Function at 0x100094fc
Capabilities:
Get session user name
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd28
push esi
push edi
mov dword [ebp - 0x98], 0xd9ed
mov dword [ebp - 0x8cc], 8
mov dword [ebp - 0x8c8], 8
mov dword [ebp - 0x8c4], 8
mov dword [ebp - 0x8c0], 8
mov dword [ebp - 0x2a8], 0
jmp 0x10009552
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x1000956e
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0x76c], 0xd9e2a8d3
jmp 0x10009545
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa24], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x76c], 0xfffffff9
jg 0x10009591
cmp dword [ebp - 0x98], 0
mov eax, 0x5ab3
cmp eax, 1
jbe 0x100095a7
mov dword [ebp - 0x350], 1
jmp 0x100095ae
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x350]
cmp eax, 0xffffffff
jne 0x100095cb
mov dword [ebp - 0x700], 1
jmp 0x100095d2
and dword [ebp - 0x700], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x76c]
cmp dword [ebp - 0x700], eax
je 0x100095f3
mov dword [ebp - 0x52c], 1
jmp 0x100095fa
and dword [ebp - 0x52c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x52c]
mov dword [ebp + eax - 0x8cc], ecx
mov dword [ebp - 0x98], 1
jmp 0x10009625
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x10009739
mov dword [ebp - 0x560], 0x3c5ad058
mov dword [ebp - 0x7c0], 0xffffffff
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x76c], 0
jne 0x100096ab
cmp dword [ebp - 0x98], 0
jne 0x1000968c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x76c]
mov dword [ebp - 0x9c8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x8cc]
neg eax
jne 0x1000968c
and dword [ebp - 0x6f8], 0
jmp 0x10009696
mov dword [ebp - 0x6f8], 1
cmp dword [ebp - 0x6f8], 0x1ea0
jge 0x100096ab
and dword [ebp - 0x304], 0
jmp 0x100096b5
mov dword [ebp - 0x304], 1
mov eax, dword [ebp - 0x560]
add eax, dword [ebp - 0x304]
cmp eax, 0xe58e
je 0x100096dd
mov eax, 0xbd2f
test eax, eax
je 0x100096dd
mov dword [ebp - 0x568], 1
jmp 0x100096e4
and dword [ebp - 0x568], 0
cmp dword [ebp - 0x568], 4
jl 0x100096f9
mov dword [ebp - 0x30c], 1
jmp 0x10009700
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0x20225168
je 0x10009721
cmp dword [ebp - 0x560], 0
je 0x10009721
mov dword [ebp - 0x314], 1
jmp 0x10009728
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x7c0], eax
jmp 0x10009618
mov dword [ebp - 8], 0xfffffff8
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x38], 0
jmp 0x10009757
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1000976d
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x774], 0xffffffff
jmp 0x10009750
mov dword [ebp - 0x38], 0
jmp 0x1000977d
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10009793
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x294], 0x11d7feae
jmp 0x10009776
mov eax, dword [ebp - 8]
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x9d8], eax
mov eax, 0xc54c9751
test eax, eax
je 0x100097c0
cmp dword [ebp - 8], 0
je 0x100097c0
mov dword [ebp - 0x68c], 1
jmp 0x100097c7
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x68c], eax
je 0x100097de
mov dword [ebp - 0x31c], 1
jmp 0x100097e5
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x31c], eax
jle 0x100097fc
mov dword [ebp - 0x534], 1
jmp 0x10009803
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
sub eax, dword [ebp - 8]
cmp eax, 1
jb 0x1000981d
mov dword [ebp - 0x324], 1
jmp 0x10009824
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
add eax, 0x19f23e52
cmp eax, dword [ebp - 8]
jg 0x10009840
mov dword [ebp - 0x61c], 1
jmp 0x10009847
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x10], eax
jle 0x10009864
mov dword [ebp - 0x32c], 1
jmp 0x1000986b
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x32c]
sub eax, 0x716b
cmp eax, dword [ebp - 8]
jl 0x10009887
mov dword [ebp - 0x53c], 1
jmp 0x1000988e
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x53c], eax
jl 0x100098ac
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x100098ac
mov dword [ebp - 0x334], 1
jmp 0x100098b3
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x334], eax
jg 0x100098ca
mov dword [ebp - 0x2ac], 1
jmp 0x100098d1
and dword [ebp - 0x2ac], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp + eax - 0x774], ecx
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x2ac], eax
jg 0x100098fb
mov dword [ebp - 0x6e4], 1
jmp 0x10009902
and dword [ebp - 0x6e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x294]
cmp dword [ebp - 0x6e4], eax
je 0x10009923
mov dword [ebp - 0x33c], 1
jmp 0x1000992a
and dword [ebp - 0x33c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x294]
cmp dword [ebp - 0x33c], eax
je 0x1000994b
mov dword [ebp - 0x544], 1
jmp 0x10009952
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x544]
mov dword [ebp + eax - 0x294], ecx
mov dword [ebp - 8], 0x14
jmp 0x10009975
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
je 0x10009aec
mov dword [ebp - 0x880], 5
mov dword [ebp - 0x10], 1
jmp 0x10009999
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10009ae7
mov dword [ebp - 0x134], 0x5243b9c3
mov dword [ebp - 0x848], 1
mov dword [ebp - 0x134], 1
jmp 0x100099d0
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x10009ad3
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x294]
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x774], 0
je 0x10009a50
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x294]
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x294]
mov dword [ebp - 0x9f0], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0xa00], eax
mov eax, 0x63f
test eax, eax
je 0x10009a50
mov eax, 0x34bd
test eax, eax
je 0x10009a50
mov dword [ebp - 0x344], 1
jmp 0x10009a57
and dword [ebp - 0x344], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x344]
sub ecx, dword [ebp + eax - 0x774]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x774]
jle 0x10009a85
mov dword [ebp - 0x624], 1
jmp 0x10009a8c
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x294]
imul eax, dword [ebp - 0x624]
cmp eax, dword [ebp - 0x848]
jle 0x10009ab1
mov dword [ebp - 0x34c], 1
jmp 0x10009ab8
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
sub eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x294], eax
jmp 0x100099c3
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x294], 0
je 0x10009ae2
jmp 0x10009ae7
jmp 0x10009992
jmp 0x1000996e
mov dword [ebp - 0xc8], 0xd9ed
mov dword [ebp - 0x8ec], 8
mov dword [ebp - 0x8e8], 8
mov dword [ebp - 0x8e4], 8
mov dword [ebp - 0x8e0], 8
mov dword [ebp - 0x298], 0
jmp 0x10009b37
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 2
jge 0x10009b53
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0x784], 0xd9e2a8d3
jmp 0x10009b2a
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xa08], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x784], 0xfffffff9
jg 0x10009b76
cmp dword [ebp - 0xc8], 0
mov eax, 0x5ab3
cmp eax, 1
jbe 0x10009b8c
mov dword [ebp - 0x54c], 1
jmp 0x10009b93
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0x54c]
cmp eax, 0xffffffff
jne 0x10009bb0
mov dword [ebp - 0x354], 1
jmp 0x10009bb7
and dword [ebp - 0x354], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x784]
cmp dword [ebp - 0x354], eax
je 0x10009bd8
mov dword [ebp - 0x694], 1
jmp 0x10009bdf
and dword [ebp - 0x694], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x694]
mov dword [ebp + eax - 0x8ec], ecx
mov dword [ebp - 0xc8], 1
jmp 0x10009c0a
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x10009d1e
mov dword [ebp - 0x36c], 0x3c5ad058
mov dword [ebp - 0x7bc], 0xffffffff
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x784], 0
jne 0x10009c90
cmp dword [ebp - 0xc8], 0
jne 0x10009c71
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x784]
mov dword [ebp - 0xa10], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x8ec]
neg eax
jne 0x10009c71
and dword [ebp - 0x35c], 0
jmp 0x10009c7b
mov dword [ebp - 0x35c], 1
cmp dword [ebp - 0x35c], 0x1ea0
jge 0x10009c90
and dword [ebp - 0x554], 0
jmp 0x10009c9a
mov dword [ebp - 0x554], 1
mov eax, dword [ebp - 0x36c]
add eax, dword [ebp - 0x554]
cmp eax, 0xe58e
je 0x10009cc2
mov eax, 0xbd2f
test eax, eax
je 0x10009cc2
mov dword [ebp - 0x364], 1
jmp 0x10009cc9
and dword [ebp - 0x364], 0
cmp dword [ebp - 0x364], 4
jl 0x10009cde
mov dword [ebp - 0x62c], 1
jmp 0x10009ce5
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 0x20225168
je 0x10009d06
cmp dword [ebp - 0x36c], 0
je 0x10009d06
mov dword [ebp - 0x55c], 1
jmp 0x10009d0d
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x7bc], eax
jmp 0x10009bfd
mov dword [ebp - 0xa8], 0x5c8094a1
mov dword [ebp - 0x7b8], 1
mov dword [ebp - 0xa18], 0xfffffff9
mov dword [ebp - 0x1b0], 0
jmp 0x10009d55
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jge 0x10009d71
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x89c], 0xf9b3
jmp 0x10009d48
mov dword [ebp - 0xa8], 1
jmp 0x10009d8a
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x10009efb
mov dword [ebp - 0x108], 0xb0ceafd9
mov dword [ebp - 0x108], 1
jmp 0x10009dba
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x10009ef6
cmp dword [ebp - 0xa8], 0
je 0x10009dec
mov eax, dword [ebp - 0xa8]
cmp dword [ebp + eax*4 - 0x89c], 0
je 0x10009dec
mov dword [ebp - 0x374], 1
jmp 0x10009df3
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x374], eax
jge 0x10009e0d
mov dword [ebp - 0x6cc], 1
jmp 0x10009e14
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x6cc], eax
jne 0x10009e2e
mov dword [ebp - 0x37c], 1
jmp 0x10009e35
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x37c], eax
jg 0x10009e4f
mov dword [ebp - 0x564], 1
jmp 0x10009e56
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x89c]
cmp eax, dword [ebp - 0x564]
jg 0x10009e77
mov dword [ebp - 0x384], 1
jmp 0x10009e7e
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0xffffffff
je 0x10009e99
mov eax, 0x48bd921b
test eax, eax
jne 0x10009e99
and dword [ebp - 0x634], 0
jmp 0x10009ea3
mov dword [ebp - 0x634], 1
mov eax, dword [ebp - 0x634]
sub eax, dword [ebp - 0xa8]
jne 0x10009ec3
mov eax, 0xbd13d8c5
test eax, eax
jne 0x10009ec3
and dword [ebp - 0x38c], 0
jmp 0x10009ecd
mov dword [ebp - 0x38c], 1
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7b8], eax
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x10009ef1
call dword [sym.imp.USER32.dll_CreatePopupMenu]
jmp 0x10009dad
jmp 0x10009d7d
mov dword [ebp - 0xb0], 0xd9ed
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x7c8], 0xfffffff6
mov dword [ebp - 0x6c], 0x8dee21af
mov dword [ebp - 0x2a0], 0
jmp 0x10009f39
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jge 0x10009f55
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x73c], 2
jmp 0x10009f2c
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x73c]
mov dword [ebp - 0xa20], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x73c], 0xffff5079
jge 0x10009f97
mov eax, 0xfa97
test eax, eax
je 0x10009f97
mov dword [ebp - 0x56c], 1
jmp 0x10009f9e
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x12c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x12c]
cmp dword [ebp + eax - 0x73c], ecx
jl 0x10009fcb
mov dword [ebp - 0x394], 1
jmp 0x10009fd2
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x7c8]
cmp dword [ebp - 0x394], eax
jl 0x10009fec
mov dword [ebp - 0x69c], 1
jmp 0x10009ff3
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 0xffffffff
jg 0x1000a008
mov dword [ebp - 0x39c], 1
jmp 0x1000a00f
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x39c]
jle 0x1000a029
mov dword [ebp - 0x574], 1
jmp 0x1000a030
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0xeae21516
jb 0x1000a048
mov dword [ebp - 0x3a4], 1
jmp 0x1000a04f
and dword [ebp - 0x3a4], 0
cmp dword [ebp - 0x3a4], 0x732adaa2
jne 0x1000a067
mov dword [ebp - 0x63c], 1
jmp 0x1000a06e
and dword [ebp - 0x63c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x73c]
cmp dword [ebp - 0x63c], eax
jge 0x1000a0a3
cmp dword [ebp - 0x6c], 0
je 0x1000a0a3
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x1000a0a1
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x1000a119
mov dword [ebp - 0x7d0], 0x3e1b
mov dword [ebp - 0x6c], 0
jmp 0x1000a0bd
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x2e
jle 0x1000a119
mov dword [ebp - 0x12c], 0
jmp 0x1000a0dc
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x1a
je 0x1000a0f1
mov dword [ebp - 0x7d0], 0
jmp 0x1000a0cf
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x1000a117
push 0x116a
push 0
push 0x1a13
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x1000a0b6
mov dword [ebp - 0x904], 8
mov dword [ebp - 0x900], 8
mov dword [ebp - 0x8fc], 8
mov dword [ebp - 0x8f8], 8
mov dword [ebp - 0x16c], 6
mov dword [ebp - 0x174], 0xf07c70ab
mov dword [ebp - 0xc0], 0xb5411457
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x258], 0
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x1000a19b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov eax, dword [ebp - 0x16c]
neg eax
imul eax, dword [ebp - 0x16c]
test eax, eax
je 0x1000a1c3
mov eax, 0xe2bbef7d
test eax, eax
je 0x1000a1c3
mov dword [ebp - 0x3ac], 1
jmp 0x1000a1ca
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x3ac], eax
jl 0x1000a1e4
mov dword [ebp - 0x3bc], 1
jmp 0x1000a1eb
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x174], eax
jge 0x1000a205
mov dword [ebp - 0x57c], 1
jmp 0x1000a20c
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x174], eax
je 0x1000a232
mov dword [ebp - 0x3b4], 1
jmp 0x1000a239
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x3b4], eax
jne 0x1000a253
mov dword [ebp - 0x6f4], 1
jmp 0x1000a25a
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
sub eax, dword [ebp - 0x110]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x110], eax
jg 0x1000a292
mov dword [ebp - 0x7d8], 1
jmp 0x1000a299
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0xc0]
sub eax, dword [ebp - 0x258]
cmp dword [ebp - 0x16c], eax
je 0x1000a459
mov dword [ebp - 0x7e8], 0x93f0
mov dword [ebp - 0x1b8], 0
jmp 0x1000a2e0
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jge 0x1000a2fc
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x77c], 0xfffffffc
jmp 0x1000a2d3
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x110], eax
je 0x1000a316
mov dword [ebp - 0x3c4], 1
jmp 0x1000a31d
and dword [ebp - 0x3c4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x77c], 0
je 0x1000a336
mov eax, 0x6a77d77f
test eax, eax
jne 0x1000a34f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x77c], 0
jne 0x1000a34f
and dword [ebp - 0x584], 0
jmp 0x1000a359
mov dword [ebp - 0x584], 1
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x584], eax
jl 0x1000a373
mov dword [ebp - 0x7e0], 1
jmp 0x1000a37a
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xa28], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xa30], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x77c]
mov dword [ebp - 0xa38], eax
cmp dword [ebp - 0xc0], 0x6add
jne 0x1000a3bd
mov dword [ebp - 0x644], 1
jmp 0x1000a3c4
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x644]
jge 0x1000a3de
mov dword [ebp - 0x3cc], 1
jmp 0x1000a3e5
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x174]
imul eax, dword [ebp - 0x3cc]
test eax, eax
je 0x1000a40b
cmp dword [ebp - 0x7e8], 0
je 0x1000a40b
mov dword [ebp - 0x58c], 1
jmp 0x1000a412
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x258]
imul eax, dword [ebp - 0x58c]
cmp eax, dword [ebp - 0x110]
jle 0x1000a433
mov dword [ebp - 0x7f0], 1
jmp 0x1000a43a
and dword [ebp - 0x7f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x77c]
mov dword [ebp - 0xa40], eax
mov dword [ebp - 0xc0], 0x395cc9e5
jmp 0x1000a499
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x1000a47a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1000a499
push 0
push 0x27d
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov dword [ebp - 0x1c0], 0
jmp 0x1000a4b2
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x1000a4ce
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x74c], 0xd9e2a8d3
jmp 0x1000a4a5
mov dword [ebp - 0x7f8], 0xffffffff
mov dword [ebp - 0x280], 0
jmp 0x1000a4f1
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jge 0x1000a50d
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0xc70], 0xffffffff
jmp 0x1000a4e4
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1000a538
push 0x17e8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc70]
mov dword [ebp - 0xa48], eax
mov dword [ebp - 0x7f8], 0x3638ecf5
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xa50], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x74c], 0xfffffff9
jg 0x1000a578
cmp dword [ebp - 0xb0], 0
mov eax, 0x5ab3
cmp eax, 1
jbe 0x1000a58e
mov dword [ebp - 0x3d4], 1
jmp 0x1000a595
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x3d4]
cmp eax, 0xffffffff
jne 0x1000a5b2
mov dword [ebp - 0x6a4], 1
jmp 0x1000a5b9
and dword [ebp - 0x6a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74c]
cmp dword [ebp - 0x6a4], eax
je 0x1000a5da
mov dword [ebp - 0x3dc], 1
jmp 0x1000a5e1
and dword [ebp - 0x3dc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp + eax - 0x904], ecx
mov dword [ebp - 0xb0], 1
jmp 0x1000a60c
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x1000a8a1
mov dword [ebp - 0x1c8], 4
mov dword [ebp - 0xa58], 0x8987f2fb
mov dword [ebp - 0xa60], 0xfffffffd
mov dword [ebp - 0xa68], 0xfffffffc
mov dword [ebp - 0xa70], 0
mov dword [ebp - 0xb14], 0xa3dbc56e
mov dword [ebp - 0xb1c], 0x5251c607
mov dword [ebp - 0xb24], 0xa83d87e3
mov dword [ebp - 0xb2c], 1
mov dword [ebp - 0x594], 0x433a
mov dword [ebp - 0x40], 0
jmp 0x1000a68d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1000a6a3
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xcf8], 0x313dd33a
jmp 0x1000a686
mov dword [ebp - 0x40], 0
jmp 0x1000a6b3
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1000a6c9
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xb34], 0x51efdb7b
jmp 0x1000a6ac
mov dword [ebp - 0x1c8], 0
jmp 0x1000a6e2
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 2
jg 0x1000a79a
mov dword [ebp - 0xb3c], 0xdae8c9f3
mov dword [ebp - 0xbc0], 0x735e4b78
mov dword [ebp - 0xbc8], 3
mov dword [ebp - 0xbd0], 0xeeda5852
mov dword [ebp - 0xbd8], 6
mov dword [ebp - 0xbe0], 0xa5dec4f3
mov dword [ebp - 0xbe8], 0x6c382506
mov dword [ebp - 0xbf0], 2
mov dword [ebp - 0xbf8], 0xffffffff
mov dword [ebp - 0xc00], 0xfffffffa
mov dword [ebp - 0x260], 0
jmp 0x1000a76c
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jge 0x1000a788
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0x94c], 0xffffffff
jmp 0x1000a75f
mov eax, dword [ebp - 0x594]
dec eax
mov dword [ebp - 0x594], eax
jmp 0x1000a6d5
mov dword [ebp - 0x3f4], 0x3c5ad058
mov dword [ebp - 0x800], 0xffffffff
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x74c], 0
jne 0x1000a813
cmp dword [ebp - 0xb0], 0
jne 0x1000a7f4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74c]
mov dword [ebp - 0xac8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x904]
neg eax
jne 0x1000a7f4
and dword [ebp - 0x3e4], 0
jmp 0x1000a7fe
mov dword [ebp - 0x3e4], 1
cmp dword [ebp - 0x3e4], 0x1ea0
jge 0x1000a813
and dword [ebp - 0x64c], 0
jmp 0x1000a81d
mov dword [ebp - 0x64c], 1
mov eax, dword [ebp - 0x3f4]
add eax, dword [ebp - 0x64c]
cmp eax, 0xe58e
je 0x1000a845
mov eax, 0xbd2f
test eax, eax
je 0x1000a845
mov dword [ebp - 0x3ec], 1
jmp 0x1000a84c
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 4
jl 0x1000a861
mov dword [ebp - 0x59c], 1
jmp 0x1000a868
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x59c], 0x20225168
je 0x1000a889
cmp dword [ebp - 0x3f4], 0
je 0x1000a889
mov dword [ebp - 0x6d4], 1
jmp 0x1000a890
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x800], eax
jmp 0x1000a5ff
mov dword [ebp - 0x18c], 5
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x74], 0
jmp 0x1000a8c2
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1000a8d8
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x724], 0xc6a53d06
jmp 0x1000a8bb
mov dword [ebp - 0x74], 0
jmp 0x1000a8e8
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1000a8fe
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x81c], 0x3629aa81
jmp 0x1000a8e1
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x1000a921
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x18c], 2
jmp 0x1000a93a
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jl 0x1000ab75
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1d0], 0
jmp 0x1000a967
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 4
jge 0x1000a983
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0xd08], 0x5732aa6
jmp 0x1000a95a
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x81c], 0xfffffff7
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0
jmp 0x1000a9ab
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x1000ab70
mov dword [ebp - 0x2a4], 0x28a0
mov dword [ebp - 0x954], 0xffffffff
mov dword [ebp - 0xbb4], 0xffffffff
mov dword [ebp - 0x95c], 0x8711
mov dword [ebp - 0xad4], 0xaa8e55a4
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x2a4], 2
jmp 0x1000aa07
mov eax, dword [ebp - 0x2a4]
dec eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jl 0x1000ab6b
mov dword [ebp - 0x5ac], 0x592404e5
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x724], 0
je 0x1000aa30
jmp 0x1000ab6b
mov dword [ebp - 0x48], 0
jmp 0x1000aa40
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x1000ab66
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x724], 0
je 0x1000aa5c
jmp 0x1000ab66
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp + eax*4 - 0x724]
mov dword [ebp - 0x964], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x81c], 0
jbe 0x1000aa8b
mov dword [ebp - 0x3fc], 1
jmp 0x1000aa92
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 0x4b83
jge 0x1000aaaa
mov dword [ebp - 0x5a4], 1
jmp 0x1000aab1
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x724]
cmp eax, dword [ebp - 0x5a4]
jne 0x1000aacf
mov dword [ebp - 0x404], 1
jmp 0x1000aad6
and dword [ebp - 0x404], 0
imul eax, dword [ebp - 0x404], 0x3644
add eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp eax, dword [ebp + ecx*4 - 0x724]
je 0x1000aafb
mov dword [ebp - 0x654], 1
jmp 0x1000ab02
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x654]
inc ecx
cmp dword [ebp + eax*4 - 0x724], ecx
jge 0x1000ab21
mov dword [ebp - 0x40c], 1
jmp 0x1000ab28
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x724]
mov dword [ebp - 0x96c], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x81c], 0
jmp 0x1000aa39
jmp 0x1000a9fa
jmp 0x1000a9a4
jmp 0x1000a92d
mov dword [ebp - 0xd0], 0x5c8094a1
mov dword [ebp - 0x808], 1
mov dword [ebp - 0xae0], 0xfffffff9
mov dword [ebp - 0x1d8], 0
jmp 0x1000abac
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 2
jge 0x1000abc8
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x8ac], 0xf9b3
jmp 0x1000ab9f
mov dword [ebp - 0xd0], 1
jmp 0x1000abe1
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x1000ad52
mov dword [ebp - 0x118], 0xb0ceafd9
mov dword [ebp - 0x118], 1
jmp 0x1000ac11
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x1000ad4d
cmp dword [ebp - 0xd0], 0
je 0x1000ac43
mov eax, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0x8ac], 0
je 0x1000ac43
mov dword [ebp - 0x414], 1
jmp 0x1000ac4a
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x414], eax
jge 0x1000ac64
mov dword [ebp - 0x6ac], 1
jmp 0x1000ac6b
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x6ac], eax
jne 0x1000ac85
mov dword [ebp - 0x41c], 1
jmp 0x1000ac8c
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x41c], eax
jg 0x1000aca6
mov dword [ebp - 0x5b4], 1
jmp 0x1000acad
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp + eax*4 - 0x8ac]
cmp eax, dword [ebp - 0x5b4]
jg 0x1000acce
mov dword [ebp - 0x424], 1
jmp 0x1000acd5
and dword [ebp - 0x424], 0
cmp dword [ebp - 0x424], 0xffffffff
je 0x1000acf0
mov eax, 0x48bd921b
test eax, eax
jne 0x1000acf0
and dword [ebp - 0x65c], 0
jmp 0x1000acfa
mov dword [ebp - 0x65c], 1
mov eax, dword [ebp - 0x65c]
sub eax, dword [ebp - 0xd0]
jne 0x1000ad1a
mov eax, 0xbd13d8c5
test eax, eax
jne 0x1000ad1a
and dword [ebp - 0x42c], 0
jmp 0x1000ad24
mov dword [ebp - 0x42c], 1
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x808], eax
mov byte [ebp - 0xdb], 0
movzx eax, byte [ebp - 0xdb]
test eax, eax
je 0x1000ad48
call dword [sym.imp.USER32.dll_CreatePopupMenu]
jmp 0x1000ac04
jmp 0x1000abd4
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x2ec], 0xffffffff
mov dword [ebp - 0x50], 0
jmp 0x1000ad73
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xc
jne 0x1000afaa
mov dword [ebp - 0x7a4], 0x703026d8
mov dword [ebp - 0x7a0], 0x703026d8
mov dword [ebp - 0x79c], 0x703026d8
mov dword [ebp - 0x798], 0x703026d8
mov dword [ebp - 0x44c], 0x65969a22
mov dword [ebp - 0x444], 0xfffffff6
mov dword [ebp - 0x7c], 0
jmp 0x1000adc9
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1000addf
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xa7c], 0
jmp 0x1000adc2
mov dword [ebp - 0x7c], 0
jmp 0x1000adef
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000ae05
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xc7c], 0xffffffff
jmp 0x1000ade8
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x974], eax
cmp dword [ebp - 0x50], 0
je 0x1000ae78
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a4]
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x44c]
cmp dword [ebp - 0x2ec], eax
jge 0x1000ae78
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x7a4], 0
je 0x1000ae57
cmp dword [ebp - 0x50], 0
je 0x1000ae57
mov dword [ebp - 0x5bc], 1
jmp 0x1000ae5e
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp - 0x5bc], eax
je 0x1000ae78
mov dword [ebp - 0x434], 1
jmp 0x1000ae7f
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x434], eax
je 0x1000ae96
mov dword [ebp - 0x6ec], 1
jmp 0x1000ae9d
and dword [ebp - 0x6ec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a4]
cmp dword [ebp - 0x6ec], eax
jge 0x1000aebe
mov dword [ebp - 0x43c], 1
jmp 0x1000aec5
and dword [ebp - 0x43c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a4]
cmp dword [ebp - 0x43c], eax
jne 0x1000aee6
mov dword [ebp - 0x5c4], 1
jmp 0x1000aeed
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x444], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a4]
cmp dword [ebp - 0x444], eax
jl 0x1000af1a
mov dword [ebp - 0x664], 1
jmp 0x1000af21
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x664], eax
jle 0x1000af38
mov dword [ebp - 0x5cc], 1
jmp 0x1000af3f
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x44c]
cmp dword [ebp - 0x5cc], eax
jg 0x1000af59
mov dword [ebp - 0x454], 1
jmp 0x1000af60
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0xffff
jbe 0x1000af78
mov dword [ebp - 0x2f4], 1
jmp 0x1000af7f
and dword [ebp - 0x2f4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2f4]
mov dword [ebp + eax - 0xa7c], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2f4]
mov dword [ebp + eax - 0xc7c], ecx
jmp 0x1000ad6c
mov dword [ebp - 0xc14], 5
mov dword [ebp - 0xc10], 5
mov dword [ebp - 0xc0c], 5
mov dword [ebp - 0xc08], 5
mov dword [ebp - 0x268], 0xe5ccc90a
mov dword [ebp - 0x268], 0
jmp 0x1000aff5
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 3
jg 0x1000b026
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1000b024
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x1000afe8
mov dword [ebp - 0x17c], 5
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x84], 0
jmp 0x1000b050
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1000b06c
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x718], 0xc6a53d06
jmp 0x1000b043
mov dword [ebp - 0x84], 0
jmp 0x1000b085
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1000b0a1
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x828], 0x3629aa81
jmp 0x1000b078
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1000b0c4
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x17c], 2
jmp 0x1000b0dd
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x1000b318
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x1e0], 0
jmp 0x1000b10a
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 4
jge 0x1000b126
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0xd18], 0x5732aa6
jmp 0x1000b0fd
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x828], 0xfffffff7
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0
jmp 0x1000b14e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x1000b313
mov dword [ebp - 0x288], 0x28a0
mov dword [ebp - 0xbbc], 0xffffffff
mov dword [ebp - 0x97c], 0xffffffff
mov dword [ebp - 0xaec], 0x8711
mov dword [ebp - 0x984], 0xaa8e55a4
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x288], 2
jmp 0x1000b1aa
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
jl 0x1000b30e
mov dword [ebp - 0x46c], 0x592404e5
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x718], 0
je 0x1000b1d3
jmp 0x1000b30e
mov dword [ebp - 0x58], 0
jmp 0x1000b1e3
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x1000b309
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x718], 0
je 0x1000b1ff
jmp 0x1000b309
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp + eax*4 - 0x718]
mov dword [ebp - 0xbf4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x828], 0
jbe 0x1000b22e
mov dword [ebp - 0x6b4], 1
jmp 0x1000b235
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0x4b83
jge 0x1000b24d
mov dword [ebp - 0x45c], 1
jmp 0x1000b254
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x718]
cmp eax, dword [ebp - 0x45c]
jne 0x1000b272
mov dword [ebp - 0x5d4], 1
jmp 0x1000b279
and dword [ebp - 0x5d4], 0
imul eax, dword [ebp - 0x5d4], 0x3644
add eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
cmp eax, dword [ebp + ecx*4 - 0x718]
je 0x1000b29e
mov dword [ebp - 0x464], 1
jmp 0x1000b2a5
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x464]
inc ecx
cmp dword [ebp + eax*4 - 0x718], ecx
jge 0x1000b2c4
mov dword [ebp - 0x66c], 1
jmp 0x1000b2cb
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x718]
mov dword [ebp - 0xaf8], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x828], 0
jmp 0x1000b1dc
jmp 0x1000b19d
jmp 0x1000b147
jmp 0x1000b0d0
mov dword [ebp - 0x8c], 0
jmp 0x1000b331
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1000b34d
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x1e8], 0x17571177
jmp 0x1000b324
mov dword [ebp - 0x8c], 0
jmp 0x1000b366
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1000b382
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x994], 0x1dbe
jmp 0x1000b359
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1e8], 0xffffffeb
jmp 0x1000b3b0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1e8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e8], 5
jne 0x1000b40a
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x270], 0
jmp 0x1000b3e3
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jl 0x1000b408
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1000b406
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1000b3d6
jmp 0x1000b395
mov dword [ebp - 0x14], 0xfe0a8eac
mov dword [ebp - 0x1f0], 0
jmp 0x1000b42a
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x1000b446
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x810], 1
jmp 0x1000b41d
mov dword [ebp - 0x14], 0x15
jmp 0x1000b456
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe3
jl 0x1000b47f
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x1000b47d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x1000b44f
cmp dword [ebp - 0x14], 0
jne 0x1000b495
push 8
pop eax
test eax, eax
jne 0x1000b495
and dword [ebp - 0x474], 0
jmp 0x1000b49f
mov dword [ebp - 0x474], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jg 0x1000b4b3
mov dword [ebp - 0x5dc], 1
jmp 0x1000b4ba
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x14]
neg eax
sub eax, dword [ebp - 0x5dc]
cmp eax, dword [ebp - 0x14]
jl 0x1000b4d6
mov dword [ebp - 0x6dc], 1
jmp 0x1000b4dd
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x474]
cmp eax, dword [ebp - 0x6dc]
jle 0x1000b4f7
mov dword [ebp - 0x47c], 1
jmp 0x1000b4fe
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x47c], eax
je 0x1000b515
mov dword [ebp - 0x5e4], 1
jmp 0x1000b51c
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x810]
cmp dword [ebp - 0x5e4], eax
je 0x1000b53d
mov dword [ebp - 0x484], 1
jmp 0x1000b544
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 0x9753589f
jbe 0x1000b55c
mov dword [ebp - 0x674], 1
jmp 0x1000b563
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x674]
neg eax
je 0x1000b5bf
mov dword [ebp - 0x29c], 0
jmp 0x1000b586
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 2
jge 0x1000b5a2
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x8f4], 0x91b4
jmp 0x1000b579
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8f4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x8f4], eax
jmp 0x1000b5c5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xb8], 0x5c8094a1
mov dword [ebp - 0x884], 1
mov dword [ebp - 4], 0xfffffff8
mov dword [ebp - 0xc], 0xfffffff6
mov dword [ebp - 0x60], 0
jmp 0x1000b5f7
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1000b60d
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x72c], 0xffffffff
jmp 0x1000b5f0
mov dword [ebp - 0x60], 0
jmp 0x1000b61d
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1000b633
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x214], 0x11d7feae
jmp 0x1000b616
mov eax, dword [ebp - 4]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x99c], eax
mov eax, 0xc54c9751
test eax, eax
je 0x1000b660
cmp dword [ebp - 4], 0
je 0x1000b660
mov dword [ebp - 0x48c], 1
jmp 0x1000b667
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x48c], eax
je 0x1000b67e
mov dword [ebp - 0x5ec], 1
jmp 0x1000b685
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x5ec], eax
jle 0x1000b69c
mov dword [ebp - 0x494], 1
jmp 0x1000b6a3
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
sub eax, dword [ebp - 4]
cmp eax, 1
jb 0x1000b6bd
mov dword [ebp - 0x6bc], 1
jmp 0x1000b6c4
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
add eax, 0x19f23e52
cmp eax, dword [ebp - 4]
jg 0x1000b6e0
mov dword [ebp - 0x49c], 1
jmp 0x1000b6e7
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xc], eax
jle 0x1000b704
mov dword [ebp - 0x5f4], 1
jmp 0x1000b70b
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
sub eax, 0x716b
cmp eax, dword [ebp - 4]
jl 0x1000b727
mov dword [ebp - 0x4a4], 1
jmp 0x1000b72e
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x4a4], eax
jl 0x1000b74c
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1000b74c
mov dword [ebp - 0x67c], 1
jmp 0x1000b753
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x67c], eax
jg 0x1000b76a
mov dword [ebp - 0x2f0], 1
jmp 0x1000b771
and dword [ebp - 0x2f0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp + eax - 0x72c], ecx
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x2f0], eax
jg 0x1000b79b
mov dword [ebp - 0x4ac], 1
jmp 0x1000b7a2
and dword [ebp - 0x4ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x214]
cmp dword [ebp - 0x4ac], eax
je 0x1000b7c3
mov dword [ebp - 0x5fc], 1
jmp 0x1000b7ca
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x214]
cmp dword [ebp - 0x5fc], eax
je 0x1000b7eb
mov dword [ebp - 0x4b4], 1
jmp 0x1000b7f2
and dword [ebp - 0x4b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4b4]
mov dword [ebp + eax - 0x214], ecx
mov dword [ebp - 4], 0x14
jmp 0x1000b815
cmp dword [ebp - 4], 0xd
je 0x1000b98c