1000d6b8
mov dword [ebp - 0x11c], 0x3a3f
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x11c]
cmp dword [ebp + eax - 0xd8], ecx
jge 0x1000d5b9
mov dword [ebp - 0x5a8], 1
jmp 0x1000d5c0
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x5a8], 0x5b1510af
jle 0x1000d5e1
cmp dword [ebp - 0x11c], 0
je 0x1000d5e1
mov dword [ebp - 0x41c], 1
jmp 0x1000d5e8
and dword [ebp - 0x41c], 0
mov esi, dword [ebp - 0x11c]
mov eax, 0x89b1ab44
sub eax, dword [ebp - 0x41c]
sub esi, eax
push 0
lea ecx, [ebp - 0x71c]
call fcn.10016ff9
cmp esi, dword [eax]
jle 0x1000d618
mov dword [ebp - 0x6e0], 1
jmp 0x1000d61f
and dword [ebp - 0x6e0], 0
cmp dword [ebp - 0x6e0], 0xffffffff
jg 0x1000d634
mov dword [ebp - 0x82c], 1
jmp 0x1000d63b
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xcec], eax
push 0
lea ecx, [ebp - 0x71c]
call fcn.10016ff9
mov eax, dword [eax]
add eax, 8
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xd8]
jl 0x1000d674
mov dword [ebp - 0x424], 1
jmp 0x1000d67b
and dword [ebp - 0x424], 0
push 0
lea ecx, [ebp - 0x71c]
call fcn.10016ff9
mov ecx, dword [ebp - 0x424]
imul ecx, dword [eax]
imul ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x7f4], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd8], 0
je 0x1000d6b3
jmp 0x1000d55f
jmp 0x1000d55f
jmp 0x1000d4dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x71c]
call fcn.10016ff4
push 2
lea ecx, [ebp - 0x2b4]
call fcn.10016f88
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x454], 0xfa7ad11e
mov dword [ebp - 0x474], 0x845925f8
mov dword [ebp - 0xcf4], 0x9e46
mov dword [ebp - 0x54], 0
jmp 0x1000d715
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1000d731
push dword [ebp - 0x54]
lea ecx, [ebp - 0x2b4]
call fcn.10016ff9
mov dword [eax], 0x6240
jmp 0x1000d70e
mov dword [ebp - 0x54], 0
jmp 0x1000d741
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x1000d757
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x258], 0xfffffff6
jmp 0x1000d73a
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1000d771
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0x10], 1
jmp 0x1000d781
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1000dd0c
mov dword [ebp - 0xa28], 1
mov dword [ebp - 0xa24], 1
mov dword [ebp - 0xa20], 1
mov dword [ebp - 0xa1c], 1
lea ecx, [ebp - 0x289]
call fcn.1000b1a3
push eax
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0xa28]
push eax
lea ecx, [ebp - 0xd1c]
call fcn.10017008
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x768]
call fcn.10016fca
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x6b8], 0xa9e1a0
mov dword [ebp - 0x104], 0xfffffff8
mov dword [ebp - 0x668], 0
push 3
lea ecx, [ebp - 0xa4c]
call fcn.10016f88
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x5d0], 4
mov dword [ebp - 0x1a8], 0
jmp 0x1000d83e
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x1000d860
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0xa4c]
call fcn.10016ff9
mov dword [eax], 1
jmp 0x1000d831
push 0
lea ecx, [ebp - 0x768]
call fcn.10016ff9
and dword [eax], 0
jmp 0x1000d896
push 0
lea ecx, [ebp - 0x768]
call fcn.10016ff9
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp - 0x5b0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5b0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x768]
call fcn.10016ff9
cmp dword [eax], 1
jg 0x1000dce9
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x45c], 0xb41ce094
mov dword [ebp - 0x218], 0
jmp 0x1000d8d9
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x1000d8f5
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x9a4], 0x5d9c72
jmp 0x1000d8cc
mov esi, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x768]
call fcn.10016ff9
cmp esi, dword [eax]
jl 0x1000d915
mov dword [ebp - 0x42c], 1
jmp 0x1000d91c
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 0xfff7
jbe 0x1000d940
mov dword [ebp - 0x250], 1
jmp 0x1000d947
and dword [ebp - 0x250], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x250]
mov dword [ebp + eax - 0x9a4], ecx
cmp dword [ebp - 0x250], 0
jne 0x1000d972
cmp dword [ebp - 0x10], 0
jne 0x1000d972
and dword [ebp - 0x434], 0
jmp 0x1000d97c
mov dword [ebp - 0x434], 1
cmp dword [ebp - 0x434], 0x5329
jne 0x1000d98c
cmp dword [ebp - 0x10], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.10016ff9
mov eax, dword [eax]
add eax, 0xfffe
cmp eax, dword [ebp - 0x10]
jl 0x1000d9b2
mov dword [ebp - 0x5b8], 1
jmp 0x1000d9b9
and dword [ebp - 0x5b8], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.10016ff9
mov ecx, dword [ebp - 0x5b8]
cmp ecx, dword [eax]
jg 0x1000d9dd
mov dword [ebp - 0x43c], 1
jmp 0x1000d9e4
and dword [ebp - 0x43c], 0
push 1
lea ecx, [ebp - 0x2b4]
call fcn.10016ff9
mov ecx, dword [ebp - 0x43c]
sub ecx, dword [eax]
mov dword [ebp - 0x6b8], ecx
mov esi, dword [ebp - 0x6b8]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.10016ff9
cmp dword [eax], esi
je 0x1000da23
mov dword [ebp - 0x444], 1
jmp 0x1000da2a
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x444], eax
jl 0x1000da44
mov dword [ebp - 0x5c0], 1
jmp 0x1000da4b
and dword [ebp - 0x5c0], 0
push 2
lea ecx, [ebp - 0x768]
call fcn.10016ff9
mov ecx, dword [ebp - 0x5c0]
cmp ecx, dword [eax]
jne 0x1000da6e
mov dword [ebp - 0x44c], 1
jmp 0x1000da75
and dword [ebp - 0x44c], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.10016ff9
mov ecx, dword [ebp - 0x44c]
add ecx, dword [eax]
mov dword [ebp - 0x668], ecx
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0x3de37d66
jge 0x1000dab5
mov dword [ebp - 0x280], 1
jmp 0x1000dabc
and dword [ebp - 0x280], 0
push 0
lea ecx, [ebp - 0xa4c]
call fcn.10016ff9
mov ecx, dword [ebp - 0x280]
mov dword [eax], ecx
cmp dword [ebp - 0x280], 0
je 0x1000daef
mov eax, 0xa955
test eax, eax
je 0x1000daef
mov dword [ebp - 0x5c8], 1
jmp 0x1000daf6
and dword [ebp - 0x5c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x258]
add eax, dword [ebp - 0x5c8]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x258]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0xffff
ja 0x1000db35
mov dword [ebp - 0x710], 1
jmp 0x1000db3c
and dword [ebp - 0x710], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.10016ff9
mov esi, dword [eax]
imul esi, dword [ebp - 0x710]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.10016ff9
cmp esi, dword [eax]
jle 0x1000db71
mov dword [ebp - 0x464], 1
jmp 0x1000db78
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x5d0], eax
jl 0x1000db9e
mov dword [ebp - 0x46c], 1
jmp 0x1000dba5
and dword [ebp - 0x46c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x258]
cmp dword [ebp - 0x46c], eax
jge 0x1000dbc6
mov dword [ebp - 0x670], 1
jmp 0x1000dbcd
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x474], eax
mov esi, dword [ebp - 0x474]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.10016ff9
cmp dword [eax], esi
jge 0x1000dbfd
mov dword [ebp - 0x5d8], 1
jmp 0x1000dc04
and dword [ebp - 0x5d8], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.10016ff9
mov ecx, dword [ebp - 0x5d8]
cmp ecx, dword [eax]
jg 0x1000dc28
mov dword [ebp - 0x47c], 1
jmp 0x1000dc2f
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
add eax, 0xfff9
je 0x1000dcd2
mov dword [ebp - 0x1b0], 0
jmp 0x1000dc59
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x1000dc75
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0xc5c], 0xffff
jmp 0x1000dc4c
mov byte [ebp - 0xa7], 0
movzx eax, byte [ebp - 0xa7]
test eax, eax
je 0x1000dc91
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov dword [ebp - 0x104], 1
jmp 0x1000dcaa
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jl 0x1000dcd0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc5c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc5c], eax
jmp 0x1000dc9d
jmp 0x1000dce4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9a4], 0
je 0x1000dce4
jmp 0x1000dce9
jmp 0x1000d872
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa4c]
call fcn.10016ff4
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x768]
call fcn.10016ff4
jmp 0x1000d77a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b4]
call fcn.10016ff4
mov dword [ebp - 0xcfc], 0x10094684
mov dword [ebp - 0xd04], 0x10094688
mov dword [ebp - 0x834], 1
push 3
lea ecx, [ebp - 0xa7c]
call fcn.10016f88
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x1f8], 0
jmp 0x1000dd66
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x1000dd88
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xa7c]
call fcn.10016ff9
mov dword [eax], 5
jmp 0x1000dd59
mov esi, dword [ebp - 0x834]
push 0
lea ecx, [ebp - 0xa7c]
call fcn.10016ff9
mov dword [eax], esi
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1000ddc8
push 0
push 0x160a
push 0xd71
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa7c]
call fcn.10016ff4
mov dword [ebp - 0xd0c], 0x6b0f7383
mov dword [ebp - 0xd14], 0x964a53aa
mov dword [ebp - 0xd10], 0xfffffff6
push 1
lea ecx, [ebp - 0xc7c]
call fcn.10016f88
mov dword [ebp - 4], 0x15
mov dword [ebp - 0xaac], 0x2b3b7bed
mov dword [ebp - 0xa98], 0
push 3
lea ecx, [ebp - 0xc6c]
call fcn.10016f88
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x6c0], 0x21f7d967
mov dword [ebp - 0x78], 0
jmp 0x1000de48
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1000de64
push dword [ebp - 0x78]
lea ecx, [ebp - 0xc7c]
call fcn.10016ff9
mov dword [eax], 0x6580849f
jmp 0x1000de41
mov dword [ebp - 0x78], 0
jmp 0x1000de74
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1000de90
push dword [ebp - 0x78]
lea ecx, [ebp - 0xc6c]
call fcn.10016ff9
mov dword [eax], 1
jmp 0x1000de6d
mov eax, dword [ebp - 0x6c0]
inc eax
mov dword [ebp - 0x6c0], eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xc6c]
call fcn.10016ff4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc7c]
call fcn.10016ff4
mov dword [ebp - 0x810], 1
mov dword [ebp - 0xb98], 2
mov dword [ebp - 0x910], 0xffffffff
mov dword [ebp - 0x1b8], 0xc5021c3a
mov dword [ebp - 0x8a8], 0x1a7ecc24
mov dword [ebp - 0xaa0], 0xddcd1665
mov dword [ebp - 0x8a0], 0
mov dword [ebp - 0xc50], 0xd95da228
mov dword [ebp - 0xaa8], 0x7f609b2b
mov dword [ebp - 0x5f0], 0x885ea6ed
mov dword [ebp - 0xba0], 0xe7528ace
mov dword [ebp - 0x800], 0x8ea5f34b
mov dword [ebp - 0xab0], 0xffffffff
mov dword [ebp - 0xcd0], 0x753f3ac9
mov dword [ebp - 0xab8], 0
mov dword [ebp - 0x83c], 0x7b30498
mov dword [ebp - 0xba8], 0xfffffffd
mov dword [ebp - 0x494], 8
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0xac0], 0
mov dword [ebp - 0x808], 0xcc321a07
mov dword [ebp - 0x5c], 0
jmp 0x1000df9d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1000dfb3
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xc60], 0xcce45d76
jmp 0x1000df96
mov dword [ebp - 0x5c], 0
jmp 0x1000dfc3
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1000dfd9
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x9c4], 0x34ccbb24
jmp 0x1000dfbc
cmp dword [ebp - 0x83c], 0xfffffff9
jle 0x1000dfee
mov dword [ebp - 0x484], 1
jmp 0x1000dff5
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x800]
cmp eax, dword [ebp - 0x484]
jle 0x1000e00f
mov dword [ebp - 0x5e0], 1
jmp 0x1000e016
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 0xfddf
jle 0x1000e02e
mov dword [ebp - 0x48c], 1
jmp 0x1000e035
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x8a0], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0xac8], eax
cmp dword [ebp - 0x1b8], 0xa1804524
je 0x1000e071
mov dword [ebp - 0x678], 1
jmp 0x1000e078
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x678]
sub eax, dword [ebp - 0x910]
cmp dword [ebp - 0x494], eax
jl 0x1000e0a4
mov dword [ebp - 0x49c], 1
jmp 0x1000e0ab
and dword [ebp - 0x49c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9c4]
inc eax
mov dword [ebp - 0x5e8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5e8]
mov dword [ebp + eax - 0x9c4], ecx
mov eax, dword [ebp - 0x5e8]
cmp eax, dword [ebp - 0x49c]
jg 0x1000e0ec
mov dword [ebp - 0x6f0], 1
jmp 0x1000e0f3
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x810]
cmp eax, dword [ebp - 0x6f0]
jge 0x1000e10d
mov dword [ebp - 0x4a4], 1
jmp 0x1000e114
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebp - 0x5f0]
dec eax
dec eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0x5d07a051
jle 0x1000e146
mov dword [ebp - 0x680], 1
jmp 0x1000e14d
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x8a8], eax
mov dword [ebp - 0xa8c], 0x6b0f7383
mov dword [ebp - 0xad0], 0x964a53aa
mov dword [ebp - 0xcf8], 0xfffffff6
push 1
lea ecx, [ebp - 0xc9c]
call fcn.10016f88
mov dword [ebp - 4], 0x17
mov dword [ebp - 0xad8], 0x2b3b7bed
mov dword [ebp - 0xbb8], 0
push 3
lea ecx, [ebp - 0xc8c]
call fcn.10016f88
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x4b4], 0x21f7d967
mov dword [ebp - 0x6c], 0
jmp 0x1000e1ca
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1000e1e6
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xc9c]
call fcn.10016ff9
mov dword [eax], 0x6580849f
jmp 0x1000e1c3
mov dword [ebp - 0x6c], 0
jmp 0x1000e1f6
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1000e212
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xc8c]
call fcn.10016ff9
mov dword [eax], 1
jmp 0x1000e1ef
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xc8c]
call fcn.10016ff4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc9c]
call fcn.10016ff4
mov dword [ebp - 0x200], 0x52cb1363
mov dword [ebp - 0x260], 0
push 2
lea ecx, [ebp - 0x8ec]
call fcn.10016f88
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x2a0], 0x18c84b7b
mov dword [ebp - 0x600], 0
mov dword [ebp - 0x238], 0
jmp 0x1000e292
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x1000e2b4
push dword [ebp - 0x238]
lea ecx, [ebp - 0x8ec]
call fcn.10016ff9
mov dword [eax], 7
jmp 0x1000e285
mov byte [ebp - 0xab], 0
movzx eax, byte [ebp - 0xab]
test eax, eax
je 0x1000e2ce
push 0
call dword [sym.imp.USER32.dll_CharNextW]
cmp dword [ebp - 0x200], 0xcf54c3c6
ja 0x1000e52a
mov dword [ebp - 0x5f8], 1
mov dword [ebp - 0x4c4], 0xffffffff
mov dword [ebp - 0x95c], 0xffffffff
mov dword [ebp - 0x4dc], 0xfffffffd
push 1
lea ecx, [ebp - 0x798]
call fcn.10016f88
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x1c0], 0
jmp 0x1000e330
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x1000e34f
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x798]
call fcn.10016ff9
and dword [eax], 0
jmp 0x1000e323
cmp dword [ebp - 0x5f8], 0
je 0x1000e36d
cmp dword [ebp - 0x5f8], 0
je 0x1000e36d
mov dword [ebp - 0x818], 1
jmp 0x1000e374
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x4c4], eax
je 0x1000e38e
mov dword [ebp - 0x4d4], 1
jmp 0x1000e395
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x4bc], eax
push 0
lea ecx, [ebp - 0x8ec]
call fcn.10016ff9
mov ecx, dword [ebp - 0x4bc]
mov dword [eax], ecx
cmp dword [ebp - 0x4bc], 0
jne 0x1000e439
push 0
lea ecx, [ebp - 0x798]
call fcn.10016ff9
imul eax, dword [eax], 0
test eax, eax
jne 0x1000e3f2
cmp dword [ebp - 0x600], 0
jne 0x1000e3f2
and dword [ebp - 0x6c8], 0
jmp 0x1000e3fc
mov dword [ebp - 0x6c8], 1
mov eax, dword [ebp - 0x4dc]
imul eax, dword [ebp - 0x6c8]
test eax, eax
jne 0x1000e41a
push 0
lea ecx, [ebp - 0x8ec]
call fcn.10016ff9
push 0
lea ecx, [ebp - 0x798]
call fcn.10016ff9
cmp dword [ebp - 0x4c4], 0
jne 0x1000e439
and dword [ebp - 0x4cc], 0
jmp 0x1000e443
mov dword [ebp - 0x4cc], 1
mov esi, dword [ebp - 0x600]
add esi, dword [ebp - 0x4cc]
push 0
lea ecx, [ebp - 0x798]
call fcn.10016ff9
imul esi, dword [eax]
cmp esi, 0xffff
je 0x1000e473
mov dword [ebp - 0x688], 1
jmp 0x1000e47a
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x688]
sub eax, dword [ebp - 0x260]
cmp dword [ebp - 0x4d4], eax
jle 0x1000e49a
mov dword [ebp - 0x608], 1
jmp 0x1000e4a1
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x95c]
cmp dword [ebp - 0x260], eax
jg 0x1000e4d0
cmp dword [ebp - 0x4dc], 0
je 0x1000e4d0
mov dword [ebp - 0x820], 1
jmp 0x1000e4d7
and dword [ebp - 0x820], 0
push 0
lea ecx, [ebp - 0x798]
call fcn.10016ff9
push 0
lea ecx, [ebp - 0x8ec]
call fcn.10016ff9
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x200], eax
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x1000e519
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x798]
call fcn.10016ff4
jmp 0x1000e557
mov dword [ebp - 0x288], 0x79a97a8d
mov dword [ebp - 0x8b0], 0xffffffff
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x8b0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8ec]
call fcn.10016ff4
mov dword [ebp - 0xae0], 0xa049fe38
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x1000e598
push 0
push 0
push 0x885
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x1000e5b4
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov dword [ebp - 0x508], 0x7c7c
mov dword [ebp - 0xe8], 8
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x508], 0xffffffff
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x124], 0
jmp 0x1000e60d
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x19
je 0x1000e65d
mov dword [ebp - 0xe8], 0
jmp 0x1000e62f
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xffffffea
jle 0x1000e65b
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x1000e659
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
jmp 0x1000e622
jmp 0x1000e600
mov byte [0x14b29e90], 1
push 2
lea ecx, [ebp - 0x2c4]
call fcn.10016f88
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x2e0], 0xfa7ad11e
mov dword [ebp - 0x320], 0x845925f8
mov dword [ebp - 0xc70], 0x9e46
mov dword [ebp - 0x38], 0
jmp 0x1000e6ad
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1000e6c9
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2c4]
call fcn.10016ff9
mov dword [eax], 0x6240
jmp 0x1000e6a6
mov dword [ebp - 0x38], 0
jmp 0x1000e6d9
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000e6ef
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x270], 0xfffffff6
jmp 0x1000e6d2
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1000e709
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0x18], 1
jmp 0x1000e719
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1000eca4
mov dword [ebp - 0xa14], 1
mov dword [ebp - 0xa10], 1
mov dword [ebp - 0xa0c], 1
mov dword [ebp - 0xa08], 1
lea ecx, [ebp - 0x2a1]
call fcn.1000b1a3
push eax
lea eax, [ebp - 0xa04]
push eax
lea eax, [ebp - 0xa14]
push eax
lea ecx, [ebp - 0xd4c]
call fcn.10017008
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x780]
call fcn.10016fca
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x4fc], 0xa9e1a0
mov dword [ebp - 0xf0], 0xfffffff8
mov dword [ebp - 0x2d8], 0
push 3
lea ecx, [ebp - 0xa64]
call fcn.10016f88
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x308], 4
mov dword [ebp - 0x1c8], 0
jmp 0x1000e7d6
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x1000e7f8
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0xa64]
call fcn.10016ff9
mov dword [eax], 1
jmp 0x1000e7c9
push 0
lea ecx, [ebp - 0x780]
call fcn.10016ff9
and dword [eax], 0
jmp 0x1000e82e
push 0
lea ecx, [ebp - 0x780]
call fcn.10016ff9
cmp dword [eax], 1
jg 0x1000ec81
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x2f0], 0xb41ce094
mov dword [ebp - 0x148], 0
jmp 0x1000e871
cmp dword [ebp - 0x148], 2
jge 0x1000e88d
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xa64]
call fcn.10016ff4
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x780]
call fcn.10016ff4
jmp 0x1000e712
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c4]
call fcn.10016ff4
mov dword [ebp - 0xae8], 0xa049fe38
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1000ece5
push 0
push 0
push 0x885
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1000ed01
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
push 1
lea ecx, [ebp - 0x75c]
call fcn.10016f88
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x348], 0x214a9bac
mov dword [ebp - 0x40], 0
jmp 0x1000ed2f
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1000ed45
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x828], 0xc85f
jmp 0x1000ed28
mov dword [ebp - 0x40], 0
jmp 0x1000ed55
cmp dword [ebp - 0x40], 1
jge 0x1000ed71
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret