Function at 0x10009074
Capabilities:
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100797e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xfd0
push esi
push edi
mov dword [ebp - 0xc4], 0xe414
push 3
lea ecx, [ebp - 0xc8c]
call fcn.10016406
and dword [ebp - 4], 0
mov dword [ebp - 0x2e8], 0
jmp 0x100090c8
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 3
jge 0x100090ea
push dword [ebp - 0x2e8]
lea ecx, [ebp - 0xc8c]
call fcn.100164a4
mov dword [eax], 0xfffffff7
jmp 0x100090bb
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xcf4], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xd08], eax
cmp dword [ebp - 0xc4], 0xfffffff8
jl 0x10009117
mov dword [ebp - 0x9d4], 1
jmp 0x1000911e
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xd10], eax
cmp dword [ebp - 0xc4], 0xf257
jne 0x10009142
mov dword [ebp - 0x4b0], 1
jmp 0x10009149
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
dec eax
cmp eax, 0xc1464f16
jbe 0x10009163
mov dword [ebp - 0x8e8], 1
jmp 0x1000916a
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x8e8], eax
jge 0x1000918d
cmp dword [ebp - 0xc4], 0
je 0x1000918d
mov dword [ebp - 0x8f0], 1
jmp 0x10009194
and dword [ebp - 0x8f0], 0
cmp dword [ebp - 0x8f0], 0x7fd1e814
jg 0x100091ac
mov dword [ebp - 0x8f8], 1
jmp 0x100091b3
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 0xd149
jl 0x100091cb
mov dword [ebp - 0x900], 1
jmp 0x100091d2
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x900], eax
jle 0x100091ec
mov dword [ebp - 0x908], 1
jmp 0x100091f3
and dword [ebp - 0x908], 0
mov esi, dword [ebp - 0x908]
sub esi, 0x6df5900a
push 1
lea ecx, [ebp - 0xc8c]
call fcn.100164a4
mov dword [eax], esi
mov byte [ebp - 0x116], 0
movzx eax, byte [ebp - 0x116]
test eax, eax
je 0x1000922a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8c]
call fcn.10016488
mov dword [ebp - 0x300], 2
mov dword [ebp - 0x30], 0x6444696a
mov dword [ebp - 0x2f0], 0x164f943a
mov dword [ebp - 0x970], 1
push 3
lea ecx, [ebp - 0x988]
call fcn.10016406
mov dword [ebp - 4], 1
mov dword [ebp - 0xa68], 0x2ef314d4
mov dword [ebp - 0x7c], 0
jmp 0x1000928c
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x100092a2
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xa60], 5
jmp 0x10009285
mov dword [ebp - 0x7c], 0
jmp 0x100092b2
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x100092ce
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x988]
call fcn.100164a4
mov dword [eax], 0xfffffffc
jmp 0x100092ab
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xd18], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
je 0x100092f9
xor eax, eax
je 0x100092f9
mov dword [ebp - 0x910], 1
jmp 0x10009300
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x910]
jge 0x10009317
mov dword [ebp - 0x918], 1
jmp 0x1000931e
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x918]
je 0x10009335
mov dword [ebp - 0x920], 1
jmp 0x1000933c
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
sub eax, 6
cmp eax, dword [ebp - 0x30]
jg 0x10009356
mov dword [ebp - 0x928], 1
jmp 0x1000935d
and dword [ebp - 0x928], 0
push 0xfffffffffffffff6
pop eax
sub eax, dword [ebp - 0x928]
mov dword [ebp - 0x930], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x930]
mov dword [ebp + eax - 0xa60], ecx
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x930], eax
jne 0x10009396
mov dword [ebp - 0x938], 1
jmp 0x1000939d
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x938], eax
jge 0x100093b4
mov dword [ebp - 0x960], 1
jmp 0x100093bb
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x960], eax
jne 0x100093d2
mov dword [ebp - 0x968], 1
jmp 0x100093d9
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x968]
add eax, 0xa
neg eax
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0xd5c], eax
push 0
lea ecx, [ebp - 0x988]
call fcn.100164a4
cmp dword [eax], 0
jne 0x1000940f
cmp dword [ebp - 0x2f0], 0
mov esi, dword [ebp - 0x30]
push 0
lea ecx, [ebp - 0x988]
call fcn.100164a4
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x988]
call fcn.100164a4
cmp esi, dword [eax]
jle 0x10009445
push 0
lea ecx, [ebp - 0x988]
call fcn.100164a4
cmp dword [eax], 0
jne 0x10009457
cmp dword [ebp - 0x2f0], 0
jne 0x10009457
and dword [ebp - 0x978], 0
jmp 0x10009461
mov dword [ebp - 0x978], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x978], eax
je 0x10009478
mov dword [ebp - 0x418], 1
jmp 0x1000947f
and dword [ebp - 0x418], 0
push 0
lea ecx, [ebp - 0x988]
call fcn.100164a4
mov ecx, dword [ebp - 0x418]
cmp ecx, dword [eax]
jle 0x100094a2
mov dword [ebp - 0x8a8], 1
jmp 0x100094a9
and dword [ebp - 0x8a8], 0
mov esi, dword [ebp - 0x30]
sub esi, dword [ebp - 0x8a8]
push 2
lea ecx, [ebp - 0x988]
call fcn.100164a4
sub esi, dword [eax]
cmp esi, dword [ebp - 0x30]
jl 0x100094d2
mov dword [ebp - 0x420], 1
jmp 0x100094d9
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0xa68], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.10016488
push 1
lea ecx, [ebp - 0xee4]
call fcn.10016406
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0xc44]
call fcn.10016406
mov byte [ebp - 4], 3
mov dword [ebp - 0xd64], 0
mov dword [ebp - 0xb0], 0
jmp 0x1000953c
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x1000955e
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xee4]
call fcn.100164a4
mov dword [eax], 1
jmp 0x1000952f
mov dword [ebp - 0x8b0], 8
mov dword [ebp - 0x1c0], 0xb5ca9869
mov dword [ebp - 0x428], 1
mov dword [ebp - 0xd6c], 0x927f7b6f
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0xd74], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0xd7c], eax
mov dword [ebp - 0x8b0], 0x976ff55e
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x8b0], eax
jle 0x100095c2
mov dword [ebp - 0x8b8], 1
jmp 0x100095c9
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0xd84], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x8b8], eax
jl 0x100095fb
mov dword [ebp - 0x430], 1
jmp 0x10009602
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
neg eax
cmp eax, 0xfffffff9
je 0x1000961b
mov dword [ebp - 0x8c0], 1
jmp 0x10009622
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x1c0], eax
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1000965b
push 0x6fb
push 0
push 0x1be7
push 0x1d4b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xb0], 0
jmp 0x10009674
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x10009696
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xc44]
call fcn.100164a4
mov dword [eax], 0xd4e677b5
jmp 0x10009667
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x100096b0
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [ebp - 0xf4], 0xe414
push 3
lea ecx, [ebp - 0xbe4]
call fcn.10016406
mov byte [ebp - 4], 4
mov dword [ebp - 0x2f8], 0
jmp 0x100096e4
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 3
jge 0x10009706
push dword [ebp - 0x2f8]
lea ecx, [ebp - 0xbe4]
call fcn.100164a4
mov dword [eax], 0xfffffff7
jmp 0x100096d7
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xd9c], eax
cmp dword [ebp - 0xf4], 0xfffffff8
jl 0x10009733
mov dword [ebp - 0xa70], 1
jmp 0x1000973a
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xda4], eax
cmp dword [ebp - 0xf4], 0xf257
jne 0x1000975e
mov dword [ebp - 0x438], 1
jmp 0x10009765
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
dec eax
cmp eax, 0xc1464f16
jbe 0x1000977f
mov dword [ebp - 0x8c8], 1
jmp 0x10009786
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x8c8], eax
jge 0x100097a9
cmp dword [ebp - 0xf4], 0
je 0x100097a9
mov dword [ebp - 0x440], 1
jmp 0x100097b0
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0x7fd1e814
jg 0x100097c8
mov dword [ebp - 0x8d0], 1
jmp 0x100097cf
and dword [ebp - 0x8d0], 0
cmp dword [ebp - 0x8d0], 0xd149
jl 0x100097e7
mov dword [ebp - 0x448], 1
jmp 0x100097ee
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x448], eax
jle 0x10009808
mov dword [ebp - 0x8d8], 1
jmp 0x1000980f
and dword [ebp - 0x8d8], 0
mov esi, dword [ebp - 0x8d8]
sub esi, 0x6df5900a
push 1
lea ecx, [ebp - 0xbe4]
call fcn.100164a4
mov dword [eax], esi
mov byte [ebp - 0x14f], 0
movzx eax, byte [ebp - 0x14f]
test eax, eax
je 0x10009846
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xbe4]
call fcn.10016488
mov dword [ebp - 0x300], 0xfffffff7
jmp 0x1000986e
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0xffffffed
jg 0x10009a5e
mov dword [ebp - 0x298], 0x7013dce9
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x100098a6
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [ebp - 0x298], 0
jmp 0x100098bf
mov eax, dword [ebp - 0x298]
dec eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0xfffffff6
je 0x10009a59
push 3
lea ecx, [ebp - 0x9c4]
call fcn.10016406
mov byte [ebp - 4], 5
mov dword [ebp - 0x2a0], 0x8421705
mov dword [ebp - 0x210], 0
jmp 0x10009900
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x10009922
push dword [ebp - 0x210]
lea ecx, [ebp - 0x9c4]
call fcn.100164a4
mov dword [eax], 8
jmp 0x100098f3
push 1
lea ecx, [ebp - 0x9c4]
call fcn.100164a4
and dword [eax], 0
jmp 0x10009958
push 1
lea ecx, [ebp - 0x9c4]
call fcn.100164a4
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp - 0x8e0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x8e0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x9c4]
call fcn.100164a4
cmp dword [eax], 0
jl 0x1000997f
push 0
lea ecx, [ebp - 0xc44]
call fcn.100164a4
mov dword [eax], 0xfffffffa
jmp 0x10009934
mov dword [ebp - 0x2a0], 0
jmp 0x10009998
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jg 0x10009a45
mov dword [ebp - 0x1dc], 2
mov dword [ebp - 0x194], 1
mov dword [ebp - 0x1dc], 2
jmp 0x100099d2
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jl 0x10009a40
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x9c4]
call fcn.100164a4
mov eax, dword [eax]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x194], 0
jmp 0x10009a0d
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jl 0x10009a3e
mov byte [ebp - 0x14a], 0
movzx eax, byte [ebp - 0x14a]
test eax, eax
je 0x10009a3c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
jmp 0x10009a00
jmp 0x100099c5
jmp 0x1000998b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9c4]
call fcn.10016488
jmp 0x100098b2
jmp 0x10009861
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc44]
call fcn.10016488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee4]
call fcn.10016488
mov dword [ebp - 0x218], 2
push 1
lea ecx, [ebp - 0xef4]
call fcn.10016406
mov dword [ebp - 4], 6
push 1
lea ecx, [ebp - 0xbfc]
call fcn.10016406
mov byte [ebp - 4], 7
mov dword [ebp - 0xdac], 0
mov dword [ebp - 0x84], 0
jmp 0x10009ace
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x10009af0
push dword [ebp - 0x84]
lea ecx, [ebp - 0xef4]
call fcn.100164a4
mov dword [eax], 1
jmp 0x10009ac1
mov dword [ebp - 0x84], 0
jmp 0x10009b09
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x10009b2b
push dword [ebp - 0x84]
lea ecx, [ebp - 0xbfc]
call fcn.100164a4
mov dword [eax], 0xd4e677b5
jmp 0x10009afc
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x10009b45
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [ebp - 0x218], 0xfffffff7
jmp 0x10009b5e
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffed
jg 0x10009d4e
mov dword [ebp - 0x2a8], 0x7013dce9
mov byte [ebp - 0x14c], 0
movzx eax, byte [ebp - 0x14c]
test eax, eax
je 0x10009b96
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [ebp - 0x2a8], 0
jmp 0x10009baf
mov eax, dword [ebp - 0x2a8]
dec eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0xfffffff6
je 0x10009d49
push 3
lea ecx, [ebp - 0x9d0]
call fcn.10016406
mov byte [ebp - 4], 8
mov dword [ebp - 0x2b0], 0x8421705
mov dword [ebp - 0x220], 0
jmp 0x10009bf0
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jge 0x10009c12
push dword [ebp - 0x220]
lea ecx, [ebp - 0x9d0]
call fcn.100164a4
mov dword [eax], 8
jmp 0x10009be3
push 1
lea ecx, [ebp - 0x9d0]
call fcn.100164a4
and dword [eax], 0
jmp 0x10009c48
push 1
lea ecx, [ebp - 0x9d0]
call fcn.100164a4
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x454]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x9d0]
call fcn.100164a4
cmp dword [eax], 0
jl 0x10009c6f
push 0
lea ecx, [ebp - 0xbfc]
call fcn.100164a4
mov dword [eax], 0xfffffffa
jmp 0x10009c24
mov dword [ebp - 0x2b0], 0
jmp 0x10009c88
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 2
jg 0x10009d35
mov dword [ebp - 0x1c4], 2
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x1c4], 2
jmp 0x10009cc2
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jl 0x10009d30
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x9d0]
call fcn.100164a4
mov eax, dword [eax]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x19c], 0
jmp 0x10009cfd
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jl 0x10009d2e
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x10009d2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
jmp 0x10009cf0
jmp 0x10009cb5
jmp 0x10009c7b
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x9d0]
call fcn.10016488
jmp 0x10009ba2
jmp 0x10009b51
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xbfc]
call fcn.10016488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xef4]
call fcn.10016488
mov dword [ebp - 0x228], 2
push 1
lea ecx, [ebp - 0xf04]
call fcn.10016406
mov dword [ebp - 4], 9
push 1
lea ecx, [ebp - 0xc74]
call fcn.10016406
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xdb4], 0
mov dword [ebp - 0x68], 0
jmp 0x10009db5
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x10009dd1
push dword [ebp - 0x68]
lea ecx, [ebp - 0xf04]
call fcn.100164a4
mov dword [eax], 1
jmp 0x10009dae
mov dword [ebp - 0x68], 0
jmp 0x10009de1
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x10009dfd
push dword [ebp - 0x68]
lea ecx, [ebp - 0xc74]
call fcn.100164a4
mov dword [eax], 0xd4e677b5
jmp 0x10009dda
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x10009e17
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [ebp - 0x228], 0xfffffff7
jmp 0x10009e30
mov eax, dword [ebp - 0x228]
dec eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffed
jg 0x1000a020
mov dword [ebp - 0x2b8], 0x7013dce9
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x10009e68
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [ebp - 0x2b8], 0
jmp 0x10009e81
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0xfffffff6
je 0x1000a01b
push 3
lea ecx, [ebp - 0x9b8]
call fcn.10016406
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x2c0], 0x8421705
mov dword [ebp - 0x230], 0
jmp 0x10009ec2
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x10009ee4
push dword [ebp - 0x230]
lea ecx, [ebp - 0x9b8]
call fcn.100164a4
mov dword [eax], 8
jmp 0x10009eb5
push 1
lea ecx, [ebp - 0x9b8]
call fcn.100164a4
and dword [eax], 0
jmp 0x10009f1a
push 1
lea ecx, [ebp - 0x9b8]
call fcn.100164a4
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x6f4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6f4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x9b8]
call fcn.100164a4
cmp dword [eax], 0
jl 0x10009f41
push 0
lea ecx, [ebp - 0xc74]
call fcn.100164a4
mov dword [eax], 0xfffffffa
jmp 0x10009ef6
mov dword [ebp - 0x2c0], 0
jmp 0x10009f5a
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jg 0x1000a007
mov dword [ebp - 0x188], 2
mov dword [ebp - 0x1d0], 1
mov dword [ebp - 0x188], 2
jmp 0x10009f94
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x1000a002
push dword [ebp - 0x188]
lea ecx, [ebp - 0x9b8]
call fcn.100164a4
mov eax, dword [eax]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1d0], 0
jmp 0x10009fcf
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jl 0x1000a000
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x10009ffe
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
jmp 0x10009fc2
jmp 0x10009f87
jmp 0x10009f4d
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x9b8]
call fcn.10016488
jmp 0x10009e74
jmp 0x10009e23
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xc74]
call fcn.10016488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf04]
call fcn.10016488
mov dword [ebp - 0xb8], 0xe0648261
mov dword [ebp - 0x1a4], 0x7ae9f903
mov dword [ebp - 0xa88], 0xffffffff
mov dword [ebp - 0xb8], 0xffffffeb
jmp 0x1000a075
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffe2
jge 0x1000a2bc
mov dword [ebp - 0x38], 0xfd43ddca
mov dword [ebp - 0x704], 0xf9e6a012
mov dword [ebp - 0xa78], 1
mov dword [ebp - 0xa80], 0xffffffff
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xdbc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xdc4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xdcc], eax
cmp dword [ebp - 0x38], 0
je 0x1000a0dd
cmp dword [ebp - 0x38], 0
je 0x1000a0dd
mov dword [ebp - 0x45c], 1
jmp 0x1000a0e4
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x45c], eax
jl 0x1000a0fe
mov dword [ebp - 0x844], 1
jmp 0x1000a105
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x844], eax
jg 0x1000a11c
mov dword [ebp - 0x464], 1
jmp 0x1000a123
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
add eax, 7
cmp eax, 0xffffffff
jne 0x1000a13d
mov dword [ebp - 0x6fc], 1
jmp 0x1000a144
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 1
jg 0x1000a15f
cmp dword [ebp - 0x38], 0
je 0x1000a15f
mov dword [ebp - 0x46c], 1
jmp 0x1000a166
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x38]
neg eax
cmp eax, dword [ebp - 0xb8]
je 0x1000a197
cmp dword [ebp - 0x38], 0
je 0x1000a197
cmp dword [ebp - 0x38], 0
je 0x1000a197
mov dword [ebp - 0x8ec], 1
jmp 0x1000a19e
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x8ec], eax
jge 0x1000a1b5
mov dword [ebp - 0x474], 1
jmp 0x1000a1bc
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x704], eax
cmp dword [ebp - 0x704], 0
jne 0x1000a1e3
mov eax, 0x800f
test eax, eax
jne 0x1000a1e3
and dword [ebp - 0x47c], 0
jmp 0x1000a1ed
mov dword [ebp - 0x47c], 1
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x47c], eax
jg 0x1000a207
mov dword [ebp - 0x84c], 1
jmp 0x1000a20e
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x84c], eax
jle 0x1000a228
mov dword [ebp - 0x484], 1
jmp 0x1000a22f
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x484], eax
jl 0x1000a246
mov dword [ebp - 0x70c], 1
jmp 0x1000a24d
and dword [ebp - 0x70c], 0
cmp dword [ebp - 0x70c], 0xf20077fe
ja 0x1000a26e
cmp dword [ebp - 0xa78], 0
je 0x1000a26e
mov dword [ebp - 0x48c], 1
jmp 0x1000a275
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 5
jg 0x1000a28a
mov dword [ebp - 0x958], 1
jmp 0x1000a291
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0xa80], eax
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x1000a2b7
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x1000a068
mov dword [ebp - 0x1a4], 0xfffffff9
jmp 0x1000a2d5
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0x1a
jl 0x1000a2eb
cmp dword [ebp - 0xa88], 0
je 0x1000a2e9
jmp 0x1000a2eb
jmp 0x1000a2c8
mov dword [ebp - 0x8c], 0xe0648261
mov dword [ebp - 0x1c8], 0x7ae9f903
mov dword [ebp - 0xaa0], 0xffffffff
mov dword [ebp - 0x8c], 0xffffffeb
jmp 0x1000a322
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffe2
jge 0x1000a569
mov dword [ebp - 0x40], 0xfd43ddca
mov dword [ebp - 0x8f4], 0xf9e6a012
mov dword [ebp - 0xa90], 1
mov dword [ebp - 0xa98], 0xffffffff
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xdd4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xddc], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xde4], eax
cmp dword [ebp - 0x40], 0
je 0x1000a38a
cmp dword [ebp - 0x40], 0
je 0x1000a38a
mov dword [ebp - 0x494], 1
jmp 0x1000a391
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x494], eax
jl 0x1000a3ab
mov dword [ebp - 0x714], 1
jmp 0x1000a3b2
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x714], eax
jg 0x1000a3c9
mov dword [ebp - 0x49c], 1
jmp 0x1000a3d0
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
add eax, 7
cmp eax, 0xffffffff
jne 0x1000a3ea
mov dword [ebp - 0x854], 1
jmp 0x1000a3f1
and dword [ebp - 0x854], 0
cmp dword [ebp - 0x854], 1
jg 0x1000a40c
cmp dword [ebp - 0x40], 0
je 0x1000a40c
mov dword [ebp - 0x4a4], 1
jmp 0x1000a413
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x40]
neg eax
cmp eax, dword [ebp - 0x8c]
je 0x1000a444
cmp dword [ebp - 0x40], 0
je 0x1000a444
cmp dword [ebp - 0x40], 0
je 0x1000a444
mov dword [ebp - 0x71c], 1
jmp 0x1000a44b
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x71c], eax
jge 0x1000a462
mov dword [ebp - 0x4ac], 1
jmp 0x1000a469
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x8f4], eax
cmp dword [ebp - 0x8f4], 0
jne 0x1000a490
mov eax, 0x800f
test eax, eax
jne 0x1000a490
and dword [ebp - 0x4b4], 0
jmp 0x1000a49a
mov dword [ebp - 0x4b4], 1
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x4b4], eax
jg 0x1000a4b4
mov dword [ebp - 0x724], 1
jmp 0x1000a4bb
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x724], eax
jle 0x1000a4d5
mov dword [ebp - 0x4bc], 1
jmp 0x1000a4dc
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x4bc], eax
jl 0x1000a4f3
mov dword [ebp - 0x85c], 1
jmp 0x1000a4fa
and dword [ebp - 0x85c], 0
cmp dword [ebp - 0x85c], 0xf20077fe
ja 0x1000a51b
cmp dword [ebp - 0xa90], 0
je 0x1000a51b
mov dword [ebp - 0x4c4], 1
jmp 0x1000a522
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 5
jg 0x1000a537
mov dword [ebp - 0x72c], 1
jmp 0x1000a53e
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0xa98], eax
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x1000a564
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x1000a315
mov dword [ebp - 0x1c8], 0xfffffff9
jmp 0x1000a582
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x1a
jl 0x1000a598
cmp dword [ebp - 0xaa0], 0
je 0x1000a596
jmp 0x1000a598
jmp 0x1000a575
mov dword [ebp - 0x238], 0x91a049fe
mov dword [ebp - 0xdec], 1
mov dword [ebp - 0x238], 0
jmp 0x1000a5c5
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
je 0x1000a5ff
mov byte [ebp - 0x150], 0
movzx eax, byte [ebp - 0x150]
test eax, eax
je 0x1000a5fd
push 0
push 0x293
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x1000a5b8
mov dword [ebp - 0xc0], 0xe0648261
mov dword [ebp - 0x1ac], 0x7ae9f903
mov dword [ebp - 0xab8], 0xffffffff
mov dword [ebp - 0xc0], 0xffffffeb
jmp 0x1000a636
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffe2
jge 0x1000a87d
mov dword [ebp - 0x3c], 0xfd43ddca
mov dword [ebp - 0x73c], 0xf9e6a012
mov dword [ebp - 0xaa8], 1
mov dword [ebp - 0xab0], 0xffffffff
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xdf4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xdfc], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe04], eax
cmp dword [ebp - 0x3c], 0
je 0x1000a69e
cmp dword [ebp - 0x3c], 0
je 0x1000a69e
mov dword [ebp - 0x4cc], 1
jmp 0x1000a6a5
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x4cc], eax
jl 0x1000a6bf
mov dword [ebp - 0x950], 1
jmp 0x1000a6c6
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x950], eax
jg 0x1000a6dd
mov dword [ebp - 0x4d4], 1
jmp 0x1000a6e4
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
add eax, 7
cmp eax, 0xffffffff
jne 0x1000a6fe
mov dword [ebp - 0x734], 1
jmp 0x1000a705
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 1
jg 0x1000a720
cmp dword [ebp - 0x3c], 0
je 0x1000a720
mov dword [ebp - 0x4dc], 1
jmp 0x1000a727
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x3c]
neg eax
cmp eax, dword [ebp - 0xc0]
je 0x1000a758
cmp dword [ebp - 0x3c], 0
je 0x1000a758
cmp dword [ebp - 0x3c], 0
je 0x1000a758
mov dword [ebp - 0x864], 1
jmp 0x1000a75f
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x864], eax
jge 0x1000a776
mov dword [ebp - 0x4e4], 1
jmp 0x1000a77d
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 0
jne 0x1000a7a4
mov eax, 0x800f
test eax, eax
jne 0x1000a7a4
and dword [ebp - 0x4ec], 0
jmp 0x1000a7ae
mov dword [ebp - 0x4ec], 1
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x4ec], eax
jg 0x1000a7c8
mov dword [ebp - 0x8fc], 1
jmp 0x1000a7cf
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x8fc], eax
jle 0x1000a7e9
mov dword [ebp - 0x4f4], 1
jmp 0x1000a7f0
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x4f4], eax
jl 0x1000a807
mov dword [ebp - 0x744], 1
jmp 0x1000a80e
and dword [ebp - 0x744], 0
cmp dword [ebp - 0x744], 0xf20077fe
ja 0x1000a82f
cmp dword [ebp - 0xaa8], 0
je 0x1000a82f
mov dword [ebp - 0x4fc], 1
jmp 0x1000a836
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 5
jg 0x1000a84b
mov dword [ebp - 0x86c], 1
jmp 0x1000a852
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0xab0], eax
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x1000a878
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x1000a629
mov dword [ebp - 0x1ac], 0xfffffff9
jmp 0x1000a896
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0x1a
jl 0x1000a8ac
cmp dword [ebp - 0xab8], 0
je 0x1000a8aa
jmp 0x1000a8ac
jmp 0x1000a889
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0xac0], 0xfd94
mov dword [ebp - 0xad0], 0x63588c55
mov dword [ebp - 0x514], 0xfffb
mov dword [ebp - 0xad8], 0xfffffffa
mov dword [ebp - 0x6c], 0
jmp 0x1000a8ee
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x1000a904
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xf74], 0xac8b
jmp 0x1000a8e7
mov dword [ebp - 0x6c], 0
jmp 0x1000a914
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1000a92a
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xa40], 1
jmp 0x1000a90d
mov dword [ebp - 0xd4], 3
jmp 0x1000a943
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x1000aa4d
mov dword [ebp - 0xe0c], 0xffffffff
mov dword [ebp - 0xac8], 0
cmp dword [ebp - 0xac0], 0
jne 0x1000a986
mov eax, dword [ebp - 0xd4]
cmp dword [ebp + eax*4 - 0xf74], 0
jne 0x1000a986
and dword [ebp - 0x32c], 0
jmp 0x1000a990
mov dword [ebp - 0x32c], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x32c]
mov dword [ebp + eax - 0xa40], ecx
cmp dword [ebp - 0x32c], 1
je 0x1000a9b8
mov dword [ebp - 0x504], 1
jmp 0x1000a9bf
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp + eax*4 - 0xf74]
cmp eax, dword [ebp - 0x504]
jle 0x1000a9e0
mov dword [ebp - 0x74c], 1
jmp 0x1000a9e7
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0xac8]
cmp dword [ebp - 0x74c], eax
jge 0x1000aa01
mov dword [ebp - 0x50c], 1
jmp 0x1000aa08
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x50c]
test eax, eax
je 0x1000aa35
mov eax, dword [ebp - 0xd4]
cmp dword [ebp + eax*4 - 0xf74], 0
je 0x1000aa35
mov dword [ebp - 0x974], 1
jmp 0x1000aa3c
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0xad0], eax
jmp 0x1000a936
mov eax, dword [ebp - 0x514]
cmp dword [ebp - 0x514], eax
jg 0x1000aa67
mov dword [ebp - 0x754], 1
jmp 0x1000aa6e
and dword [ebp - 0x754], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa40], 0x31e13ca4
jl 0x1000aa8d
mov dword [ebp - 0x51c], 1
jmp 0x1000aa94
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x754]
cmp eax, dword [ebp - 0x51c]
je 0x1000aaae
mov dword [ebp - 0x874], 1
jmp 0x1000aab5
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0xad8]
cmp dword [ebp - 0x874], eax
jne 0x1000aad8
mov eax, 0x3b7c
test eax, eax
je 0x1000aad8
mov dword [ebp - 0x524], 1
jmp 0x1000aadf
and dword [ebp - 0x524], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x524]
mov dword [ebp + eax - 0xa40], ecx
push 2
lea ecx, [ebp - 0xba8]
call fcn.10016406
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x158], 1
mov dword [ebp - 0x2c8], 0
jmp 0x1000ab29
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 2
jge 0x1000ab4b
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0xba8]
call fcn.100164a4
mov dword [eax], 1
jmp 0x1000ab1c
mov dword [ebp - 0x158], 1
jmp 0x1000ab64
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x1000ab97
push dword [ebp - 0x158]
lea ecx, [ebp - 0xba8]
call fcn.100164a4
mov esi, eax
push dword [ebp - 0x158]
lea ecx, [ebp - 0xba8]
call fcn.100164a4
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000ab57
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba8]
call fcn.10016488
mov dword [ebp - 0x240], 0x91a049fe
mov dword [ebp - 0xe14], 1
mov dword [ebp - 0x240], 0
jmp 0x1000abd3
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
je 0x1000ac0d
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x1000ac0b
push 0
push 0x293
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x1000abc6
mov dword [ebp - 0x2d0], 0x91a049fe
mov dword [ebp - 0xe1c], 1
mov dword [ebp - 0x2d0], 0
jmp 0x1000ac3a
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
je 0x1000ac74
mov byte [ebp - 0x110], 0
movzx eax, byte [ebp - 0x110]
test eax, eax
je 0x1000ac72
push 0
push 0x293
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x1000ac2d
mov dword [ebp - 0xec], 1
mov dword [ebp - 0xb40], 0xfd94
mov dword [ebp - 0xb50], 0x63588c55
mov dword [ebp - 0x764], 0xfffb
mov dword [ebp - 0xb58], 0xfffffffa
mov dword [ebp - 0x70], 0
jmp 0x1000acb6
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1000accc
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xf88], 0xac8b
jmp 0x1000acaf
mov dword [ebp - 0x70], 0
jmp 0x1000acdc
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1000acf2
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xa4c], 1
jmp 0x1000acd5
mov dword [ebp - 0xec], 3
jmp 0x1000ad0b
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x1000ae15
mov dword [ebp - 0xe24], 0xffffffff
mov dword [ebp - 0xb48], 0
cmp dword [ebp - 0xb40], 0
jne 0x1000ad4e
mov eax, dword [ebp - 0xec]
cmp dword [ebp + eax*4 - 0xf88], 0
jne 0x1000ad4e
and dword [ebp - 0x368], 0
jmp 0x1000ad58
mov dword [ebp - 0x368], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x368]
mov dword [ebp + eax - 0xa4c], ecx
cmp dword [ebp - 0x368], 1
je 0x1000ad80
mov dword [ebp - 0x75c], 1
jmp 0x1000ad87
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp + eax*4 - 0xf88]
cmp eax, dword [ebp - 0x75c]
jle 0x1000ada8
mov dword [ebp - 0x52c], 1
jmp 0x1000adaf
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0xb48]
cmp dword [ebp - 0x52c], eax
jge 0x1000adc9
mov dword [ebp - 0x904], 1
jmp 0x1000add0
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0x904]
test eax, eax
je 0x1000adfd
mov eax, dword [ebp - 0xec]
cmp dword [ebp + eax*4 - 0xf88], 0
je 0x1000adfd
mov dword [ebp - 0x534], 1
jmp 0x1000ae04
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0xb50], eax
jmp 0x1000acfe
mov eax, dword [ebp - 0x764]
cmp dword [ebp - 0x764], eax
jg 0x1000ae2f
mov dword [ebp - 0x53c], 1
jmp 0x1000ae36
and dword [ebp - 0x53c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa4c], 0x31e13ca4
jl 0x1000ae55
mov dword [ebp - 0x87c], 1
jmp 0x1000ae5c
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x53c]
cmp eax, dword [ebp - 0x87c]
je 0x1000ae76
mov dword [ebp - 0x544], 1
jmp 0x1000ae7d
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0xb58]
cmp dword [ebp - 0x544], eax
jne 0x1000aea0
mov eax, 0x3b7c
test eax, eax
je 0x1000aea0
mov dword [ebp - 0x76c], 1
jmp 0x1000aea7
and dword [ebp - 0x76c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x76c]
mov dword [ebp + eax - 0xa4c], ecx
mov dword [ebp - 0x60], 0x6801fc3e
mov dword [ebp - 0x50], 0
push 4
lea ecx, [ebp - 0x3a0]
call fcn.10016406
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x160], 0xffffffff
mov dword [ebp - 0xb68], 0xfff7
mov dword [ebp - 0xe2c], 0x2d863e32
mov dword [ebp - 0x390], 0xffffffff
mov dword [ebp - 0x57c], 0
mov dword [ebp - 0x380], 1
mov dword [ebp - 0x9e0], 0x791a13c5
mov dword [ebp - 0x378], 0xb0c4f31b
mov dword [ebp - 0x94], 0
jmp 0x1000af45
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x1000af67
push dword [ebp - 0x94]
lea ecx, [ebp - 0x3a0]
call fcn.100164a4
mov dword [eax], 0x9333
jmp 0x1000af38
mov dword [ebp - 0x94], 0
jmp 0x1000af80
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1000af9c
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xc5c], 0xffffffff
jmp 0x1000af73
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], eax
jl 0x1000b068
cmp dword [ebp - 0x60], 0x41145714
jne 0x1000afbd
mov dword [ebp - 0x54c], 1
jmp 0x1000afc4
and dword [ebp - 0x54c], 0
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100164a4
mov ecx, dword [ebp - 0x54c]
cmp ecx, dword [eax]
jne 0x1000afe7
mov dword [ebp - 0x954], 1
jmp 0x1000afee
and dword [ebp - 0x954], 0
mov esi, dword [ebp - 0x954]
neg esi
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100164a4
imul esi, dword [eax]
sub esi, 0x360de574
jne 0x1000b029
push 3
lea ecx, [ebp - 0x3a0]
call fcn.100164a4
cmp dword [eax], 0
jne 0x1000b029
and dword [ebp - 0x554], 0
jmp 0x1000b033
mov dword [ebp - 0x554], 1
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100164a4
mov ecx, dword [ebp - 0x554]
cmp ecx, dword [eax]
je 0x1000b068
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100164a4
cmp dword [eax], 0
je 0x1000b068
mov dword [ebp - 0x774], 1
jmp 0x1000b06f
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x160], eax
mov esi, dword [ebp - 0x160]
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100164a4
cmp esi, dword [eax]
jge 0x1000b09e
mov dword [ebp - 0x55c], 1
jmp 0x1000b0a5
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x55c]
jge 0x1000b0bc
mov dword [ebp - 0x884], 1
jmp 0x1000b0c3
and dword [ebp - 0x884], 0
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100164a4
mov ecx, dword [ebp - 0x884]
cmp ecx, dword [eax]
jne 0x1000b0e6
mov dword [ebp - 0x564], 1
jmp 0x1000b0ed
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x564]
jge 0x1000b10a
mov dword [ebp - 0x77c], 1
jmp 0x1000b111
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x77c], eax
jg 0x1000b128
mov dword [ebp - 0xb60], 1
jmp 0x1000b12f
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xe34], eax
mov dword [ebp - 0xb68], 0
cmp dword [ebp - 0x160], 0
je 0x1000b4ce
mov dword [ebp - 0x370], 0xfffffffb
mov dword [ebp - 0xb70], 0x59cde89c
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x388], 0xffffffff
mov dword [ebp - 0x58c], 0xdf123efb
mov dword [ebp - 0x594], 4
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0xe3c], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xe44], eax
mov eax, 0x3c1dc0ac
test eax, eax
jne 0x1000b1d4
mov dword [ebp - 0x56c], 1
jmp 0x1000b1db
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x56c], eax
jl 0x1000b1f2
mov dword [ebp - 0x90c], 1
jmp 0x1000b1f9
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x90c], eax
jg 0x1000b213
mov dword [ebp - 0x574], 1
jmp 0x1000b21a
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x574], eax
jge 0x1000b23a
cmp dword [ebp - 0x50], 0
je 0x1000b23a
mov dword [ebp - 0x784], 1
jmp 0x1000b241
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0xe4c], eax
mov esi, dword [ebp - 0xb70]
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100164a4
cmp esi, dword [eax]
jne 0x1000b27c
mov dword [ebp - 0x88c], 1
jmp 0x1000b283
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x88c], eax
jl 0x1000b29a
mov dword [ebp - 0x584], 1
jmp 0x1000b2a1
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x584], eax
jne 0x1000b2bb
mov dword [ebp - 0x78c], 1
jmp 0x1000b2c2
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x370]
cmp eax, dword [ebp - 0x78c]
jne 0x1000b2dc
mov dword [ebp - 0xa34], 1
jmp 0x1000b2e3
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 0
jne 0x1000b308
push 2
pop eax
test eax, eax
jne 0x1000b308
and dword [ebp - 0x96c], 0
jmp 0x1000b312
mov dword [ebp - 0x96c], 1
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0xe54], eax
mov esi, dword [ebp - 0x380]
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100164a4
sub esi, dword [eax]
cmp esi, dword [ebp - 0x380]
jg 0x1000b353
mov dword [ebp - 0x794], 1
jmp 0x1000b35a
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x794], eax
jl 0x1000b374
mov dword [ebp - 0x59c], 1
jmp 0x1000b37b
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x1d8]
imul eax, dword [ebp - 0x59c]
sub eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x9e0]
cmp eax, 0xde1f
je 0x1000b3ad
cmp dword [ebp - 0x378], 0
jne 0x1000b3ad
and dword [ebp - 0x894], 0
jmp 0x1000b3b7
mov dword [ebp - 0x894], 1
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x378], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x50]
imul ecx, dword [ebp - 0x378]
mov edx, dword [ebp - 0x160]
sub edx, ecx
cmp edx, dword [ebp + eax - 0xc5c]
jge 0x1000b3f0
mov dword [ebp - 0x5a4], 1
jmp 0x1000b3f7
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x5a4]
je 0x1000b42f
mov dword [ebp - 0x9e8], 0xb134
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9e8]
cmp dword [ebp + eax - 0xc5c], ecx
je 0x1000b4f9
mov dword [ebp - 0x5ac], 1
jmp 0x1000b500
and dword [ebp - 0x5ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc5c]
cmp eax, dword [ebp - 0x5ac]
jg 0x1000b521
mov dword [ebp - 0x914], 1
jmp 0x1000b528
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x390], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a0]
call fcn.10016488
push 2
lea ecx, [ebp - 0x9a0]
call fcn.10016406
mov dword [ebp - 4], 0xf
push 3
lea ecx, [ebp - 0x1f4]
call fcn.10016406
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x5e4], 0xe5477a75
mov dword [ebp - 0x9f8], 0x74bf7a83
mov dword [ebp - 0xac], 0
jmp 0x1000b595
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x1000b5b7
push dword [ebp - 0xac]
lea ecx, [ebp - 0x9a0]
call fcn.100164a4
mov dword [eax], 0xa8c6
jmp 0x1000b588
mov dword [ebp - 0xac], 0
jmp 0x1000b5d0
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x1000b5f2
push dword [ebp - 0xac]
lea ecx, [ebp - 0x1f4]
call fcn.100164a4
mov dword [eax], 0xfffffffb
jmp 0x1000b5c3
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100164a4
mov dword [eax], 1
jmp 0x1000b62b
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100164a4
cmp dword [eax], 0
jl 0x1000b9a5
mov dword [ebp - 0x20], 1
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x2d8], 0
jmp 0x1000b66b
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jge 0x1000b687
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0xb5c], 3
jmp 0x1000b65e
mov dword [ebp - 0x20], 1
jmp 0x1000b697
cmp dword [ebp - 0x20], 0
jl 0x1000b825
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9a0]
call fcn.100164a4
cmp dword [eax], 0
je 0x1000b6fb
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9a0]
call fcn.100164a4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xe5c], eax
push 1
lea ecx, [ebp - 0x1f4]
call fcn.100164a4
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100164a4
cmp dword [eax], 0
je 0x1000b6fb
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x7a4], eax
jl 0x1000b719
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], eax
jg 0x1000b83f
mov dword [ebp - 0x95c], 1
jmp 0x1000b846
and dword [ebp - 0x95c], 0
push 1
lea ecx, [ebp - 0x1f4]
call fcn.100164a4
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100164a4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x95c], eax
jge 0x1000b87c
mov byte [ebp - 0x112], 0
movzx eax, byte [ebp - 0x112]
test eax, eax
je 0x1000b9c4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1f4]
call fcn.10016488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9a0]
call fcn.10016488
push 2
lea ecx, [ebp - 0xbb4]
call fcn.10016406
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x2e0], 0
jmp 0x1000ba19
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 2
jge 0x1000ba3b
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xbb4]
call fcn.100164a4
mov dword [eax], 1
jmp 0x1000ba0c
mov dword [ebp - 0x180], 1
jmp 0x1000ba54
cmp dword [ebp - 0x180], 0
jl 0x1000ba87
push dword [ebp - 0x180]
lea ecx, [ebp - 0xbb4]
call fcn.100164a4
mov esi, eax
push dword [ebp - 0x180]
lea ecx, [ebp - 0xbb4]
call fcn.100164a4
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000ba47
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbb4]
call fcn.10016488
mov dword [ebp - 0x1b4], 0xffffffff
mov dword [ebp - 0x1b4], 0
jmp 0x1000bab9