Function at 0x1000a934
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008afdd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1744
call fcn.10088560
push esi
push edi
push 3
lea ecx, [ebp - 0x13e4]
call fcn.10018e8a
and dword [ebp - 4], 0
mov dword [ebp - 0x26c], 0xffffffff
mov dword [ebp - 0x160c], 0xffffffff
mov dword [ebp - 0x6c0], 0x44f4cc51
mov dword [ebp - 0xb18], 1
mov dword [ebp - 0xc0], 0
jmp 0x1000a9aa
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1000a9cc
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x13e4]
call fcn.10018f28
mov dword [eax], 0x334
jmp 0x1000a99d
mov dword [ebp - 0xc0], 0
jmp 0x1000a9e5
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x1000aa01
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x1688], 0xffffffff
jmp 0x1000a9d8
mov dword [ebp - 0x26c], 2
jmp 0x1000aa1a
mov eax, dword [ebp - 0x26c]
dec eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jl 0x1000ab2c
mov dword [ebp - 0x15b0], 0x6ff23b1a
mov dword [ebp - 0x1354], 0xfffffffe
mov dword [ebp - 0x14e8], 0xfffffffc
mov dword [ebp - 0x135c], 0xffffffff
mov dword [ebp - 0xfb0], 0x6c902da
mov dword [ebp - 0xfac], 0x6c902da
mov dword [ebp - 0xfa8], 0x6c902da
mov dword [ebp - 0xfa4], 0x6c902da
lea ecx, [ebp - 0x469]
call fcn.1000a6f3
push eax
lea eax, [ebp - 0xfa0]
push eax
lea eax, [ebp - 0xfb0]
push eax
lea ecx, [ebp - 0x16a0]
call fcn.10018f37
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1644]
call fcn.10018ee6
mov byte [ebp - 4], 1
push 1
lea ecx, [ebp - 0x13d4]
call fcn.10018e8a
mov byte [ebp - 4], 2
mov dword [ebp - 0x2e8], 0
jmp 0x1000aada
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 1
jge 0x1000aafc
push dword [ebp - 0x2e8]
lea ecx, [ebp - 0x13d4]
call fcn.10018f28
mov dword [eax], 0x7dcda720
jmp 0x1000aacd
mov eax, dword [ebp - 0x6c0]
dec eax
mov dword [ebp - 0x6c0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x13d4]
call fcn.10018f0c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1644]
call fcn.10018f0c
jmp 0x1000aa0d
mov eax, dword [ebp - 0xb18]
dec eax
mov dword [ebp - 0xb18], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13e4]
call fcn.10018f0c
push 2
lea ecx, [ebp - 0x13f4]
call fcn.10018e8a
mov dword [ebp - 4], 3
mov dword [ebp - 0x328], 0x57976326
mov dword [ebp - 0x270], 0
jmp 0x1000ab7f
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 2
jge 0x1000ab9e
push dword [ebp - 0x270]
lea ecx, [ebp - 0x13f4]
call fcn.10018f28
and dword [eax], 0
jmp 0x1000ab72
mov dword [ebp - 0x328], 1
jmp 0x1000abb7
mov eax, dword [ebp - 0x328]
dec eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jl 0x1000abef
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1000abed
push 0
push 0
push 0x13f8
push 0xe75
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x1000abaa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13f4]
call fcn.10018f0c
mov dword [ebp - 0xb6c], 0x464b
mov dword [ebp - 0xd70], 0x4c506d44
mov dword [ebp - 0xd60], 0x7b1c2a2c
mov dword [ebp - 0x1634], 0xfffffffb
mov dword [ebp - 0x1364], 0xfffffffc
mov dword [ebp - 0xb54], 0xcf09cc25
mov dword [ebp - 0xd68], 0
mov dword [ebp - 0xdc0], 0xfffffffe
mov dword [ebp - 0x14f8], 0x368a9017
mov dword [ebp - 0x136c], 0xf298
mov dword [ebp - 0x278], 0
push 3
lea ecx, [ebp - 0xeac]
call fcn.10018e8a
mov dword [ebp - 4], 4
mov dword [ebp - 0x88], 0
jmp 0x1000ac99
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1000acb5
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x3b0], 0xffffffff
jmp 0x1000ac8c
mov dword [ebp - 0x88], 0
jmp 0x1000acce
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1000acf0
push dword [ebp - 0x88]
lea ecx, [ebp - 0xeac]
call fcn.10018f28
mov dword [eax], 0x2d14b432
jmp 0x1000acc1
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
imul eax, dword [ebp - 0xdc0], 0x2214
test eax, eax
je 0x1000ad20
mov eax, 0xfff7
test eax, eax
je 0x1000ad20
mov dword [ebp - 0xb20], 1
jmp 0x1000ad27
and dword [ebp - 0xb20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b0]
cmp dword [ebp - 0xb20], eax
jle 0x1000ad48
mov dword [ebp - 0xb28], 1
jmp 0x1000ad4f
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0xb28], eax
jne 0x1000ad69
mov dword [ebp - 0xd58], 1
jmp 0x1000ad70
and dword [ebp - 0xd58], 0
mov dword [ebp - 0xb54], 0x6e60be62
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0x15b8], eax
push 1
lea ecx, [ebp - 0xeac]
call fcn.10018f28
cmp dword [eax], 0
je 0x1000ada5
push 2
lea ecx, [ebp - 0xeac]
call fcn.10018f28
mov eax, dword [ebp - 0xb6c]
cmp dword [ebp - 0xd60], eax
jg 0x1000adbf
mov dword [ebp - 0xb5c], 1
jmp 0x1000adc6
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0xd68]
cmp dword [ebp - 0xb5c], eax
jle 0x1000ade0
mov dword [ebp - 0xb64], 1
jmp 0x1000ade7
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0xb64]
jmp 0x1000ae01
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0xb6c]
cmp dword [ebp - 0xb74], eax
jge 0x1000ae22
mov dword [ebp - 0xb7c], 1
jmp 0x1000ae29
and dword [ebp - 0xb7c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b0]
cmp dword [ebp - 0xb7c], eax
jne 0x1000ae4a
mov dword [ebp - 0xb84], 1
jmp 0x1000ae51
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0xb84]
sub eax, dword [ebp - 0xd70]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3b0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeac]
call fcn.10018f0c
push 3
lea ecx, [ebp - 0x1424]
call fcn.10018e8a
mov dword [ebp - 4], 5
mov dword [ebp - 0x2f0], 0xba394643
mov dword [ebp - 0x13a0], 0xa622a149
mov dword [ebp - 0x1558], 0x672ca3c0
mov dword [ebp - 0x13a8], 8
mov dword [ebp - 0x15c8], 0xffffffff
mov dword [ebp - 0x13b0], 0xd658edfe
mov dword [ebp - 0x1560], 0x87a7525d
mov dword [ebp - 0x13b8], 0x9cf13e13
mov dword [ebp - 0x1604], 0xfffffffa
mov dword [ebp - 0x13c0], 0xfffffff9
mov dword [ebp - 0x1568], 0xfffffff7
mov dword [ebp - 0x13c8], 0xa165018
mov dword [ebp - 0x15d0], 0x28405cef
push 3
lea ecx, [ebp - 0x1404]
call fcn.10018e8a
mov byte [ebp - 4], 6
mov dword [ebp - 0x13d8], 1
mov dword [ebp - 0x1570], 0x16488a97
mov dword [ebp - 0xb94], 0
mov dword [ebp - 0xd8], 0
jmp 0x1000af57
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 4
jge 0x1000af73
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x1740], 3
jmp 0x1000af4a
mov dword [ebp - 0xd8], 0
jmp 0x1000af8c
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x1000afae
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1404]
call fcn.10018f28
mov dword [eax], 0x64f6cbcb
jmp 0x1000af7f
mov dword [ebp - 0x2f0], 3
jmp 0x1000afc7
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
jl 0x1000b00a
mov dword [ebp - 0xb8c], 0x9609c3fb
mov eax, dword [ebp - 0xb8c]
inc eax
mov dword [ebp - 0xb8c], eax
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1000b008
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x1000afba
mov eax, dword [ebp - 0xb94]
dec eax
mov dword [ebp - 0xb94], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1404]
call fcn.10018f0c
mov dword [ebp - 0x280], 0xffffffff
mov dword [ebp - 0x13e8], 0xffffffff
mov dword [ebp - 0xb9c], 0x44f4cc51
mov dword [ebp - 0xba4], 1
mov dword [ebp - 0x90], 0
jmp 0x1000b067
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1000b089
push dword [ebp - 0x90]
lea ecx, [ebp - 0x1424]
call fcn.10018f28
mov dword [eax], 0x334
jmp 0x1000b05a
mov dword [ebp - 0x90], 0
jmp 0x1000b0a2
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1000b0be
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x1720], 0xffffffff
jmp 0x1000b095
mov dword [ebp - 0x280], 2
jmp 0x1000b0d7
mov eax, dword [ebp - 0x280]
dec eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jl 0x1000b1e9
mov dword [ebp - 0x162c], 0x6ff23b1a
mov dword [ebp - 0x13f8], 0xfffffffe
mov dword [ebp - 0x1578], 0xfffffffc
mov dword [ebp - 0x1270], 0xffffffff
mov dword [ebp - 0x1050], 0x6c902da
mov dword [ebp - 0x104c], 0x6c902da
mov dword [ebp - 0x1048], 0x6c902da
mov dword [ebp - 0x1044], 0x6c902da
lea ecx, [ebp - 0x471]
call fcn.1000a6f3
push eax
lea eax, [ebp - 0x1040]
push eax
lea eax, [ebp - 0x1050]
push eax
lea ecx, [ebp - 0x1730]
call fcn.10018f37
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1650]
call fcn.10018ee6
mov byte [ebp - 4], 7
push 1
lea ecx, [ebp - 0x1414]
call fcn.10018e8a
mov byte [ebp - 4], 8
mov dword [ebp - 0x348], 0
jmp 0x1000b197
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 1
jge 0x1000b1b9
push dword [ebp - 0x348]
lea ecx, [ebp - 0x1414]
call fcn.10018f28
mov dword [eax], 0x7dcda720
jmp 0x1000b18a
mov eax, dword [ebp - 0xb9c]
dec eax
mov dword [ebp - 0xb9c], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1414]
call fcn.10018f0c
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1650]
call fcn.10018f0c
jmp 0x1000b0ca
mov eax, dword [ebp - 0xba4]
dec eax
mov dword [ebp - 0xba4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1424]
call fcn.10018f0c
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x428], 0xfffffffb
mov dword [ebp - 0x2f8], 1
mov dword [ebp - 0xc8], 0
jmp 0x1000b23c
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x1000b258
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x116c], 1
jmp 0x1000b22f
mov dword [ebp - 0xc8], 0
jmp 0x1000b271
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x1000b28d
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x1434], 0
jmp 0x1000b264
mov dword [ebp - 0x124], 0
jmp 0x1000b2a6
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x14
jge 0x1000b4b1
push 2
lea ecx, [ebp - 0xc34]
call fcn.10018e8a
mov dword [ebp - 4], 9
push 3
lea ecx, [ebp - 0x11e4]
call fcn.10018e8a
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x98], 0
jmp 0x1000b2f1
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1000b313
push dword [ebp - 0x98]
lea ecx, [ebp - 0xc34]
call fcn.10018f28
mov dword [eax], 1
jmp 0x1000b2e4
mov dword [ebp - 0x98], 0
jmp 0x1000b32c
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1000b34e
push dword [ebp - 0x98]
lea ecx, [ebp - 0x11e4]
call fcn.10018f28
mov dword [eax], 0x166941fc
jmp 0x1000b31f
push 1
lea ecx, [ebp - 0xc34]
call fcn.10018f28
mov dword [eax], 0xffffffe7
jmp 0x1000b387
push 1
lea ecx, [ebp - 0xc34]
call fcn.10018f28
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbac]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xbac]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xc34]
call fcn.10018f28
cmp dword [eax], 0
je 0x1000b48e
push 1
lea ecx, [ebp - 0x1154]
call fcn.10018e8a
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x288], 0
jmp 0x1000b3c7
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jge 0x1000b3e9
push dword [ebp - 0x288]
lea ecx, [ebp - 0x1154]
call fcn.10018f28
mov dword [eax], 0xd7d393e7
jmp 0x1000b3ba
push 1
lea ecx, [ebp - 0xc34]
call fcn.10018f28
mov esi, eax
push 1
lea ecx, [ebp - 0x11e4]
call fcn.10018f28
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0xbb4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbb4]
mov dword [ebp + eax - 0x116c], ecx
mov eax, 0x54bc
sub eax, dword [ebp - 0xbb4]
or ecx, 0xffffffff
sub ecx, eax
mov dword [ebp - 0x2f8], ecx
mov eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x2f8]
cmp eax, 0xddd9cd44
jb 0x1000b45e
mov dword [ebp - 0xbbc], 1
jmp 0x1000b465
and dword [ebp - 0xbbc], 0
push 0
lea ecx, [ebp - 0x1154]
call fcn.10018f28
mov ecx, dword [ebp - 0xbbc]
mov dword [eax], ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1154]
call fcn.10018f0c
jmp 0x1000b363
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11e4]
call fcn.10018f0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc34]
call fcn.10018f0c
jmp 0x1000b299
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x1278], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x116c]
mov dword [ebp - 0x1280], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x1288], eax
xor eax, eax
inc eax
cmp eax, 0xffffffff
je 0x1000b4f0
mov dword [ebp - 0xbc4], 1
jmp 0x1000b4f7
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0xbc4], eax
jg 0x1000b511
mov dword [ebp - 0xbcc], 1
jmp 0x1000b518
and dword [ebp - 0xbcc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1434]
cmp dword [ebp - 0xbcc], eax
jg 0x1000b539
mov dword [ebp - 0xa14], 1
jmp 0x1000b540
and dword [ebp - 0xa14], 0
cmp dword [ebp - 0xa14], 0xda37
jne 0x1000b55e
cmp dword [ebp - 0x124], 0
jne 0x1000b55e
and dword [ebp - 0xb10], 0
jmp 0x1000b568
mov dword [ebp - 0xb10], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb10]
sub ecx, dword [ebp + eax - 0x1434]
cmp ecx, 0xffff
jbe 0x1000b58f
mov dword [ebp - 0x4cc], 1
jmp 0x1000b596
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x4cc], eax
jg 0x1000b5b0
mov dword [ebp - 0x888], 1
jmp 0x1000b5b7
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x888], eax
jg 0x1000b5d1
mov dword [ebp - 0x4d4], 1
jmp 0x1000b5d8
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
sub eax, 0x7a88
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x116c], eax
mov dword [ebp - 0xf8], 0xa439beb0
mov dword [ebp - 0xea0], 0x45c8100c
mov dword [ebp - 0xe9c], 0x45c8100c
mov dword [ebp - 0xe98], 0x45c8100c
mov dword [ebp - 0xe94], 0x45c8100c
mov dword [ebp - 0xd80], 0x9e071a05
push 3
lea ecx, [ebp - 0x122c]
call fcn.10018e8a
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xd88], 7
mov dword [ebp - 0x290], 0
jmp 0x1000b663
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x1000b685
push dword [ebp - 0x290]
lea ecx, [ebp - 0x122c]
call fcn.10018f28
mov dword [eax], 0xfffffff7
jmp 0x1000b656
mov dword [ebp - 0xf8], 0x8bbca631
cmp dword [ebp - 0xf8], 0
je 0x1000b798
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xea0]
mov dword [ebp - 0x880], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x880]
mov dword [ebp + eax - 0xea0], ecx
mov eax, dword [ebp - 0xf8]
imul eax, dword [ebp - 0x880]
cmp eax, 0xffff07f4
jge 0x1000b6e2
mov dword [ebp - 0x4dc], 1
jmp 0x1000b6e9
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x4dc]
jg 0x1000b703
mov dword [ebp - 0x868], 1
jmp 0x1000b70a
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x868], eax
jle 0x1000b724
mov dword [ebp - 0x4e4], 1
jmp 0x1000b72b
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x4e4], eax
jg 0x1000b745
mov dword [ebp - 0x86c], 1
jmp 0x1000b74c
and dword [ebp - 0x86c], 0
cmp dword [ebp - 0x86c], 0x710d
jg 0x1000b764
mov dword [ebp - 0xd78], 1
jmp 0x1000b76b
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1290], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd80]
cmp dword [ebp + eax - 0xea0], ecx
jge 0x1000b798
mov dword [ebp - 0x4ec], 1
jmp 0x1000b79f
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
add eax, dword [ebp - 0xf8]
mov dword [ebp - 0xaec], eax
push 1
lea ecx, [ebp - 0x122c]
call fcn.10018f28
mov ecx, dword [ebp - 0xaec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xd88], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x122c]
call fcn.10018f0c
push 3
lea ecx, [ebp - 0x1494]
call fcn.10018e8a
mov dword [ebp - 4], 0xd
push 1
lea ecx, [ebp - 0x250]
call fcn.10018e8a
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xf4], 0xc75286e8
mov dword [ebp - 0x300], 0xfffffff6
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 0x4f4], 0x67e307b
mov dword [ebp - 0x20], 0x9ec4279c
mov dword [ebp - 0x3b8], 0x147b80be
mov dword [ebp - 0x298], 1
mov dword [ebp - 0x330], 0
jmp 0x1000b862
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 1
jge 0x1000b884
push dword [ebp - 0x330]
lea ecx, [ebp - 0x250]
call fcn.10018f28
mov dword [eax], 0x24039b64
jmp 0x1000b855
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
push 0
lea ecx, [ebp - 0x250]
call fcn.10018f28
mov eax, 0xffffa1f5
sub eax, dword [ebp - 0x300]
mov dword [ebp - 0x4f4], eax
mov esi, dword [ebp - 0x4f4]
neg esi
push 0
lea ecx, [ebp - 0x250]
call fcn.10018f28
cmp esi, dword [eax]
jle 0x1000b8d4
mov dword [ebp - 0x874], 1
jmp 0x1000b8db
and dword [ebp - 0x874], 0
push 0
lea ecx, [ebp - 0x250]
call fcn.10018f28
mov ecx, dword [ebp - 0x874]
cmp ecx, dword [eax]
je 0x1000b8fe
mov dword [ebp - 0x4fc], 1
jmp 0x1000b905
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x4fc]
jle 0x1000b91f
mov dword [ebp - 0xa1c], 1
jmp 0x1000b926
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xa1c]
jne 0x1000b93d
mov dword [ebp - 0x504], 1
jmp 0x1000b944
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 3
jae 0x1000b959
mov dword [ebp - 0x87c], 1
jmp 0x1000b960
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x87c], eax
jle 0x1000b97a
mov dword [ebp - 0x50c], 1
jmp 0x1000b981
and dword [ebp - 0x50c], 0
imul esi, dword [ebp - 0x50c], 0x6768
push 0
lea ecx, [ebp - 0x250]
call fcn.10018f28
add esi, dword [eax]
jne 0x1000b9ae
cmp dword [ebp - 0x3b8], 0
jne 0x1000b9ae
and dword [ebp - 0xb98], 0
jmp 0x1000b9b8
mov dword [ebp - 0xb98], 1
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x300]
add eax, dword [ebp - 0x1d4]
add eax, dword [ebp - 0xf4]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x1298], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x12a0], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x12a8], eax
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x20], eax
jle 0x1000ba17
mov dword [ebp - 0x514], 1
jmp 0x1000ba1e
and dword [ebp - 0x514], 0
push 0
lea ecx, [ebp - 0x250]
call fcn.10018f28
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [eax]
jg 0x1000ba41
mov dword [ebp - 0x884], 1
jmp 0x1000ba48
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x884], eax
jne 0x1000ba5f
mov dword [ebp - 0x51c], 1
jmp 0x1000ba66
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x51c], eax
jle 0x1000ba7d
mov dword [ebp - 0xa24], 1
jmp 0x1000ba84
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x300]
cmp dword [ebp - 0x20], eax
jge 0x1000bab0
mov dword [ebp - 0x524], 1
jmp 0x1000bab7
and dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 7
je 0x1000bb07
mov dword [ebp - 0xf4], 0
jmp 0x1000bad9
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xfffffffb
jl 0x1000bb02
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x1000bb00
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1000bacc
jmp 0x1000bd47
mov dword [ebp - 0x460], 0x39b6
mov dword [ebp - 0xa2c], 0x1f9d99d
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x1000bb3c
push 0
push 0xc0a
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov dword [ebp - 0x20], 0
jmp 0x1000bb4c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x1000bd47
mov dword [ebp - 0xd90], 1
mov dword [ebp - 0xda8], 0xf0cdbbf8
mov dword [ebp - 0xdb0], 0xec2c04dd
mov dword [ebp - 0x1d4], 0xfffffffe
push dword [ebp - 0x20]
lea ecx, [ebp - 0x250]
call fcn.10018f28
push dword [ebp - 0x20]
lea ecx, [ebp - 0x250]
call fcn.10018f28
cmp dword [eax], 0
jne 0x1000bc0c
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0xd90], eax
jl 0x1000bbb9
mov dword [ebp - 0x88c], 1
jmp 0x1000bbc0
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x460]
imul eax, dword [ebp - 0x88c]
cmp eax, 0xb836
jl 0x1000bbe0
mov dword [ebp - 0xd98], 1
jmp 0x1000bbe7
and dword [ebp - 0xd98], 0
cmp dword [ebp - 0x460], 0
jne 0x1000bc0c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x250]
call fcn.10018f28
cmp dword [eax], 0
jne 0x1000bc0c
and dword [ebp - 0x52c], 0
jmp 0x1000bc16
mov dword [ebp - 0x52c], 1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x250]
call fcn.10018f28
mov ecx, dword [ebp - 0x52c]
cmp ecx, dword [eax]
jg 0x1000bc3a
mov dword [ebp - 0xaf4], 1
jmp 0x1000bc41
and dword [ebp - 0xaf4], 0
cmp dword [ebp - 0xaf4], 8
jg 0x1000bc56
mov dword [ebp - 0x534], 1
jmp 0x1000bc5d
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 0xfff9
jae 0x1000bc75
mov dword [ebp - 0xda0], 1
jmp 0x1000bc7c
and dword [ebp - 0xda0], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x250]
call fcn.10018f28
cmp dword [eax], 0
je 0x1000bcad
push 0
lea ecx, [ebp - 0x250]
call fcn.10018f28
cmp dword [eax], 0
je 0x1000bcad
mov dword [ebp - 0x894], 1
jmp 0x1000bcb4
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x460]
cmp dword [ebp - 0x894], eax
jg 0x1000bcce
mov dword [ebp - 0x53c], 1
jmp 0x1000bcd5
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
sub eax, 0x17e5ed53
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0x12b0], eax
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0x12b8], eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x250]
call fcn.10018f28
xor eax, eax
inc eax
je 0x1000bd2f
push 0
lea ecx, [ebp - 0x250]
call fcn.10018f28
cmp dword [eax], 0
je 0x1000bd2f
mov dword [ebp - 0x544], 1
jmp 0x1000bd36
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0xdb0], eax
jmp 0x1000bb45
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x250]
call fcn.10018f0c
mov dword [ebp - 0x2b0], 0xffffffff
mov dword [ebp - 0x358], 0xe1757117
push 2
lea ecx, [ebp - 0x1444]
call fcn.10018e8a
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x2a0], 0
jmp 0x1000bd94
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jge 0x1000bdb6
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0x1444]
call fcn.10018f28
mov dword [eax], 9
jmp 0x1000bd87
mov dword [ebp - 0x358], 4
jmp 0x1000bdcf
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x12
jne 0x1000be6a
mov dword [ebp - 0x2a8], 0xffffffff
mov dword [ebp - 0x89c], 1
mov dword [ebp - 0x2a8], 0
jmp 0x1000be09
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 1
jg 0x1000be4b
mov eax, dword [ebp - 0x89c]
inc eax
mov dword [ebp - 0x89c], eax
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x1000be49
push 0x12e3
push 0
push 0
push 0
push 0x268c
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x1000bdfc
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x1000be65
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x1000bdc2
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1444]
call fcn.10018f0c
mov dword [ebp - 0x12c0], 0xffffffff
mov dword [ebp - 0xbc0], 0x44f4cc51
mov dword [ebp - 0xdb8], 0x20e83c77
mov dword [ebp - 0xdc8], 0x6542
mov dword [ebp - 0x12c8], 0xdb6d0374
mov dword [ebp - 0xe8], 0
jmp 0x1000bec4
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jge 0x1000bee0
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x1454], 0xf37831e4
jmp 0x1000beb7
mov dword [ebp - 0xe8], 0
jmp 0x1000bef9
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x1000bf15
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0xc74], 0xb11accba
jmp 0x1000beec
mov eax, dword [ebp - 0xdb8]
mov dword [ebp - 0x54c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x54c]
mov dword [ebp + eax - 0x1454], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x54c]
mov dword [ebp + eax - 0xc74], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xdc8]
mov dword [ebp + eax - 0x1454], ecx
mov dword [ebp - 0x594], 1
mov dword [ebp - 0xa0], 0
jmp 0x1000bf7c
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1000bf9e
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x1494]
call fcn.10018f28
mov dword [eax], 0x334
jmp 0x1000bf6f
mov dword [ebp - 0xa0], 0
jmp 0x1000bfb7
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1000bfd3
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x1728], 0xffffffff
jmp 0x1000bfaa
mov dword [ebp - 0x308], 0x6ff55e00
mov dword [ebp - 0x8a4], 7
mov dword [ebp - 0xfd8], 1
mov dword [ebp - 0xfd4], 1
mov dword [ebp - 0xfd0], 1
mov dword [ebp - 0xfcc], 1
lea ecx, [ebp - 0x449]
call fcn.1000a6f3
push eax
lea eax, [ebp - 0xfc8]
push eax
lea eax, [ebp - 0xfd8]
push eax
lea ecx, [ebp - 0x1698]
call fcn.10018f37
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe50]
call fcn.10018ee6
mov byte [ebp - 4], 0x10
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1000c06d
push 0
push 0xea6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x12d0], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x12d8], eax
cmp dword [ebp - 0x308], 0xe7ed
jl 0x1000c09d
mov dword [ebp - 0xb68], 1
jmp 0x1000c0a4
and dword [ebp - 0xb68], 0
push 0
lea ecx, [ebp - 0xe50]
call fcn.10018f28
mov ecx, dword [ebp - 0xb68]
cmp ecx, dword [eax]
je 0x1000c0c7
mov dword [ebp - 0x554], 1
jmp 0x1000c0ce
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x8a4], eax
imul eax, dword [ebp - 0x554], 0x9869
cmp dword [ebp - 0x8a4], eax
jne 0x1000c0f8
mov dword [ebp - 0x55c], 1
jmp 0x1000c0ff
and dword [ebp - 0x55c], 0
push 0
lea ecx, [ebp - 0xe50]
call fcn.10018f28
mov esi, dword [ebp - 0x55c]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0xe50]
call fcn.10018f28
cmp esi, dword [eax]
jg 0x1000c131
mov dword [ebp - 0xa34], 1
jmp 0x1000c138
and dword [ebp - 0xa34], 0
push 3
lea ecx, [ebp - 0xe50]
call fcn.10018f28
mov ecx, dword [ebp - 0xa34]
mov dword [eax], ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe50]
call fcn.10018f0c
mov dword [ebp - 0x2b0], 2
jmp 0x1000c175
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0
jl 0x1000c74b
push 2
lea ecx, [ebp - 0x1464]
call fcn.10018e8a
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x2b8], 0x57976326
mov dword [ebp - 0x338], 0
jmp 0x1000c1b6
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 2
jge 0x1000c1d5
push dword [ebp - 0x338]
lea ecx, [ebp - 0x1464]
call fcn.10018f28
and dword [eax], 0
jmp 0x1000c1a9
mov dword [ebp - 0x2b8], 1
jmp 0x1000c1ee
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jl 0x1000c226
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x1000c224
push 0
push 0
push 0x13f8
push 0xe75
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x1000c1e1
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1464]
call fcn.10018f0c
mov dword [ebp - 0x12e0], 0x6ff23b1a
mov dword [ebp - 0x8b4], 0x464b
mov dword [ebp - 0xdf0], 0x4c506d44
mov dword [ebp - 0xde0], 0x7b1c2a2c
mov dword [ebp - 0x12e8], 0xfffffffb
mov dword [ebp - 0x12f0], 0xfffffffc
mov dword [ebp - 0x56c], 0xcf09cc25
mov dword [ebp - 0xde8], 0
mov dword [ebp - 0xdd0], 0xfffffffe
mov dword [ebp - 0x12f8], 0x368a9017
mov dword [ebp - 0x1300], 0xf298
mov dword [ebp - 0x310], 0
push 3
lea ecx, [ebp - 0xeb8]
call fcn.10018e8a
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xd0], 0
jmp 0x1000c2d7
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x1000c2f3
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x3c0], 0xffffffff
jmp 0x1000c2ca
mov dword [ebp - 0xd0], 0
jmp 0x1000c30c
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x1000c32e
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xeb8]
call fcn.10018f28
mov dword [eax], 0x2d14b432
jmp 0x1000c2ff
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
imul eax, dword [ebp - 0xdd0], 0x2214
test eax, eax
je 0x1000c35e
mov eax, 0xfff7
test eax, eax
je 0x1000c35e
mov dword [ebp - 0x564], 1
jmp 0x1000c365
and dword [ebp - 0x564], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c0]
cmp dword [ebp - 0x564], eax
jle 0x1000c386
mov dword [ebp - 0x8ac], 1
jmp 0x1000c38d
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x8ac], eax
jne 0x1000c3a7
mov dword [ebp - 0xdd8], 1
jmp 0x1000c3ae
and dword [ebp - 0xdd8], 0
mov dword [ebp - 0x56c], 0x6e60be62
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x1308], eax
push 1
lea ecx, [ebp - 0xeb8]
call fcn.10018f28
cmp dword [eax], 0
je 0x1000c3e3
push 2
lea ecx, [ebp - 0xeb8]
call fcn.10018f28
mov eax, dword [ebp - 0x8b4]
cmp dword [ebp - 0xde0], eax
jg 0x1000c3fd
mov dword [ebp - 0xafc], 1
jmp 0x1000c404
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0xde8]
cmp dword [ebp - 0xafc], eax
jle 0x1000c41e
mov dword [ebp - 0x574], 1
jmp 0x1000c425
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x310]
add eax, dword [ebp - 0x574]
jmp 0x1000c43f
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x8b4]
cmp dword [ebp - 0x57c], eax
jge 0x1000c460
mov dword [ebp - 0xa3c], 1
jmp 0x1000c467
and dword [ebp - 0xa3c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c0]
cmp dword [ebp - 0xa3c], eax
jne 0x1000c488
mov dword [ebp - 0x584], 1
jmp 0x1000c48f
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
sub eax, dword [ebp - 0xdf0]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3c0], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xeb8]
call fcn.10018f0c
mov dword [ebp - 0x1310], 0xfffffffe
mov dword [ebp - 0x2c0], 0xba394643
mov dword [ebp - 0x1318], 0xa622a149
mov dword [ebp - 0x1320], 0x672ca3c0
mov dword [ebp - 0x1328], 8
mov dword [ebp - 0x1330], 0xffffffff
mov dword [ebp - 0x1338], 0xd658edfe
mov dword [ebp - 0x1340], 0x87a7525d
mov dword [ebp - 0x1348], 0x9cf13e13
mov dword [ebp - 0x1350], 0xfffffffa
mov dword [ebp - 0x1358], 0xfffffff9
mov dword [ebp - 0x1360], 0xfffffff7
mov dword [ebp - 0x1368], 0xa165018
mov dword [ebp - 0x1370], 0x28405cef
push 3
lea ecx, [ebp - 0x1474]
call fcn.10018e8a
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x137c], 1
mov dword [ebp - 0x1388], 0x16488a97
mov dword [ebp - 0x58c], 0
mov dword [ebp - 0xa8], 0
jmp 0x1000c58b
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jge 0x1000c5a7
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x1750], 3
jmp 0x1000c57e
mov dword [ebp - 0xa8], 0
jmp 0x1000c5c0
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1000c5e2
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x1474]
call fcn.10018f28
mov dword [eax], 0x64f6cbcb
jmp 0x1000c5b3
mov dword [ebp - 0x2c0], 3
jmp 0x1000c5fb
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0
jl 0x1000c63e
mov dword [ebp - 0x8bc], 0x9609c3fb
mov eax, dword [ebp - 0x8bc]
inc eax
mov dword [ebp - 0x8bc], eax
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x1000c63c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x1000c5ee
mov eax, dword [ebp - 0x58c]
dec eax
mov dword [ebp - 0x58c], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1474]
call fcn.10018f0c
mov dword [ebp - 0x1394], 0xfffffffc
mov dword [ebp - 0x1544], 0xffffffff
mov dword [ebp - 0x10a0], 0x6c902da
mov dword [ebp - 0x109c], 0x6c902da
mov dword [ebp - 0x1098], 0x6c902da
mov dword [ebp - 0x1094], 0x6c902da
lea ecx, [ebp - 0x44b]
call fcn.1000a6f3
push eax
lea eax, [ebp - 0x1090]
push eax
lea eax, [ebp - 0x10a0]
push eax
lea ecx, [ebp - 0x16a8]
call fcn.10018f37
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1668]
call fcn.10018ee6
mov byte [ebp - 4], 0x14
push 1
lea ecx, [ebp - 0x1484]
call fcn.10018e8a
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x350], 0
jmp 0x1000c6f9
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 1
jge 0x1000c71b
push dword [ebp - 0x350]
lea ecx, [ebp - 0x1484]
call fcn.10018f28
mov dword [eax], 0x7dcda720
jmp 0x1000c6ec
mov eax, dword [ebp - 0xbc0]
dec eax
mov dword [ebp - 0xbc0], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1484]
call fcn.10018f0c
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1668]
call fcn.10018f0c
jmp 0x1000c168
mov eax, dword [ebp - 0x594]
dec eax
mov dword [ebp - 0x594], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1494]
call fcn.10018f0c
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x430], 0xfffffffb
mov dword [ebp - 0x318], 1
mov dword [ebp - 0xb8], 0
jmp 0x1000c79e
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1000c7ba
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x113c], 1
jmp 0x1000c791
mov dword [ebp - 0xb8], 0
jmp 0x1000c7d3
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1000c7ef
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x14a4], 0
jmp 0x1000c7c6
mov dword [ebp - 0x12c], 0
jmp 0x1000c808
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x14
jge 0x1000ca13
push 2
lea ecx, [ebp - 0xc40]
call fcn.10018e8a
mov dword [ebp - 4], 0x16
push 3
lea ecx, [ebp - 0x11cc]
call fcn.10018e8a
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xb0], 0
jmp 0x1000c853
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1000c875
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xc40]
call fcn.10018f28
mov dword [eax], 1
jmp 0x1000c846
mov dword [ebp - 0xb0], 0
jmp 0x1000c88e
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x1000c8b0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x11cc]
call fcn.10018f28
mov dword [eax], 0x166941fc
jmp 0x1000c881
push 1
lea ecx, [ebp - 0xc40]
call fcn.10018f28
mov dword [eax], 0xffffffe7
jmp 0x1000c8e9
push 1
lea ecx, [ebp - 0xc40]
call fcn.10018f28
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x8c4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x8c4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xc40]
call fcn.10018f28
cmp dword [eax], 0
je 0x1000c9f0
push 1
lea ecx, [ebp - 0x1124]
call fcn.10018e8a
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x2c8], 0
jmp 0x1000c929
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x1000c94b
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0x1124]
call fcn.10018f28
mov dword [eax], 0xd7d393e7
jmp 0x1000c91c
push 1
lea ecx, [ebp - 0xc40]
call fcn.10018f28
mov esi, eax
push 1
lea ecx, [ebp - 0x11cc]
call fcn.10018f28
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x59c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x59c]
mov dword [ebp + eax - 0x113c], ecx
mov eax, 0x54bc
sub eax, dword [ebp - 0x59c]
or ecx, 0xffffffff
sub ecx, eax
mov dword [ebp - 0x318], ecx
mov eax, dword [ebp - 0x12c]
imul eax, dword [ebp - 0x318]
cmp eax, 0xddd9cd44
jb 0x1000c9c0
mov dword [ebp - 0xa44], 1
jmp 0x1000c9c7
and dword [ebp - 0xa44], 0
push 0
lea ecx, [ebp - 0x1124]
call fcn.10018f28
mov ecx, dword [ebp - 0xa44]
mov dword [eax], ecx
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1124]
call fcn.10018f0c
jmp 0x1000c8c5
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x11cc]
call fcn.10018f0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.10018f0c
jmp 0x1000c7fb
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x1530], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x113c]
mov dword [ebp - 0x154c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x1540], eax
xor eax, eax
inc eax
cmp eax, 0xffffffff
je 0x1000ca52
mov dword [ebp - 0x5a4], 1
jmp 0x1000ca59
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x430]
cmp dword [ebp - 0x5a4], eax
jg 0x1000ca73
mov dword [ebp - 0x8cc], 1
jmp 0x1000ca7a
and dword [ebp - 0x8cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14a4]
cmp dword [ebp - 0x8cc], eax
jg 0x1000ca9b
mov dword [ebp - 0x5ac], 1
jmp 0x1000caa2
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0xda37
jne 0x1000cac0
cmp dword [ebp - 0x12c], 0
jne 0x1000cac0
and dword [ebp - 0xb04], 0
jmp 0x1000caca
mov dword [ebp - 0xb04], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb04]
sub ecx, dword [ebp + eax - 0x14a4]
cmp ecx, 0xffff
jbe 0x1000caf1
mov dword [ebp - 0x5b4], 1
jmp 0x1000caf8
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x430]
cmp dword [ebp - 0x5b4], eax
jg 0x1000cb12
mov dword [ebp - 0x8d4], 1
jmp 0x1000cb19
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x8d4], eax
jg 0x1000cb33
mov dword [ebp - 0x5bc], 1
jmp 0x1000cb3a
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x5bc]
sub eax, 0x7a88
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x113c], eax
push 2
lea ecx, [ebp - 0x22c]
call fcn.10018e8a
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x54], 0xa876e6ba
mov dword [ebp - 0xa54], 0xffffffff
mov dword [ebp - 0x38], 0
jmp 0x1000cb87
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1000cba3
push dword [ebp - 0x38]
lea ecx, [ebp - 0x22c]
call fcn.10018f28
mov dword [eax], 0x99ff6065
jmp 0x1000cb80
mov dword [ebp - 0x38], 0
jmp 0x1000cbb3
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1000cbc9
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1378], 0xfffffff7
jmp 0x1000cbac
mov dword [ebp - 0x38], 0
jmp 0x1000cbd9
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000cbef
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe00], 0
jmp 0x1000cbd2
mov dword [ebp - 0x54], 1
jmp 0x1000cbff
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1000ce6f
mov dword [ebp - 0x5c4], 0xfffffffd
mov dword [ebp - 0x204], 0xf748dc16
push dword [ebp - 0x54]
lea ecx, [ebp - 0x22c]
call fcn.10018f28
mov dword [ebp - 0xa4c], eax
push dword [ebp - 0x54]
lea ecx, [ebp - 0x22c]
call fcn.10018f28
mov ecx, dword [ebp - 0xa4c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xa4c]
cmp dword [eax], 0
jne 0x1000ce35
push dword [ebp - 0x54]
lea ecx, [ebp - 0x22c]
call fcn.10018f28
cmp dword [eax], 0
jne 0x1000cc77
mov dword [ebp - 0x5cc], 1
jmp 0x1000cc7e
and dword [ebp - 0x5cc], 0
push 0
lea ecx, [ebp - 0x22c]
call fcn.10018f28
push 1
lea ecx, [ebp - 0x22c]
call fcn.10018f28
mov eax, dword [eax]
mov dword [ebp - 0x5c4], eax
mov esi, dword [ebp - 0x5c4]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x22c]
call fcn.10018f28
cmp esi, dword [eax]
jle 0x1000ccc4
mov dword [ebp - 0x8dc], 1
jmp 0x1000cccb
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x8dc], eax
jg 0x1000cce5
mov dword [ebp - 0xdf8], 1
jmp 0x1000ccec
and dword [ebp - 0xdf8], 0
push 0
lea ecx, [ebp - 0x22c]
call fcn.10018f28
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x155c], eax
mov dword [ebp - 0x204], 0xffffffff
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x15c0], eax
push 0
lea ecx, [ebp - 0x22c]
call fcn.10018f28
push dword [ebp - 0x54]
lea ecx, [ebp - 0x22c]
call fcn.10018f28
cmp dword [eax], 1
jle 0x1000cd53
mov dword [ebp - 0xb70], 1
jmp 0x1000cd5a
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp - 0xb70]
jg 0x1000cd74
mov dword [ebp - 0x5d4], 1
jmp 0x1000cd7b
and dword [ebp - 0x5d4], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x22c]
call fcn.10018f28
mov ecx, dword [ebp - 0x5d4]
cmp ecx, dword [eax]
jle 0x1000cd9f
mov dword [ebp - 0x8e4], 1
jmp 0x1000cda6
and dword [ebp - 0x8e4], 0
mov esi, dword [ebp - 0x8e4]
sub esi, 0x42c1fe72
push dword [ebp - 0x54]
lea ecx, [ebp - 0x22c]
call fcn.10018f28
cmp esi, dword [eax]
jge 0x1000cde2
push 1
lea ecx, [ebp - 0x22c]
call fcn.10018f28
cmp dword [eax], 0
je 0x1000cde2
mov dword [ebp - 0x5dc], 1
jmp 0x1000cde9
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0xa54], eax
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0x5e4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5e4]
mov dword [ebp + eax - 0x1378], ecx
push dword [ebp - 0x54]
lea ecx, [ebp - 0x22c]
call fcn.10018f28
mov ecx, dword [ebp - 0x5e4]
cmp ecx, dword [eax]
jg 0x1000ce35
and dword [ebp - 0x8ec], 0
jmp 0x1000ce3f
mov dword [ebp - 0x8ec], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8ec]
mov dword [ebp + eax - 0xe00], ecx
push dword [ebp - 0x54]
lea ecx, [ebp - 0x22c]
call fcn.10018f28
cmp dword [eax], 0
je 0x1000ce6a
jmp 0x1000cbf8
jmp 0x1000cbf8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.10018f0c
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x3c8], 0xfffffffb
mov dword [ebp - 0x340], 1
mov dword [ebp - 0xbc], 0
jmp 0x1000ceb5
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x1000ced1
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x11fc], 1
jmp 0x1000cea8
mov dword [ebp - 0xbc], 0
jmp 0x1000ceea
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x1000cf06
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x14b4], 0
jmp 0x1000cedd
mov dword [ebp - 0x134], 0
jmp 0x1000cf1f
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x14
jge 0x1000d10c
push 2
lea ecx, [ebp - 0xc10]
call fcn.10018e8a
mov dword [ebp - 4], 0x1a
push 3
lea ecx, [ebp - 0x1184]
call fcn.10018e8a
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x7c], 0
jmp 0x1000cf61
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1000cf7d
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xc10]
call fcn.10018f28
mov dword [eax], 1
jmp 0x1000cf5a
mov dword [ebp - 0x7c], 0
jmp 0x1000cf8d
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000cfa9
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x1184]
call fcn.10018f28
mov dword [eax], 0x166941fc
jmp 0x1000cf86
push 1
lea ecx, [ebp - 0xc10]
call fcn.10018f28
mov dword [eax], 0xffffffe7
jmp 0x1000cfe2
push 1
lea ecx, [ebp - 0xc10]
call fcn.10018f28
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5ec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5ec]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xc10]
call fcn.10018f28
cmp dword [eax], 0
je 0x1000d0e9
push 1
lea ecx, [ebp - 0x1244]
call fcn.10018e8a
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x2d0], 0
jmp 0x1000d022
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 1
jge 0x1000d044
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0x1244]
call fcn.10018f28
mov dword [eax], 0xd7d393e7
jmp 0x1000d015
push 1
lea ecx, [ebp - 0xc10]
call fcn.10018f28
mov esi, eax
push 1
lea ecx, [ebp - 0x1184]
call fcn.10018f28
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xb0c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb0c]
mov dword [ebp + eax - 0x11fc], ecx
mov eax, 0x54bc
sub eax, dword [ebp - 0xb0c]
or ecx, 0xffffffff
sub ecx, eax
mov dword [ebp - 0x340], ecx
mov eax, dword [ebp - 0x134]
imul eax, dword [ebp - 0x340]
cmp eax, 0xddd9cd44
jb 0x1000d0b9
mov dword [ebp - 0x5f4], 1
jmp 0x1000d0c0
and dword [ebp - 0x5f4], 0
push 0
lea ecx, [ebp - 0x1244]
call fcn.10018f28
mov ecx, dword [ebp - 0x5f4]
mov dword [eax], ecx
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1244]
call fcn.10018f0c
jmp 0x1000cfbe
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1184]
call fcn.10018f0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc10]
call fcn.10018f0c
jmp 0x1000cf12
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x1550], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11fc]
mov dword [ebp - 0x1398], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x139c], eax
xor eax, eax
inc eax
cmp eax, 0xffffffff
je 0x1000d14b
mov dword [ebp - 0x8f4], 1
jmp 0x1000d152
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x8f4], eax
jg 0x1000d16c
mov dword [ebp - 0x5fc], 1
jmp 0x1000d173
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14b4]
cmp dword [ebp - 0x5fc], eax
jg 0x1000d194
mov dword [ebp - 0xa5c], 1
jmp 0x1000d19b
and dword [ebp - 0xa5c], 0
cmp dword [ebp - 0xa5c], 0xda37
jne 0x1000d1b9
cmp dword [ebp - 0x134], 0
jne 0x1000d1b9
and dword [ebp - 0x604], 0
jmp 0x1000d1c3
mov dword [ebp - 0x604], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x604]
sub ecx, dword [ebp + eax - 0x14b4]
cmp ecx, 0xffff
jbe 0x1000d1ea
mov dword [ebp - 0x8fc], 1
jmp 0x1000d1f1
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x8fc], eax
jg 0x1000d20b
mov dword [ebp - 0x60c], 1
jmp 0x1000d212
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0x60c], eax
jg 0x1000d22c
mov dword [ebp - 0xba0], 1
jmp 0x1000d233
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0xba0]
sub eax, 0x7a88
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x11fc], eax
mov dword [ebp - 0xf74], 0xfffffffb
mov dword [ebp - 0xf70], 0xfffffffb
mov dword [ebp - 0xf6c], 0xfffffffb
mov dword [ebp - 0xf68], 0xfffffffb
lea ecx, [ebp - 0x451]
call fcn.1000a6f3
push eax
lea eax, [ebp - 0xf64]
push eax
lea eax, [ebp - 0xf74]
push eax
lea ecx, [ebp - 0x16b8]
call fcn.10018f37
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x37c]
call fcn.10018ee6
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0xe08], 0x96f377cc
mov dword [ebp - 0x360], 0xffffffff
mov dword [ebp - 0x2e0], 0xffff
mov dword [ebp - 0x90c], 0x2ff7a2d4
mov dword [ebp - 0xe30], 0x2fdd
mov dword [ebp - 0xe68], 0xb334fe9d
mov dword [ebp - 0xc4], 0
jmp 0x1000d304
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x1000d31d
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x18], 0x184c506d
jmp 0x1000d2f7
mov dword [ebp - 0xc4], 0
jmp 0x1000d336
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x1000d352
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x91c], 0x3196add8
jmp 0x1000d329
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x18], 3
jmp 0x1000d377
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0
jl 0x1000d9c3
mov dword [ebp - 0x13c], 3
mov dword [ebp - 0xf48], 0xbbfefa2e
mov dword [ebp - 0xf44], 0xbbfefa2e
mov dword [ebp - 0xf40], 0xbbfefa2e
mov dword [ebp - 0xf3c], 0xbbfefa2e
push 3
lea ecx, [ebp - 0x48c]
call fcn.10018e8a
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x2d8], 0
jmp 0x1000d3e4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x37c]
call fcn.10018f0c
mov dword [ebp - 0x6c], 0xa61928c1
mov dword [ebp - 0xe70], 0xcf7921e1
mov dword [ebp - 0x92c], 0xfffffffb
mov dword [ebp - 0x924], 0xc6578637
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x1000da11