Function at 0x100093f9
Capabilities:
Contain obfuscated stackstrings
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b53d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe60
push esi
push edi
mov dword [ebp - 0x2a8], 0
jmp 0x10009432
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x1000944e
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0x824], 8
jmp 0x10009425
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x10009478
push 0x1f7e
push 0
push 0
push 0
push 0xdaa
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x824], 0xfffffffd
jmp 0x100094a6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x824]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x824], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x824], 0x14
je 0x100094de
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x100094dc
push 0
push 0xa1e
push 0x1209
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
jmp 0x1000948b
mov dword [ebp - 0x1e8], 0
jmp 0x100094f7
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jge 0x10009513
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x834], 8
jmp 0x100094ea
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1000953d
push 0x1f7e
push 0
push 0
push 0
push 0xdaa
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x834], 0xfffffffd
jmp 0x1000956b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x834]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x834], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x834], 0x14
je 0x100095a3
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x100095a1
push 0
push 0xa1e
push 0x1209
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
jmp 0x10009550
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x5c4], 0xef20fe6e
mov dword [ebp - 0x258], 0
jmp 0x100095d0
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x100095ec
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x918], 0xbeccce1e
jmp 0x100095c3
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x5c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5c4]
mov dword [ebp + eax - 0x918], ecx
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x10009636
push 0
push 0x202f
push 0
push 0x20ed
push 0x13d
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov dword [ebp - 0x140], 0x7862fd41
mov dword [ebp - 0x190], 0xbefcdf1
mov dword [ebp - 0x1f0], 0
jmp 0x10009663
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x1000967f
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0xa2c], 0xcfda6c2e
jmp 0x10009656
mov dword [ebp - 0x140], 0xfffffffb
jmp 0x10009698
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffe3
jg 0x100098ef
mov dword [ebp - 0x90], 0x70ade21
mov dword [ebp - 0x790], 1
mov dword [ebp - 0x90], 0
jmp 0x100096d2
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x11
jg 0x100097ee
mov dword [ebp - 0x290], 0xfffffffa
mov dword [ebp - 0x7b4], 0xe018
mov dword [ebp - 0x920], 0x6be856df
cmp dword [ebp - 0x290], 0
jne 0x10009722
mov dword [ebp - 0x7b4], 0x714ad38
cmp dword [ebp - 0x7b4], 0
jne 0x10009722
and dword [ebp - 0x7bc], 0
jmp 0x1000972c
mov dword [ebp - 0x7bc], 1
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x7bc], eax
jne 0x10009746
mov dword [ebp - 0x7c4], 1
jmp 0x1000974d
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x7c4], eax
jle 0x10009767
mov dword [ebp - 0x38c], 1
jmp 0x1000976e
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x290], eax
jge 0x10009791
cmp dword [ebp - 0x190], 0
je 0x10009791
mov dword [ebp - 0x770], 1
jmp 0x10009798
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x38c]
cmp eax, dword [ebp - 0x770]
jne 0x100097b2
mov dword [ebp - 0x394], 1
jmp 0x100097b9
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x394]
add eax, 6
cmp eax, dword [ebp - 0x190]
jne 0x100097d6
mov dword [ebp - 0x778], 1
jmp 0x100097dd
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x920], eax
jmp 0x100096c5
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xb4c], eax
cmp dword [ebp - 0x140], 0x7bf7
je 0x10009812
mov dword [ebp - 0x39c], 1
jmp 0x10009819
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
sub eax, dword [ebp - 0x90]
mov dword [ebp - 0x780], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x780]
mov dword [ebp + eax - 0xa2c], ecx
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x780], eax
jg 0x10009861
mov eax, 0x1477
test eax, eax
je 0x10009861
mov dword [ebp - 0x3a4], 1
jmp 0x10009868
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x190]
imul eax, dword [ebp - 0x3a4]
cmp eax, dword [ebp - 0x90]
jge 0x10009889
mov dword [ebp - 0x788], 1
jmp 0x10009890
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x788], eax
je 0x100098aa
mov dword [ebp - 0x3ac], 1
jmp 0x100098b1
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x790]
cmp dword [ebp - 0x90], eax
jle 0x100098d7
mov dword [ebp - 0x798], 1
jmp 0x100098de
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x90], eax
jmp 0x1000968b
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0xa2c]
mov dword [ebp + ecx - 0xa2c], eax
mov dword [ebp - 0xac], 0xac204e2
mov dword [ebp - 0x1f8], 0
jmp 0x1000992b
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x10009947
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0xe54], 0xffffffff
jmp 0x1000991e
mov dword [ebp - 0xac], 0
jmp 0x10009960
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffff9
je 0x1000998a
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10009988
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
jmp 0x10009953
mov dword [ebp - 0xac], 2
jmp 0x100099a3
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x100099cf
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x100099cd
push 0x184a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x10009996
mov dword [ebp - 0x260], 0
jmp 0x100099e8
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 2
jge 0x10009a04
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0x82c], 8
jmp 0x100099db
mov dword [ebp - 0x174], 0x5c96dd1e
mov dword [ebp - 0x1c0], 0xf2f4a8b1
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 0x200], 0xffffffff
mov dword [ebp - 0x324], 1
mov dword [ebp - 0x68], 0
jmp 0x10009a46
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x10009a5c
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x930], 0xe149cff2
jmp 0x10009a3f
mov dword [ebp - 0x68], 0
jmp 0x10009a6c
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x10009a82
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xdc4], 0x17b38e51
jmp 0x10009a65
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1c0], eax
mov eax, 0xb5e4
sub eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0x174]
sub eax, 0xebb
sub eax, dword [ebp - 0x3c4]
jne 0x10009abe
cmp dword [ebp - 0x174], 0
jne 0x10009abe
and dword [ebp - 0x928], 0
jmp 0x10009ac8
mov dword [ebp - 0x928], 1
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x200], eax
jl 0x10009aef
xor eax, eax
jne 0x10009aef
and dword [ebp - 0x3b8], 0
jmp 0x10009af9
mov dword [ebp - 0x3b8], 1
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x3b8], eax
jg 0x10009b13
mov dword [ebp - 0x3bc], 1
jmp 0x10009b1a
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
sub eax, dword [ebp - 0x200]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
sub eax, 0x5900
cmp dword [ebp - 0x1c0], eax
jge 0x10009b4b
mov dword [ebp - 0x6ec], 1
jmp 0x10009b52
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x3c4], 0
je 0x10009b7c
cmp dword [ebp - 0x1c0], 0
je 0x10009b7c
mov dword [ebp - 0x5e4], 1
jmp 0x10009b83
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x5e4], eax
je 0x10009b9d
mov dword [ebp - 0x3cc], 1
jmp 0x10009ba4
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x174]
imul eax, dword [ebp - 0x3cc]
test eax, eax
jne 0x10009bc7
cmp dword [ebp - 0x324], 0
jne 0x10009bc7
and dword [ebp - 0x774], 0
jmp 0x10009bd1
mov dword [ebp - 0x774], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x774]
mov dword [ebp + eax - 0x930], ecx
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x10009c0e
push 0x1f7e
push 0
push 0
push 0
push 0xdaa
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x9d8], 0xfffffff9
mov dword [ebp - 0x9d4], 0xfffffff9
mov dword [ebp - 0x9d0], 0xfffffff9
mov dword [ebp - 0x9cc], 0xfffffff9
lea ecx, [ebp - 0x2c5]
call fcn.100091b3
push eax
lea eax, [ebp - 0x9c8]
push eax
lea eax, [ebp - 0x9d8]
push eax
lea ecx, [ebp - 0xdfc]
call fcn.10015934
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7dc]
call fcn.100158fa
and dword [ebp - 4], 0
mov dword [ebp - 0x148], 0x184c506d
mov dword [ebp - 0x148], 0
jmp 0x10009c92
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jg 0x10009e6c
mov dword [ebp - 0x54], 0x6b950ba1
mov dword [ebp - 0x938], 0xffffffff
mov dword [ebp - 0x54], 3
jmp 0x10009cc0
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x10009e67
mov dword [ebp - 0x2b8], 0
jmp 0x10009ce3
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 2
jge 0x10009cff
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0xcdc], 0x63a74adf
jmp 0x10009cd6
cmp dword [ebp - 0x54], 0x795ed7c6
jne 0x10009d14
mov dword [ebp - 0x3d4], 1
jmp 0x10009d1b
and dword [ebp - 0x3d4], 0
push 1
lea ecx, [ebp - 0x7dc]
call fcn.10015925
mov ecx, dword [ebp - 0x3d4]
cmp ecx, dword [eax]
je 0x10009d4e
push dword [ebp - 0x54]
lea ecx, [ebp - 0x7dc]
call fcn.10015925
cmp dword [eax], 0
jne 0x10009d4e
and dword [ebp - 0x5ec], 0
jmp 0x10009d58
mov dword [ebp - 0x5ec], 1
mov esi, dword [ebp - 0x54]
mov eax, dword [ebp - 0x5ec]
sub eax, dword [ebp - 0x54]
imul esi, eax
push dword [ebp - 0x54]
lea ecx, [ebp - 0x7dc]
call fcn.10015925
cmp esi, dword [eax]
jle 0x10009d85
mov dword [ebp - 0x3dc], 1
jmp 0x10009d8c
and dword [ebp - 0x3dc], 0
push dword [ebp - 0x148]
lea ecx, [ebp - 0x7dc]
call fcn.10015925
mov ecx, dword [ebp - 0x3dc]
cmp ecx, dword [eax]
jle 0x10009db3
mov dword [ebp - 0x2e4], 1
jmp 0x10009dba
and dword [ebp - 0x2e4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp + eax - 0xcdc], ecx
cmp dword [ebp - 0x2e4], 0xf219a6f
jne 0x10009de5
mov dword [ebp - 0x6f4], 1
jmp 0x10009dec
and dword [ebp - 0x6f4], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x7dc]
call fcn.10015925
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6f4]
jg 0x10009e10
mov dword [ebp - 0x3e4], 1
jmp 0x10009e17
and dword [ebp - 0x3e4], 0
push dword [ebp - 0x148]
lea ecx, [ebp - 0x7dc]
call fcn.10015925
mov esi, eax
push 0
lea ecx, [ebp - 0x7dc]
call fcn.10015925
mov ecx, dword [ebp - 0x3e4]
sub ecx, dword [eax]
cmp dword [esi], ecx
je 0x10009e4f
mov dword [ebp - 0x5f4], 1
jmp 0x10009e56
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x938], eax
jmp 0x10009cb9
jmp 0x10009c85
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7dc]
call fcn.10015920
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x82c], 0xfffffffd
jmp 0x10009ea9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x82c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x82c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x82c], 0x14
je 0x10009ee1
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x10009edf
push 0
push 0xa1e
push 0x1209
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
jmp 0x10009e8e
mov dword [ebp - 0xd0c], 5
mov dword [ebp - 0xbe4], 0xffffffff
mov dword [ebp - 0xb10], 0xbd97a888
mov dword [ebp - 0xb18], 0
mov dword [ebp - 0xb20], 0x7f2fb5a5
mov dword [ebp - 0xb28], 0xd035c573
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb38], 0xfffffffd
push 2
lea ecx, [ebp - 0xa68]
call fcn.100158b8
mov dword [ebp - 4], 1
mov dword [ebp - 0xb40], 9
mov dword [ebp - 0x98], 0
jmp 0x10009f68
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x10009f84
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xb48], 0xfffffff9
jmp 0x10009f5b
mov dword [ebp - 0x98], 0
jmp 0x10009f9d
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x10009fbf
push dword [ebp - 0x98]
lea ecx, [ebp - 0xa68]
call fcn.10015925
mov dword [eax], 8
jmp 0x10009f90
push 1
lea ecx, [ebp - 0xa68]
call fcn.10015925
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3ec]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa68]
call fcn.10015920
mov dword [ebp - 0xb50], 5
mov dword [ebp - 0xb58], 0xffffffff
mov dword [ebp - 0xb60], 0xbd97a888
mov dword [ebp - 0xb68], 0
mov dword [ebp - 0xb70], 0x7f2fb5a5
mov dword [ebp - 0xb78], 0xd035c573
mov dword [ebp - 0xb80], 0
mov dword [ebp - 0xb88], 0xfffffffd
push 2
lea ecx, [ebp - 0xa80]
call fcn.100158b8
mov dword [ebp - 4], 2
mov dword [ebp - 0xb90], 9
mov dword [ebp - 0x70], 0
jmp 0x1000a070
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1000a086
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xb98], 0xfffffff9
jmp 0x1000a069
mov dword [ebp - 0x70], 0
jmp 0x1000a096
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1000a0b2
push dword [ebp - 0x70]
lea ecx, [ebp - 0xa80]
call fcn.10015925
mov dword [eax], 8
jmp 0x1000a08f
push 1
lea ecx, [ebp - 0xa80]
call fcn.10015925
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x7b8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x7b8]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa80]
call fcn.10015920
mov dword [ebp - 0xba0], 5
mov dword [ebp - 0xba8], 0xffffffff
mov dword [ebp - 0xbb0], 0xbd97a888
mov dword [ebp - 0xbb8], 0
mov dword [ebp - 0xbc0], 0x7f2fb5a5
mov dword [ebp - 0xbc8], 0xd035c573
mov dword [ebp - 0xbd0], 0
mov dword [ebp - 0xbd8], 0xfffffffd
push 2
lea ecx, [ebp - 0xa98]
call fcn.100158b8
mov dword [ebp - 4], 3
mov dword [ebp - 0xbe0], 9
mov dword [ebp - 0xa0], 0
jmp 0x1000a16c
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x1000a188
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xcf0], 0xfffffff9
jmp 0x1000a15f
mov dword [ebp - 0xa0], 0
jmp 0x1000a1a1
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1000a1c3
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xa98]
call fcn.10015925
mov dword [eax], 8
jmp 0x1000a194
push 1
lea ecx, [ebp - 0xa98]
call fcn.10015925
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3f4]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa98]
call fcn.10015920
mov dword [ebp - 0x34c], 0xffffffff
mov dword [ebp - 0x940], 1
mov dword [ebp - 0x950], 0xe6a3735b
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0xcf8], eax
mov eax, dword [ebp - 0x34c]
sub eax, 0x2d68d631
cmp dword [ebp - 0x940], eax
jg 0x1000a248
mov eax, 0xffff
test eax, eax
je 0x1000a248
mov dword [ebp - 0x5fc], 1
jmp 0x1000a24f
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 0xe60f
jne 0x1000a267
mov dword [ebp - 0x3fc], 1
jmp 0x1000a26e
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x34c]
cmp eax, dword [ebp - 0x3fc]
je 0x1000a292
mov dword [ebp - 0x948], 0xffff
mov dword [ebp - 0x948], 0xffffffff
jmp 0x1000a29c
mov dword [ebp - 0x950], 0xf65e790e
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x1000a2ce
push 0
push 0xd59
push 0x167d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov dword [ebp - 0x2ec], 0xffffffff
mov dword [ebp - 0x958], 1
mov dword [ebp - 0x968], 0xe6a3735b
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0xd00], eax
mov eax, dword [ebp - 0x2ec]
sub eax, 0x2d68d631
cmp dword [ebp - 0x958], eax
jg 0x1000a320
mov eax, 0xffff
test eax, eax
je 0x1000a320
mov dword [ebp - 0x6fc], 1
jmp 0x1000a327
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 0xe60f
jne 0x1000a33f
mov dword [ebp - 0x404], 1
jmp 0x1000a346
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x2ec]
cmp eax, dword [ebp - 0x404]
je 0x1000a36a
mov dword [ebp - 0x960], 0xffff
mov dword [ebp - 0x960], 0xffffffff
jmp 0x1000a374
mov dword [ebp - 0x968], 0xf65e790e
mov byte [ebp - 0xe0], 0
movzx eax, byte [ebp - 0xe0]
test eax, eax
je 0x1000a3a6
push 0
push 0xd59
push 0x167d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov dword [ebp - 0x10], 0x60477862
push 2
lea ecx, [ebp - 0x7ec]
call fcn.100158b8
mov dword [ebp - 4], 4
mov dword [ebp - 0x208], 0
jmp 0x1000a3da
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x1000a3fc
push dword [ebp - 0x208]
lea ecx, [ebp - 0x7ec]
call fcn.10015925
mov dword [eax], 6
jmp 0x1000a3cd
mov dword [ebp - 0x10], 0
jmp 0x1000a40c
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1000a4c0
mov dword [ebp - 0x970], 0xfff8
mov dword [ebp - 0x604], 0x5c62e089
mov dword [ebp - 0x9ec], 0x6a756a33
mov dword [ebp - 0x9e8], 0x6a756a33
mov dword [ebp - 0x9e4], 0x6a756a33
mov dword [ebp - 0x9e0], 0x6a756a33
lea ecx, [ebp - 0x2d1]
call fcn.100091b3
push eax
lea eax, [ebp - 0x9dc]
push eax
lea eax, [ebp - 0x9ec]
push eax
lea ecx, [ebp - 0xe0c]
call fcn.10015934
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbf0]
call fcn.100158fa
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x604], eax
mov esi, dword [ebp - 0x604]
push 0
lea ecx, [ebp - 0xbf0]
call fcn.10015925
mov dword [eax], esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xbf0]
call fcn.10015920
jmp 0x1000a405
mov dword [ebp - 0x10], 1
jmp 0x1000a4d0
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1000a6ad
mov dword [ebp - 0xb8], 0x49f6d4a0
mov dword [ebp - 0x77c], 0xfffffffc
mov dword [ebp - 0x980], 0xffffffff
mov dword [ebp - 0xb8], 0
jmp 0x1000a511
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jg 0x1000a6a8
mov dword [ebp - 0x32c], 0xffffffff
push 4
lea ecx, [ebp - 0xa8c]
call fcn.100158b8
mov byte [ebp - 4], 6
mov dword [ebp - 0x268], 0
jmp 0x1000a552
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 4
jge 0x1000a574
push dword [ebp - 0x268]
lea ecx, [ebp - 0xa8c]
call fcn.10015925
mov dword [eax], 0xfffffffe
jmp 0x1000a545
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7ec]
call fcn.10015925
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7ec]
call fcn.10015925
mov ecx, dword [ebp - 0x40c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x40c]
mov eax, dword [eax]
mov dword [ebp - 0x77c], eax
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 1
jbe 0x1000a5cf
mov dword [ebp - 0x414], 1
jmp 0x1000a5d6
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 1
jb 0x1000a66c
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x7ec]
call fcn.10015925
mov esi, eax
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x7ec]
call fcn.10015925
mov ecx, dword [esi]
add ecx, dword [eax]
imul ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x32c]
jl 0x1000a623
mov dword [ebp - 0x978], 1
jmp 0x1000a62a
and dword [ebp - 0x978], 0
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x7ec]
call fcn.10015925
mov eax, dword [eax]
dec eax
je 0x1000a64a
cmp dword [ebp - 0x10], 0
je 0x1000a64a
cmp dword [ebp - 0x10], 0
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x7ec]
call fcn.10015925
cmp dword [eax], 0
je 0x1000a66c
mov dword [ebp - 0x2f4], 1
jmp 0x1000a673
and dword [ebp - 0x2f4], 0
push 2
lea ecx, [ebp - 0xa8c]
call fcn.10015925
mov ecx, dword [ebp - 0x2f4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x980], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa8c]
call fcn.10015920
jmp 0x1000a504
jmp 0x1000a4c9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7ec]
call fcn.10015920
mov dword [ebp - 0x358], 0xffffffff
mov dword [ebp - 0x95c], 1
mov dword [ebp - 0x8b8], 0xe6a3735b
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0xd08], eax
mov eax, dword [ebp - 0x358]
sub eax, 0x2d68d631
cmp dword [ebp - 0x95c], eax
jg 0x1000a70e
mov eax, 0xffff
test eax, eax
je 0x1000a70e
mov dword [ebp - 0x60c], 1
jmp 0x1000a715
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 0xe60f
jne 0x1000a72d
mov dword [ebp - 0x41c], 1
jmp 0x1000a734
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x358]
cmp eax, dword [ebp - 0x41c]
je 0x1000a758
mov dword [ebp - 0x910], 0xffff
mov dword [ebp - 0x910], 0xffffffff
jmp 0x1000a762
mov dword [ebp - 0x8b8], 0xf65e790e
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x1000a794
push 0
push 0xd59
push 0x167d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov dword [ebp - 0x17c], 1
push 3
lea ecx, [ebp - 0xc04]
call fcn.100158b8
mov dword [ebp - 4], 7
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x210], 0
jmp 0x1000a7d5
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x1000a7f7
push dword [ebp - 0x210]
lea ecx, [ebp - 0xc04]
call fcn.10015925
mov dword [eax], 0x13d
jmp 0x1000a7c8
mov dword [ebp - 0x17c], 0x1a
jmp 0x1000a810
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x1b
jl 0x1000aa0e
mov dword [ebp - 0x1a0], 0x772304b2
mov dword [ebp - 0xad8], 0xf1e5c8a5
mov dword [ebp - 0xad4], 0xf1e5c8a5
mov dword [ebp - 0xad0], 0xf1e5c8a5
mov dword [ebp - 0xacc], 0xf1e5c8a5
mov dword [ebp - 0x864], 0xc44d4e2b
mov dword [ebp - 0x1a0], 0
jmp 0x1000a872
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 2
jg 0x1000a9d3
mov dword [ebp - 0x298], 8
mov dword [ebp - 0x298], 0
jmp 0x1000a8a2
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 2
jg 0x1000a9ce
mov dword [ebp - 0x1b8], 0xea66e58d
mov dword [ebp - 0x704], 0
mov dword [ebp - 0x1b8], 2
jmp 0x1000a8dc
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x1000a931
mov dword [ebp - 0x218], 0xe135e1f6
mov dword [ebp - 0x218], 0
jmp 0x1000a908
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jg 0x1000a92f
mov byte [ebp - 0xe2], 0
movzx eax, byte [ebp - 0xe2]
test eax, eax
je 0x1000a92d
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
jmp 0x1000a8fb
jmp 0x1000a8cf
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xd10], eax
mov eax, 0xffff
test eax, eax
je 0x1000a9bd
imul eax, dword [ebp - 0x704], 0xf0f5
test eax, eax
je 0x1000a969
mov eax, 0xfff9
test eax, eax
je 0x1000a969
mov dword [ebp - 0x868], 1
jmp 0x1000a970
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xd54], eax
cmp dword [ebp - 0x1b8], 0xc3f4f880
jb 0x1000a994
mov dword [ebp - 0x2fc], 1
jmp 0x1000a99b
and dword [ebp - 0x2fc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2fc]
mov dword [ebp + eax - 0xad8], ecx
cmp dword [ebp - 0x2fc], 0
jne 0x1000a9bd
cmp dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x864], eax
jmp 0x1000a895
jmp 0x1000a865
cmp dword [ebp - 0x424], 0
je 0x1000a9e8
mov dword [ebp - 0x424], 0xd91f06e8
jmp 0x1000aa09
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x1000aa09
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x1000a803
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x1000aa34
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc04]
call fcn.10015920
mov dword [ebp - 0x150], 0xffffffff
mov dword [ebp - 0x61c], 0xfff9
push 1
lea ecx, [ebp - 0xc14]
call fcn.100158b8
mov dword [ebp - 4], 8
mov dword [ebp - 0x270], 0
jmp 0x1000aa84
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x1000aaa6
push dword [ebp - 0x270]
lea ecx, [ebp - 0xc14]
call fcn.10015925
mov dword [eax], 0xdfd99643
jmp 0x1000aa77
mov dword [ebp - 0x150], 0
jmp 0x1000aabf
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xffffffe6
jle 0x1000ad77
push 1
lea ecx, [ebp - 0x374]
call fcn.100158b8
mov byte [ebp - 4], 9
mov dword [ebp - 0x86c], 0x3b0639e6
mov dword [ebp - 0x874], 1
mov dword [ebp - 0x220], 0
jmp 0x1000ab0a
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x1000ab2c
push dword [ebp - 0x220]
lea ecx, [ebp - 0x374]
call fcn.10015925
mov dword [eax], 0xeede0b40
jmp 0x1000aafd
push 0
lea ecx, [ebp - 0x374]
call fcn.10015925
mov dword [eax], 9
jmp 0x1000ab65
push 0
lea ecx, [ebp - 0x374]
call fcn.10015925
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x614]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x614]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x374]
call fcn.10015925
cmp dword [eax], 8
jge 0x1000ad63
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x42c], 0x9aaed6b6
mov dword [ebp - 0x70c], 0xfffffffd
mov dword [ebp - 0x2b0], 0
jmp 0x1000abb2
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 1
jge 0x1000abce
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x334], 0xed1d25bb
jmp 0x1000aba5
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xd5c], eax
push 0
lea ecx, [ebp - 0x374]
call fcn.10015925
mov eax, dword [eax]
mov dword [ebp - 0x800], eax
push 0
lea ecx, [ebp - 0x374]
call fcn.10015925
mov eax, dword [eax]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
cmp dword [ebp - 0x800], eax
jg 0x1000ac1e
mov dword [ebp - 0x8f4], 1
jmp 0x1000ac25
and dword [ebp - 0x8f4], 0
mov esi, dword [ebp - 0x61c]
push 0
lea ecx, [ebp - 0x374]
call fcn.10015925
cmp esi, dword [eax]
jg 0x1000ac4e
mov eax, 0x4039
test eax, eax
jne 0x1000ac4e
and dword [ebp - 0x434], 0
jmp 0x1000ac58
mov dword [ebp - 0x434], 1
mov eax, dword [ebp - 0x434]
neg eax
cmp eax, dword [ebp - 0x61c]
jl 0x1000ac74
mov dword [ebp - 0x43c], 1
jmp 0x1000ac7b
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
sub eax, 0x41e68184
mov dword [ebp - 0x70c], eax
mov eax, dword [ebp - 0x70c]
sub eax, 4
cmp eax, 0x2104
jg 0x1000aca8
mov dword [ebp - 0x444], 1
jmp 0x1000acaf
and dword [ebp - 0x444], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x334]
cmp dword [ebp - 0x444], eax
je 0x1000acd0
mov dword [ebp - 0x624], 1
jmp 0x1000acd7
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x86c]
cmp dword [ebp - 0x624], eax
jg 0x1000acfe
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x334], 0
jne 0x1000acfe
and dword [ebp - 0x44c], 0
jmp 0x1000ad08
mov dword [ebp - 0x44c], 1
push 0
lea ecx, [ebp - 0x374]
call fcn.10015925
mov ecx, dword [ebp - 0x44c]
cmp ecx, dword [eax]
jl 0x1000ad2b
mov dword [ebp - 0x93c], 1
jmp 0x1000ad32
and dword [ebp - 0x93c], 0
push 0
lea ecx, [ebp - 0x374]
call fcn.10015925
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xd64], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x334]
mov dword [ebp - 0x874], eax
jmp 0x1000ab41
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x374]
call fcn.10015920
jmp 0x1000aab2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc14]
call fcn.10015920
mov dword [ebp - 0x18], 0x60477862
push 2
lea ecx, [ebp - 0x7fc]
call fcn.100158b8
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x228], 0
jmp 0x1000adba
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x1000addc
push dword [ebp - 0x228]
lea ecx, [ebp - 0x7fc]
call fcn.10015925
mov dword [eax], 6
jmp 0x1000adad
mov dword [ebp - 0x18], 0
jmp 0x1000adec
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x1000aea0
mov dword [ebp - 0x8fc], 0xfff8
mov dword [ebp - 0x784], 0x5c62e089
mov dword [ebp - 0xa14], 0x6a756a33
mov dword [ebp - 0xa10], 0x6a756a33
mov dword [ebp - 0xa0c], 0x6a756a33
mov dword [ebp - 0xa08], 0x6a756a33
lea ecx, [ebp - 0x319]
call fcn.100091b3
push eax
lea eax, [ebp - 0xa04]
push eax
lea eax, [ebp - 0xa14]
push eax
lea ecx, [ebp - 0xe04]
call fcn.10015934
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc24]
call fcn.100158fa
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0x784], eax
mov esi, dword [ebp - 0x784]
push 0
lea ecx, [ebp - 0xc24]
call fcn.10015925
mov dword [eax], esi
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xc24]
call fcn.10015920
jmp 0x1000ade5
mov dword [ebp - 0x18], 1
jmp 0x1000aeb0
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1000b08d
mov dword [ebp - 0xd8], 0x49f6d4a0
mov dword [ebp - 0x62c], 0xfffffffc
mov dword [ebp - 0x97c], 0xffffffff
mov dword [ebp - 0xd8], 0
jmp 0x1000aef1
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jg 0x1000b088
mov dword [ebp - 0x304], 0xffffffff
push 4
lea ecx, [ebp - 0xa50]
call fcn.100158b8
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x278], 0
jmp 0x1000af32
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 4
jge 0x1000af54
push dword [ebp - 0x278]
lea ecx, [ebp - 0xa50]
call fcn.10015925
mov dword [eax], 0xfffffffe
jmp 0x1000af25
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7fc]
call fcn.10015925
mov dword [ebp - 0x454], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7fc]
call fcn.10015925
mov ecx, dword [ebp - 0x454]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x454]
mov eax, dword [eax]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jbe 0x1000afaf
mov dword [ebp - 0x45c], 1
jmp 0x1000afb6
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 1
jb 0x1000b04c
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x7fc]
call fcn.10015925
mov esi, eax
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x7fc]
call fcn.10015925
mov ecx, dword [esi]
add ecx, dword [eax]
imul ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x304]
jl 0x1000b003
mov dword [ebp - 0x87c], 1
jmp 0x1000b00a
and dword [ebp - 0x87c], 0
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x7fc]
call fcn.10015925
mov eax, dword [eax]
dec eax
je 0x1000b02a
cmp dword [ebp - 0x18], 0
je 0x1000b02a
cmp dword [ebp - 0x18], 0
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x7fc]
call fcn.10015925
cmp dword [eax], 0
je 0x1000b04c
mov dword [ebp - 0x350], 1
jmp 0x1000b053
and dword [ebp - 0x350], 0
push 2
lea ecx, [ebp - 0xa50]
call fcn.10015925
mov ecx, dword [ebp - 0x350]
mov dword [eax], ecx
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x97c], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa50]
call fcn.10015920
jmp 0x1000aee4
jmp 0x1000aea9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7fc]
call fcn.10015920
mov dword [ebp - 0x14], 0x60477862
push 2
lea ecx, [ebp - 0x80c]
call fcn.100158b8
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x230], 0
jmp 0x1000b0d0
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x1000b0f2
push dword [ebp - 0x230]
lea ecx, [ebp - 0x80c]
call fcn.10015925
mov dword [eax], 6
jmp 0x1000b0c3
mov dword [ebp - 0x14], 0
jmp 0x1000b102
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x1000b1b6
mov dword [ebp - 0x884], 0xfff8
mov dword [ebp - 0x714], 0x5c62e089
mov dword [ebp - 0xa00], 0x6a756a33
mov dword [ebp - 0x9fc], 0x6a756a33
mov dword [ebp - 0x9f8], 0x6a756a33
mov dword [ebp - 0x9f4], 0x6a756a33
lea ecx, [ebp - 0x345]
call fcn.100091b3
push eax
lea eax, [ebp - 0x9f0]
push eax
lea eax, [ebp - 0xa00]
push eax
lea ecx, [ebp - 0xdd4]
call fcn.10015934
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc34]
call fcn.100158fa
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x714], eax
mov esi, dword [ebp - 0x714]
push 0
lea ecx, [ebp - 0xc34]
call fcn.10015925
mov dword [eax], esi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc34]
call fcn.10015920
jmp 0x1000b0fb
mov dword [ebp - 0x14], 1
jmp 0x1000b1c6
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1000b3a3
mov dword [ebp - 0xc0], 0x49f6d4a0
mov dword [ebp - 0x634], 0xfffffffc
mov dword [ebp - 0x88c], 0xffffffff
mov dword [ebp - 0xc0], 0
jmp 0x1000b207
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jg 0x1000b39e
mov dword [ebp - 0x30c], 0xffffffff
push 4
lea ecx, [ebp - 0xa44]
call fcn.100158b8
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x2a0], 0
jmp 0x1000b248
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 4
jge 0x1000b26a
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xa44]
call fcn.10015925
mov dword [eax], 0xfffffffe
jmp 0x1000b23b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x80c]
call fcn.10015925
mov dword [ebp - 0x464], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x80c]
call fcn.10015925
mov ecx, dword [ebp - 0x464]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x464]
mov eax, dword [eax]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 1
jbe 0x1000b2c5
mov dword [ebp - 0x46c], 1
jmp 0x1000b2cc
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 1
jb 0x1000b362
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x80c]
call fcn.10015925
mov esi, eax
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x80c]
call fcn.10015925
mov ecx, dword [esi]
add ecx, dword [eax]
imul ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x30c]
jl 0x1000b319
mov dword [ebp - 0x904], 1
jmp 0x1000b320
and dword [ebp - 0x904], 0
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x80c]
call fcn.10015925
mov eax, dword [eax]
dec eax
je 0x1000b340
cmp dword [ebp - 0x14], 0
je 0x1000b340
cmp dword [ebp - 0x14], 0
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x80c]
call fcn.10015925
cmp dword [eax], 0
je 0x1000b362
mov dword [ebp - 0x33c], 1
jmp 0x1000b369
and dword [ebp - 0x33c], 0
push 2
lea ecx, [ebp - 0xa44]
call fcn.10015925
mov ecx, dword [ebp - 0x33c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x88c], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa44]
call fcn.10015920
jmp 0x1000b1fa
jmp 0x1000b1bf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80c]
call fcn.10015920
mov dword [ebp - 0xcd0], 0xfffffffa
mov dword [ebp - 0xaf8], 1
mov dword [ebp - 0xb08], 0x398070a
mov dword [ebp - 0xd58], 1
mov dword [ebp - 0xb04], 0x8974b666
mov dword [ebp - 0xc08], 0x367f5ed9
push 2
lea ecx, [ebp - 0xc44]
call fcn.100158b8
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xd24], 3
mov dword [ebp - 0xd20], 3
mov dword [ebp - 0xd1c], 3
mov dword [ebp - 0xd18], 3
mov dword [ebp - 0xb0c], 2
mov dword [ebp - 0x7c0], 0xffffffff
mov dword [ebp - 0x78], 0
jmp 0x1000b44e
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1000b46a
push dword [ebp - 0x78]
lea ecx, [ebp - 0xc44]
call fcn.10015925
mov dword [eax], 0x11151c3c
jmp 0x1000b447
mov dword [ebp - 0x78], 0
jmp 0x1000b47a
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1000b490
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xdf4], 0xfb2c41ac
jmp 0x1000b473
mov eax, dword [ebp - 0x7c0]
inc eax
mov dword [ebp - 0x7c0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc44]
call fcn.10015920
mov dword [ebp - 0x184], 1
push 3
lea ecx, [ebp - 0xc54]
call fcn.100158b8
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x63c], 1
mov dword [ebp - 0x238], 0
jmp 0x1000b4ed
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1000b50f
push dword [ebp - 0x238]
lea ecx, [ebp - 0xc54]
call fcn.10015925
mov dword [eax], 0x13d
jmp 0x1000b4e0
mov dword [ebp - 0x184], 0x1a
jmp 0x1000b528
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x1b
jl 0x1000b726
mov dword [ebp - 0x1a8], 0x772304b2
mov dword [ebp - 0xaa8], 0xf1e5c8a5
mov dword [ebp - 0xaa4], 0xf1e5c8a5
mov dword [ebp - 0xaa0], 0xf1e5c8a5
mov dword [ebp - 0xa9c], 0xf1e5c8a5
mov dword [ebp - 0x894], 0xc44d4e2b
mov dword [ebp - 0x1a8], 0
jmp 0x1000b58a
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 2
jg 0x1000b6eb
mov dword [ebp - 0x280], 8
mov dword [ebp - 0x280], 0
jmp 0x1000b5ba
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 2
jg 0x1000b6e6
mov dword [ebp - 0x1c8], 0xea66e58d
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x1c8], 2
jmp 0x1000b5f4
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jl 0x1000b649
mov dword [ebp - 0x240], 0xe135e1f6
mov dword [ebp - 0x240], 0
jmp 0x1000b620
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jg 0x1000b647
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x1000b645
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
jmp 0x1000b613
jmp 0x1000b5e7
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xce4], eax
mov eax, 0xffff
test eax, eax
je 0x1000b6d5
imul eax, dword [ebp - 0x474], 0xf0f5
test eax, eax
je 0x1000b681
mov eax, 0xfff9
test eax, eax
je 0x1000b681
mov dword [ebp - 0x944], 1
jmp 0x1000b688
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xb14], eax
cmp dword [ebp - 0x1c8], 0xc3f4f880
jb 0x1000b6ac
mov dword [ebp - 0x314], 1
jmp 0x1000b6b3
and dword [ebp - 0x314], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x314]
mov dword [ebp + eax - 0xaa8], ecx
cmp dword [ebp - 0x314], 0
jne 0x1000b6d5
cmp dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x894], eax
jmp 0x1000b5ad
jmp 0x1000b57d
cmp dword [ebp - 0x63c], 0
je 0x1000b700
mov dword [ebp - 0x63c], 0xd91f06e8
jmp 0x1000b721
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x1000b721
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x1000b51b
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1000b74c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc54]
call fcn.10015920
movzx eax, byte [0x11ef246c]
test eax, eax
je 0x1000b779
mov esi, 0x100835c4
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1000fb7a
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x344], 0x76acb8f2
mov dword [ebp - 0x48c], 1
mov dword [ebp - 0xa8], 0
jmp 0x1000b7ad
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1000b7c9
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xd70], 0x72c02a3
jmp 0x1000b7a0
mov dword [ebp - 0xa8], 0
jmp 0x1000b7e2
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1000b7fe
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xe6c], 0xabac89d7
jmp 0x1000b7d5
mov dword [ebp - 0x2c], 0
jmp 0x1000b80e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jl 0x1000b9be
mov dword [ebp - 0x78c], 0xc234
mov dword [ebp - 0x158], 0xfffffffe
cmp dword [ebp - 0x2c], 0
je 0x1000b874
cmp dword [ebp - 0x2c], 0
je 0x1000b874
mov eax, 0x1b583dc0
test eax, eax
je 0x1000b853
cmp dword [ebp - 0x2c], 0
je 0x1000b853
mov dword [ebp - 0x47c], 1
jmp 0x1000b85a
and dword [ebp - 0x47c], 0
imul eax, dword [ebp - 0x47c], 0xe661
test eax, eax
je 0x1000b874
mov dword [ebp - 0x71c], 1
jmp 0x1000b87b
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x71c], eax
jg 0x1000b892
mov dword [ebp - 0x484], 1
jmp 0x1000b899
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x484]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x344], eax
jle 0x1000b8bf
mov dword [ebp - 0x644], 1
jmp 0x1000b8c6
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x644], eax
jge 0x1000b8dd
mov dword [ebp - 0x90c], 1
jmp 0x1000b8e4
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x78c], 1
jbe 0x1000b91a
mov dword [ebp - 0x494], 1
jmp 0x1000b921
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x494], eax
jne 0x1000b93b
mov dword [ebp - 0x64c], 1
jmp 0x1000b942
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x64c], eax
jge 0x1000b95c
mov dword [ebp - 0x49c], 1
jmp 0x1000b963
and dword [ebp - 0x49c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x49c]
mov dword [ebp + eax - 0xd70], ecx
mov dword [ebp - 0x158], 0xffffffff
jmp 0x1000b98f
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x15
jle 0x1000b9b9
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1000b9b7
push 0
push 0x1de3
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x1000b982
jmp 0x1000b807
mov dword [ebp - 0x18c], 0xffffffff
mov dword [ebp - 0x7f0], 0xfff9
push 1
lea ecx, [ebp - 0xc64]
call fcn.100158b8
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x2c0], 0
jmp 0x1000b9ff
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 1
jge 0x1000ba21
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0xc64]
call fcn.10015925
mov dword [eax], 0xdfd99643
jmp 0x1000b9f2
mov dword [ebp - 0x18c], 0
jmp 0x1000ba3a
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xffffffe6
jle 0x1000bcf2
push 1
lea ecx, [ebp - 0x380]
call fcn.100158b8
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x964], 0x3b0639e6
mov dword [ebp - 0x914], 1
mov dword [ebp - 0x248], 0
jmp 0x1000ba85
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1000baa7
push dword [ebp - 0x248]
lea ecx, [ebp - 0x380]
call fcn.10015925
mov dword [eax], 0xeede0b40
jmp 0x1000ba78
push 0
lea ecx, [ebp - 0x380]
call fcn.10015925
mov dword [eax], 9
jmp 0x1000bae0
push 0
lea ecx, [ebp - 0x380]
call fcn.10015925
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x724]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x724]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x380]
call fcn.10015925
cmp dword [eax], 8
jge 0x1000bcde
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x4a4], 0x9aaed6b6
mov dword [ebp - 0x65c], 0xfffffffd
mov dword [ebp - 0x288], 0
jmp 0x1000bb2d
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jge 0x1000bb49
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0x2cc], 0xed1d25bb
jmp 0x1000bb20
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xb1c], eax
push 0
lea ecx, [ebp - 0x380]
call fcn.10015925
mov eax, dword [eax]
mov dword [ebp - 0x654], eax
push 0
lea ecx, [ebp - 0x380]
call fcn.10015925
mov eax, dword [eax]
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x654], eax
jg 0x1000bb99
mov dword [ebp - 0x89c], 1
jmp 0x1000bba0
and dword [ebp - 0x89c], 0
mov esi, dword [ebp - 0x7f0]
push 0
lea ecx, [ebp - 0x380]
call fcn.10015925
cmp esi, dword [eax]
jg 0x1000bbc9
mov eax, 0x4039
test eax, eax
jne 0x1000bbc9
and dword [ebp - 0x4ac], 0
jmp 0x1000bbd3
mov dword [ebp - 0x4ac], 1
mov eax, dword [ebp - 0x4ac]
neg eax
cmp eax, dword [ebp - 0x7f0]
jl 0x1000bbef
mov dword [ebp - 0x4b4], 1
jmp 0x1000bbf6
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
sub eax, 0x41e68184
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x65c]
sub eax, 4
cmp eax, 0x2104
jg 0x1000bc23
mov dword [ebp - 0x4bc], 1
jmp 0x1000bc2a
and dword [ebp - 0x4bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2cc]
cmp dword [ebp - 0x4bc], eax
je 0x1000bc4b
mov dword [ebp - 0x72c], 1
jmp 0x1000bc52
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x964]
cmp dword [ebp - 0x72c], eax
jg 0x1000bc79
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2cc], 0
jne 0x1000bc79
and dword [ebp - 0x4c4], 0
jmp 0x1000bc83
mov dword [ebp - 0x4c4], 1
push 0
lea ecx, [ebp - 0x380]
call fcn.10015925
mov ecx, dword [ebp - 0x4c4]
cmp ecx, dword [eax]
jl 0x1000bca6
mov dword [ebp - 0x8a4], 1
jmp 0x1000bcad
and dword [ebp - 0x8a4], 0
push 0
lea ecx, [ebp - 0x380]
call fcn.10015925
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xd14], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2cc]
mov dword [ebp - 0x914], eax
jmp 0x1000babc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x380]
call fcn.10015920
jmp 0x1000ba2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc64]
call fcn.10015920
mov dword [ebp - 0xd0], 0xfffffffa
mov dword [ebp - 0x110], 0x61e3ff14
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x1000bd2f
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov dword [ebp - 0xd0], 0xfffffff9
jmp 0x1000bd48
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xfffffffa
jge 0x1000c1a2
mov dword [ebp - 0x160], 0x9ba095a9
mov dword [ebp - 0xb0], 0xf4f823aa
mov dword [ebp - 0x674], 0xf093d7f2
mov dword [ebp - 0x8ac], 0xd2c2
mov dword [ebp - 0x504], 0x9c821f9
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x80fc
jle 0x1000bdab
mov dword [ebp - 0x664], 1
jmp 0x1000bdb2
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x664]
je 0x1000bdcc
mov dword [ebp - 0x4cc], 1
jmp 0x1000bdd3
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x4cc], eax
je 0x1000bded
mov dword [ebp - 0x794], 1
jmp 0x1000bdf4
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x794]
je 0x1000be1a
mov dword [ebp - 0x4d4], 1
jmp 0x1000be21
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x160]
add eax, dword [ebp - 0x4d4]
jne 0x1000be3b
mov dword [ebp - 0x66c], 1
jmp 0x1000be42
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
add eax, 9
jne 0x1000be5f
mov eax, 0x2c41
test eax, eax
jne 0x1000be5f
and dword [ebp - 0x4dc], 0
jmp 0x1000be69
mov dword [ebp - 0x4dc], 1
cmp dword [ebp - 0x4dc], 1
jg 0x1000be84
cmp dword [ebp - 0x160], 0
jne 0x1000be84
and dword [ebp - 0x734], 0
jmp 0x1000be8e
mov dword [ebp - 0x734], 1
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x734], eax
jle 0x1000c134
mov dword [ebp - 0x108], 6
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x73c], 0xfffffffb
push 2
lea ecx, [ebp - 0xa74]
call fcn.100158b8
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x8b4], 0xfffffffa
mov dword [ebp - 0x1d0], 0
jmp 0x1000bef5
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jge 0x1000bf14
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xa74]
call fcn.10015925
and dword [eax], 0
jmp 0x1000bee8
cmp dword [ebp - 0x108], 8
jl 0x1000bf29
mov dword [ebp - 0x4e4], 1
jmp 0x1000bf30
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x674], eax
jl 0x1000bf56
mov dword [ebp - 0x4ec], 1
jmp 0x1000bf5d
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x4ec], eax
jg 0x1000bf77
mov dword [ebp - 0x7a0], 1
jmp 0x1000bf7e
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x8ac]
cmp dword [ebp - 0x7a0], eax
jle 0x1000bf98
mov dword [ebp - 0x91c], 0xffffffff
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x91c], eax
mov dword [ebp - 0xb0], 0
jmp 0x1000c16f
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x10
jge 0x1000c19d
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1000c19b
push 0
push 0
push 0x1473
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
jmp 0x1000c162
jmp 0x1000bd3b
mov dword [ebp - 0x178], 1
push 3
lea ecx, [ebp - 0xc74]
call fcn.100158b8
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x744], 1
mov dword [ebp - 0x250], 0
jmp 0x1000c1e3
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x1000c205
push dword [ebp - 0x250]
lea ecx, [ebp - 0xc74]
call fcn.10015925
mov dword [eax], 0x13d
jmp 0x1000c1d6
mov dword [ebp - 0x178], 0x1a
jmp 0x1000c21e
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x1b
jl 0x1000c41c
mov dword [ebp - 0x1b0], 0x772304b2
mov dword [ebp - 0xab8], 0xf1e5c8a5
mov dword [ebp - 0xab4], 0xf1e5c8a5
mov dword [ebp - 0xab0], 0xf1e5c8a5
mov dword [ebp - 0xaac], 0xf1e5c8a5
mov dword [ebp - 0x974], 0xc44d4e2b
mov dword [ebp - 0x1b0], 0
jmp 0x1000c280
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jg 0x1000c3e1
mov dword [ebp - 0x1dc], 8
mov dword [ebp - 0x1dc], 0
jmp 0x1000c2b0
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 2
jg 0x1000c3dc
mov dword [ebp - 0x194], 0xea66e58d
mov dword [ebp - 0x51c], 0
mov dword [ebp - 0x194], 2
jmp 0x1000c2ea
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jl 0x1000c33f
mov dword [ebp - 0x1e4], 0xe135e1f6
mov dword [ebp - 0x1e4], 0
jmp 0x1000c316
cmp dword [ebp - 0x1e4], 2
jg 0x1000c33d
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1000c33b
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
jmp 0x1000c309
jmp 0x1000c2dd
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0xc28], eax
mov eax, 0xffff
test eax, eax
je 0x1000c3cb
imul eax, dword [ebp - 0x51c], 0xf0f5
test eax, eax
je 0x1000c377
mov eax, 0xfff9
test eax, eax
je 0x1000c377
mov dword [ebp - 0x8bc], 1
jmp 0x1000c37e
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xb2c], eax
cmp dword [ebp - 0x194], 0xc3f4f880
jb 0x1000c3a2
mov dword [ebp - 0x2d8], 1
jmp 0x1000c3a9
and dword [ebp - 0x2d8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2d8]
mov dword [ebp + eax - 0xab8], ecx
cmp dword [ebp - 0x2d8], 0
jne 0x1000c3cb
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x974], eax
jmp 0x1000c2a3
jmp 0x1000c273
cmp dword [ebp - 0x744], 0
je 0x1000c3f6
mov dword [ebp - 0x744], 0xd91f06e8
jmp 0x1000c417
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x1000c417
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x1000c211
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1000c442
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc74]
call fcn.10015920
mov dword [ebp - 0xcec], 0x100835c4
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x2e0], 0x76acb8f2
mov dword [ebp - 0x534], 1
mov dword [ebp - 0x80], 0
jmp 0x1000c486
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1000c49c
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xd94], 0x72c02a3
jmp 0x1000c47f
mov dword [ebp - 0x80], 0
jmp 0x1000c4ac
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1000c4c2
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xe18], 0xabac89d7
jmp 0x1000c4a5
mov dword [ebp - 0x34], 0
jmp 0x1000c4d2
cmp dword [ebp - 0x34], 1
jl 0x1000c682
mov dword [ebp - 0x69c], 0xc234
mov dword [ebp - 0x168], 0xfffffffe
cmp dword [ebp - 0x34], 0
je 0x1000c538
cmp dword [ebp - 0x34], 0
je 0x1000c538
mov eax, 0x1b583dc0
test eax, eax
je 0x1000c517
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x694], eax
jg 0x1000c556
mov dword [ebp - 0x52c], 1
jmp 0x1000c55d
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x52c]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2e0], eax
jle 0x1000c583
mov dword [ebp - 0xc38], 0x100835c8
mov dword [ebp - 0xb3c], 0xfffffffa
mov dword [ebp - 0xd50], 1
mov dword [ebp - 0xb44], 0x398070a
mov dword [ebp - 0xc48], 1
mov dword [ebp - 0xaec], 0x8974b666
mov dword [ebp - 0xcf4], 0x367f5ed9
push 2
lea ecx, [ebp - 0xc84]
call fcn.100158b8
mov dword [ebp - 4], 0x16
mov dword [ebp - 0xd38], 3
mov dword [ebp - 0xd34], 3
mov dword [ebp - 0xd30], 3
mov dword [ebp - 0xd2c], 3
mov dword [ebp - 0xb54], 2
mov dword [ebp - 0x6a4], 0xffffffff
mov dword [ebp - 0x5c], 0
jmp 0x1000c728
cmp dword [ebp - 0x5c], 2
jge 0x1000c744
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xc84]
call fcn.10015925
mov dword [eax], 0x11151c3c
jmp 0x1000c721
mov dword [ebp - 0x5c], 0
jmp 0x1000c754
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret