Function at 0x10009144
Capabilities:
Get keyboard layout
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100808ed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x101c
call fcn.100673e0
push esi
push edi
mov dword [ebp - 0x4c], 0xcea5d6c0
mov dword [ebp - 0x248], 0
jmp 0x10009188
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x100091a4
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x228], 0xffffffff
jmp 0x1000917b
mov dword [ebp - 0x4c], 0xfffffff1
jmp 0x100091b4
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffff0
jl 0x100091dd
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x100091db
push 0
push 0x1051
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
jmp 0x100091ad
mov dword [ebp - 0x4c], 0
jmp 0x100091ed
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jg 0x1000932a
mov dword [ebp - 0x308], 0xfffffff8
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x228], 0
jne 0x1000929a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x228]
cmp dword [ebp - 0x308], eax
jg 0x10009233
mov dword [ebp - 0x6ec], 1
jmp 0x1000923a
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x6ec]
je 0x10009251
mov dword [ebp - 0xa40], 1
jmp 0x10009258
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x308]
imul eax, dword [ebp - 0x308]
cmp eax, 0xa9b27fa
je 0x10009278
mov dword [ebp - 0xa38], 1
jmp 0x1000927f
and dword [ebp - 0xa38], 0
imul eax, dword [ebp - 0xa38], 0x5bef
cmp dword [ebp - 0xa40], eax
jge 0x1000929a
and dword [ebp - 0xa48], 0
jmp 0x100092a4
mov dword [ebp - 0xa48], 1
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x228]
cmp dword [ebp - 0xa48], eax
jl 0x100092c2
mov dword [ebp - 0xa50], 1
jmp 0x100092c9
and dword [ebp - 0xa50], 0
cmp dword [ebp - 0xa50], 0xfffa
jb 0x100092e1
mov dword [ebp - 0xa58], 1
jmp 0x100092e8
and dword [ebp - 0xa58], 0
cmp dword [ebp - 0xa58], 0
je 0x10009313
mov dword [ebp - 0xb24], 0xd271
mov dword [ebp - 0xbbc], 0x9ee491ba
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0xbbc], eax
jmp 0x10009325
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x228], 0
je 0x10009325
jmp 0x1000932a
jmp 0x100091e6
mov dword [ebp - 0x64], 0
mov dword [ebp - 0xf0], 0
push 2
lea ecx, [ebp - 0xa78]
call fcn.10016697
and dword [ebp - 4], 0
mov dword [ebp - 0x134], 0x2bf5f40e
mov dword [ebp - 0xd6c], 0x88307b36
mov dword [ebp - 0xd68], 0x88307b36
mov dword [ebp - 0xd64], 0x88307b36
mov dword [ebp - 0xd60], 0x88307b36
mov dword [ebp - 0x420], 0xfffffffd
mov dword [ebp - 0xbd4], 0xdd754719
mov dword [ebp - 0x2e4], 0
jmp 0x100093ab
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 2
jge 0x100093cd
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0xa78]
call fcn.10016738
mov dword [eax], 0x725245f5
jmp 0x1000939e
cmp dword [ebp - 0x64], 0
jne 0x100094a0
push 1
lea ecx, [ebp - 0xa78]
call fcn.10016738
cmp dword [eax], 1
jle 0x100093f5
mov dword [ebp - 0xa68], 1
jmp 0x100093fc
and dword [ebp - 0xa68], 0
mov dword [ebp - 0xf0], 0xffffffff
mov esi, dword [ebp - 0xf0]
push 1
lea ecx, [ebp - 0xa78]
call fcn.10016738
mov ecx, dword [ebp - 0xa68]
sub ecx, dword [eax]
cmp esi, ecx
jge 0x10009431
mov dword [ebp - 0x748], 1
jmp 0x10009438
and dword [ebp - 0x748], 0
push 1
lea ecx, [ebp - 0xa78]
call fcn.10016738
mov ecx, dword [ebp - 0x748]
cmp ecx, dword [eax]
jge 0x1000945b
mov dword [ebp - 0x3f0], 1
jmp 0x10009462
and dword [ebp - 0x3f0], 0
cmp dword [ebp - 0x3f0], 0
je 0x10009472
cmp dword [ebp - 0xf0], 0
mov eax, 0xa5ea
imul esi, eax, 0x623b
sub esi, 0x5d1c
push 0
lea ecx, [ebp - 0xa78]
call fcn.10016738
sub esi, dword [eax]
cmp esi, dword [ebp - 0x64]
jg 0x100094a0
and dword [ebp - 0x750], 0
jmp 0x100094aa
mov dword [ebp - 0x750], 1
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x64], 1
jmp 0x100094c6
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x100099c5
mov dword [ebp - 0xbc4], 0x757520c2
mov dword [ebp - 0xf0], 0
jmp 0x100094f3
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jg 0x100099c0
mov dword [ebp - 0x1a0], 0x2089ce37
mov dword [ebp - 0x3f8], 0x2edfd682
mov dword [ebp - 0x430], 0xdfba308d
mov dword [ebp - 0x78], 0
jmp 0x1000952e
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x10009544
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xed4], 0x3f0b
jmp 0x10009527
mov dword [ebp - 0x78], 0
jmp 0x10009554
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1000956a
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xbcc], 0
jmp 0x1000954d
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x10009592
push 0
push 0
push 0x26c
push 0x17d3
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
mov dword [ebp - 0x134], 0
jmp 0x100095ab
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jg 0x100099bb
mov dword [ebp - 0x100], 2
mov dword [ebp - 0x758], 0xd8169b41
mov dword [ebp - 0x230], 0
jmp 0x100095e5
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x10009601
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0xfc8], 0
jmp 0x100095d8
mov dword [ebp - 0x100], 0
jmp 0x1000961a
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jg 0x100099b6
push 3
lea ecx, [ebp - 0xcf8]
call fcn.10016697
mov byte [ebp - 4], 1
mov dword [ebp - 0xe4], 0
jmp 0x10009651
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x1000966d
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x790], 3
jmp 0x10009644
mov dword [ebp - 0xe4], 0
jmp 0x10009686
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jge 0x100096a8
push dword [ebp - 0xe4]
lea ecx, [ebp - 0xcf8]
call fcn.10016738
mov dword [eax], 0x1ddbc75b
jmp 0x10009679
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xed4]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xed4], eax
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0xe9c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xfc8], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0
je 0x10009708
cmp dword [ebp - 0x758], 0
je 0x10009708
mov dword [ebp - 0x400], 1
jmp 0x1000970f
and dword [ebp - 0x400], 0
cmp dword [ebp - 0x400], 0xffffffff
jge 0x10009724
mov dword [ebp - 0x760], 1
jmp 0x1000972b
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x760], eax
je 0x1000974b
cmp dword [ebp - 0x100], 0
jne 0x1000974b
and dword [ebp - 0x408], 0
jmp 0x10009755
mov dword [ebp - 0x408], 1
push 2
lea ecx, [ebp - 0xcf8]
call fcn.10016738
mov ecx, dword [ebp - 0x408]
cmp ecx, dword [eax]
jle 0x10009778
mov dword [ebp - 0x768], 1
jmp 0x1000977f
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x768]
je 0x10009799
mov dword [ebp - 0x310], 1
jmp 0x100097a0
and dword [ebp - 0x310], 0
push 2
lea ecx, [ebp - 0xcf8]
call fcn.10016738
mov ecx, dword [ebp - 0x310]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x310], eax
jg 0x100097d1
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xd6c], 0
mov eax, 0xab93
neg eax
cmp eax, 0xfffffffc
jbe 0x100097e9
mov dword [ebp - 0x410], 1
jmp 0x100097f0
and dword [ebp - 0x410], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x410]
mov dword [ebp + eax - 0xd6c], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x790]
cmp dword [ebp - 0x100], eax
jge 0x10009824
mov dword [ebp - 0x770], 1
jmp 0x1000982b
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x10009855
mov eax, 0x85fae11b
test eax, eax
je 0x10009855
mov dword [ebp - 0x418], 1
jmp 0x1000985c
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
neg eax
je 0x1000987b
mov eax, 0xebc4d591
test eax, eax
je 0x1000987b
mov dword [ebp - 0x780], 1
jmp 0x10009882
and dword [ebp - 0x780], 0
push dword [ebp - 0xf0]
lea ecx, [ebp - 0xa78]
call fcn.10016738
mov dword [ebp - 0x778], eax
push dword [ebp - 0x134]
lea ecx, [ebp - 0xa78]
call fcn.10016738
mov ecx, dword [ebp - 0x778]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x778]
mov eax, dword [eax]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
sub eax, dword [ebp - 0x780]
cmp eax, dword [ebp - 0x64]
je 0x100098df
mov dword [ebp - 0x428], 1
jmp 0x100098e6
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x428], eax
jge 0x10009900
mov dword [ebp - 0x788], 1
jmp 0x10009907
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x430], eax
imul eax, dword [ebp - 0x430], 0
add eax, dword [ebp - 0x64]
imul eax, dword [ebp - 0xbc4]
add eax, dword [ebp - 0x64]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x790]
jne 0x10009942
mov dword [ebp - 0x438], 1
jmp 0x10009949
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x438], eax
jl 0x10009963
mov dword [ebp - 0x798], 1
jmp 0x1000996a
and dword [ebp - 0x798], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbcc]
cmp dword [ebp - 0x798], eax
jg 0x1000998c
xor eax, eax
jne 0x1000998c
and dword [ebp - 0x440], 0
jmp 0x10009996
mov dword [ebp - 0x440], 1
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0xbd4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xcf8]
call fcn.1001671c
jmp 0x1000960d
jmp 0x1000959e
jmp 0x100094e6
jmp 0x100094bf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa78]
call fcn.1001671c
mov dword [ebp - 0xf8], 0
push 3
lea ecx, [ebp - 0x210]
call fcn.10016697
mov dword [ebp - 4], 2
mov dword [ebp - 0x448], 0xffff
mov dword [ebp - 0x7a0], 1
push 1
lea ecx, [ebp - 0xde4]
call fcn.10016697
mov byte [ebp - 4], 3
mov dword [ebp - 0x2ec], 0
jmp 0x10009a30
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 1
jge 0x10009a52
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0xde4]
call fcn.10016738
mov dword [eax], 0x9d94
jmp 0x10009a23
cmp dword [ebp - 0x448], 0
je 0x10009aa2
mov dword [ebp - 0x190], 0x8b108f82
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x190], 0
jmp 0x10009a8a
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x31
jne 0x10009aa0
cmp dword [ebp - 0x7a0], 0
je 0x10009a9e
jmp 0x10009aa0
jmp 0x10009a7d
jmp 0x10009ad7
mov dword [ebp - 0xbdc], 0x2a831d26
mov dword [ebp - 0xbe4], 0x5c285ce9
mov esi, dword [ebp - 0x448]
push 0
lea ecx, [ebp - 0xde4]
call fcn.10016738
mov dword [eax], esi
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbe4], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xde4]
call fcn.1001671c
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x164], 0xffffffff
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jne 0x10009b12
mov dword [ebp - 0x450], 1
jmp 0x10009b19
and dword [ebp - 0x450], 0
cmp dword [ebp - 0x50], 0
jne 0x10009b2b
mov dword [ebp - 0x7a8], 1
jmp 0x10009b32
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x450], eax
jl 0x10009b5b
mov dword [ebp - 0x7b0], 1
jmp 0x10009b62
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x7b0], eax
jge 0x10009b79
mov dword [ebp - 0x458], 1
jmp 0x10009b80
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x458], eax
jle 0x10009b97
mov dword [ebp - 0x7b8], 1
jmp 0x10009b9e
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x7b8], eax
jl 0x10009bb5
mov dword [ebp - 0x460], 1
jmp 0x10009bbc
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x460]
jle 0x10009bd3
mov dword [ebp - 0x7c0], 1
jmp 0x10009bda
and dword [ebp - 0x7c0], 0
cmp dword [ebp - 0x7c0], 0xfffffff8
jne 0x10009bef
mov dword [ebp - 0x468], 1
jmp 0x10009bf6
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x468]
jne 0x10009c0d
mov dword [ebp - 0x7c8], 1
jmp 0x10009c14
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x164], 0
jmp 0x10009c36
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0xffffffee
je 0x10009cbe
push 4
lea ecx, [ebp - 0xdc0]
call fcn.10016697
mov byte [ebp - 4], 4
mov dword [ebp - 0xbec], 9
mov dword [ebp - 0x238], 0
jmp 0x10009c73
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 4
jge 0x10009c95
push dword [ebp - 0x238]
lea ecx, [ebp - 0xdc0]
call fcn.10016738
mov dword [eax], 0xfffe
jmp 0x10009c66
push 3
lea ecx, [ebp - 0xdc0]
call fcn.10016738
mov eax, dword [eax]
mov dword [ebp - 0xbec], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdc0]
call fcn.1001671c
jmp 0x10009c29
mov dword [ebp - 0x80], 0
jmp 0x10009cce
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x10009cea
push dword [ebp - 0x80]
lea ecx, [ebp - 0x210]
call fcn.10016738
mov dword [eax], 1
jmp 0x10009cc7
mov dword [ebp - 0x80], 0
jmp 0x10009cfa
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x10009d10
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1cc], 0xda7da9fc
jmp 0x10009cf3
mov eax, 0x551da622
test eax, eax
je 0x10009d2e
cmp dword [ebp - 0xf8], 0
je 0x10009d2e
mov dword [ebp - 0x370], 1
jmp 0x10009d35
and dword [ebp - 0x370], 0
push 0
lea ecx, [ebp - 0x210]
call fcn.10016738
mov ecx, dword [ebp - 0x370]
mov dword [eax], ecx
cmp dword [ebp - 0x370], 0
je 0x10009d7d
push 0
lea ecx, [ebp - 0x210]
call fcn.10016738
imul eax, dword [eax], 0x7adf
test eax, eax
je 0x10009d7d
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x10009d7d
mov dword [ebp - 0x470], 1
jmp 0x10009d84
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x470], eax
je 0x10009d9b
mov dword [ebp - 0x7d0], 1
jmp 0x10009da2
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x7d0]
jle 0x10009dbc
mov dword [ebp - 0xbf4], 1
jmp 0x10009dc3
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xe80], eax
xor eax, eax
je 0x10009f2e
mov dword [ebp - 0x2f4], 0x16488a
cmp dword [ebp - 0xf8], 0
je 0x10009e71
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xf28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xe88], eax
push 0
lea ecx, [ebp - 0x210]
call fcn.10016738
mov ecx, dword [ebp - 0x2f4]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x2f4]
jge 0x10009e26
mov dword [ebp - 0x478], 1
jmp 0x10009e2d
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x478], eax
jg 0x10009e47
mov dword [ebp - 0x7d8], 1
jmp 0x10009e4e
and dword [ebp - 0x7d8], 0
imul eax, dword [ebp - 0x7d8], 0x90
test eax, eax
je 0x10009e71
cmp dword [ebp - 0x2f4], 0
je 0x10009e71
mov dword [ebp - 0x480], 1
jmp 0x10009e78
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0x5189
je 0x10009e90
mov dword [ebp - 0x7e0], 1
jmp 0x10009e97
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x7e0]
add eax, 0xe62b
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x10], 0
jmp 0x10009eb8
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x10009f29
mov dword [ebp - 0xf8], 0
jmp 0x10009ed7
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jg 0x10009f06
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x10009f04
push 0x1047
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x10009eca
mov byte [ebp - 0x110], 0
movzx eax, byte [ebp - 0x110]
test eax, eax
je 0x10009f27
push 0x7ab
push 0x73
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x10009eb1
jmp 0x1000a39a
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x1a4], 1
mov dword [ebp - 0x188], 0x879b6842
mov dword [ebp - 0x10], 2
jmp 0x10009f59
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1000a1a8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xf94], eax
mov esi, dword [ebp - 0x2c]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x210]
call fcn.10016738
cmp esi, dword [eax]
jge 0x10009f90
cmp dword [ebp - 0x2c], 0
jne 0x10009f90
and dword [ebp - 0x318], 0
jmp 0x10009f9a
mov dword [ebp - 0x318], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x318]
mov dword [ebp + eax - 0x1cc], ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x210]
call fcn.10016738
mov esi, dword [ebp - 0x318]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x210]
call fcn.10016738
sub esi, dword [eax]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x210]
call fcn.10016738
sub esi, dword [eax]
cmp esi, dword [ebp - 0x2c]
jge 0x10009ff3
mov dword [ebp - 0x488], 1
jmp 0x10009ffa
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x488]
jne 0x1000a011
mov dword [ebp - 0xbfc], 1
jmp 0x1000a018
and dword [ebp - 0xbfc], 0
push 1
lea ecx, [ebp - 0x210]
call fcn.10016738
push dword [ebp - 0x10]
lea ecx, [ebp - 0x210]
call fcn.10016738
mov ecx, dword [ebp - 0x2c]
cmp dword [eax], ecx
jne 0x1000a046
mov dword [ebp - 0x7e8], 1
jmp 0x1000a04d
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 9
jge 0x1000a06e
mov dword [ebp - 0xc2c], 1
jmp 0x1000a075
and dword [ebp - 0xc2c], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x210]
call fcn.10016738
mov ecx, dword [ebp - 0x2c]
cmp dword [eax], ecx
jle 0x1000a096
mov dword [ebp - 0x490], 1
jmp 0x1000a09d
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x490]
jne 0x1000a0c6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1cc], 0
jne 0x1000a0c6
xor eax, eax
inc eax
jne 0x1000a0c6
and dword [ebp - 0x7f0], 0
jmp 0x1000a0d0
mov dword [ebp - 0x7f0], 1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x210]
call fcn.10016738
mov ecx, dword [ebp - 0x7f0]
cmp ecx, dword [eax]
jne 0x1000a0f4
mov dword [ebp - 0x498], 1
jmp 0x1000a0fb
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xc499
jg 0x1000a12f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1cc], 0
je 0x1000a12f
mov dword [ebp - 0x7f8], 1
jmp 0x1000a136
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x7f8], eax
jg 0x1000a152
xor eax, eax
inc eax
je 0x1000a152
mov dword [ebp - 0x4a0], 1
jmp 0x1000a159
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x4a0]
jne 0x1000a173
cmp dword [ebp - 0x10], 0
jne 0x1000a173
and dword [ebp - 0x800], 0
jmp 0x1000a17d
mov dword [ebp - 0x800], 1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x210]
call fcn.10016738
mov esi, dword [eax]
sub esi, dword [ebp - 0x800]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x210]
call fcn.10016738
mov dword [eax], esi
jmp 0x10009f52
mov dword [ebp - 0x2c], 0
jmp 0x1000a1b8
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 9
jne 0x1000a39a
push 1
lea ecx, [ebp - 0xa88]
call fcn.10016697
mov byte [ebp - 4], 5
mov dword [ebp - 0x240], 0
jmp 0x1000a1ec
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 1
jge 0x1000a20e
push dword [ebp - 0x240]
lea ecx, [ebp - 0xa88]
call fcn.10016738
mov dword [eax], 0xfffffff9
jmp 0x1000a1df
mov dword [ebp - 0x1a4], 0xfffffff6
mov esi, dword [ebp - 0x1a4]
push 0
lea ecx, [ebp - 0xa88]
call fcn.10016738
cmp esi, dword [eax]
jle 0x1000a23b
mov dword [ebp - 0x810], 1
jmp 0x1000a242
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x188], eax
jg 0x1000a25c
mov dword [ebp - 0x4a8], 1
jmp 0x1000a263
and dword [ebp - 0x4a8], 0
push 0
lea ecx, [ebp - 0xa88]
call fcn.10016738
mov ecx, dword [ebp - 0x4a8]
sub ecx, dword [eax]
jne 0x1000a295
push 0
lea ecx, [ebp - 0xa88]
call fcn.10016738
cmp dword [eax], 0
jne 0x1000a295
and dword [ebp - 0x808], 0
jmp 0x1000a29f
mov dword [ebp - 0x808], 1
push 0
lea ecx, [ebp - 0x210]
call fcn.10016738
mov ecx, dword [ebp - 0x808]
sub ecx, dword [eax]
cmp ecx, 0x49af
je 0x1000a2c8
mov dword [ebp - 0x4b0], 1
jmp 0x1000a2cf
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0x839ca31b
jb 0x1000a2e7
mov dword [ebp - 0x4b8], 1
jmp 0x1000a2ee
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x810]
cmp eax, dword [ebp - 0x4b8]
je 0x1000a30b
mov dword [ebp - 0x818], 1
jmp 0x1000a312
and dword [ebp - 0x818], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1cc], 0xf913
mov eax, dword [ebp - 0x818]
add eax, 0xf913
mov dword [ebp - 0x188], eax
je 0x1000a35b
push 0
lea ecx, [ebp - 0xa88]
call fcn.10016738
cmp dword [eax], 0
je 0x1000a359
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa88]
call fcn.1001671c
jmp 0x1000a39a
jmp 0x1000a36c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1cc], 6
cmp dword [ebp - 0x1a4], 0
je 0x1000a386
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa88]
call fcn.1001671c
jmp 0x1000a39a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa88]
call fcn.1001671c
jmp 0x1000a1b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x210]
call fcn.1001671c
mov dword [ebp - 0x108], 0
push 3
lea ecx, [ebp - 0x21c]
call fcn.10016697
mov dword [ebp - 4], 6
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0xc8], 0
jmp 0x1000a3e7
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x1000a409
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x21c]
call fcn.10016738
mov dword [eax], 1
jmp 0x1000a3da
mov dword [ebp - 0xc8], 0
jmp 0x1000a422
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1000a43e
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x1e4], 0xda7da9fc
jmp 0x1000a415
mov eax, 0x551da622
test eax, eax
je 0x1000a45c
cmp dword [ebp - 0x108], 0
je 0x1000a45c
mov dword [ebp - 0x3a0], 1
jmp 0x1000a463
and dword [ebp - 0x3a0], 0
push 0
lea ecx, [ebp - 0x21c]
call fcn.10016738
mov ecx, dword [ebp - 0x3a0]
mov dword [eax], ecx
cmp dword [ebp - 0x3a0], 0
je 0x1000a4ab
push 0
lea ecx, [ebp - 0x21c]
call fcn.10016738
imul eax, dword [eax], 0x7adf
test eax, eax
je 0x1000a4ab
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1000a4ab
mov dword [ebp - 0x4c0], 1
jmp 0x1000a4b2
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x4c0], eax
je 0x1000a4c9
mov dword [ebp - 0x820], 1
jmp 0x1000a4d0
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x820]
jle 0x1000a4ea
mov dword [ebp - 0xc34], 1
jmp 0x1000a4f1
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xe90], eax
xor eax, eax
je 0x1000a65c
mov dword [ebp - 0x2fc], 0x16488a
cmp dword [ebp - 0x108], 0
je 0x1000a59f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xe98], eax
push 0
lea ecx, [ebp - 0x21c]
call fcn.10016738
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x2fc]
jge 0x1000a554
mov dword [ebp - 0x4c8], 1
jmp 0x1000a55b
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x4c8], eax
jg 0x1000a575
mov dword [ebp - 0x828], 1
jmp 0x1000a57c
and dword [ebp - 0x828], 0
imul eax, dword [ebp - 0x828], 0x90
test eax, eax
je 0x1000a59f
cmp dword [ebp - 0x2fc], 0
je 0x1000a59f
mov dword [ebp - 0x4d0], 1
jmp 0x1000a5a6
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 0x5189
je 0x1000a5be
mov dword [ebp - 0x830], 1
jmp 0x1000a5c5
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
add eax, 0xe62b
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x18], 0
jmp 0x1000a5e6
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x1000a657
mov dword [ebp - 0x108], 0
jmp 0x1000a605
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jg 0x1000a634
mov byte [ebp - 0x112], 0
movzx eax, byte [ebp - 0x112]
test eax, eax
je 0x1000a632
push 0x1047
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x1000a5f8
mov byte [ebp - 0x114], 0
movzx eax, byte [ebp - 0x114]
test eax, eax
je 0x1000a655
push 0x7ab
push 0x73
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x1000a5df
jmp 0x1000aac8
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x1ac], 1
mov dword [ebp - 0x170], 0x879b6842
mov dword [ebp - 0x18], 2
jmp 0x1000a687
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1000a8d6
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xfb8], eax
mov esi, dword [ebp - 0x28]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10016738
cmp esi, dword [eax]
jge 0x1000a6be
cmp dword [ebp - 0x28], 0
jne 0x1000a6be
and dword [ebp - 0x320], 0
jmp 0x1000a6c8
mov dword [ebp - 0x320], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x320]
mov dword [ebp + eax - 0x1e4], ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10016738
mov esi, dword [ebp - 0x320]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x21c]
call fcn.10016738
sub esi, dword [eax]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10016738
sub esi, dword [eax]
cmp esi, dword [ebp - 0x28]
jge 0x1000a721
mov dword [ebp - 0x4d8], 1
jmp 0x1000a728
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x4d8]
jne 0x1000a73f
mov dword [ebp - 0xc3c], 1
jmp 0x1000a746
and dword [ebp - 0xc3c], 0
push 1
lea ecx, [ebp - 0x21c]
call fcn.10016738
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10016738
mov ecx, dword [ebp - 0x28]
cmp dword [eax], ecx
jne 0x1000a774
mov dword [ebp - 0x838], 1
jmp 0x1000a77b
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 9
jge 0x1000a79c
mov dword [ebp - 0xc44], 1
jmp 0x1000a7a3
and dword [ebp - 0xc44], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10016738
mov ecx, dword [ebp - 0x28]
cmp dword [eax], ecx
jle 0x1000a7c4
mov dword [ebp - 0x4e0], 1
jmp 0x1000a7cb
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x4e0]
jne 0x1000a7f4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e4], 0
jne 0x1000a7f4
xor eax, eax
inc eax
jne 0x1000a7f4
and dword [ebp - 0x840], 0
jmp 0x1000a7fe
mov dword [ebp - 0x840], 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10016738
mov ecx, dword [ebp - 0x840]
cmp ecx, dword [eax]
jne 0x1000a822
mov dword [ebp - 0x4e8], 1
jmp 0x1000a829
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xc499
jg 0x1000a85d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e4], 0
je 0x1000a85d
mov dword [ebp - 0x848], 1
jmp 0x1000a864
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x848], eax
jg 0x1000a880
xor eax, eax
inc eax
je 0x1000a880
mov dword [ebp - 0x4f0], 1
jmp 0x1000a887
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x4f0]
jne 0x1000a8a1
cmp dword [ebp - 0x18], 0
jne 0x1000a8a1
and dword [ebp - 0x850], 0
jmp 0x1000a8ab
mov dword [ebp - 0x850], 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10016738
mov esi, dword [eax]
sub esi, dword [ebp - 0x850]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10016738
mov dword [eax], esi
jmp 0x1000a680
mov dword [ebp - 0x28], 0
jmp 0x1000a8e6
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 9
jne 0x1000aac8
push 1
lea ecx, [ebp - 0xa98]
call fcn.10016697
mov byte [ebp - 4], 7
mov dword [ebp - 0x304], 0
jmp 0x1000a91a
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jge 0x1000a93c
push dword [ebp - 0x304]
lea ecx, [ebp - 0xa98]
call fcn.10016738
mov dword [eax], 0xfffffff9
jmp 0x1000a90d
mov dword [ebp - 0x1ac], 0xfffffff6
mov esi, dword [ebp - 0x1ac]
push 0
lea ecx, [ebp - 0xa98]
call fcn.10016738
cmp esi, dword [eax]
jle 0x1000a969
mov dword [ebp - 0x860], 1
jmp 0x1000a970
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x170], eax
jg 0x1000a98a
mov dword [ebp - 0x4f8], 1
jmp 0x1000a991
and dword [ebp - 0x4f8], 0
push 0
lea ecx, [ebp - 0xa98]
call fcn.10016738
mov ecx, dword [ebp - 0x4f8]
sub ecx, dword [eax]
jne 0x1000a9c3
push 0
lea ecx, [ebp - 0xa98]
call fcn.10016738
cmp dword [eax], 0
jne 0x1000a9c3
and dword [ebp - 0x858], 0
jmp 0x1000a9cd
mov dword [ebp - 0x858], 1
push 0
lea ecx, [ebp - 0x21c]
call fcn.10016738
mov ecx, dword [ebp - 0x858]
sub ecx, dword [eax]
cmp ecx, 0x49af
je 0x1000a9f6
mov dword [ebp - 0x500], 1
jmp 0x1000a9fd
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0x839ca31b
jb 0x1000aa15
mov dword [ebp - 0x508], 1
jmp 0x1000aa1c
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x860]
cmp eax, dword [ebp - 0x508]
je 0x1000aa39
mov dword [ebp - 0x868], 1
jmp 0x1000aa40
and dword [ebp - 0x868], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1e4], 0xf913
mov eax, dword [ebp - 0x868]
add eax, 0xf913
mov dword [ebp - 0x170], eax
je 0x1000aa89
push 0
lea ecx, [ebp - 0xa98]
call fcn.10016738
cmp dword [eax], 0
je 0x1000aa87
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa98]
call fcn.1001671c
jmp 0x1000aac8
jmp 0x1000aa9a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1e4], 6
cmp dword [ebp - 0x1ac], 0
je 0x1000aab4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa98]
call fcn.1001671c
jmp 0x1000aac8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa98]
call fcn.1001671c
jmp 0x1000a8df
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.1001671c
mov dword [ebp - 0xec], 0
push 3
lea ecx, [ebp - 0x204]
call fcn.10016697
mov dword [ebp - 4], 8
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x68], 0
jmp 0x1000ab0c
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1000ab28
push dword [ebp - 0x68]
lea ecx, [ebp - 0x204]
call fcn.10016738
mov dword [eax], 1
jmp 0x1000ab05
mov dword [ebp - 0x68], 0
jmp 0x1000ab38
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1000ab4e
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x1d4], 0xda7da9fc
jmp 0x1000ab31
mov eax, 0x551da622
test eax, eax
je 0x1000ab6c
cmp dword [ebp - 0xec], 0
je 0x1000ab6c
mov dword [ebp - 0x378], 1
jmp 0x1000ab73
and dword [ebp - 0x378], 0
push 0
lea ecx, [ebp - 0x204]
call fcn.10016738
mov ecx, dword [ebp - 0x378]
mov dword [eax], ecx
cmp dword [ebp - 0x378], 0
je 0x1000abbb
push 0
lea ecx, [ebp - 0x204]
call fcn.10016738
imul eax, dword [eax], 0x7adf
test eax, eax
je 0x1000abbb
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1000abbb
mov dword [ebp - 0x510], 1
jmp 0x1000abc2
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x510], eax
je 0x1000abd9
mov dword [ebp - 0x870], 1
jmp 0x1000abe0
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x870]
jle 0x1000abfa
mov dword [ebp - 0xc4c], 1
jmp 0x1000ac01
and dword [ebp - 0xc4c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xea0], eax
xor eax, eax
je 0x1000ad6c
mov dword [ebp - 0x2a8], 0x16488a
cmp dword [ebp - 0xec], 0
je 0x1000acaf
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf48], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xea8], eax
push 0
lea ecx, [ebp - 0x204]
call fcn.10016738
mov ecx, dword [ebp - 0x2a8]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x2a8]
jge 0x1000ac64
mov dword [ebp - 0x518], 1
jmp 0x1000ac6b
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x518], eax
jg 0x1000ac85
mov dword [ebp - 0x878], 1
jmp 0x1000ac8c
and dword [ebp - 0x878], 0
imul eax, dword [ebp - 0x878], 0x90
test eax, eax
je 0x1000acaf
cmp dword [ebp - 0x2a8], 0
je 0x1000acaf
mov dword [ebp - 0x520], 1
jmp 0x1000acb6
and dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 0x5189
je 0x1000acce
mov dword [ebp - 0x880], 1
jmp 0x1000acd5
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x880]
add eax, 0xe62b
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x14], 0
jmp 0x1000acf6
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x1000ad67
mov dword [ebp - 0xec], 0
jmp 0x1000ad15
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jg 0x1000ad44
mov byte [ebp - 0x116], 0
movzx eax, byte [ebp - 0x116]
test eax, eax
je 0x1000ad42
push 0x1047
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x1000ad08
mov byte [ebp - 0x118], 0
movzx eax, byte [ebp - 0x118]
test eax, eax
je 0x1000ad65
push 0x7ab
push 0x73
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x1000acef
jmp 0x1000b1d8
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0x180], 0x879b6842
mov dword [ebp - 0x14], 2
jmp 0x1000ad97
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1000afe6
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xfa0], eax
mov esi, dword [ebp - 0x30]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x204]
call fcn.10016738
cmp esi, dword [eax]
jge 0x1000adce
cmp dword [ebp - 0x30], 0
jne 0x1000adce
and dword [ebp - 0x328], 0
jmp 0x1000add8
mov dword [ebp - 0x328], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x328]
mov dword [ebp + eax - 0x1d4], ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x204]
call fcn.10016738
mov esi, dword [ebp - 0x328]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x204]
call fcn.10016738
sub esi, dword [eax]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x204]
call fcn.10016738
sub esi, dword [eax]
cmp esi, dword [ebp - 0x30]
jge 0x1000ae31
mov dword [ebp - 0x528], 1
jmp 0x1000ae38
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x528]
jne 0x1000ae4f
mov dword [ebp - 0xc54], 1
jmp 0x1000ae56
and dword [ebp - 0xc54], 0
push 1
lea ecx, [ebp - 0x204]
call fcn.10016738
push dword [ebp - 0x14]
lea ecx, [ebp - 0x204]
call fcn.10016738
mov ecx, dword [ebp - 0x30]
cmp dword [eax], ecx
jne 0x1000ae84
mov dword [ebp - 0x888], 1
jmp 0x1000ae8b
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 9
jge 0x1000aeac
mov dword [ebp - 0xc5c], 1
jmp 0x1000aeb3
and dword [ebp - 0xc5c], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x204]
call fcn.10016738
mov ecx, dword [ebp - 0x30]
cmp dword [eax], ecx
jle 0x1000aed4
mov dword [ebp - 0x530], 1
jmp 0x1000aedb
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x530]
jne 0x1000af04
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d4], 0
jne 0x1000af04
xor eax, eax
inc eax
jne 0x1000af04
and dword [ebp - 0x890], 0
jmp 0x1000af0e
mov dword [ebp - 0x890], 1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x204]
call fcn.10016738
mov ecx, dword [ebp - 0x890]
cmp ecx, dword [eax]
jne 0x1000af32
mov dword [ebp - 0x538], 1
jmp 0x1000af39
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xc499
jg 0x1000af6d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d4], 0
je 0x1000af6d
mov dword [ebp - 0x898], 1
jmp 0x1000af74
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x898], eax
jg 0x1000af90
xor eax, eax
inc eax
je 0x1000af90
mov dword [ebp - 0x540], 1
jmp 0x1000af97
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x540]
jne 0x1000afb1
cmp dword [ebp - 0x14], 0
jne 0x1000afb1
and dword [ebp - 0x8a0], 0
jmp 0x1000afbb
mov dword [ebp - 0x8a0], 1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x204]
call fcn.10016738
mov esi, dword [eax]
sub esi, dword [ebp - 0x8a0]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x204]
call fcn.10016738
mov dword [eax], esi
jmp 0x1000ad90
mov dword [ebp - 0x30], 0
jmp 0x1000aff6
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 9
jne 0x1000b1d8
push 1
lea ecx, [ebp - 0xaa8]
call fcn.10016697
mov byte [ebp - 4], 9
mov dword [ebp - 0x250], 0
jmp 0x1000b02a
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jge 0x1000b04c
push dword [ebp - 0x250]
lea ecx, [ebp - 0xaa8]
call fcn.10016738
mov dword [eax], 0xfffffff9
jmp 0x1000b01d
mov dword [ebp - 0x1b4], 0xfffffff6
mov esi, dword [ebp - 0x1b4]
push 0
lea ecx, [ebp - 0xaa8]
call fcn.10016738
cmp esi, dword [eax]
jle 0x1000b079
mov dword [ebp - 0x8b0], 1
jmp 0x1000b080
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x180], eax
jg 0x1000b09a
mov dword [ebp - 0x548], 1
jmp 0x1000b0a1
and dword [ebp - 0x548], 0
push 0
lea ecx, [ebp - 0xaa8]
call fcn.10016738
mov ecx, dword [ebp - 0x548]
sub ecx, dword [eax]
jne 0x1000b0d3
push 0
lea ecx, [ebp - 0xaa8]
call fcn.10016738
cmp dword [eax], 0
jne 0x1000b0d3
and dword [ebp - 0x8a8], 0
jmp 0x1000b0dd
mov dword [ebp - 0x8a8], 1
push 0
lea ecx, [ebp - 0x204]
call fcn.10016738
mov ecx, dword [ebp - 0x8a8]
sub ecx, dword [eax]
cmp ecx, 0x49af
je 0x1000b106
mov dword [ebp - 0x550], 1
jmp 0x1000b10d
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0x839ca31b
jb 0x1000b125
mov dword [ebp - 0x558], 1
jmp 0x1000b12c
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x8b0]
cmp eax, dword [ebp - 0x558]
je 0x1000b149
mov dword [ebp - 0x8d0], 1
jmp 0x1000b150
and dword [ebp - 0x8d0], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1d4], 0xf913
mov eax, dword [ebp - 0x8d0]
add eax, 0xf913
mov dword [ebp - 0x180], eax
je 0x1000b199
push 0
lea ecx, [ebp - 0xaa8]
call fcn.10016738
cmp dword [eax], 0
je 0x1000b197
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xaa8]
call fcn.1001671c
jmp 0x1000b1d8
jmp 0x1000b1aa
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1d4], 6
cmp dword [ebp - 0x1b4], 0
je 0x1000b1c4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xaa8]
call fcn.1001671c
jmp 0x1000b1d8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xaa8]
call fcn.1001671c
jmp 0x1000afef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x204]
call fcn.1001671c
mov dword [ebp - 0x178], 0xffffffff
mov dword [ebp - 0x330], 0xfffffffb
mov dword [ebp - 0xc6c], 0xb80ebbd4
mov dword [ebp - 0x178], 0
jmp 0x1000b21e
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x11
jl 0x1000b39a
mov dword [ebp - 0x380], 0
mov dword [ebp - 0x3ac], 0x1f1eb32a
mov eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0x178]
test eax, eax
jne 0x1000b262
mov eax, 0xd373ee76
test eax, eax
jne 0x1000b262
and dword [ebp - 0x560], 0
jmp 0x1000b26c
mov dword [ebp - 0x560], 1
cmp dword [ebp - 0x560], 0x4c92
jne 0x1000b284
mov dword [ebp - 0x8d8], 1
jmp 0x1000b28b
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x8d8], eax
je 0x1000b2a5
mov dword [ebp - 0x568], 1
jmp 0x1000b2ac
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x330]
cmp dword [ebp - 0x568], eax
jge 0x1000b2c6
mov dword [ebp - 0x8e0], 1
jmp 0x1000b2cd
and dword [ebp - 0x8e0], 0
cmp dword [ebp - 0x8e0], 0xb779c63c
jbe 0x1000b2e5
mov dword [ebp - 0x570], 1
jmp 0x1000b2ec
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x330]
cmp dword [ebp - 0x570], eax
je 0x1000b306
mov dword [ebp - 0xc64], 1
jmp 0x1000b30d
and dword [ebp - 0xc64], 0
mov dword [ebp - 0x3ac], 0xffff
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0xeb0], eax
mov eax, dword [ebp - 0x380]
imul eax, dword [ebp - 0x3ac]
test eax, eax
jne 0x1000b340
mov dword [ebp - 0x8e8], 1
jmp 0x1000b347
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x330]
cmp dword [ebp - 0x8e8], eax
jle 0x1000b361
mov dword [ebp - 0x578], 1
jmp 0x1000b368
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x578], eax
je 0x1000b382
mov dword [ebp - 0x8f0], 1
jmp 0x1000b389
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0xc6c], eax
jmp 0x1000b211
mov byte [ebp - 0x11a], 0
movzx eax, byte [ebp - 0x11a]
test eax, eax
je 0x1000b3b4
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x2d8], 0x8a61928c
mov dword [ebp - 0x2d8], 0
jmp 0x1000b3d7
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0xd
jge 0x1000b3fc
mov byte [ebp - 0x11c], 0
movzx eax, byte [ebp - 0x11c]
test eax, eax
je 0x1000b3fa
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x1000b3ca
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x1000b427
push 0
push 0x1c64
push 0x35b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov dword [ebp - 0x168], 0xffffffff
mov dword [ebp - 0x3a8], 0xfffffffb
mov dword [ebp - 0xc7c], 0xb80ebbd4
mov dword [ebp - 0x168], 0
jmp 0x1000b45e
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x11
jl 0x1000b5da
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x338], 0x1f1eb32a
mov eax, dword [ebp - 0x168]
imul eax, dword [ebp - 0x168]
test eax, eax
jne 0x1000b4a2
mov eax, 0xd373ee76
test eax, eax
jne 0x1000b4a2
and dword [ebp - 0x580], 0
jmp 0x1000b4ac
mov dword [ebp - 0x580], 1
cmp dword [ebp - 0x580], 0x4c92
jne 0x1000b4c4
mov dword [ebp - 0x8f8], 1
jmp 0x1000b4cb
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0x8f8], eax
je 0x1000b4e5
mov dword [ebp - 0x588], 1
jmp 0x1000b4ec
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0x588], eax
jge 0x1000b506
mov dword [ebp - 0x900], 1
jmp 0x1000b50d
and dword [ebp - 0x900], 0
cmp dword [ebp - 0x900], 0xb779c63c
jbe 0x1000b525
mov dword [ebp - 0x590], 1
jmp 0x1000b52c
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0x590], eax
je 0x1000b546
mov dword [ebp - 0xc74], 1
jmp 0x1000b54d
and dword [ebp - 0xc74], 0
mov dword [ebp - 0x338], 0xffff
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0xf58], eax
mov eax, dword [ebp - 0x340]
imul eax, dword [ebp - 0x338]
test eax, eax
jne 0x1000b580
mov dword [ebp - 0x908], 1
jmp 0x1000b587
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0x908], eax
jle 0x1000b5a1
mov dword [ebp - 0x598], 1
jmp 0x1000b5a8
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0x598], eax
je 0x1000b5c2
mov dword [ebp - 0x910], 1
jmp 0x1000b5c9
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xc7c], eax
jmp 0x1000b451
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x1000b5f4
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x258], 0
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x1000b62b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebp - 0x258], 0x1a
jmp 0x1000b644
mov eax, dword [ebp - 0x258]
dec eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xe
jl 0x1000b664
mov dword [ebp - 0xbb4], 1
cmp dword [ebp - 0xbb4], 0
je 0x1000b662
jmp 0x1000b664
jmp 0x1000b637
mov dword [ebp - 0x16c], 0xffffffff
mov dword [ebp - 0x348], 0xfffffffb
mov dword [ebp - 0xb34], 0xb80ebbd4
mov dword [ebp - 0x16c], 0
jmp 0x1000b69b
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x11
jl 0x1000b817
mov dword [ebp - 0x3b0], 0
mov dword [ebp - 0x388], 0x1f1eb32a
mov eax, dword [ebp - 0x16c]
imul eax, dword [ebp - 0x16c]
test eax, eax
jne 0x1000b6df
mov eax, 0xd373ee76
test eax, eax
jne 0x1000b6df
and dword [ebp - 0x5a0], 0
jmp 0x1000b6e9
mov dword [ebp - 0x5a0], 1
cmp dword [ebp - 0x5a0], 0x4c92
jne 0x1000b701
mov dword [ebp - 0x918], 1
jmp 0x1000b708
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x918], eax
je 0x1000b722
mov dword [ebp - 0x5a8], 1
jmp 0x1000b729
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x5a8], eax
jge 0x1000b743
mov dword [ebp - 0x920], 1
jmp 0x1000b74a
and dword [ebp - 0x920], 0
cmp dword [ebp - 0x920], 0xb779c63c
jbe 0x1000b762
mov dword [ebp - 0x5b0], 1
jmp 0x1000b769
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x5b0], eax
je 0x1000b783
mov dword [ebp - 0xb54], 1
jmp 0x1000b78a
and dword [ebp - 0xb54], 0
mov dword [ebp - 0x388], 0xffff
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0xdf8], eax
mov eax, dword [ebp - 0x3b0]
imul eax, dword [ebp - 0x388]
test eax, eax
jne 0x1000b7bd
mov dword [ebp - 0x928], 1
jmp 0x1000b7c4
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x928], eax
jle 0x1000b7de
mov dword [ebp - 0x5b8], 1
jmp 0x1000b7e5
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x5b8], eax
je 0x1000b7ff
mov dword [ebp - 0x930], 1
jmp 0x1000b806
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0xb34], eax
jmp 0x1000b68e
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x1000b831
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x2b0], 0x8a61928c
mov dword [ebp - 0x2b0], 0
jmp 0x1000b854
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0xd
jge 0x1000b879
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x1000b877
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x1000b847
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1000b8a4
push 0
push 0x1c64
push 0x35b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov dword [ebp - 0xb38], 0x81ce
mov dword [ebp - 0xdfc], 0xffffffff
mov dword [ebp - 0xb40], 5
mov dword [ebp - 0x5c0], 1
mov dword [ebp - 0xc24], 0xd6a5
mov dword [ebp - 0xe04], 0x7507af9c
push 1
lea ecx, [ebp - 0xef4]
call fcn.10016697
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x938], 0xfffffffc
mov dword [ebp - 0x260], 0
jmp 0x1000b917
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jge 0x1000b939
push dword [ebp - 0x260]
lea ecx, [ebp - 0xef4]
call fcn.10016738
mov dword [eax], 0xfffffffa
jmp 0x1000b90a
mov eax, dword [ebp - 0xb38]
inc eax
mov dword [ebp - 0x5c0], eax
mov eax, dword [ebp - 0xc24]
cmp dword [ebp - 0x5c0], eax
je 0x1000b983
cmp dword [ebp - 0xb40], 0
je 0x1000b983
mov byte [ebp - 0x128], 0
movzx eax, byte [ebp - 0x128]
test eax, eax
je 0x1000b97e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x1000ba1d
push 1
lea ecx, [ebp - 0xee4]
call fcn.10016697
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xe0c], 0xfffffffb
mov dword [ebp - 0xe14], 0x88a01932
mov dword [ebp - 0xe1c], 0x35b68906
mov dword [ebp - 0x6c], 0
jmp 0x1000b9c2
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1000b9db
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xee4]
call fcn.10016738
and dword [eax], 0
jmp 0x1000b9bb
mov dword [ebp - 0x6c], 0
jmp 0x1000b9eb
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1000ba01
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x1028], 0xa5616d21
jmp 0x1000b9e4
mov eax, dword [ebp - 0x938]
inc eax
mov dword [ebp - 0x938], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xee4]
call fcn.1001671c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xef4]
call fcn.1001671c
push 3
lea ecx, [ebp - 0xafc]
call fcn.10016697
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x88], 0
jmp 0x1000ba59
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1000ba75
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x3d4], 0
jmp 0x1000ba4c
mov dword [ebp - 0x88], 0
jmp 0x1000ba8e
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1000bab0
push dword [ebp - 0x88]
lea ecx, [ebp - 0xafc]
call fcn.10016738
mov dword [eax], 0x50faeb38
jmp 0x1000ba81
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3d4], 0xffffffe2
jmp 0x1000bade
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3d4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d4], 8
jne 0x1000bc96
mov dword [ebp - 0x350], 0x7b1891f7
mov dword [ebp - 0x5c8], 0xfffffff6
mov dword [ebp - 0xb48], 0xfffffff9
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x5c8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d4]
mov dword [ebp - 0xe24], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3d4], 0
jne 0x1000bb51
cmp dword [ebp - 0x5c8], 0
jne 0x1000bb51
and dword [ebp - 0x940], 0
jmp 0x1000bb5b
mov dword [ebp - 0x940], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d4]
cmp dword [ebp - 0x940], eax
jge 0x1000bb89
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d4], 0
jne 0x1000bb89
and dword [ebp - 0x5d0], 0
jmp 0x1000bb93
mov dword [ebp - 0x5d0], 1
push 0
lea ecx, [ebp - 0xafc]
call fcn.10016738
mov ecx, dword [ebp - 0x5d0]
cmp ecx, dword [eax]
jg 0x1000bbb6
mov dword [ebp - 0x948], 1
jmp 0x1000bbbd
and dword [ebp - 0x948], 0
push 1
lea ecx, [ebp - 0xafc]
call fcn.10016738
mov ecx, dword [ebp - 0x948]
cmp ecx, dword [eax]
jl 0x1000bbe0
mov dword [ebp - 0xc08], 1
jmp 0x1000bbe7
and dword [ebp - 0xc08], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d4]
mov dword [ebp - 0xe2c], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x3d4]
push 2
lea ecx, [ebp - 0xafc]
call fcn.10016738
imul esi, dword [eax]
cmp esi, dword [ebp - 0x350]
jge 0x1000bc2b
mov dword [ebp - 0x5d8], 1
jmp 0x1000bc32
and dword [ebp - 0x5d8], 0
push 2
lea ecx, [ebp - 0xafc]
call fcn.10016738
mov ecx, dword [ebp - 0x5d8]
cmp ecx, dword [eax]
jne 0x1000bc55
mov dword [ebp - 0x950], 1
jmp 0x1000bc5c
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x350]
add eax, dword [ebp - 0x950]
cmp eax, 0xfffffffe
jg 0x1000bc79
mov dword [ebp - 0x5e0], 1
jmp 0x1000bc80
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
add eax, 0xfa1
mov dword [ebp - 0xb48], eax
jmp 0x1000bac3
mov byte [ebp - 0x12c], 0
movzx eax, byte [ebp - 0x12c]
test eax, eax
je 0x1000bcc1
push 0x25d0
push 0x1d6e
push 0
push 0
push 0x1165
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xafc]
call fcn.1001671c
mov dword [ebp - 0x2f0], 0
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x1000bd07
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebp - 0x2f0], 0x1a
jmp 0x1000bd20
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0xe
jl 0x1000bd40
mov dword [ebp - 0xc58], 1
cmp dword [ebp - 0xc58], 0
je 0x1000bd3e
jmp 0x1000bd40
jmp 0x1000bd13
mov dword [ebp - 0x13c], 0xfffffffd
mov dword [ebp - 0xf4], 0
push 2
lea ecx, [ebp - 0xc8c]
call fcn.10016697
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xd8], 0
jmp 0x1000bd81
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x1000bd9a
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x3c], 0xcad2086b
jmp 0x1000bd74
mov dword [ebp - 0xd8], 0
jmp 0x1000bdb3
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x1000bdd5
push dword [ebp - 0xd8]
lea ecx, [ebp - 0xc8c]
call fcn.10016738
mov dword [eax], 1
jmp 0x1000bda6
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3c]
cmp dword [ebp + eax - 0x3c], ecx
jge 0x1000bdf7
mov dword [ebp - 0xb50], 1
jmp 0x1000bdfe
and dword [ebp - 0xb50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
imul eax, dword [ebp - 0xf4]
cmp eax, 0xffffffff
jne 0x1000be26
cmp dword [ebp - 0xf4], 0
jne 0x1000be26
and dword [ebp - 0x958], 0
jmp 0x1000be30
mov dword [ebp - 0x958], 1
mov dword [ebp - 0x13c], 0xfffffff8
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0xf4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf4]
neg ecx
sub ecx, dword [ebp + eax - 0x3c]
cmp dword [ebp - 0x13c], ecx
jne 0x1000be6c
mov dword [ebp - 0x5e8], 1
jmp 0x1000be73
and dword [ebp - 0x5e8], 0
cmp dword [ebp - 0x5e8], 5
jg 0x1000be88
mov dword [ebp - 0x960], 1
jmp 0x1000be8f
and dword [ebp - 0x960], 0
cmp dword [ebp - 0x960], 0
jne 0x1000bea4
mov dword [ebp - 0x5f0], 1
jmp 0x1000beab
and dword [ebp - 0x5f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
sub eax, dword [ebp - 0x5f0]
mov ecx, 0x4325
sub ecx, eax
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x3c]
je 0x1000beda
mov dword [ebp - 0x968], 1
jmp 0x1000bee1
and dword [ebp - 0x968], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
imul eax, dword [ebp - 0x968]
imul esi, eax, 0xd52a
push 0
lea ecx, [ebp - 0xc8c]
call fcn.10016738
mov dword [eax], esi
mov dword [ebp - 0xf4], 0xfffffff0
jmp 0x1000bf20
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 3
jne 0x1000c1cc
mov dword [ebp - 0x358], 0xfffffffb
mov dword [ebp - 0x13c], 0
jmp 0x1000bf50
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x17
je 0x1000c1bb
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x980], 0xc32c7527
mov dword [ebp - 0x90], 0
jmp 0x1000bf8a
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x1000c18e
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x174], 0
jmp 0x1000bfba
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jg 0x1000c189
mov dword [ebp - 0xb58], 0xea1dc7e9
mov eax, dword [ebp - 0x90]
cmp dword [ebp + eax*4 - 0x3c], 4
jle 0x1000bfea
mov dword [ebp - 0x5f8], 1
jmp 0x1000bff1
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x5f8], eax
jl 0x1000c00b
mov dword [ebp - 0x970], 1
jmp 0x1000c012
and dword [ebp - 0x970], 0
cmp dword [ebp - 0x970], 0xffffffff
jg 0x1000c027
mov dword [ebp - 0x600], 1
jmp 0x1000c02e
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
dec eax
jne 0x1000c049
cmp dword [ebp - 0x90], 0
jne 0x1000c049
and dword [ebp - 0x978], 0
jmp 0x1000c053
mov dword [ebp - 0x978], 1
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x978]
mov ecx, dword [ebp - 0x90]
cmp eax, dword [ebp + ecx*4 - 0x3c]
jg 0x1000c078
mov dword [ebp - 0xc10], 1
jmp 0x1000c07f
and dword [ebp - 0xc10], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0xe34], eax
cmp dword [ebp - 0x358], 0xffff
ja 0x1000c0ad
cmp dword [ebp - 0x13c], 0
jne 0x1000c0ad
and dword [ebp - 0x390], 0
jmp 0x1000c0b7
mov dword [ebp - 0x390], 1
push dword [ebp - 0x174]
lea ecx, [ebp - 0xc8c]
call fcn.10016738
mov ecx, dword [ebp - 0x390]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp + eax*4 - 0x3c]
cmp eax, dword [ebp - 0x390]
je 0x1000c0ee
mov dword [ebp - 0x608], 1
jmp 0x1000c0f5
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0xb58], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
ja 0x1000c127
xor eax, eax
jne 0x1000c127
and dword [ebp - 0x610], 0
jmp 0x1000c131
mov dword [ebp - 0x610], 1
cmp dword [ebp - 0x610], 0xad33
jl 0x1000c149
mov dword [ebp - 0x988], 1
jmp 0x1000c150
and dword [ebp - 0x988], 0
cmp dword [ebp - 0x988], 0xbf2fea27
je 0x1000c168
mov dword [ebp - 0x618], 1
jmp 0x1000c16f
and dword [ebp - 0x618], 0
push 0
lea ecx, [ebp - 0xc8c]
call fcn.10016738
mov ecx, dword [ebp - 0x618]
mov dword [eax], ecx
jmp 0x1000bfad
jmp 0x1000bf7d
mov byte [ebp - 0x156], 0
movzx eax, byte [ebp - 0x156]
test eax, eax
je 0x1000c1b6
push 1
push 0
push 0x1d23
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x1000bf43
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x358], eax
jmp 0x1000bf13
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8c]
call fcn.1001671c
mov dword [ebp - 0x268], 0x8a61928c
mov dword [ebp - 0x268], 0
jmp 0x1000c1fe
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0xd
jge 0x1000c223
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1000c221
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x1000c1f1
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1000c24e
push 0
push 0x1c64
push 0x35b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov dword [ebp - 0x1f4], 0x9b3198a8
mov dword [ebp - 0x2b8], 0
jmp 0x1000c271
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x1000c28d
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0xfec], 0xffffffff
jmp 0x1000c264
mov dword [ebp - 0x1f4], 0
jmp 0x1000c2a6
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0xfffffff3
je 0x1000c39d
and dword [ebp - 0xda8], 0
and dword [ebp - 0xda4], 0
and dword [ebp - 0xda0], 0
and dword [ebp - 0xd9c], 0
lea ecx, [ebp - 0x3b9]
call fcn.10008f03
push eax
lea eax, [ebp - 0xd98]
push eax
lea eax, [ebp - 0xda8]
push eax
lea ecx, [ebp - 0x1000]
call fcn.10016747
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb14]
call fcn.100166f6
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x1f4], 0
je 0x1000c325
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb14]
call fcn.1001671c
jmp 0x1000c39d
push 1
lea ecx, [ebp - 0xb14]
call fcn.10016738
and dword [eax], 0
jmp 0x1000c35b
push 1
lea ecx, [ebp - 0xb14]
call fcn.10016738
mov dword [ebp - 0x990], eax
mov eax, dword [ebp - 0x990]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x990]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb14]
call fcn.10016738
cmp dword [eax], 3
jge 0x1000c389
push 1
lea ecx, [ebp - 0xb14]
call fcn.10016738
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0xfec], 0x6f6dd8d1
jmp 0x1000c337
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb14]
call fcn.1001671c
jmp 0x1000c299
mov dword [ebp - 0xc80], 0x81ce
mov dword [ebp - 0xe3c], 0xffffffff
mov dword [ebp - 0xc18], 5
mov dword [ebp - 0x620], 1
mov dword [ebp - 0xb60], 0xd6a5
mov dword [ebp - 0xe44], 0x7507af9c
push 1
lea ecx, [ebp - 0xf14]
call fcn.10016697
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x998], 0xfffffffc
mov dword [ebp - 0x270], 0
jmp 0x1000c410
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x1000c432
push dword [ebp - 0x270]
lea ecx, [ebp - 0xf14]
call fcn.10016738
mov dword [eax], 0xfffffffa
jmp 0x1000c403
mov eax, dword [ebp - 0xc80]
inc eax
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0xb60]
cmp dword [ebp - 0x620], eax
je 0x1000c47c
cmp dword [ebp - 0xc18], 0
je 0x1000c47c
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x1000c477
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x1000c534
push 1
lea ecx, [ebp - 0xf04]
call fcn.10016697
mov byte [ebp - 4], 0x10
mov dword [ebp - 0xe4c], 0xfffffffb
mov dword [ebp - 0xe54], 0x88a01932
mov dword [ebp - 0xe5c], 0x35b68906
mov dword [ebp - 0xd0], 0
jmp 0x1000c4c4
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x1000c4e3
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xf04]
call fcn.10016738
and dword [eax], 0
jmp 0x1000c4b7
mov dword [ebp - 0xd0], 0
jmp 0x1000c4fc
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x1000c518
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x1010], 0xa5616d21
jmp 0x1000c4ef
mov eax, dword [ebp - 0x998]
inc eax
mov dword [ebp - 0x998], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf04]
call fcn.1001671c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf14]
call fcn.1001671c
mov dword [ebp - 0x98], 0xade2167
mov dword [ebp - 0x1bc], 0x335c0de4
mov dword [ebp - 0x278], 0xeb64d07d
mov dword [ebp - 0x398], 0x3d97867a
mov dword [ebp - 0x3b8], 0x8bbe26b5
push 3
lea ecx, [ebp - 0xab8]
call fcn.10016697
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x360], 1
mov dword [ebp - 0x2e0], 0
jmp 0x1000c5ac
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 3
jge 0x1000c5ce
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xab8]
call fcn.10016738
mov dword [eax], 0xfffffffa
jmp 0x1000c59f
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x98], eax
jl 0x1000c5e8
mov dword [ebp - 0x9b0], 1
jmp 0x1000c5ef
and dword [ebp - 0x9b0], 0
xor eax, eax
je 0x1000c603