Function at 0x10024ad6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a36e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x11e8
call fcn.10077190
push esi
push edi
mov dword [ebp - 0xaa0], 0x9aed23b6
mov dword [ebp - 0x138], 0x45307222
mov dword [ebp - 0x5c], 0xe08cccdd
mov dword [ebp - 0x290], 0xf576c516
mov dword [ebp - 0x2e4], 0x516a205b
mov dword [ebp - 0xb44], 0
push 2
lea ecx, [ebp - 0xd70]
call fcn.10008f68
and dword [ebp - 4], 0
mov dword [ebp - 0x18c], 0
jmp 0x10024b5d
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x10024b7f
push dword [ebp - 0x18c]
lea ecx, [ebp - 0xd70]
call fcn.10009009
mov dword [eax], 1
jmp 0x10024b50
mov eax, dword [ebp - 0xaa0]
neg eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x5c], 0xffffffff
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x290]
je 0x10024bbc
or eax, 0xffffffff
je 0x10024bbc
mov dword [ebp - 0x76c], 1
jmp 0x10024bc3
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x138]
mov ecx, 0x9bdd7770
sub ecx, dword [ebp - 0x138]
sub eax, ecx
cmp eax, 0xa7b7e80d
jbe 0x10024bf5
mov dword [ebp - 0x9d8], 1
jmp 0x10024bfc
and dword [ebp - 0x9d8], 0
imul eax, dword [ebp - 0x9d8], 0xb0b4
cmp eax, 0x27a4129b
jne 0x10024c1f
cmp dword [ebp - 0x290], 0
jne 0x10024c1f
and dword [ebp - 0x9e0], 0
jmp 0x10024c29
mov dword [ebp - 0x9e0], 1
cmp dword [ebp - 0x9e0], 0xfff6
jbe 0x10024c41
mov dword [ebp - 0xa00], 1
jmp 0x10024c48
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0xa00]
neg eax
cmp eax, 0xbd0a7084
jbe 0x10024e86
mov dword [ebp - 0x318], 0xeaf6
mov dword [ebp - 0x31c], 0xe11771b7
mov dword [ebp - 0x380], 0x895c4b79
push 2
lea ecx, [ebp - 0xdb8]
call fcn.10008f68
mov byte [ebp - 4], 1
mov dword [ebp - 0xb4c], 0x55833a
mov dword [ebp - 0x190], 0
jmp 0x10024cad
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jge 0x10024ccf
push dword [ebp - 0x190]
lea ecx, [ebp - 0xdb8]
call fcn.10009009
mov dword [eax], 6
jmp 0x10024ca0
cmp dword [ebp - 0x318], 0
jne 0x10024ce4
mov dword [ebp - 0xa08], 1
jmp 0x10024ceb
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x138], eax
jl 0x10024d05
mov dword [ebp - 0x368], 1
jmp 0x10024d0c
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0xa08]
cmp eax, dword [ebp - 0x368]
je 0x10024d26
mov dword [ebp - 0x830], 1
jmp 0x10024d2d
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x2e4]
cmp dword [ebp - 0x830], eax
jle 0x10024d47
mov dword [ebp - 0x370], 1
jmp 0x10024d4e
and dword [ebp - 0x370], 0
cmp dword [ebp - 0x370], 0xec1e183a
jne 0x10024d66
mov dword [ebp - 0x838], 1
jmp 0x10024d6d
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x31c]
add eax, dword [ebp - 0x838]
cmp eax, dword [ebp - 0xb44]
jne 0x10024d8d
mov dword [ebp - 0x378], 1
jmp 0x10024d94
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x378]
add eax, 9
cmp dword [ebp - 0x318], eax
jle 0x10024db1
mov dword [ebp - 0x840], 1
jmp 0x10024db8
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
jne 0x10024ddf
cmp dword [ebp - 0x31c], 0
jne 0x10024ddf
and dword [ebp - 0x848], 0
jmp 0x10024de9
mov dword [ebp - 0x848], 1
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x848], eax
jne 0x10024e03
mov dword [ebp - 0x388], 1
jmp 0x10024e0a
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x388]
jle 0x10024e27
mov eax, 0xd2
test eax, eax
jne 0x10024e27
and dword [ebp - 0x850], 0
jmp 0x10024e31
mov dword [ebp - 0x850], 1
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x850]
jle 0x10024e40
cmp dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x10a0], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x1090], eax
mov esi, dword [ebp - 0x31c]
push 1
lea ecx, [ebp - 0xdb8]
call fcn.10009009
sub esi, dword [eax]
neg esi
mov dword [ebp - 0xb4c], esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xdb8]
call fcn.10008fed
jmp 0x10024eb2
mov dword [ebp - 0x5c], 0
jmp 0x10024e96
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x10024eb2
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xd70]
call fcn.10009009
mov dword [eax], 1
jmp 0x10024e8f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd70]
call fcn.10008fed
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0xbc], 0xffffffff
mov dword [ebp - 0x38], 0xffffffed
jmp 0x10024ee9
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff6
jge 0x10024fe6
push 3
lea ecx, [ebp - 0xbdc]
call fcn.10008f68
mov dword [ebp - 4], 2
mov dword [ebp - 0x198], 0
jmp 0x10024f20
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jge 0x10024f3f
push dword [ebp - 0x198]
lea ecx, [ebp - 0xbdc]
call fcn.10009009
and dword [eax], 0
jmp 0x10024f13
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xf64], eax
cmp dword [ebp - 0x38], 0
jne 0x10024f5b
xor eax, eax
jne 0x10024f5b
and dword [ebp - 0x390], 0
jmp 0x10024f65
mov dword [ebp - 0x390], 1
mov eax, dword [ebp - 0x390]
sub eax, dword [ebp - 0x38]
cmp eax, 1
jg 0x10024f7f
mov dword [ebp - 0x858], 1
jmp 0x10024f86
and dword [ebp - 0x858], 0
mov esi, dword [ebp - 0x858]
dec esi
dec esi
push 1
lea ecx, [ebp - 0xbdc]
call fcn.10009009
cmp esi, dword [eax]
jne 0x10024fa3
cmp dword [ebp - 0x38], 0
push 1
lea ecx, [ebp - 0xbdc]
call fcn.10009009
xor ecx, ecx
add ecx, 0x49cec79f
imul ecx, ecx, 0x6501
mov esi, ecx
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0xbdc]
call fcn.10009009
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbdc]
call fcn.10008fed
jmp 0x10024ee2
cmp dword [ebp - 0x38], 0
jne 0x10024ffe
cmp dword [ebp - 0x38], 0x7f59ec13
jl 0x10024ffe
and dword [ebp - 0x860], 0
jmp 0x10025008
mov dword [ebp - 0x860], 1
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], eax
jl 0x10025022
mov dword [ebp - 0x398], 1
jmp 0x10025029
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x398], eax
jl 0x10025043
mov dword [ebp - 0x3a0], 1
jmp 0x1002504a
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x3a0]
jg 0x1002506a
mov dword [ebp - 0x868], 1
jmp 0x10025071
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x868]
cmp eax, dword [ebp - 0xbc]
jg 0x10025092
mov dword [ebp - 0x3a8], 1
jmp 0x10025099
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x3a8]
cmp eax, 0xffffffff
jl 0x100250b7
mov dword [ebp - 0x870], 1
jmp 0x100250be
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0xbc], eax
push 2
lea ecx, [ebp - 0xdac]
call fcn.10008f68
mov dword [ebp - 4], 3
mov dword [ebp - 0x1054], 0x6f25db2b
mov dword [ebp - 0x94], 0
push 1
lea ecx, [ebp - 0xd64]
call fcn.10008f68
mov byte [ebp - 4], 4
mov dword [ebp - 0x2ec], 0xfffffff8
push 2
lea ecx, [ebp - 0xa6c]
call fcn.10008f68
mov byte [ebp - 4], 5
mov dword [ebp - 0xb6c], 0x4ed09eb8
mov dword [ebp - 0xb74], 0x1cc545e2
mov dword [ebp - 0x80], 0
jmp 0x10025142
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1002515e
push dword [ebp - 0x80]
lea ecx, [ebp - 0xd64]
call fcn.10009009
mov dword [eax], 2
jmp 0x1002513b
mov dword [ebp - 0x80], 0
jmp 0x1002516e
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1002518a
push dword [ebp - 0x80]
lea ecx, [ebp - 0xa6c]
call fcn.10009009
mov dword [eax], 0xfffffffd
jmp 0x10025167
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xf6c], eax
cmp dword [ebp - 0x94], 0xd7006986
jbe 0x100251b0
or eax, 0xffffffff
jne 0x100251b0
and dword [ebp - 0xb54], 0
jmp 0x100251ba
mov dword [ebp - 0xb54], 1
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xe60], eax
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x3b0], eax
push 1
lea ecx, [ebp - 0xa6c]
call fcn.10009009
mov ecx, dword [ebp - 0x3b0]
mov dword [eax], ecx
cmp dword [ebp - 0x3b0], 0
jne 0x10025208
push 0
lea ecx, [ebp - 0xa6c]
call fcn.10009009
cmp dword [eax], 0
je 0x10025226
push 1
lea ecx, [ebp - 0xa6c]
call fcn.10009009
cmp dword [eax], 0
je 0x10025226
mov dword [ebp - 0x878], 1
jmp 0x1002522d
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x878]
cmp eax, dword [ebp - 0x2ec]
jg 0x1002524d
mov dword [ebp - 0xb5c], 1
jmp 0x10025254
and dword [ebp - 0xb5c], 0
push 1
lea ecx, [ebp - 0xa6c]
call fcn.10009009
mov ecx, dword [ebp - 0x94]
cmp dword [eax], ecx
jg 0x10025277
mov dword [ebp - 0xb64], 1
jmp 0x1002527e
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0xe68], eax
push 0
lea ecx, [ebp - 0xa6c]
call fcn.10009009
mov ecx, dword [ebp - 0xb6c]
cmp dword [eax], ecx
jle 0x100252ad
mov dword [ebp - 0x880], 1
jmp 0x100252b4
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x3b8], eax
push 0
lea ecx, [ebp - 0xd64]
call fcn.10009009
mov ecx, dword [ebp - 0x3b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x3b8]
imul ecx, dword [ebp - 0x880], 0x9ce
cmp eax, ecx
je 0x100252fb
mov dword [ebp - 0x3c0], 1
jmp 0x10025302
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0xfffffffa
jne 0x10025317
mov dword [ebp - 0x888], 1
jmp 0x1002531e
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x888], eax
jle 0x10025338
mov dword [ebp - 0x3c8], 1
jmp 0x1002533f
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xb74], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa6c]
call fcn.10008fed
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd64]
call fcn.10008fed
mov dword [ebp - 0xe70], 0xb8d8131d
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x228], 0xd2f2
mov dword [ebp - 0xb84], 0xe62699ff
mov dword [ebp - 0xb8c], 0x1f205951
mov dword [ebp - 0x84], 0
jmp 0x100253b1
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x100253cd
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x2c4], 0x8bbca631
jmp 0x100253a4
mov dword [ebp - 0x84], 0
jmp 0x100253e6
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x10025402
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xa18], 0xf58aae07
jmp 0x100253d9
mov dword [ebp - 0x44], 0
jmp 0x10025412
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x10025485
mov dword [ebp - 0x170], 0x65ab3e90
mov dword [ebp - 0x170], 1
jmp 0x1002543b
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jl 0x10025483
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x170]
mov eax, dword [ebp + eax*4 - 0x2c4]
mov dword [ebp + ecx*4 - 0x2c4], eax
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x10025481
push 0x11a5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1002542e
jmp 0x1002540b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2c4]
mov dword [ebp - 0xe78], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa18], 0xa814
jne 0x100254b6
mov dword [ebp - 0x3d0], 1
jmp 0x100254bd
and dword [ebp - 0x3d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c4]
mov dword [ebp - 0x890], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x890]
mov dword [ebp + eax - 0x2c4], ecx
mov eax, dword [ebp - 0x890]
cmp eax, dword [ebp - 0x3d0]
jle 0x1002551c
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x2c4], 0
test eax, eax
je 0x10025513
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c4], 0
jne 0x1002551c
and dword [ebp - 0x898], 0
jmp 0x10025526
mov dword [ebp - 0x898], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x898]
sub ecx, dword [ebp + eax - 0xa18]
push 4
pop eax
shl eax, 1
cmp ecx, dword [ebp + eax - 0xa18]
jle 0x10025552
mov dword [ebp - 0x3d8], 1
jmp 0x10025559
and dword [ebp - 0x3d8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa18]
imul eax, dword [ebp - 0x3d8]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xa18]
jle 0x10025586
mov dword [ebp - 0x8a0], 1
jmp 0x1002558d
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0x3c5a
jge 0x100255a5
mov dword [ebp - 0x3e0], 1
jmp 0x100255ac
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x3e0], eax
jge 0x100255c6
mov dword [ebp - 0xb7c], 1
jmp 0x100255cd
and dword [ebp - 0xb7c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa18]
mov dword [ebp - 0xe80], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jl 0x100255f3
mov dword [ebp - 0x8a8], 1
jmp 0x100255fa
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x8a8]
sub eax, dword [ebp - 0x228]
je 0x1002560c
cmp dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x228], eax
jl 0x10025623
mov dword [ebp - 0x3e8], 1
jmp 0x1002562a
and dword [ebp - 0x3e8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa18]
imul eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x10025662
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa18], 0
je 0x10025662
mov dword [ebp - 0x8b0], 1
jmp 0x10025669
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0xb84], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x228]
cmp dword [ebp + eax - 0x2c4], ecx
jne 0x10025696
mov dword [ebp - 0x3f0], 1
jmp 0x1002569d
and dword [ebp - 0x3f0], 0
cmp dword [ebp - 0x3f0], 0xfbc0
jge 0x100256b5
mov dword [ebp - 0x8b8], 1
jmp 0x100256bc
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xe88], 0xffffffff
mov dword [ebp - 0xe90], 0xf7d59448
push 1
lea ecx, [ebp - 0xc9c]
call fcn.10008f68
mov byte [ebp - 4], 6
push 2
lea ecx, [ebp - 0x35c]
call fcn.10008f68
mov byte [ebp - 4], 7
mov dword [ebp - 0x334], 1
push 2
lea ecx, [ebp - 0xe00]
call fcn.10008f68
mov byte [ebp - 4], 8
mov dword [ebp - 0x14], 0
jmp 0x10025729
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002573f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9ec], 0x8256
jmp 0x10025722
mov dword [ebp - 0x14], 0
jmp 0x1002574f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1002576b
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc9c]
call fcn.10009009
mov dword [eax], 0x4888999d
jmp 0x10025748
mov dword [ebp - 0x14], 0
jmp 0x1002577b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10025797
push dword [ebp - 0x14]
lea ecx, [ebp - 0x35c]
call fcn.10009009
mov dword [eax], 0xa831d26e
jmp 0x10025774
mov dword [ebp - 0x14], 0
jmp 0x100257a7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100257c3
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe00]
call fcn.10009009
mov dword [eax], 0x36717b38
jmp 0x100257a0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9ec], 0
jne 0x10025819
push 0
lea ecx, [ebp - 0xc9c]
call fcn.10009009
cmp dword [eax], 0x3281d21f
jl 0x100257f4
mov dword [ebp - 0x3f8], 1
jmp 0x100257fb
and dword [ebp - 0x3f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9ec]
cmp eax, dword [ebp - 0x3f8]
jne 0x10025819
and dword [ebp - 0x8c0], 0
jmp 0x10025823
mov dword [ebp - 0x8c0], 1
xor esi, esi
sub esi, dword [ebp - 0x8c0]
push 1
lea ecx, [ebp - 0x35c]
call fcn.10009009
mov dword [eax], esi
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
mov esi, dword [ebp - 0x334]
push 1
lea ecx, [ebp - 0x35c]
call fcn.10009009
mov edi, eax
push 1
lea ecx, [ebp - 0x35c]
call fcn.10009009
mov ecx, dword [edi]
imul ecx, dword [eax]
cmp esi, ecx
jge 0x1002587e
mov dword [ebp - 0x8c8], 1
jmp 0x10025885
and dword [ebp - 0x8c8], 0
push 1
lea ecx, [ebp - 0x35c]
call fcn.10009009
cmp dword [eax], 0
jne 0x100258f5
push 1
lea ecx, [ebp - 0x35c]
call fcn.10009009
mov eax, dword [eax]
sub eax, 0x374fd522
cmp eax, 0x335900b0
je 0x100258be
mov dword [ebp - 0x400], 1
jmp 0x100258c5
and dword [ebp - 0x400], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9ec]
cmp dword [ebp - 0x400], eax
jne 0x100258f5
push 1
lea ecx, [ebp - 0x35c]
call fcn.10009009
cmp dword [eax], 0
jne 0x100258f5
and dword [ebp - 0x408], 0
jmp 0x100258ff
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x8c8]
neg eax
cmp eax, dword [ebp - 0x408]
jle 0x1002591b
mov dword [ebp - 0x8d0], 1
jmp 0x10025922
and dword [ebp - 0x8d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9ec]
cmp dword [ebp - 0x8d0], eax
jge 0x10025943
mov dword [ebp - 0x410], 1
jmp 0x1002594a
and dword [ebp - 0x410], 0
mov esi, 0x924b5411
sub esi, dword [ebp - 0x410]
push 1
lea ecx, [ebp - 0x35c]
call fcn.10009009
mov eax, dword [eax]
lea eax, [esi + eax - 9]
test eax, eax
je 0x1002597e
push 0
lea ecx, [ebp - 0x35c]
call fcn.10009009
cmp dword [eax], 0
je 0x10025993
mov eax, 0xfffe
test eax, eax
je 0x10025993
mov dword [ebp - 0x8d8], 1
jmp 0x1002599a
and dword [ebp - 0x8d8], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x9ec]
add esi, dword [ebp - 0x8d8]
neg esi
push 0
lea ecx, [ebp - 0xc9c]
call fcn.10009009
cmp esi, dword [eax]
jne 0x100259d0
push 7
pop eax
test eax, eax
jne 0x100259d0
and dword [ebp - 0x418], 0
jmp 0x100259da
mov dword [ebp - 0x418], 1
push 1
lea ecx, [ebp - 0xe00]
call fcn.10009009
mov ecx, dword [ebp - 0x418]
mov dword [eax], ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xe00]
call fcn.10008fed
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x35c]
call fcn.10008fed
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc9c]
call fcn.10008fed
mov dword [ebp - 0xe98], 0xffffffff
mov dword [ebp - 0x8f8], 0x376e
mov dword [ebp - 0x1a0], 0
jmp 0x10025a49
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 2
jge 0x10025a6b
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xdac]
call fcn.10009009
mov dword [eax], 3
jmp 0x10025a3c
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jl 0x10025a7f
mov dword [ebp - 0x8e0], 1
jmp 0x10025a86
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
je 0x10025aa1
mov dword [ebp - 0x420], 1
jmp 0x10025aa8
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x8e0]
cmp eax, dword [ebp - 0x420]
jle 0x10025ac5
mov dword [ebp - 0x8e8], 1
jmp 0x10025acc
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x8e8], eax
jge 0x10025ae3
mov dword [ebp - 0x428], 1
jmp 0x10025aea
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x428], eax
jle 0x10025b04
cmp dword [ebp - 0x48], 0
jne 0x10025b04
and dword [ebp - 0x8f0], 0
jmp 0x10025b0e
mov dword [ebp - 0x8f0], 1
cmp dword [ebp - 0x8f0], 0
je 0x10025b23
mov dword [ebp - 0x430], 1
jmp 0x10025b2a
and dword [ebp - 0x430], 0
mov esi, dword [ebp - 0x48]
imul esi, dword [ebp - 0x430]
push 0
lea ecx, [ebp - 0xdac]
call fcn.10009009
mov dword [eax], esi
mov eax, dword [ebp - 0x8f8]
dec eax
mov dword [ebp - 0x8f8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdac]
call fcn.10008fed
mov dword [ebp - 0x4c], 1
push 2
lea ecx, [ebp - 0xdc4]
call fcn.10008f68
mov dword [ebp - 4], 9
mov dword [ebp - 0xea0], 0x6f25db2b
mov dword [ebp - 0xea8], 0xb8d8131d
mov dword [ebp - 0xeb0], 0xffffffff
mov dword [ebp - 0xeb8], 0xf7d59448
mov dword [ebp - 0xec0], 0xffffffff
mov dword [ebp - 0x450], 0x376e
mov dword [ebp - 0x270], 0
jmp 0x10025bcf
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 2
jge 0x10025bf1
push dword [ebp - 0x270]
lea ecx, [ebp - 0xdc4]
call fcn.10009009
mov dword [eax], 3
jmp 0x10025bc2
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jl 0x10025c05
mov dword [ebp - 0x438], 1
jmp 0x10025c0c
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4c]
je 0x10025c27
mov dword [ebp - 0x900], 1
jmp 0x10025c2e
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x438]
cmp eax, dword [ebp - 0x900]
jle 0x10025c4b
mov dword [ebp - 0x440], 1
jmp 0x10025c52
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x440], eax
jge 0x10025c69
mov dword [ebp - 0x908], 1
jmp 0x10025c70
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x908], eax
jle 0x10025c8a
cmp dword [ebp - 0x4c], 0
jne 0x10025c8a
and dword [ebp - 0x448], 0
jmp 0x10025c94
mov dword [ebp - 0x448], 1
cmp dword [ebp - 0x448], 0
je 0x10025ca9
mov dword [ebp - 0x910], 1
jmp 0x10025cb0
and dword [ebp - 0x910], 0
mov esi, dword [ebp - 0x4c]
imul esi, dword [ebp - 0x910]
push 0
lea ecx, [ebp - 0xdc4]
call fcn.10009009
mov dword [eax], esi
mov eax, dword [ebp - 0x450]
dec eax
mov dword [ebp - 0x450], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc4]
call fcn.10008fed
mov dword [ebp - 0x54], 1
push 2
lea ecx, [ebp - 0xddc]
call fcn.10008f68
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xec8], 0x6f25db2b
mov dword [ebp - 0xed0], 0xb8d8131d
mov dword [ebp - 0xed8], 0xffffffff
mov dword [ebp - 0xee0], 0xf7d59448
mov dword [ebp - 0xee8], 0xffffffff
mov dword [ebp - 0x930], 0x376e
mov dword [ebp - 0x1a8], 0
jmp 0x10025d55
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 2
jge 0x10025d77
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0xddc]
call fcn.10009009
mov dword [eax], 3
jmp 0x10025d48
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
jl 0x10025d8b
mov dword [ebp - 0x918], 1
jmp 0x10025d92
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x54]
je 0x10025dad
mov dword [ebp - 0x458], 1
jmp 0x10025db4
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x918]
cmp eax, dword [ebp - 0x458]
jle 0x10025dd1
mov dword [ebp - 0x920], 1
jmp 0x10025dd8
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x920], eax
jge 0x10025def
mov dword [ebp - 0x460], 1
jmp 0x10025df6
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x460], eax
jle 0x10025e10
cmp dword [ebp - 0x54], 0
jne 0x10025e10
and dword [ebp - 0x928], 0
jmp 0x10025e1a
mov dword [ebp - 0x928], 1
cmp dword [ebp - 0x928], 0
je 0x10025e2f
mov dword [ebp - 0x468], 1
jmp 0x10025e36
and dword [ebp - 0x468], 0
mov esi, dword [ebp - 0x54]
imul esi, dword [ebp - 0x468]
push 0
lea ecx, [ebp - 0xddc]
call fcn.10009009
mov dword [eax], esi
mov eax, dword [ebp - 0x930]
dec eax
mov dword [ebp - 0x930], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xddc]
call fcn.10008fed
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0x940], 0
mov dword [ebp - 0xef0], 0
mov dword [ebp - 0xef8], 0xfffffffc
mov dword [ebp - 0xf00], 1
mov dword [ebp - 0xf08], 0xfffffffb
mov dword [ebp - 0x1b8], 3
mov dword [ebp - 0xf10], 0xbdbaf9eb
mov dword [ebp - 0xf18], 0xffffffff
mov dword [ebp - 0xf20], 0xf2b8319b
mov dword [ebp - 0xf28], 0x3e2e1665
mov dword [ebp - 0xf30], 0xffffffff
mov dword [ebp - 0xf38], 0xd8b26de0
push 3
lea ecx, [ebp - 0xfbc]
call fcn.10008f68
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x230], 0
jmp 0x10025f1a
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x10025f3c
push dword [ebp - 0x230]
lea ecx, [ebp - 0xfbc]
call fcn.10009009
mov dword [eax], 0xfffffff9
jmp 0x10025f0d
mov dword [ebp - 0xc4], 0xffffffed
jmp 0x10025f55
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xffffffe5
jg 0x100261af
mov dword [ebp - 0x2b0], 0x60b0
mov dword [ebp - 0x2f4], 0x3e38693
mov dword [ebp - 0x1b0], 0
jmp 0x10025f8f
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 1
jge 0x10025fab
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0xb94], 2
jmp 0x10025f82
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
jne 0x100260c2
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0xc4], eax
jge 0x10025fd8
mov dword [ebp - 0x470], 1
jmp 0x10025fdf
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x940]
cmp eax, dword [ebp - 0x470]
jge 0x10025ff9
mov dword [ebp - 0x938], 1
jmp 0x10026000
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x2f4]
sub eax, dword [ebp - 0x938]
mov dword [ebp - 0x478], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x478]
mov dword [ebp + eax - 0xb94], ecx
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x478]
je 0x10026048
cmp dword [ebp - 0x940], 0
je 0x10026048
mov dword [ebp - 0x480], 1
jmp 0x1002604f
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x480]
jl 0x10026069
mov dword [ebp - 0x948], 1
jmp 0x10026070
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x2f4]
cmp dword [ebp - 0x948], eax
jne 0x1002608a
mov dword [ebp - 0x488], 1
jmp 0x10026091
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
add eax, 7
cmp eax, dword [ebp - 0x2f4]
jg 0x100260ae
mov dword [ebp - 0x950], 1
jmp 0x100260b5
and dword [ebp - 0x950], 0
cmp dword [ebp - 0x950], 0
je 0x1002614d
mov dword [ebp - 0xd10], 0x1c1d686a
mov dword [ebp - 0xd0c], 0x1c1d686a
mov dword [ebp - 0xd08], 0x1c1d686a
mov dword [ebp - 0xd04], 0x1c1d686a
lea ecx, [ebp - 0x341]
call fcn.10009018
push eax
lea eax, [ebp - 0xd00]
push eax
lea eax, [ebp - 0xd10]
push eax
lea ecx, [ebp - 0x116c]
call fcn.1000901b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10dc]
call fcn.10008fc7
mov dword [ebp - 0xf40], 1
mov dword [ebp - 0x490], 0x8da91e53
mov eax, dword [ebp - 0x490]
dec eax
mov dword [ebp - 0x490], eax
lea ecx, [ebp - 0x10dc]
call fcn.10008fed
jmp 0x100261aa
mov dword [ebp - 0xb9c], 0x41a4
mov dword [ebp - 0x1b8], 0
jmp 0x10026170
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xffffffe3
jge 0x1002619c
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1002619a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x10026163
cmp dword [ebp - 0xb9c], 0
je 0x100261aa
jmp 0x10025f48
jmp 0x10025f48
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfbc]
call fcn.10008fed
mov dword [ebp - 0xcc], 5
mov dword [ebp - 0xf48], 0
mov dword [ebp - 0xba4], 0
mov dword [ebp - 0xd4], 0x5561
push 2
lea ecx, [ebp - 0xdf4]
call fcn.10008f68
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xa4], 0
jmp 0x10026213
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1002622f
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x10b4], 0x7f3e76e5
jmp 0x10026206
mov dword [ebp - 0xa4], 0
jmp 0x10026248
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1002626a
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xdf4]
call fcn.10009009
mov dword [eax], 0xfffffffe
jmp 0x1002623b
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xf50], eax
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xf58], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xf60], eax
cmp dword [ebp - 0xd4], 0xd4a1cf04
jne 0x100262a6
mov dword [ebp - 0x958], 1
jmp 0x100262ad
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x958], eax
jge 0x100262cd
cmp dword [ebp - 0xcc], 0
jne 0x100262cd
and dword [ebp - 0x498], 0
jmp 0x100262d7
mov dword [ebp - 0x498], 1
cmp dword [ebp - 0x498], 0xf34f
jl 0x100262ea
cmp dword [ebp - 0xd4], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x10b4]
push 1
lea ecx, [ebp - 0xdf4]
call fcn.10009009
mov dword [eax], esi
mov dword [ebp - 0xcc], 0x10
jmp 0x1002631f
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x19
jg 0x100263b6
mov dword [ebp - 0x960], 0xffffffff
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x1002635a
push 0x1844
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [ebp - 0xd4], 0xffffffeb
jmp 0x10026373
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffe2
je 0x100263b1
mov eax, dword [ebp - 0x960]
dec eax
mov dword [ebp - 0x960], eax
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x100263af
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
jmp 0x10026366
jmp 0x10026312
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf4]
call fcn.10008fed
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x970], 0
mov dword [ebp - 0xf68], 0
mov dword [ebp - 0xf70], 0xfffffffc
mov dword [ebp - 0xf7c], 1
mov dword [ebp - 0xf84], 0xfffffffb
mov dword [ebp - 0x1c8], 3
mov dword [ebp - 0xf8c], 0xbdbaf9eb
mov dword [ebp - 0xf94], 0xffffffff
mov dword [ebp - 0xf9c], 0xf2b8319b
mov dword [ebp - 0xfa4], 0x3e2e1665
mov dword [ebp - 0xfac], 0xffffffff
mov dword [ebp - 0x107c], 0xd8b26de0
push 3
lea ecx, [ebp - 0xfcc]
call fcn.10008f68
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x238], 0
jmp 0x10026474
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x10026496
push dword [ebp - 0x238]
lea ecx, [ebp - 0xfcc]
call fcn.10009009
mov dword [eax], 0xfffffff9
jmp 0x10026467
mov dword [ebp - 0xdc], 0xffffffed
jmp 0x100264af
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xffffffe5
jg 0x10026709
mov dword [ebp - 0x278], 0x60b0
mov dword [ebp - 0x324], 0x3e38693
mov dword [ebp - 0x1c0], 0
jmp 0x100264e9
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x10026505
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0xbac], 2
jmp 0x100264dc
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
jne 0x1002661c
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0xdc], eax
jge 0x10026532
mov dword [ebp - 0x4a0], 1
jmp 0x10026539
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x970]
cmp eax, dword [ebp - 0x4a0]
jge 0x10026553
mov dword [ebp - 0x968], 1
jmp 0x1002655a
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x324]
sub eax, dword [ebp - 0x968]
mov dword [ebp - 0x4a8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp + eax - 0xbac], ecx
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0x4a8]
je 0x100265a2
cmp dword [ebp - 0x970], 0
je 0x100265a2
mov dword [ebp - 0x4b0], 1
jmp 0x100265a9
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x4b0]
jl 0x100265c3
mov dword [ebp - 0x978], 1
jmp 0x100265ca
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0x978], eax
jne 0x100265e4
mov dword [ebp - 0x4b8], 1
jmp 0x100265eb
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
add eax, 7
cmp eax, dword [ebp - 0x324]
jg 0x10026608
mov dword [ebp - 0x980], 1
jmp 0x1002660f
and dword [ebp - 0x980], 0
cmp dword [ebp - 0x980], 0
je 0x100266a7
mov dword [ebp - 0xce8], 0x1c1d686a
mov dword [ebp - 0xce4], 0x1c1d686a
mov dword [ebp - 0xce0], 0x1c1d686a
mov dword [ebp - 0xcdc], 0x1c1d686a
lea ecx, [ebp - 0x2d9]
call fcn.10009018
push eax
lea eax, [ebp - 0xcd8]
push eax
lea eax, [ebp - 0xce8]
push eax
lea ecx, [ebp - 0x11bc]
call fcn.1000901b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x113c]
call fcn.10008fc7
mov dword [ebp - 0x1084], 1
mov dword [ebp - 0x4c0], 0x8da91e53
mov eax, dword [ebp - 0x4c0]
dec eax
mov dword [ebp - 0x4c0], eax
lea ecx, [ebp - 0x113c]
call fcn.10008fed
jmp 0x10026704
mov dword [ebp - 0xbb4], 0x41a4
mov dword [ebp - 0x1c8], 0
jmp 0x100266ca
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xffffffe3
jge 0x100266f6
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x100266f4
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x100266bd
cmp dword [ebp - 0xbb4], 0
je 0x10026704
jmp 0x100264a2
jmp 0x100264a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfcc]
call fcn.10008fed
mov dword [ebp - 0x28], 0
mov dword [ebp - 0xbc4], 1
mov dword [ebp - 0x240], 0
jmp 0x10026742
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 1
jge 0x1002675e
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x154], 0x8c6a53d0
jmp 0x10026735
mov dword [ebp - 0x28], 0
jmp 0x1002676e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x10026785
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x154], 0
je 0x10026783
jmp 0x10026785
jmp 0x10026767
mov dword [ebp - 0x28], 0
jmp 0x10026795
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x100268d0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x8c], 0
jmp 0x100267c2
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x100268cb
mov eax, dword [ebp - 0x8c]
cmp dword [ebp + eax*4 - 0x154], 0
jne 0x1002689d
mov eax, dword [ebp - 0x8c]
cmp dword [ebp + eax*4 - 0x154], 0
jne 0x10026886
cmp dword [ebp - 0x28], 0x9689
je 0x1002681c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x154], 0
je 0x1002681c
mov dword [ebp - 0x988], 1
jmp 0x10026823
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x988], eax
je 0x1002683a
mov dword [ebp - 0x4c8], 1
jmp 0x10026841
and dword [ebp - 0x4c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
add eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x8c]
jne 0x10026868
mov dword [ebp - 0x990], 1
jmp 0x1002686f
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x990]
jne 0x10026886
and dword [ebp - 0x4d0], 0
jmp 0x10026890
mov dword [ebp - 0x4d0], 1
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp + eax*4 - 0x154]
xor eax, eax
jne 0x100268ad
mov dword [ebp - 0xbbc], 1
jmp 0x100268b4
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x108c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xbc4], eax
jmp 0x100267b5
jmp 0x1002678e
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0x4e0], 0
mov dword [ebp - 0x1094], 0
mov dword [ebp - 0x109c], 0xfffffffc
mov dword [ebp - 0x10a4], 1
mov dword [ebp - 0x10ac], 0xfffffffb
mov dword [ebp - 0x248], 3
mov dword [ebp - 0x10b8], 0xbdbaf9eb
mov dword [ebp - 0x10c0], 0xffffffff
mov dword [ebp - 0x10c8], 0xf2b8319b
mov dword [ebp - 0x10d0], 0x3e2e1665
mov dword [ebp - 0x10cc], 0xffffffff
mov dword [ebp - 0xf80], 0xd8b26de0
push 3
lea ecx, [ebp - 0xfdc]
call fcn.10008f68
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x1d0], 0
jmp 0x1002697f
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x100269a1
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xfdc]
call fcn.10009009
mov dword [eax], 0xfffffff9
jmp 0x10026972
mov dword [ebp - 0xe4], 0xffffffed
jmp 0x100269ba
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xffffffe5
jg 0x10026c14
mov dword [ebp - 0x1d8], 0x60b0
mov dword [ebp - 0x2fc], 0x3e38693
mov dword [ebp - 0x298], 0
jmp 0x100269f4
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 1
jge 0x10026a10
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0xbcc], 2
jmp 0x100269e7
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
jne 0x10026b27
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0xe4], eax
jge 0x10026a3d
mov dword [ebp - 0x998], 1
jmp 0x10026a44
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x4e0]
cmp eax, dword [ebp - 0x998]
jge 0x10026a5e
mov dword [ebp - 0x4d8], 1
jmp 0x10026a65
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x2fc]
sub eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x9a0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9a0]
mov dword [ebp + eax - 0xbcc], ecx
mov eax, dword [ebp - 0xe4]
add eax, dword [ebp - 0x9a0]
je 0x10026aad
cmp dword [ebp - 0x4e0], 0
je 0x10026aad
mov dword [ebp - 0x9a8], 1
jmp 0x10026ab4
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x9a8]
jl 0x10026ace
mov dword [ebp - 0x4e8], 1
jmp 0x10026ad5
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x4e8], eax
jne 0x10026aef
mov dword [ebp - 0x9b0], 1
jmp 0x10026af6
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x9b0]
add eax, 7
cmp eax, dword [ebp - 0x2fc]
jg 0x10026b13
mov dword [ebp - 0x4f0], 1
jmp 0x10026b1a
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 0
je 0x10026bb2
mov dword [ebp - 0xcfc], 0x1c1d686a
mov dword [ebp - 0xcf8], 0x1c1d686a
mov dword [ebp - 0xcf4], 0x1c1d686a
mov dword [ebp - 0xcf0], 0x1c1d686a
lea ecx, [ebp - 0x339]
call fcn.10009018
push eax
lea eax, [ebp - 0xcec]
push eax
lea eax, [ebp - 0xcfc]
push eax
lea ecx, [ebp - 0x11d4]
call fcn.1000901b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1154]
call fcn.10008fc7
mov dword [ebp - 0xe58], 1
mov dword [ebp - 0x9b8], 0x8da91e53
mov eax, dword [ebp - 0x9b8]
dec eax
mov dword [ebp - 0x9b8], eax
lea ecx, [ebp - 0x1154]
call fcn.10008fed
jmp 0x10026c0f
mov dword [ebp - 0xb3c], 0x41a4
mov dword [ebp - 0x248], 0
jmp 0x10026bd5
cmp dword [ebp - 0x248], 0xffffffe3
jge 0x10026c01
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x10026bff
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x10026bc8
cmp dword [ebp - 0xb3c], 0
je 0x10026c0f
jmp 0x100269ad
jmp 0x100269ad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfdc]
call fcn.10008fed
mov dword [ebp - 0xec], 5
mov dword [ebp - 0xe54], 0
mov dword [ebp - 0xb0c], 0
mov dword [ebp - 0xf4], 0x5561
push 2
lea ecx, [ebp - 0xe0c]
call fcn.10008f68
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x9c], 0
jmp 0x10026c78
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x10026c94
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xf78], 0x7f3e76e5
jmp 0x10026c6b
mov dword [ebp - 0x9c], 0
jmp 0x10026cad
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x10026ccf
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xe0c]
call fcn.10009009
mov dword [eax], 0xfffffffe
jmp 0x10026ca0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1098], eax
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xe5c], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf88], eax
cmp dword [ebp - 0xf4], 0xd4a1cf04
jne 0x10026d0b
mov dword [ebp - 0x4f8], 1
jmp 0x10026d12
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x4f8], eax
jge 0x10026d32
cmp dword [ebp - 0xec], 0
jne 0x10026d32
and dword [ebp - 0x9c0], 0
jmp 0x10026d3c
mov dword [ebp - 0x9c0], 1
cmp dword [ebp - 0x9c0], 0xf34f
jl 0x10026d4f
cmp dword [ebp - 0xf4], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xf78]
push 1
lea ecx, [ebp - 0xe0c]
call fcn.10009009
mov dword [eax], esi
mov dword [ebp - 0xec], 0x10
jmp 0x10026d84
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x19
jg 0x10026e1b
mov dword [ebp - 0x500], 0xffffffff
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x10026dbf
push 0x1844
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [ebp - 0xf4], 0xffffffeb
jmp 0x10026dd8
cmp dword [ebp - 0xf4], 0xffffffe2
je 0x10026e16
mov eax, dword [ebp - 0x500]
dec eax
mov dword [ebp - 0x500], eax
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x10026e14
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
jmp 0x10026dcb
jmp 0x10026d77
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0c]
call fcn.10008fed
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xb78], 1
mov dword [ebp - 0x1e0], 0
jmp 0x10026e54
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x10026e70
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x144], 0x8c6a53d0
jmp 0x10026e47
mov dword [ebp - 0x2c], 0
jmp 0x10026e80
cmp dword [ebp - 0x2c], 0
jg 0x10026e97
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x144], 0
je 0x10026e95
mov dword [ebp - 0x2c], 0
jmp 0x10026ea7