Function at 0x100087ba
Capabilities:
Check os version
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072bfe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x102c
call fcn.1006eb90
push esi
push edi
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x1ac], 0xfffffffa
push 2
lea ecx, [ebp - 0xb9c]
call fcn.10016dd3
and dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
jmp 0x10008810
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10008826
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3f8], 0
jmp 0x10008809
mov dword [ebp - 0x2c], 0
jmp 0x10008836
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1000884f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb9c]
call fcn.10016e40
and dword [eax], 0
jmp 0x1000882f
mov dword [ebp - 0x2c], 0
jmp 0x1000885f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10008875
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa08], 0x9f4aec70
jmp 0x10008858
mov dword [ebp - 0x48], 0
jmp 0x10008885
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x100088c8
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x100088c6
push 0x20af
push 0
push 0
push 0x26a3
push 0xa2b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
jmp 0x1000887e
cmp dword [ebp - 0x48], 0
je 0x100089e1
mov dword [ebp - 0x48], 0xd0c1
cmp dword [ebp - 0x48], 0
jne 0x10008984
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x10008911
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3f8], 0
jne 0x10008911
and dword [ebp - 0x9b8], 0
jmp 0x1000891b
mov dword [ebp - 0x9b8], 1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3f8], 0
jne 0x10008937
xor eax, eax
jne 0x10008937
and dword [ebp - 0x470], 0
jmp 0x10008941
mov dword [ebp - 0x470], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x470], eax
jge 0x10008962
mov dword [ebp - 0x9e8], 1
jmp 0x10008969
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xd44], eax
mov eax, 0x23e4
test eax, eax
jne 0x10008984
and dword [ebp - 0x8d8], 0
jmp 0x1000898e
mov dword [ebp - 0x8d8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x8d8], eax
jl 0x100089b3
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x100089b3
and dword [ebp - 0x8e0], 0
jmp 0x100089bd
mov dword [ebp - 0x8e0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
imul eax, dword [ebp - 0x8e0]
test eax, eax
je 0x100089e1
mov dword [ebp - 0x8e8], 1
jmp 0x100089e8
and dword [ebp - 0x8e8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x8e8], eax
jge 0x10008a09
mov dword [ebp - 0x9f0], 1
jmp 0x10008a10
and dword [ebp - 0x9f0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0x1ac]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x3f8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3f8]
jle 0x10008a4f
mov dword [ebp - 0x8f0], 1
jmp 0x10008a56
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x8f0], eax
jge 0x10008a70
mov dword [ebp - 0x918], 1
jmp 0x10008a77
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x918], eax
jl 0x10008a91
mov dword [ebp - 0x9f8], 1
jmp 0x10008a98
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x1ac]
sub eax, 0x2afa4368
neg eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3f8]
jne 0x10008ac0
mov dword [ebp - 0x920], 1
jmp 0x10008ac7
and dword [ebp - 0x920], 0
cmp dword [ebp - 0x920], 0xffffffff
je 0x10008adc
mov dword [ebp - 0x928], 1
jmp 0x10008ae3
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x1ac], eax
mov eax, 0xfff6
cmp eax, 0xa9cb
je 0x10008b07
mov dword [ebp - 0x930], 1
jmp 0x10008b0e
and dword [ebp - 0x930], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x930]
imul ecx, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0x938], ecx
push 0
lea ecx, [ebp - 0xb9c]
call fcn.10016e40
mov ecx, dword [ebp - 0x938]
mov dword [eax], ecx
cmp dword [ebp - 0x938], 0
jne 0x10008b55
cmp dword [ebp - 0x48], 0
jne 0x10008b55
and dword [ebp - 0xa00], 0
jmp 0x10008b5f
mov dword [ebp - 0xa00], 1
push 0
lea ecx, [ebp - 0xb9c]
call fcn.10016e40
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0xe34], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa08], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb9c]
call fcn.10016e3b
mov dword [ebp - 0x58], 5
mov dword [ebp - 0x1b4], 0xfffffffa
push 2
lea ecx, [ebp - 0xbb4]
call fcn.10016dd3
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], 0
jmp 0x10008bd4
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10008bea
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3e8], 0
jmp 0x10008bcd
mov dword [ebp - 0x20], 0
jmp 0x10008bfa
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10008c13
push dword [ebp - 0x20]
lea ecx, [ebp - 0xbb4]
call fcn.10016e40
and dword [eax], 0
jmp 0x10008bf3
mov dword [ebp - 0x20], 0
jmp 0x10008c23
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10008c39
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xac0], 0x9f4aec70
jmp 0x10008c1c
mov dword [ebp - 0x58], 0
jmp 0x10008c49
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x10008c8c
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10008c8a
push 0x20af
push 0
push 0
push 0x26a3
push 0xa2b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
jmp 0x10008c42
cmp dword [ebp - 0x58], 0
je 0x10008da5
mov dword [ebp - 0x58], 0xd0c1
cmp dword [ebp - 0x58], 0
jne 0x10008d48
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3e8]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x10008cd5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3e8], 0
jne 0x10008cd5
and dword [ebp - 0xa10], 0
jmp 0x10008cdf
mov dword [ebp - 0xa10], 1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3e8], 0
jne 0x10008cfb
xor eax, eax
jne 0x10008cfb
and dword [ebp - 0x940], 0
jmp 0x10008d05
mov dword [ebp - 0x940], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e8]
cmp dword [ebp - 0x940], eax
jge 0x10008d26
mov dword [ebp - 0xa18], 1
jmp 0x10008d2d
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xd28], eax
mov eax, 0x23e4
test eax, eax
jne 0x10008d48
and dword [ebp - 0x948], 0
jmp 0x10008d52
mov dword [ebp - 0x948], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e8]
cmp dword [ebp - 0x948], eax
jl 0x10008d77
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10008d77
and dword [ebp - 0x950], 0
jmp 0x10008d81
mov dword [ebp - 0x950], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e8]
imul eax, dword [ebp - 0x950]
test eax, eax
je 0x10008da5
mov dword [ebp - 0x95c], 1
jmp 0x10008dac
and dword [ebp - 0x95c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3e8]
cmp dword [ebp - 0x95c], eax
jge 0x10008dcd
mov dword [ebp - 0xaa8], 1
jmp 0x10008dd4
and dword [ebp - 0xaa8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3e8]
mov dword [ebp - 0xd30], eax
mov eax, dword [ebp - 0x1b4]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x3e8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3e8]
jle 0x10008e13
mov dword [ebp - 0x8fc], 1
jmp 0x10008e1a
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x8fc], eax
jge 0x10008e34
mov dword [ebp - 0x45c], 1
jmp 0x10008e3b
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x45c], eax
jl 0x10008e55
mov dword [ebp - 0xab0], 1
jmp 0x10008e5c
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x1b4]
sub eax, 0x2afa4368
neg eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3e8]
jne 0x10008e84
mov dword [ebp - 0x44c], 1
jmp 0x10008e8b
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0xffffffff
je 0x10008ea0
mov dword [ebp - 0x8c0], 1
jmp 0x10008ea7
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x1b4], eax
mov eax, 0xfff6
cmp eax, 0xa9cb
je 0x10008ecb
mov dword [ebp - 0x454], 1
jmp 0x10008ed2
and dword [ebp - 0x454], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x454]
imul ecx, dword [ebp + eax - 0x3e8]
mov dword [ebp - 0x8c8], ecx
push 0
lea ecx, [ebp - 0xbb4]
call fcn.10016e40
mov ecx, dword [ebp - 0x8c8]
mov dword [eax], ecx
cmp dword [ebp - 0x8c8], 0
jne 0x10008f19
cmp dword [ebp - 0x58], 0
jne 0x10008f19
and dword [ebp - 0xab8], 0
jmp 0x10008f23
mov dword [ebp - 0xab8], 1
push 0
lea ecx, [ebp - 0xbb4]
call fcn.10016e40
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e8]
mov dword [ebp - 0xd38], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xac0], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbb4]
call fcn.10016e3b
mov dword [ebp - 0xac8], 0xa1f94964
mov dword [ebp - 0x29c], 4
mov dword [ebp - 0x318], 3
mov dword [ebp - 0xad8], 0x3b6f9b69
cmp dword [ebp - 0xac8], 0
je 0x10009024
cmp dword [ebp - 0x29c], 0xfffffffa
jg 0x10008fad
mov dword [ebp - 0x8d0], 1
jmp 0x10008fb4
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
sub eax, dword [ebp - 0x29c]
jne 0x10008fe0
cmp dword [ebp - 0x318], 0
jne 0x10008fe0
and dword [ebp - 0xad0], 0
jmp 0x10008fea
mov dword [ebp - 0xad0], 1
cmp dword [ebp - 0x29c], 0
jne 0x10009005
cmp dword [ebp - 0x29c], 0
jne 0x10009005
and dword [ebp - 0x8dc], 0
jmp 0x1000900f
mov dword [ebp - 0x8dc], 1
cmp dword [ebp - 0x8dc], 1
je 0x10009024
mov dword [ebp - 0x464], 1
jmp 0x1000902b
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0xad8], eax
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x1000905d
push 0x12e6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x2a4], 0xfdf99ff6
mov dword [ebp - 0xd0c], 0x5bf25cbd
mov dword [ebp - 0xd10], 0xfffffff7
mov dword [ebp - 0xd18], 0xe673292c
mov dword [ebp - 0x1f0], 0
jmp 0x100090a5
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x100090c1
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x1018], 0xfffffffe
jmp 0x10009098
mov dword [ebp - 0x2a4], 0
jmp 0x100090da
mov eax, dword [ebp - 0x2a4]
dec eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0xfffffffc
je 0x10009172
mov dword [ebp - 0xd20], 0x6444
mov dword [ebp - 0xd68], 0xeb7161ab
push 1
lea ecx, [ebp - 0xeb0]
call fcn.10016dd3
mov dword [ebp - 4], 2
mov dword [ebp - 0x6f4], 0xd91e66c6
mov dword [ebp - 0x1f8], 0
jmp 0x10009132
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jge 0x10009151
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xeb0]
call fcn.10016e40
or dword [eax], 0xffffffff
jmp 0x10009125
mov eax, dword [ebp - 0x6f4]
inc eax
mov dword [ebp - 0x6f4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeb0]
call fcn.10016e3b
jmp 0x100090cd
mov dword [ebp - 0x1a4], 0xfffffffa
push 2
lea ecx, [ebp - 0xbcc]
call fcn.10016dd3
mov dword [ebp - 4], 3
mov dword [ebp - 0x2ac], 0
jmp 0x100091a9
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 1
jge 0x100091c5
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x200], 0xfc558bac
jmp 0x1000919c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x200], 0
je 0x100091f1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x200], 0
je 0x100091f1
mov dword [ebp - 0x83c], 1
jmp 0x100091f8
and dword [ebp - 0x83c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x200], 0
jne 0x10009214
mov dword [ebp - 0x46c], 1
jmp 0x1000921b
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 0
jle 0x10009230
mov dword [ebp - 0x474], 1
jmp 0x10009237
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x83c]
cmp eax, dword [ebp - 0x474]
jl 0x10009251
mov dword [ebp - 0x6fc], 1
jmp 0x10009258
and dword [ebp - 0x6fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6fc]
mov dword [ebp + eax - 0x200], ecx
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000928e
push 0
push 0x185c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [ebp - 0x28], 0
jmp 0x1000929e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x100092b4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3c8], 0
jmp 0x10009297
mov dword [ebp - 0x28], 0
jmp 0x100092c4
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x100092dd
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbcc]
call fcn.10016e40
and dword [eax], 0
jmp 0x100092bd
mov dword [ebp - 0x28], 0
jmp 0x100092ed
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x10009303
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb08], 0x9f4aec70
jmp 0x100092e6
mov dword [ebp - 0x50], 0
jmp 0x10009313
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jg 0x10009356
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x10009354
push 0x20af
push 0
push 0
push 0x26a3
push 0xa2b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
jmp 0x1000930c
cmp dword [ebp - 0x50], 0
je 0x1000946f
mov dword [ebp - 0x50], 0xd0c1
cmp dword [ebp - 0x50], 0
jne 0x10009412
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3c8]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x1000939f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3c8], 0
jne 0x1000939f
and dword [ebp - 0xae0], 0
jmp 0x100093a9
mov dword [ebp - 0xae0], 1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3c8], 0
jne 0x100093c5
xor eax, eax
jne 0x100093c5
and dword [ebp - 0x47c], 0
jmp 0x100093cf
mov dword [ebp - 0x47c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c8]
cmp dword [ebp - 0x47c], eax
jge 0x100093f0
mov dword [ebp - 0xae8], 1
jmp 0x100093f7
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xd70], eax
mov eax, 0x23e4
test eax, eax
jne 0x10009412
and dword [ebp - 0x94c], 0
jmp 0x1000941c
mov dword [ebp - 0x94c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c8]
cmp dword [ebp - 0x94c], eax
jl 0x10009441
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10009441
and dword [ebp - 0x484], 0
jmp 0x1000944b
mov dword [ebp - 0x484], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3c8]
imul eax, dword [ebp - 0x484]
test eax, eax
je 0x1000946f
mov dword [ebp - 0x704], 1
jmp 0x10009476
and dword [ebp - 0x704], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3c8]
cmp dword [ebp - 0x704], eax
jge 0x10009497
mov dword [ebp - 0xaf0], 1
jmp 0x1000949e
and dword [ebp - 0xaf0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3c8]
mov dword [ebp - 0xd78], eax
mov eax, dword [ebp - 0x1a4]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x3c8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3c8]
jle 0x100094dd
mov dword [ebp - 0x48c], 1
jmp 0x100094e4
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x48c], eax
jge 0x100094fe
mov dword [ebp - 0x844], 1
jmp 0x10009505
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x844], eax
jl 0x1000951f
mov dword [ebp - 0xaf8], 1
jmp 0x10009526
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0x1a4]
sub eax, 0x2afa4368
neg eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3c8]
jne 0x1000954e
mov dword [ebp - 0x494], 1
jmp 0x10009555
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0xffffffff
je 0x1000956a
mov dword [ebp - 0x70c], 1
jmp 0x10009571
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x1a4], eax
mov eax, 0xfff6
cmp eax, 0xa9cb
je 0x10009595
mov dword [ebp - 0x49c], 1
jmp 0x1000959c
and dword [ebp - 0x49c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x49c]
imul ecx, dword [ebp + eax - 0x3c8]
mov dword [ebp - 0x8e4], ecx
push 0
lea ecx, [ebp - 0xbcc]
call fcn.10016e40
mov ecx, dword [ebp - 0x8e4]
mov dword [eax], ecx
cmp dword [ebp - 0x8e4], 0
jne 0x100095e3
cmp dword [ebp - 0x50], 0
jne 0x100095e3
and dword [ebp - 0xb00], 0
jmp 0x100095ed
mov dword [ebp - 0xb00], 1
push 0
lea ecx, [ebp - 0xbcc]
call fcn.10016e40
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c8]
mov dword [ebp - 0xd80], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb08], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbcc]
call fcn.10016e3b
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x19c], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xd90], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xd98], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jge 0x1000966d
mov dword [ebp - 0x4a4], 1
jmp 0x10009674
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0x8029
jle 0x1000968c
mov dword [ebp - 0x714], 1
jmp 0x10009693
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
sub eax, dword [ebp - 0x714]
cmp eax, dword [ebp - 0x34]
jl 0x100096b9
mov dword [ebp - 0x4ac], 1
jmp 0x100096c0
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x4ac], eax
jge 0x100096d7
mov dword [ebp - 0x84c], 1
jmp 0x100096de
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 0xe4e91208
jne 0x100096f6
mov dword [ebp - 0x4b4], 1
jmp 0x100096fd
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0xf09a2b44
jb 0x10009715
mov dword [ebp - 0x71c], 1
jmp 0x1000971c
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x71c], eax
jl 0x10009743
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x10009741
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x100097ab
mov dword [ebp - 0x19c], 0
jmp 0x1000975c
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xfffffffc
jne 0x100097ab
mov dword [ebp - 0xb40], 0xfffffff8
mov dword [ebp - 0x34], 8
jmp 0x1000977f
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xe
jne 0x100097a9
mov dword [ebp - 0x4bc], 1
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0xb40], 0
je 0x100097a7
jmp 0x100097a9
jmp 0x10009778
jmp 0x1000974f
mov dword [ebp - 0xb48], 0xa1f94964
mov dword [ebp - 0x2b4], 4
mov dword [ebp - 0x37c], 3
mov dword [ebp - 0x9e0], 0x3b6f9b69
cmp dword [ebp - 0xb48], 0
je 0x1000986c
cmp dword [ebp - 0x2b4], 0xfffffffa
jg 0x100097f5
mov dword [ebp - 0x8f8], 1
jmp 0x100097fc
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
sub eax, dword [ebp - 0x2b4]
jne 0x10009828
cmp dword [ebp - 0x37c], 0
jne 0x10009828
and dword [ebp - 0xaac], 0
jmp 0x10009832
mov dword [ebp - 0xaac], 1
cmp dword [ebp - 0x2b4], 0
jne 0x1000984d
cmp dword [ebp - 0x2b4], 0
jne 0x1000984d
and dword [ebp - 0x4c4], 0
jmp 0x10009857
mov dword [ebp - 0x4c4], 1
cmp dword [ebp - 0x4c4], 1
je 0x1000986c
mov dword [ebp - 0x724], 1
jmp 0x10009873
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x9e0], eax
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x100098a5
push 0x12e6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 3
lea ecx, [ebp - 0xce0]
call fcn.10016dd3
mov dword [ebp - 4], 4
mov dword [ebp - 0x1b8], 0xfffffff7
mov dword [ebp - 0xda0], 0xfffffff9
mov dword [ebp - 0xda8], 0x22e974a5
mov dword [ebp - 0xdb0], 0xfffffffb
mov dword [ebp - 0xdb8], 1
mov dword [ebp - 0xa40], 0xfffffffe
mov dword [ebp - 0x2bc], 0xab46
mov dword [ebp - 0x9cc], 0xfc37f20b
mov dword [ebp - 0x70], 0
jmp 0x10009919
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10009935
push dword [ebp - 0x70]
lea ecx, [ebp - 0xce0]
call fcn.10016e40
mov dword [eax], 0xc204
jmp 0x10009912
mov dword [ebp - 0x70], 0
jmp 0x10009945
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1000995b
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x9c4], 6
jmp 0x1000993e
mov dword [ebp - 0x1b8], 2
jmp 0x10009974
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x100099ec
mov dword [ebp - 0x208], 0xfffffffb
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x100099a9
push 0x1455
push 0x18d2
call dword [sym.imp.USER32.dll_SetCaretPos]
mov dword [ebp - 0x208], 0
jmp 0x100099c2
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jg 0x100099e7
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x100099e5
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x100099b5
jmp 0x10009967
cmp dword [ebp - 0x1b8], 0xdb5a
jne 0x10009a4f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c4], 0xffffffff
jb 0x10009a14
mov dword [ebp - 0x4cc], 1
jmp 0x10009a1b
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 0xcc33bab7
jae 0x10009a33
mov dword [ebp - 0x854], 1
jmp 0x10009a3a
and dword [ebp - 0x854], 0
cmp dword [ebp - 0x854], 1
ja 0x10009a4f
mov dword [ebp - 0x4d4], 1
jmp 0x10009a56
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 0xfffffffa
jne 0x10009a6b
mov dword [ebp - 0x72c], 1
jmp 0x10009a72
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
imul eax, dword [ebp - 0x72c]
sub eax, 0xb221
imul eax, eax, 0x9f36
cmp eax, 0xfb38
jl 0x10009aaa
mov dword [ebp - 0x4dc], 1
jmp 0x10009ab1
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0xa40]
cmp dword [ebp - 0x4dc], eax
jge 0x10009ad1
cmp dword [ebp - 0x2bc], 0
jne 0x10009ad1
and dword [ebp - 0x8ec], 0
jmp 0x10009adb
mov dword [ebp - 0x8ec], 1
push 0
lea ecx, [ebp - 0xce0]
call fcn.10016e40
mov ecx, dword [ebp - 0x8ec]
cmp ecx, dword [eax]
jl 0x10009afe
mov dword [ebp - 0x4e4], 1
jmp 0x10009b05
and dword [ebp - 0x4e4], 0
imul eax, dword [ebp - 0x4e4], 0x700d
mov dword [ebp - 0x9cc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xce0]
call fcn.10016e3b
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x194], 1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xdc0], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xdc8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jge 0x10009b64
mov dword [ebp - 0x734], 1
jmp 0x10009b6b
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 0x8029
jle 0x10009b83
mov dword [ebp - 0x4ec], 1
jmp 0x10009b8a
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
sub eax, dword [ebp - 0x4ec]
cmp eax, dword [ebp - 0x3c]
jl 0x10009bb0
mov dword [ebp - 0x85c], 1
jmp 0x10009bb7
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x85c], eax
jge 0x10009bce
mov dword [ebp - 0x4f4], 1
jmp 0x10009bd5
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0xe4e91208
jne 0x10009bed
mov dword [ebp - 0x73c], 1
jmp 0x10009bf4
and dword [ebp - 0x73c], 0
cmp dword [ebp - 0x73c], 0xf09a2b44
jb 0x10009c0c
mov dword [ebp - 0x4fc], 1
jmp 0x10009c13
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x4fc], eax
jl 0x10009c3a
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x10009c38
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x10009ca2
mov dword [ebp - 0x194], 0
jmp 0x10009c53
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xfffffffc
jne 0x10009ca2
mov dword [ebp - 0xa48], 0xfffffff8
mov dword [ebp - 0x3c], 8
jmp 0x10009c76
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xe
jne 0x10009ca0
mov dword [ebp - 0x900], 1
mov eax, dword [ebp - 0x900]
inc eax
mov dword [ebp - 0x900], eax
cmp dword [ebp - 0xa48], 0
je 0x10009c9e
jmp 0x10009ca0
jmp 0x10009c6f
jmp 0x10009c46
mov dword [ebp - 0x9d4], 0xbeaa
push 1
lea ecx, [ebp - 0xc80]
call fcn.10016dd3
mov dword [ebp - 4], 5
mov dword [ebp - 0xdd8], 0xf69f
mov dword [ebp - 0x210], 0
jmp 0x10009ce3
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x10009d05
push dword [ebp - 0x210]
lea ecx, [ebp - 0xc80]
call fcn.10016e40
mov dword [eax], 0xb457102d
jmp 0x10009cd6
mov esi, dword [ebp - 0x9d4]
push 0
lea ecx, [ebp - 0xc80]
call fcn.10016e40
mov dword [eax], esi
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x10009d32
call dword [sym.imp.KERNEL32.dll_GetVersion]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc80]
call fcn.10016e3b
mov dword [ebp - 0xa50], 0xa1f94964
mov dword [ebp - 0x2c4], 4
mov dword [ebp - 0x328], 3
mov dword [ebp - 0xa20], 0x3b6f9b69
cmp dword [ebp - 0xa50], 0
je 0x10009e02
cmp dword [ebp - 0x2c4], 0xfffffffa
jg 0x10009d8b
mov dword [ebp - 0x504], 1
jmp 0x10009d92
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
sub eax, dword [ebp - 0x2c4]
jne 0x10009dbe
cmp dword [ebp - 0x328], 0
jne 0x10009dbe
and dword [ebp - 0x9dc], 0
jmp 0x10009dc8
mov dword [ebp - 0x9dc], 1
cmp dword [ebp - 0x2c4], 0
jne 0x10009de3
cmp dword [ebp - 0x2c4], 0
jne 0x10009de3
and dword [ebp - 0x744], 0
jmp 0x10009ded
mov dword [ebp - 0x744], 1
cmp dword [ebp - 0x744], 1
je 0x10009e02
mov dword [ebp - 0x50c], 1
jmp 0x10009e09
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0xa20], eax
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x10009e3b
push 0x12e6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x218], 0xffffffff
mov dword [ebp - 0xde0], 0xfffffffa
mov dword [ebp - 0xb78], 0x822c
mov dword [ebp - 0xb74], 0x822c
mov dword [ebp - 0xb70], 0x822c
mov dword [ebp - 0xb6c], 0x822c
mov dword [ebp - 0x218], 0xb
jmp 0x10009e90
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffff
jge 0x10009f17
mov dword [ebp - 0x2cc], 0xffffffff
mov dword [ebp - 0xde8], 0x693e932
mov dword [ebp - 0xdf0], 0xfffffff8
mov dword [ebp - 0xdf8], 0xa98815cb
mov dword [ebp - 0x2cc], 0
jmp 0x10009eda
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 3
jl 0x10009f12
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb78]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xb78], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb78], 0
je 0x10009f10
jmp 0x10009f12
jmp 0x10009ecd
jmp 0x10009e83
push 3
lea ecx, [ebp - 0xc8c]
call fcn.10016dd3
mov dword [ebp - 4], 6
mov dword [ebp - 0x1bc], 0xfffffff7
mov dword [ebp - 0xe00], 0xfffffff9
mov dword [ebp - 0xe08], 0x22e974a5
mov dword [ebp - 0xe10], 0xfffffffb
mov dword [ebp - 0xe18], 1
mov dword [ebp - 0xa60], 0xfffffffe
mov dword [ebp - 0x2d4], 0xab46
mov dword [ebp - 0x9ec], 0xfc37f20b
mov dword [ebp - 0xb8], 0
jmp 0x10009f94
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x10009fb6
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xc8c]
call fcn.10016e40
mov dword [eax], 0xc204
jmp 0x10009f87
mov dword [ebp - 0xb8], 0
jmp 0x10009fcf
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x10009feb
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x9e4], 6
jmp 0x10009fc2
mov dword [ebp - 0x1bc], 2
jmp 0x1000a004
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jl 0x1000a07c
mov dword [ebp - 0x220], 0xfffffffb
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x1000a039
push 0x1455
push 0x18d2
call dword [sym.imp.USER32.dll_SetCaretPos]
mov dword [ebp - 0x220], 0
jmp 0x1000a052
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jg 0x1000a077
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1000a075
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x1000a045
jmp 0x10009ff7
cmp dword [ebp - 0x1bc], 0xdb5a
jne 0x1000a0df
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9e4], 0xffffffff
jb 0x1000a0a4
mov dword [ebp - 0x864], 1
jmp 0x1000a0ab
and dword [ebp - 0x864], 0
cmp dword [ebp - 0x864], 0xcc33bab7
jae 0x1000a0c3
mov dword [ebp - 0x514], 1
jmp 0x1000a0ca
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 1
ja 0x1000a0df
mov dword [ebp - 0x74c], 1
jmp 0x1000a0e6
and dword [ebp - 0x74c], 0
cmp dword [ebp - 0x74c], 0xfffffffa
jne 0x1000a0fb
mov dword [ebp - 0x51c], 1
jmp 0x1000a102
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
imul eax, dword [ebp - 0x51c]
sub eax, 0xb221
imul eax, eax, 0x9f36
cmp eax, 0xfb38
jl 0x1000a13a
mov dword [ebp - 0x8f4], 1
jmp 0x1000a141
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0xa60]
cmp dword [ebp - 0x8f4], eax
jge 0x1000a161
cmp dword [ebp - 0x2d4], 0
jne 0x1000a161
and dword [ebp - 0x524], 0
jmp 0x1000a16b
mov dword [ebp - 0x524], 1
push 0
lea ecx, [ebp - 0xc8c]
call fcn.10016e40
mov ecx, dword [ebp - 0x524]
cmp ecx, dword [eax]
jl 0x1000a18e
mov dword [ebp - 0x754], 1
jmp 0x1000a195
and dword [ebp - 0x754], 0
imul eax, dword [ebp - 0x754], 0x700d
mov dword [ebp - 0x9ec], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8c]
call fcn.10016e3b
push 2
lea ecx, [ebp - 0xec0]
call fcn.10016dd3
mov dword [ebp - 4], 7
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x228], 0
jmp 0x1000a1eb
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x1000a20d
push dword [ebp - 0x228]
lea ecx, [ebp - 0xec0]
call fcn.10016e40
mov dword [eax], 0x55bb2c21
jmp 0x1000a1de
mov dword [ebp - 0x2dc], 0
jmp 0x1000a226
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 1
jg 0x1000a31c
mov dword [ebp - 0x1cc], 0x5260417b
mov dword [ebp - 0x1cc], 1
jmp 0x1000a256
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jl 0x1000a309
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0xe0], 0
jmp 0x1000a286
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jg 0x1000a2b1
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1000a2af
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x1000a279
mov dword [ebp - 0xe0], 0
jmp 0x1000a2ca
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jg 0x1000a304
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x1000a302
push 0
push 0x2606
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x1000a2bd
jmp 0x1000a249
cmp dword [ebp - 0x1cc], 0
je 0x1000a317
jmp 0x1000a219
jmp 0x1000a219
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec0]
call fcn.10016e3b
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x188], 1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xe20], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xe28], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jge 0x1000a36b
mov dword [ebp - 0x52c], 1
jmp 0x1000a372
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0x8029
jle 0x1000a38a
mov dword [ebp - 0x86c], 1
jmp 0x1000a391
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
sub eax, dword [ebp - 0x86c]
cmp eax, dword [ebp - 0x38]
jl 0x1000a3b7
mov dword [ebp - 0x534], 1
jmp 0x1000a3be
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x534], eax
jge 0x1000a3d5
mov dword [ebp - 0x75c], 1
jmp 0x1000a3dc
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x75c], 0xe4e91208
jne 0x1000a3f4
mov dword [ebp - 0x53c], 1
jmp 0x1000a3fb
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 0xf09a2b44
jb 0x1000a413
mov dword [ebp - 0x908], 1
jmp 0x1000a41a
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x908], eax
jl 0x1000a441
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x1000a43f
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x1000a4a9
mov dword [ebp - 0x188], 0
jmp 0x1000a45a
cmp dword [ebp - 0x188], 0xfffffffc
jne 0x1000a4a9
mov dword [ebp - 0xa68], 0xfffffff8
mov dword [ebp - 0x38], 8
jmp 0x1000a47d
cmp dword [ebp - 0x38], 0xe
jne 0x1000a4a7
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0xa68], 0
je 0x1000a4a5
jmp 0x1000a44d
mov dword [ebp - 0x9f4], 0xbeaa
push 1
lea ecx, [ebp - 0xca4]
call fcn.10016dd3
mov dword [ebp - 4], 8
mov dword [ebp - 0xe38], 0xf69f
mov dword [ebp - 0x230], 0
jmp 0x1000a4ea
cmp dword [ebp - 0x230], 1
jge 0x1000a50c
push dword [ebp - 0x230]
lea ecx, [ebp - 0xca4]
call fcn.10016e40
mov dword [eax], 0xb457102d
jmp 0x1000a4dd
mov esi, dword [ebp - 0x9f4]
push 0
lea ecx, [ebp - 0xca4]
call fcn.10016e40
mov dword [eax], esi
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x1000a539