Function at 0x1001dde7
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065c2c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x978
push esi
push edi
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x1cc], 0x64f16efa
mov dword [ebp - 0x41c], 0x40fff069
mov dword [ebp - 0x424], 0xd3cd3624
mov dword [ebp - 0x44], 0xe
jmp 0x1001de3c
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x12
jg 0x1001dfe7
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0x128], 0
jmp 0x1001de69
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x1001de85
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x18c], 0x81826fbd
jmp 0x1001de5c
mov byte [ebp - 0x82], 0
movzx eax, byte [ebp - 0x82]
test eax, eax
je 0x1001dea6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [ebp - 0x44], 0
je 0x1001dfcf
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x548], eax
xor eax, eax
inc eax
cmp eax, 0xd635290c
jae 0x1001decf
mov dword [ebp - 0x234], 1
jmp 0x1001ded6
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
neg eax
cmp eax, dword [ebp - 0x44]
je 0x1001deef
mov dword [ebp - 0x3f8], 1
jmp 0x1001def6
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x524], eax
push 0x21
pop eax
imul eax, eax, 0xffff
test eax, eax
je 0x1001df24
cmp dword [ebp - 0xac], 0
je 0x1001df24
mov dword [ebp - 0x37c], 1
jmp 0x1001df2b
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x37c], eax
jl 0x1001df45
mov dword [ebp - 0x1c0], 1
jmp 0x1001df4c
and dword [ebp - 0x1c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18c]
add eax, dword [ebp - 0x1c0]
cmp eax, 0xfff6
jae 0x1001df72
mov dword [ebp - 0x374], 1
jmp 0x1001df79
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x374]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x18c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x18c]
lea eax, [eax + ecx + 0x30f8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x1cc], eax
jg 0x1001dfcf
mov dword [ebp - 0x2a0], 1
jmp 0x1001dfd6
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x424], eax
jmp 0x1001de35
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x1d8], 0x64f16efa
mov dword [ebp - 0x434], 0x40fff069
mov dword [ebp - 0x494], 0xd3cd3624
mov dword [ebp - 0x40], 0xe
jmp 0x1001e01c
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x12
jg 0x1001e1c1
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0x13c], 0
jmp 0x1001e049
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x1001e065
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x16c], 0x81826fbd
jmp 0x1001e03c
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1001e080
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [ebp - 0x40], 0
je 0x1001e1a9
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x52c], eax
xor eax, eax
inc eax
cmp eax, 0xd635290c
jae 0x1001e0a9
mov dword [ebp - 0x1c8], 1
jmp 0x1001e0b0
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
neg eax
cmp eax, dword [ebp - 0x40]
je 0x1001e0c9
mov dword [ebp - 0x42c], 1
jmp 0x1001e0d0
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x534], eax
push 0x21
pop eax
imul eax, eax, 0xffff
test eax, eax
je 0x1001e0fe
cmp dword [ebp - 0xcc], 0
je 0x1001e0fe
mov dword [ebp - 0x310], 1
jmp 0x1001e105
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x310], eax
jl 0x1001e11f
mov dword [ebp - 0x1d0], 1
jmp 0x1001e126
and dword [ebp - 0x1d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x16c]
add eax, dword [ebp - 0x1d0]
cmp eax, 0xfff6
jae 0x1001e14c
mov dword [ebp - 0x2a8], 1
jmp 0x1001e153
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x2a8]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x16c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x16c]
lea eax, [eax + ecx + 0x30f8]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x1d8], eax
jg 0x1001e1a9
mov dword [ebp - 0x348], 1
jmp 0x1001e1b0
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x494], eax
jmp 0x1001e015
push 4
lea ecx, [ebp - 0x5e0]
call fcn.1000a859
and dword [ebp - 4], 0
mov dword [ebp - 0xec], 0x66fe7d8a
mov dword [ebp - 0x53c], 0x7059141a
mov dword [ebp - 0x544], 0x60cbeb96
mov dword [ebp - 0x54c], 0x303f0244
mov dword [ebp - 0x554], 6
push 3
lea ecx, [ebp - 0x5d0]
call fcn.1000a859
mov byte [ebp - 4], 1
mov dword [ebp - 0x1e0], 0x7073
mov dword [ebp - 0x30], 0
jmp 0x1001e22f
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1001e24b
push dword [ebp - 0x30]
lea ecx, [ebp - 0x5e0]
call fcn.1000a8c0
mov dword [eax], 0xfffffffa
jmp 0x1001e228
mov dword [ebp - 0x30], 0
jmp 0x1001e25b
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1001e277
push dword [ebp - 0x30]
lea ecx, [ebp - 0x5d0]
call fcn.1000a8c0
mov dword [eax], 0xc8490231
jmp 0x1001e254
mov dword [ebp - 0xec], 0
jmp 0x1001e290
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jg 0x1001e442
mov dword [ebp - 0xb4], 0x72304b25
mov dword [ebp - 0x55c], 0x357257ea
mov dword [ebp - 0x564], 0xffffffff
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0x5a8], 1
mov dword [ebp - 0x5b0], 1
mov dword [ebp - 0x5b8], 0x6e85fcb
mov dword [ebp - 0x470], 0xfffffff7
mov dword [ebp - 0x124], 0
jmp 0x1001e306
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x1001e322
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x6ac], 0x72305ab
jmp 0x1001e2f9
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x1001e336
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [ebp - 0xb4], 3
jmp 0x1001e34f
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x1001e43d
mov dword [ebp - 0x14c], 5
mov dword [ebp - 0xf4], 0
jmp 0x1001e37f
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x1001e39b
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x5c0], 0
jmp 0x1001e372
mov dword [ebp - 0x14c], 3
jmp 0x1001e3b4
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jl 0x1001e42c
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x66c], 0x8039d6b9
mov dword [ebp - 0x64c], 9
mov dword [ebp - 0xfc], 0
jmp 0x1001e3fe
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x1001e41a
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x62c], 0xb39d2057
jmp 0x1001e3f1
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
jmp 0x1001e3a7
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x470], eax
jmp 0x1001e342
jmp 0x1001e283
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5d0]
call fcn.1000a8bb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5e0]
call fcn.1000a8bb
push 4
lea ecx, [ebp - 0x600]
call fcn.1000a859
mov dword [ebp - 4], 2
mov dword [ebp - 0x12c], 0x66fe7d8a
mov dword [ebp - 0x510], 0x7059141a
mov dword [ebp - 0x5bc], 0x60cbeb96
mov dword [ebp - 0x518], 0x303f0244
mov dword [ebp - 0x630], 6
push 3
lea ecx, [ebp - 0x5f0]
call fcn.1000a859
mov byte [ebp - 4], 3
mov dword [ebp - 0x2b0], 0x7073
mov dword [ebp - 0x3c], 0
jmp 0x1001e4d1
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x1001e4ed
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x600]
call fcn.1000a8c0
mov dword [eax], 0xfffffffa
jmp 0x1001e4ca
mov dword [ebp - 0x3c], 0
jmp 0x1001e4fd
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1001e519
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x5f0]
call fcn.1000a8c0
mov dword [eax], 0xc8490231
jmp 0x1001e4f6
mov dword [ebp - 0x12c], 0
jmp 0x1001e532
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jg 0x1001e6ea
mov dword [ebp - 0xc4], 0x72304b25
mov dword [ebp - 0x520], 0x357257ea
mov dword [ebp - 0x5c4], 0xffffffff
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x648], 1
mov dword [ebp - 0x530], 1
mov dword [ebp - 0x5d4], 0x6e85fcb
mov dword [ebp - 0x3c8], 0xfffffff7
mov dword [ebp - 0x104], 0
jmp 0x1001e5a8
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x1001e5c4
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x6ec], 0x72305ab
jmp 0x1001e59b
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x1001e5de
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [ebp - 0xc4], 3
jmp 0x1001e5f7
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x1001e6e5
mov dword [ebp - 0x10c], 5
mov dword [ebp - 0x144], 0
jmp 0x1001e627
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x1001e643
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x538], 0
jmp 0x1001e61a
mov dword [ebp - 0x10c], 3
jmp 0x1001e65c
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jl 0x1001e6d4
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x540], 0
mov dword [ebp - 0x5e4], 0x8039d6b9
mov dword [ebp - 0x508], 9
mov dword [ebp - 0x134], 0
jmp 0x1001e6a6
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x1001e6c2
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x574], 0xb39d2057
jmp 0x1001e699
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
jmp 0x1001e64f
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x3c8], eax
jmp 0x1001e5ea
jmp 0x1001e525
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5f0]
call fcn.1000a8bb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x600]
call fcn.1000a8bb
mov dword [ebp - 0x114], 0xb3ae3556
mov dword [ebp - 0x114], 0
jmp 0x1001e72b
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfffffffd
jle 0x1001e764
mov dword [ebp - 0x414], 0x905d
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x1001e757
push 0x68c
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [ebp - 0x414], 0
je 0x1001e762
jmp 0x1001e764
jmp 0x1001e71e
mov dword [ebp - 0x438], 0x2260
cmp dword [ebp - 0x438], 0xfd0
jge 0x1001e83a
lea eax, [ebp - 0x1ac]
push eax
push 0x10008180
call fcn.1004bcab
pop ecx
pop ecx
mov eax, dword [ebp - 0x1ac]
and eax, 1
mov byte [ebp - 0x11], al
and dword [ebp - 0xa4], 0
jmp 0x1001e7b3
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x1ac]
jge 0x1001e810
lea eax, [ebp - 0x1e8]
push eax
push 0x10008180
call fcn.1004bcab
pop ecx
pop ecx
cmp dword [ebp - 0xa4], 0
jne 0x1001e7ee
mov eax, dword [ebp - 0x1e8]
and eax, 1
jne 0x1001e7ee
mov byte [ebp - 0x11], 0
jmp 0x1001e810
mov eax, dword [ebp - 0x1ac]
dec eax
cmp dword [ebp - 0xa4], eax
jne 0x1001e80e
mov eax, dword [ebp - 0x1e8]
and eax, 1
jne 0x1001e80e
mov byte [ebp - 0x11], 0
jmp 0x1001e810
jmp 0x1001e7a6
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1001e824
mov dword [ebp - 0x318], 0x1000850c
jmp 0x1001e82e
mov dword [ebp - 0x318], 0x10008510
push dword [ebp - 0x318]
call fcn.1004c236
pop ecx
mov dword [ebp - 0x154], 0xb3ae3556
mov dword [ebp - 0x154], 0
jmp 0x1001e85d
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xfffffffd
jle 0x1001e89c
mov dword [ebp - 0x3d0], 0x905d
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1001e88f
push 0x68c
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [ebp - 0x3d0], 0
je 0x1001e89a
jmp 0x1001e89c
jmp 0x1001e850
mov dword [ebp - 0xa0], 0x6da5
mov dword [ebp - 0x11c], 0xbf90edca
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x550], 0xffffffff
mov dword [ebp - 0x1f8], 0xfffffffa
mov dword [ebp - 0x3e0], 0xf3f17e2f
mov dword [ebp - 0x174], 0xb3bfa32a
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0x578], 0x9069002f
mov dword [ebp - 0x28], 0
jmp 0x1001e906
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1001e91c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x698], 0
jmp 0x1001e8ff
mov dword [ebp - 0x28], 0
jmp 0x1001e92c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1001e942
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x6f8], 1
jmp 0x1001e925
mov byte [ebp - 0x46], 0
movzx eax, byte [ebp - 0x46]
test eax, eax
je 0x1001e96c
push 0x12a1
push 0x1ef9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0xa0], eax
jne 0x1001e9bf
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x174]
inc ecx
mov dword [ebp - 0x174], ecx
test eax, eax
je 0x1001e9a6
cmp dword [ebp - 0x1f8], 0
je 0x1001e9a6
mov dword [ebp - 0x1f0], 1
jmp 0x1001e9ad
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x2b8]
imul eax, dword [ebp - 0x2b8]
cmp eax, dword [ebp - 0x1f8]
jg 0x1001e9e0
mov dword [ebp - 0x370], 1
jmp 0x1001e9e7
and dword [ebp - 0x370], 0
cmp dword [ebp - 0x370], 0x6d8bc0d1
jl 0x1001e9ff
mov dword [ebp - 0x200], 1
jmp 0x1001ea06
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
je 0x1001ea30
cmp dword [ebp - 0xdc], 0
je 0x1001ea30
mov dword [ebp - 0x2c0], 1
jmp 0x1001ea37
and dword [ebp - 0x2c0], 0
cmp dword [ebp - 0x2c0], 0xb780f885
jb 0x1001ea4f
mov dword [ebp - 0x208], 1
jmp 0x1001ea56
and dword [ebp - 0x208], 0
cmp dword [ebp - 0x208], 2
ja 0x1001eac2
mov dword [ebp - 0x4f4], 0xffffffff
mov dword [ebp - 0x4f0], 0xffffffff
mov dword [ebp - 0x4ec], 0xffffffff
mov dword [ebp - 0x4e8], 0xffffffff
mov dword [ebp - 0xa0], 0
jmp 0x1001eaa0
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xfffffff3
jge 0x1001eabd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4f4], 0
je 0x1001eabb
jmp 0x1001eabd
jmp 0x1001ea93
jmp 0x1001ed46
mov dword [ebp - 0x1a4], 0
and dword [ebp - 0x4cc], 0
and dword [ebp - 0x4c8], 0
and dword [ebp - 0x4c4], 0
and dword [ebp - 0x4c0], 0
lea ecx, [ebp - 0x1a5]
call fcn.1000a8cf
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x4cc]
push eax
lea ecx, [ebp - 0x6e4]
call fcn.1000a8d2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3ac]
call fcn.1000a895
mov dword [ebp - 4], 4
mov dword [ebp - 0x194], 1
mov dword [ebp - 0x230], 0xfffffff8
mov dword [ebp - 0x17c], 0xbf2f
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x480], eax
push 0
lea ecx, [ebp - 0x3ac]
call fcn.1000a8c0
mov ecx, dword [ebp - 0x480]
mov dword [eax], ecx
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x17c]
neg eax
mov dword [ebp - 0x320], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x320]
mov dword [ebp + eax - 0x698], ecx
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x320]
sub eax, 0x5f4
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x3d8]
cmp eax, dword [ebp - 0x444]
jl 0x1001ebe0
mov dword [ebp - 0x220], 1
jmp 0x1001ebe7
and dword [ebp - 0x220], 0
push 4
pop eax
test eax, eax
je 0x1001ec33
cmp dword [ebp - 0x1a4], 0xe0bb
jg 0x1001ec06
mov dword [ebp - 0x210], 1
jmp 0x1001ec0d
and dword [ebp - 0x210], 0
push 0
lea ecx, [ebp - 0x3ac]
call fcn.1000a8c0
mov ecx, dword [ebp - 0x210]
imul ecx, dword [eax]
test ecx, ecx
je 0x1001ec33
mov dword [ebp - 0x2c8], 1
jmp 0x1001ec3a
and dword [ebp - 0x2c8], 0
mov esi, dword [ebp - 0xdc]
imul esi, dword [ebp - 0x2c8]
push 0
lea ecx, [ebp - 0x3ac]
call fcn.1000a8c0
cmp esi, dword [eax]
jl 0x1001ec64
mov dword [ebp - 0x218], 1
jmp 0x1001ec6b
and dword [ebp - 0x218], 0
push 0
lea ecx, [ebp - 0x3ac]
call fcn.1000a8c0
mov ecx, dword [ebp - 0x218]
cmp ecx, dword [eax]
jl 0x1001ec8e
mov dword [ebp - 0x350], 1
jmp 0x1001ec95
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x230]
add eax, dword [ebp - 0x350]
mov ecx, dword [ebp - 0x220]
imul ecx, eax
mov dword [ebp - 0x2d0], ecx
push 0
lea ecx, [ebp - 0x3ac]
call fcn.1000a8c0
mov ecx, dword [ebp - 0x2d0]
mov dword [eax], ecx
cmp dword [ebp - 0x2d0], 0
jne 0x1001ece9
push 0
lea ecx, [ebp - 0x3ac]
call fcn.1000a8c0
cmp dword [eax], 0
jne 0x1001ece9
and dword [ebp - 0x228], 0
jmp 0x1001ecf3
mov dword [ebp - 0x228], 1
mov eax, dword [ebp - 0x3e0]
cmp dword [ebp - 0x228], eax
je 0x1001ed0d
mov dword [ebp - 0x328], 1
jmp 0x1001ed14
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x230], eax
mov byte [ebp - 0x47], 0
movzx eax, byte [ebp - 0x47]
test eax, eax
je 0x1001ed37
push 0x1225
call dword [sym.imp.KERNEL32.dll_ExitThread]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ac]
call fcn.1000a8bb
mov dword [ebp - 0xa8], 0x6da5
mov dword [ebp - 0xe8], 0xbf90edca
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x580], 0xffffffff
mov dword [ebp - 0x368], 0xfffffffa
mov dword [ebp - 0x3c0], 0xf3f17e2f
mov dword [ebp - 0x184], 0xb3bfa32a
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0x560], 0x9069002f
mov dword [ebp - 0x2c], 0
jmp 0x1001edb0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1001edc6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x6a4], 0
jmp 0x1001eda9
mov dword [ebp - 0x2c], 0
jmp 0x1001edd6
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1001edec
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x704], 1
jmp 0x1001edcf
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x1001ee16
push 0x12a1
push 0x1ef9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0xa8], eax
jne 0x1001ee69
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x184]
inc ecx
mov dword [ebp - 0x184], ecx
test eax, eax
je 0x1001ee50
cmp dword [ebp - 0x368], 0
je 0x1001ee50
mov dword [ebp - 0x2d8], 1
jmp 0x1001ee57
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x238]
imul eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x368]
jg 0x1001ee8a
mov dword [ebp - 0x240], 1
jmp 0x1001ee91
and dword [ebp - 0x240], 0
cmp dword [ebp - 0x240], 0x6d8bc0d1
jl 0x1001eea9
mov dword [ebp - 0x2e0], 1
jmp 0x1001eeb0
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
je 0x1001eeda
cmp dword [ebp - 0xf0], 0
je 0x1001eeda
mov dword [ebp - 0x248], 1
jmp 0x1001eee1
and dword [ebp - 0x248], 0
cmp dword [ebp - 0x248], 0xb780f885
jb 0x1001eef9
mov dword [ebp - 0x330], 1
jmp 0x1001ef00
and dword [ebp - 0x330], 0
cmp dword [ebp - 0x330], 2
ja 0x1001ef6c
mov dword [ebp - 0x504], 0xffffffff
mov dword [ebp - 0x500], 0xffffffff
mov dword [ebp - 0x4fc], 0xffffffff
mov dword [ebp - 0x4f8], 0xffffffff
mov dword [ebp - 0xa8], 0
jmp 0x1001ef4a
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xfffffff3
jge 0x1001ef67
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x504], 0
je 0x1001ef65
jmp 0x1001ef67
jmp 0x1001ef3d
jmp 0x1001f2b2
mov dword [ebp - 0x168], 0
and dword [ebp - 0x4b8], 0
and dword [ebp - 0x4b4], 0
and dword [ebp - 0x4b0], 0
and dword [ebp - 0x4ac], 0
lea ecx, [ebp - 0x1ad]
call fcn.1000a8cf
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x6dc]
call fcn.1000a8d2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3a0]
call fcn.1000a895
mov dword [ebp - 4], 5
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x278], 0xfffffff8
mov dword [ebp - 0x164], 0xbf2f
mov dword [ebp - 0x46c], 0x1450
cmp dword [ebp - 0x46c], 0x5e1
jge 0x1001f0ae
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x250]
push eax
push 0x10008514
call fcn.1004bcab
add esp, 0xc
mov eax, dword [ebp - 0x250]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
shl eax, 1
mov ecx, dword [ebp - 0x250]
sub ecx, eax
mov dword [ebp - 0x8c], ecx
cmp dword [ebp - 0x58], 0
jl 0x1001f07c
cmp dword [ebp - 0x8c], 0
jl 0x1001f07c
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x8c]
cdq
idiv dword [ebp - 0x3e8]
test edx, edx
je 0x1001f07c
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x8c]
inc eax
inc eax
mov dword [ebp - 0x8c], eax
jmp 0x1001f042
cmp dword [ebp - 0x58], 0
jl 0x1001f08b
cmp dword [ebp - 0x8c], 0
jge 0x1001f098
push 0x1000848c
call fcn.1004c236
pop ecx
jmp 0x1001f0ae
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x8c]
push eax
push 0x10008460
call fcn.1004c43c
pop ecx
pop ecx
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x450], eax
push 0
lea ecx, [ebp - 0x3a0]
call fcn.1000a8c0
mov ecx, dword [ebp - 0x450]
mov dword [eax], ecx
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x164]
neg eax
mov dword [ebp - 0x2e8], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2e8]
mov dword [ebp + eax - 0x6a4], ecx
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x2e8]
sub eax, 0x5f4
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x3f0]
cmp eax, dword [ebp - 0x474]
jl 0x1001f14c
mov dword [ebp - 0x268], 1
jmp 0x1001f153
and dword [ebp - 0x268], 0
push 4
pop eax
test eax, eax
je 0x1001f19f
cmp dword [ebp - 0x168], 0xe0bb
jg 0x1001f172
mov dword [ebp - 0x258], 1
jmp 0x1001f179
and dword [ebp - 0x258], 0
push 0
lea ecx, [ebp - 0x3a0]
call fcn.1000a8c0
mov ecx, dword [ebp - 0x258]
imul ecx, dword [eax]
test ecx, ecx
je 0x1001f19f
mov dword [ebp - 0x358], 1
jmp 0x1001f1a6
and dword [ebp - 0x358], 0
mov esi, dword [ebp - 0xf0]
imul esi, dword [ebp - 0x358]
push 0
lea ecx, [ebp - 0x3a0]
call fcn.1000a8c0
cmp esi, dword [eax]
jl 0x1001f1d0
mov dword [ebp - 0x260], 1
jmp 0x1001f1d7
and dword [ebp - 0x260], 0
push 0
lea ecx, [ebp - 0x3a0]
call fcn.1000a8c0
mov ecx, dword [ebp - 0x260]
cmp ecx, dword [eax]
jl 0x1001f1fa
mov dword [ebp - 0x2f0], 1
jmp 0x1001f201
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x268]
imul ecx, eax
mov dword [ebp - 0x338], ecx
push 0
lea ecx, [ebp - 0x3a0]
call fcn.1000a8c0
mov ecx, dword [ebp - 0x338]
mov dword [eax], ecx
cmp dword [ebp - 0x338], 0
jne 0x1001f255
push 0
lea ecx, [ebp - 0x3a0]
call fcn.1000a8c0
cmp dword [eax], 0
jne 0x1001f255
and dword [ebp - 0x270], 0
jmp 0x1001f25f
mov dword [ebp - 0x270], 1
mov eax, dword [ebp - 0x3c0]
cmp dword [ebp - 0x270], eax
je 0x1001f279
mov dword [ebp - 0x2f8], 1
jmp 0x1001f280
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x278], eax
mov byte [ebp - 0x4b], 0
movzx eax, byte [ebp - 0x4b]
test eax, eax
je 0x1001f2a3
push 0x1225
call dword [sym.imp.KERNEL32.dll_ExitThread]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a0]
call fcn.1000a8bb
movzx eax, byte [0x1076b789]
test eax, eax
je 0x1001f2d0
mov esi, 0x10658080
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10020aeb
mov dword [ebp - 0x60], 0xfd3df75d
mov dword [ebp - 0x290], 0xe3d2f551
mov dword [ebp - 0x410], 0x6e836ea0
mov dword [ebp - 0x568], 0x3f36fc75
mov dword [ebp - 0x60], 0
jmp 0x1001f305
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x1c
jle 0x1001f50c
mov dword [ebp - 0x68], 0xa35f394
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x68], 4
jmp 0x1001f330
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x1c
jge 0x1001f4ee
mov dword [ebp - 0x170], 0x4e6d
mov dword [ebp - 0xd4], 0x1023dcdf
mov dword [ebp - 0x45c], 0x54e3f157
mov dword [ebp - 0x468], 0x64939e63
cmp dword [ebp - 0x68], 0
je 0x1001f499
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x45c], 0
jne 0x1001f396
cmp dword [ebp - 0x170], 0x257a10dd
jge 0x1001f396
and dword [ebp - 0x378], 0
jmp 0x1001f3a0
mov dword [ebp - 0x378], 1
cmp dword [ebp - 0x378], 0
jg 0x1001f3b8
cmp dword [ebp - 0x60], 0
jne 0x1001f3b8
and dword [ebp - 0x280], 0
jmp 0x1001f3c2
mov dword [ebp - 0x280], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x280], eax
jg 0x1001f3d9
mov dword [ebp - 0x300], 1
jmp 0x1001f3e0
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x300], eax
jne 0x1001f3f7
mov dword [ebp - 0x288], 1
jmp 0x1001f3fe
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x400]
cmp eax, dword [ebp - 0x47c]
jle 0x1001f43d
mov dword [ebp - 0x340], 1
jmp 0x1001f444
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x340], eax
jl 0x1001f45b
mov dword [ebp - 0x408], 1
jmp 0x1001f462
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x290], 0xf6b903cf
cmp dword [ebp - 0x290], 0
je 0x1001f499
mov dword [ebp - 0x308], 1
jmp 0x1001f4a0
and dword [ebp - 0x308], 0
mov eax, 0xed1
sub eax, dword [ebp - 0x308]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x298], eax
je 0x1001f4cb
mov dword [ebp - 0x360], 1
jmp 0x1001f4d2
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x68], 0
je 0x1001f4e9
jmp 0x1001f329
jmp 0x1001f329
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x1001f507
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
jmp 0x1001f2fe
mov dword [ebp - 0x5a0], 0x10658080
mov dword [ebp - 0x98], 0xf89b546
mov dword [ebp - 0x178], 0xafd11d96
mov dword [ebp - 0x57c], 0xfffffffd
mov dword [ebp - 0x484], 5
mov dword [ebp - 0x1b8], 0x69bd697e
mov dword [ebp - 0x1bc], 0xd19c9214
mov dword [ebp - 0x48c], 0x17a68fab
mov dword [ebp - 0xf8], 0
jmp 0x1001f575
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jge 0x1001f591
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x4e4], 0x85f70ad6
jmp 0x1001f568
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x1001f5b3
push 0
push 0
push 0x1ed9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 0x98], 0
jmp 0x1001f5cc
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jg 0x1001f712
mov dword [ebp - 0x100], 0xa77c8748
mov dword [ebp - 0x100], 8
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x178], eax
jg 0x1001f620
mov dword [ebp - 0x1c4], 1
jmp 0x1001f627
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp + eax*4 - 0x4e4]
cmp eax, dword [ebp - 0x1c4]
jle 0x1001f648
mov dword [ebp - 0x1d4], 1
jmp 0x1001f64f
and dword [ebp - 0x1d4], 0
mov dword [ebp - 0x484], 0xfffa
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4e4], 0x6a3f1540
jle 0x1001f677
mov dword [ebp - 0x418], 1
jmp 0x1001f67e
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x5f4], eax
imul eax, dword [ebp - 0x1b8], 0x5a2e
mov ecx, dword [ebp - 0x98]
cmp eax, dword [ebp + ecx*4 - 0x4e4]
jne 0x1001f6af
mov dword [ebp - 0x1dc], 1
jmp 0x1001f6b6
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x1dc]
jg 0x1001f6d0
mov dword [ebp - 0x1e4], 1
jmp 0x1001f6d7
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x48c]
add eax, dword [ebp - 0x1e4]
imul eax, eax, 0xfffffff8
cmp eax, dword [ebp - 0x100]
je 0x1001f6fa
mov dword [ebp - 0x1ec], 1
jmp 0x1001f701
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x178], eax
jmp 0x1001f5bf
mov dword [ebp - 0x420], 0x142c
cmp dword [ebp - 0x420], 0x1271
jge 0x1001f90a
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 0x49c]
push eax
mov ecx, 0x10658770
call fcn.1001c1e2
mov ecx, eax
call fcn.1001c1e2
cmp dword [ebp - 0x3bc], 1
jne 0x1001f77d
cmp dword [ebp - 0x3b8], 0
jne 0x1001f77d
push fcn.1000e0ee
mov edx, 0x1000850c
mov ecx, 0x106586b8
call fcn.1000dd7a
mov ecx, eax
call fcn.1000a626
jmp 0x1001f90a
lea ecx, [ebp - 0x3b4]
call fcn.10021d8a
mov dword [ebp - 4], 6
xorpd xmm0, xmm0
movlpd qword [ebp - 0x160], xmm0
mov dword [ebp - 0xe4], 1
and dword [ebp - 0xe0], 0
jmp 0x1001f7cc
mov eax, dword [ebp - 0xe4]
add eax, 1
mov ecx, dword [ebp - 0xe0]
adc ecx, 0
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], ecx
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0x3b8]
jg 0x1001f88e
jl 0x1001f7f2
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x3bc]
ja 0x1001f88e
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
push dword [ebp - 0x498]
push dword [ebp - 0x49c]
call fcn.10064fc0
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x4a0], edx
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x6d4]
push eax
lea ecx, [ebp - 0x3b4]
call fcn.10021d9f
mov eax, dword [ebp - 0x160]
add eax, 1
mov ecx, dword [ebp - 0x15c]
adc ecx, 0
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], ecx
lea ecx, [ebp - 0x3b4]
call fcn.1001c4ca
xor ecx, ecx
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], ecx
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x440]
jne 0x1001f887
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x43c]
je 0x1001f889
jmp 0x1001f88e
jmp 0x1001f7ae
lea ecx, [ebp - 0x3b4]
call fcn.1001c4ca
xor ecx, ecx
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x448], ecx
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x44c]
jne 0x1001f8e0
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x448]
jne 0x1001f8e0
push fcn.1000e0ee
mov edx, 0x1000850c
mov ecx, 0x106586b8
call fcn.1000dd7a
mov ecx, eax
call fcn.1000a626
jmp 0x1001f8fb
push fcn.1000e0ee
mov edx, 0x10008510
mov ecx, 0x106586b8
call fcn.1000dd7a
mov ecx, eax
call fcn.1000a626
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b4]
call fcn.10021dbd
mov dword [ebp - 0x70], 0xfd3df75d
mov dword [ebp - 0x21c], 0xe3d2f551
mov dword [ebp - 0x3c4], 0x6e836ea0
mov dword [ebp - 0x584], 0x3f36fc75
mov dword [ebp - 0x70], 0
jmp 0x1001f93f
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x1c
jle 0x1001fb46
mov dword [ebp - 0x78], 0xa35f394
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x78], 4
jmp 0x1001f96a
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x1c
jge 0x1001fb28
mov dword [ebp - 0x180], 0x4e6d
mov dword [ebp - 0x108], 0x1023dcdf
mov dword [ebp - 0x490], 0x54e3f157
mov dword [ebp - 0x488], 0x64939e63
cmp dword [ebp - 0x78], 0
je 0x1001fad3
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x490], 0
jne 0x1001f9d0
cmp dword [ebp - 0x180], 0x257a10dd
jge 0x1001f9d0
and dword [ebp - 0x1f4], 0
jmp 0x1001f9da
mov dword [ebp - 0x1f4], 1
cmp dword [ebp - 0x1f4], 0
jg 0x1001f9f2
cmp dword [ebp - 0x70], 0
jne 0x1001f9f2
and dword [ebp - 0x1fc], 0
jmp 0x1001f9fc
mov dword [ebp - 0x1fc], 1
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x1fc], eax
jg 0x1001fa13
mov dword [ebp - 0x204], 1
jmp 0x1001fa1a
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x204], eax
jne 0x1001fa31
mov dword [ebp - 0x20c], 1
jmp 0x1001fa38
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x478]
jle 0x1001fa77
mov dword [ebp - 0x214], 1
jmp 0x1001fa7e
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x214], eax
jl 0x1001fa95
mov dword [ebp - 0x430], 1
jmp 0x1001fa9c
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x21c], 0xf6b903cf
cmp dword [ebp - 0x21c], 0
je 0x1001fad3
mov dword [ebp - 0x224], 1
jmp 0x1001fada
and dword [ebp - 0x224], 0
mov eax, 0xed1
sub eax, dword [ebp - 0x224]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x22c], eax
je 0x1001fb05
mov dword [ebp - 0x1b4], 1
jmp 0x1001fb0c
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x78], 0
je 0x1001fb23
jmp 0x1001f963
jmp 0x1001f963
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x1001fb41
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
jmp 0x1001f938
push 2
lea ecx, [ebp - 0x610]
call fcn.1000a859
mov dword [ebp - 4], 7
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x110], 0
jmp 0x1001fb7d
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x1001fb9c
push dword [ebp - 0x110]
lea ecx, [ebp - 0x610]
call fcn.1000a8c0
or dword [eax], 0xffffffff
jmp 0x1001fb70
mov dword [ebp - 0x118], 0
jmp 0x1001fbb5
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jg 0x1001fbd7
mov byte [ebp - 0x53], 0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x1001fbd5
push 0xcbf
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x1001fba8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x610]
call fcn.1000a8bb
mov dword [ebp - 0x594], 0x10658084
mov dword [ebp - 0x3cc], 0x16a7
cmp dword [ebp - 0x3cc], 0xae7
jge 0x10020045
lea ecx, [ebp - 0x394]
call fcn.1000a34b
mov dword [ebp - 4], 8
xor eax, eax
inc eax
je 0x10020036
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x23c]
push eax
mov ecx, 0x10658770
call fcn.1000a437
mov ecx, eax
call fcn.1000a437
mov ecx, eax
call fcn.1000a437
cmp dword [ebp - 0x23c], 0
jne 0x1001fc72
cmp dword [ebp - 0x244], 0
jne 0x1001fc72
cmp dword [ebp - 0x24c], 0
jne 0x1001fc72
jmp 0x10020036
lea edx, [ebp - 0x394]
mov ecx, 0x10658770
call fcn.1000dd72
push 0x20
lea ecx, [ebp - 0x394]
call fcn.1000abc8
push eax
lea ecx, [ebp - 0x664]
call fcn.1000bef9
mov byte [ebp - 4], 9
and dword [ebp - 0x10], 0
and dword [ebp - 0x90], 0
jmp 0x1001fcb9
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
lea ecx, [ebp - 0x394]
call fcn.1000abc8
cmp dword [ebp - 0x90], eax
jae 0x1001fd17
push dword [ebp - 0x90]
lea ecx, [ebp - 0x394]
call fcn.1000c073
movsx eax, byte [eax]
cmp eax, 0x61
jl 0x1001fd15
push dword [ebp - 0x90]
lea ecx, [ebp - 0x394]
call fcn.1000c073
movsx eax, byte [eax]
cmp eax, 0x69
jg 0x1001fd15
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x844], ecx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x1001fcac
cmp dword [ebp - 0x10], 0
je 0x1001fdc1
and dword [ebp - 0xb0], 0
jmp 0x1001fd37
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x10]
jge 0x1001fd68
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x23c]
cdq
idiv dword [ebp - 0x10]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x844]
mov dword [ebp + edx*4 - 0x984], eax
jmp 0x1001fd2a
and dword [ebp - 0xb8], 0
jmp 0x1001fd7e
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x10]
jge 0x1001fdc1
mov eax, dword [ebp - 0xb8]
push dword [ebp + eax*4 - 0x984]
lea ecx, [ebp - 0x394]
call fcn.1000c073
mov esi, eax
mov eax, dword [ebp - 0xb8]
push dword [ebp + eax*4 - 0x844]
lea ecx, [ebp - 0x664]
call fcn.1000c073
mov cl, byte [esi]
mov byte [eax], cl
jmp 0x1001fd71
and dword [ebp - 0x10], 0
and dword [ebp - 0x94], 0
jmp 0x1001fddb
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
lea ecx, [ebp - 0x394]
call fcn.1000abc8
cmp dword [ebp - 0x94], eax
jae 0x1001fe39
push dword [ebp - 0x94]
lea ecx, [ebp - 0x394]
call fcn.1000c073
movsx eax, byte [eax]
cmp eax, 0x6a
jl 0x1001fe37
push dword [ebp - 0x94]
lea ecx, [ebp - 0x394]
call fcn.1000c073
movsx eax, byte [eax]
cmp eax, 0x72
jg 0x1001fe37
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x844], ecx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x1001fdce
cmp dword [ebp - 0x10], 0
je 0x1001fee3
and dword [ebp - 0xc0], 0
jmp 0x1001fe59
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x10]
jge 0x1001fe8a
mov eax, dword [ebp - 0xc0]
add eax, dword [ebp - 0x244]
cdq
idiv dword [ebp - 0x10]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x844]
mov dword [ebp + edx*4 - 0x984], eax
jmp 0x1001fe4c
and dword [ebp - 0xc8], 0
jmp 0x1001fea0
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x10]
jge 0x1001fee3
mov eax, dword [ebp - 0xc8]
push dword [ebp + eax*4 - 0x984]
lea ecx, [ebp - 0x394]
call fcn.1000c073
mov esi, eax
mov eax, dword [ebp - 0xc8]
push dword [ebp + eax*4 - 0x844]
lea ecx, [ebp - 0x664]
call fcn.1000c073
mov cl, byte [esi]
mov byte [eax], cl
jmp 0x1001fe93
and dword [ebp - 0x10], 0
and dword [ebp - 0x80], 0
jmp 0x1001fef4
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0x394]
call fcn.1000abc8
cmp dword [ebp - 0x80], eax
jae 0x1001ff5c
push dword [ebp - 0x80]
lea ecx, [ebp - 0x394]
call fcn.1000c073
movsx eax, byte [eax]
cmp eax, 0x73
jl 0x1001ff30
push dword [ebp - 0x80]
lea ecx, [ebp - 0x394]
call fcn.1000c073
movsx eax, byte [eax]
cmp eax, 0x7a
jle 0x1001ff46
push dword [ebp - 0x80]
lea ecx, [ebp - 0x394]
call fcn.1000c073
movsx eax, byte [eax]
cmp eax, 0x5f
jne 0x1001ff5a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x844], ecx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x1001feed
cmp dword [ebp - 0x10], 0
je 0x10020006
and dword [ebp - 0xd0], 0
jmp 0x1001ff7c
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x10]
jge 0x1001ffad
mov eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0x24c]
cdq
idiv dword [ebp - 0x10]
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp + eax*4 - 0x844]
mov dword [ebp + edx*4 - 0x984], eax
jmp 0x1001ff6f
and dword [ebp - 0xbc], 0
jmp 0x1001ffc3
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x10]
jge 0x10020006
mov eax, dword [ebp - 0xbc]
push dword [ebp + eax*4 - 0x984]
lea ecx, [ebp - 0x394]
call fcn.1000c073
mov esi, eax
mov eax, dword [ebp - 0xbc]
push dword [ebp + eax*4 - 0x844]
lea ecx, [ebp - 0x664]
call fcn.1000c073
mov cl, byte [esi]
mov byte [eax], cl
jmp 0x1001ffb6
push fcn.1000e0ee
lea edx, [ebp - 0x664]
mov ecx, 0x106586b8
call fcn.1000df51
mov ecx, eax
call fcn.1000a626
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x664]
call fcn.1000a38b
jmp 0x1001fc1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x394]
call fcn.1000a38b
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x120], 0
jmp 0x10020065
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x10020081
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x458], 0x56834504
jmp 0x10020058
mov dword [ebp - 0x1c], 0
jmp 0x10020091
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x100200e7
mov dword [ebp - 0x254], 0x2e8588d0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x458]
mov dword [ebp + ecx*4 - 0x458], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x458], 0
je 0x100200d8
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x100200d6
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp 0x100200e5
mov eax, dword [ebp - 0x254]
dec eax
mov dword [ebp - 0x254], eax
jmp 0x1002008a
mov dword [ebp - 0x1c], 0
jmp 0x100200f7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x1002013e
mov byte [ebp - 0x48], 0
movzx eax, byte [ebp - 0x48]
test eax, eax
je 0x10020122
push 1
push 0x263f
push 0x5b5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1002013c
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x100200f0
mov byte [0x1076b789], 1
mov dword [ebp - 0x668], 0x8261f9c2
mov byte [ebp - 0x4a], 0
movzx eax, byte [ebp - 0x4a]
test eax, eax
je 0x10020168
push 0x30c
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1002018a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x10657e70
mov dword [ebp - 0x304], eax
mov dword [ebp - 0x9c], 0xf89b546
mov dword [ebp - 0x188], 0xafd11d96
mov dword [ebp - 0x59c], 0xfffffffd
mov dword [ebp - 0x3d4], 5
mov dword [ebp - 0x26c], 0x69bd697e
mov dword [ebp - 0x25c], 0xd19c9214
mov dword [ebp - 0x3e4], 0x17a68fab
mov dword [ebp - 0xd8], 0
jmp 0x100201fd
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x10020219
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x4d8], 0x85f70ad6
jmp 0x100201f0
mov byte [ebp - 0x4c], 0
movzx eax, byte [ebp - 0x4c]
test eax, eax
je 0x1002023b
push 0
push 0
push 0x1ed9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 0x9c], 0
jmp 0x10020254
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jg 0x1002039a
mov dword [ebp - 0x130], 0xa77c8748
mov dword [ebp - 0x130], 8
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x188], eax
jg 0x100202a8
mov dword [ebp - 0x264], 1
jmp 0x100202af
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp + eax*4 - 0x4d8]
cmp eax, dword [ebp - 0x264]
jle 0x100202d0
mov dword [ebp - 0x274], 1
jmp 0x100202d7
and dword [ebp - 0x274], 0
mov dword [ebp - 0x3d4], 0xfffa
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4d8], 0x6a3f1540
jle 0x100202ff
mov dword [ebp - 0x3dc], 1
jmp 0x10020306
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x614], eax
imul eax, dword [ebp - 0x26c], 0x5a2e
mov ecx, dword [ebp - 0x9c]
cmp eax, dword [ebp + ecx*4 - 0x4d8]
jne 0x10020337
mov dword [ebp - 0x27c], 1
jmp 0x1002033e
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x27c]
jg 0x10020358
mov dword [ebp - 0x284], 1
jmp 0x1002035f
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x3e4]
add eax, dword [ebp - 0x284]
imul eax, eax, 0xfffffff8
cmp eax, dword [ebp - 0x130]
je 0x10020382
mov dword [ebp - 0x28c], 1
jmp 0x10020389
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x188], eax
jmp 0x10020247
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x138], 0xcadd6352
mov dword [ebp - 0x2b4], 0xeadd5d08
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x34], 0
jmp 0x100203cf
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x100203e5
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x6bc], 0x7f039d3c
jmp 0x100203c8
mov dword [ebp - 0x34], 0
jmp 0x100203f5
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x1002040b
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x67c], 0xbd6cd538
jmp 0x100203ee
cmp dword [ebp - 0x24], 0
jne 0x1002041d
mov dword [ebp - 0x3ec], 1
jmp 0x10020424
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x24], 0
jne 0x10020458
cmp dword [ebp - 0x24], 0xa0c8d467
jae 0x1002043f
mov dword [ebp - 0x294], 1
jmp 0x10020446
and dword [ebp - 0x294], 0
cmp dword [ebp - 0x294], 0xfffffff9
jne 0x10020458
and dword [ebp - 0x3f4], 0
jmp 0x10020462
mov dword [ebp - 0x3f4], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x138], 0
jne 0x10020483
cmp dword [ebp - 0x24], 0
jne 0x10020483
and dword [ebp - 0x29c], 0
jmp 0x1002048d
mov dword [ebp - 0x29c], 1
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x29c], eax
jle 0x100204a7
mov dword [ebp - 0x2a4], 1
jmp 0x100204ae
and dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 6
je 0x100204c3
mov dword [ebp - 0x2ac], 1
jmp 0x100204ca
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x2b4], eax
jg 0x100204f0
mov dword [ebp - 0x2bc], 1
jmp 0x100204f7
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x624], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x6bc], 0x40fff069
cmp dword [ebp - 0x24], 0x40fff069
jge 0x1002054a
mov dword [ebp - 0x2c4], 1
jmp 0x10020551
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2c4], eax
jle 0x10020568
mov dword [ebp - 0x2cc], 1
jmp 0x1002056f
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2cc], eax
jle 0x10020586
mov dword [ebp - 0x2d4], 1
jmp 0x1002058d
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
sub eax, dword [ebp - 0x138]
imul eax, dword [ebp - 0x24]
cmp eax, 1
ja 0x100205ae
mov dword [ebp - 0x2dc], 1
jmp 0x100205b5
and dword [ebp - 0x2dc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2dc]
imul ecx, dword [ebp + eax - 0x67c]
mov dword [ebp - 0x2e4], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp + eax - 0x67c], ecx
cmp dword [ebp - 0x2e4], 0
je 0x10020602
mov dword [ebp - 0x2ec], 0xbc712bad
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
jmp 0x10020619
mov dword [ebp - 0x2f4], 0xfffffffe
mov eax, dword [ebp - 0x2f4]
dec eax
mov dword [ebp - 0x2f4], eax
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x10657e70
mov dword [ebp - 0x1a0], eax
push 2
lea ecx, [ebp - 0x620]
call fcn.1000a859
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x148], 0xffffffff
mov dword [ebp - 0x140], 0
jmp 0x10020661
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 2
jge 0x10020680
push dword [ebp - 0x140]
lea ecx, [ebp - 0x620]
call fcn.1000a8c0
or dword [eax], 0xffffffff
jmp 0x10020654
mov dword [ebp - 0x148], 0
jmp 0x10020699
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jg 0x100206c1
mov byte [ebp - 0x84], 0
movzx eax, byte [ebp - 0x84]
test eax, eax
je 0x100206bf
push 0xcbf
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x1002068c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x620]
call fcn.1000a8bb
mov eax, dword [ebp - 0x304]
mov dword [0x10658080], eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x150], 0
jmp 0x100206fb
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x10020717
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x464], 0x56834504
jmp 0x100206ee
mov dword [ebp - 0x18], 0
jmp 0x10020727
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x1002077d
mov dword [ebp - 0x2fc], 0x2e8588d0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x464]
mov dword [ebp + ecx*4 - 0x464], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x464], 0
je 0x1002076e
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x1002076c
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp 0x1002077b
mov eax, dword [ebp - 0x2fc]
dec eax
mov dword [ebp - 0x2fc], eax
jmp 0x10020720
mov dword [ebp - 0x18], 0
jmp 0x1002078d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
je 0x100207ce
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x100207b8
push 1
push 0x263f
push 0x5b5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
mov byte [ebp - 0x50], 0
movzx eax, byte [ebp - 0x50]
test eax, eax
je 0x100207cc
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x10020786
mov eax, dword [ebp - 0x1a0]
mov dword [0x10658084], eax
mov dword [ebp - 0x5b4], 0x8261f9c2
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x100207fc
push 0x30c
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x1002081e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x1a0]
mov edx, dword [edx + eax]
mov eax, dword [ebp - 0x304]
mov ecx, dword [eax + ecx]
call fcn.1001dda6
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x158], 0xcadd6352
mov dword [ebp - 0x32c], 0xeadd5d08
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x38], 0
jmp 0x1002087c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x10020892
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x6cc], 0x7f039d3c
jmp 0x10020875
mov dword [ebp - 0x38], 0
jmp 0x100208a2
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x100208b8
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x68c], 0xbd6cd538
jmp 0x1002089b
cmp dword [ebp - 0x20], 0
jne 0x100208ca
mov dword [ebp - 0x3fc], 1
jmp 0x100208d1
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x20], 0
jne 0x10020905
cmp dword [ebp - 0x20], 0xa0c8d467
jae 0x100208ec
mov dword [ebp - 0x30c], 1
jmp 0x100208f3
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0xfffffff9
jne 0x10020905
and dword [ebp - 0x404], 0
jmp 0x1002090f
mov dword [ebp - 0x404], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x158], 0
jne 0x10020930
cmp dword [ebp - 0x20], 0
jne 0x10020930
and dword [ebp - 0x314], 0
jmp 0x1002093a
mov dword [ebp - 0x314], 1
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x314], eax
jle 0x10020954
mov dword [ebp - 0x31c], 1
jmp 0x1002095b
and dword [ebp - 0x31c], 0
cmp dword [ebp - 0x31c], 6
je 0x10020970
mov dword [ebp - 0x324], 1
jmp 0x10020977
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x32c], eax
jg 0x1002099d
mov dword [ebp - 0x334], 1
jmp 0x100209a4
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x51c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x6cc], 0x40fff069
cmp dword [ebp - 0x20], 0x40fff069
jge 0x100209f7
mov dword [ebp - 0x33c], 1
jmp 0x100209fe
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x33c], eax
jle 0x10020a15
mov dword [ebp - 0x344], 1
jmp 0x10020a1c
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x344], eax
jle 0x10020a33
mov dword [ebp - 0x34c], 1
jmp 0x10020a3a
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
sub eax, dword [ebp - 0x158]
imul eax, dword [ebp - 0x20]
cmp eax, 1
ja 0x10020a5b
mov dword [ebp - 0x354], 1
jmp 0x10020a62
and dword [ebp - 0x354], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x354]
imul ecx, dword [ebp + eax - 0x68c]
mov dword [ebp - 0x35c], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x35c]
mov dword [ebp + eax - 0x68c], ecx
cmp dword [ebp - 0x35c], 0
je 0x10020aaf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret