Function at 0x1004af82
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a7b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x9fc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 4
lea ecx, [ebp - 0x5a4]
call fcn.10010621
and dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0xd0]
call fcn.10010621
mov byte [ebp - 4], 1
mov dword [ebp - 0x3c], 0
jmp 0x1004afd9
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x1004aff5
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x5a4]
call fcn.100106bf
mov dword [eax], 0xfffffffa
jmp 0x1004afd2
mov dword [ebp - 0x3c], 0
jmp 0x1004b005
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1004b021
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xd0]
call fcn.100106bf
mov dword [eax], 0xa32b1cec
jmp 0x1004affe
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
and dword [eax], 0
jmp 0x1004b057
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4a8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
cmp dword [eax], 3
jg 0x1004b265
mov dword [ebp - 0x6dc], 0xfffffffb
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0x5a4]
call fcn.100106bf
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
cmp dword [eax], 0
jne 0x1004b107
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
imul esi, dword [eax], 0xffffffff
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0x5a4]
call fcn.100106bf
sub esi, dword [eax]
cmp esi, 0xfffffff9
jl 0x1004b0e0
mov dword [ebp - 0x554], 1
jmp 0x1004b0e7
and dword [ebp - 0x554], 0
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
mov ecx, dword [ebp - 0x554]
cmp ecx, dword [eax]
jl 0x1004b107
and dword [ebp - 0x55c], 0
jmp 0x1004b111
mov dword [ebp - 0x55c], 1
mov eax, dword [ebp - 0x55c]
add eax, 6
jne 0x1004b144
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0x5a4]
call fcn.100106bf
cmp dword [eax], 0
jne 0x1004b144
and dword [ebp - 0x4d4], 0
jmp 0x1004b14e
mov dword [ebp - 0x4d4], 1
cmp dword [ebp - 0x4d4], 0x6ec7
jl 0x1004b166
mov dword [ebp - 0x5d8], 1
jmp 0x1004b16d
and dword [ebp - 0x5d8], 0
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0x5a4]
call fcn.100106bf
mov esi, dword [eax]
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
mov eax, dword [eax]
lea eax, [esi + eax - 0xffff]
imul eax, eax, 0xfffffffe
mov dword [ebp - 0x230], eax
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0x5a4]
call fcn.100106bf
mov ecx, dword [ebp - 0x230]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
mov ecx, dword [ebp - 0x230]
cmp ecx, dword [eax]
jne 0x1004b1fa
mov dword [ebp - 0x4dc], 1
jmp 0x1004b201
and dword [ebp - 0x4dc], 0
push 0
lea ecx, [ebp - 0xd0]
call fcn.100106bf
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [eax]
jle 0x1004b224
mov dword [ebp - 0x238], 1
jmp 0x1004b22b
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x6dc], eax
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1004b260
push 0
push 0x1493
push 0xaf0
push 0xd86
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x1004b033
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xd0]
call fcn.100106a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5a4]
call fcn.100106a3
push 4
lea ecx, [ebp - 0x598]
call fcn.10010621
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0xc0]
call fcn.10010621
mov byte [ebp - 4], 3
mov dword [ebp - 0x64], 0
jmp 0x1004b2b8
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x1004b2d4
push dword [ebp - 0x64]
lea ecx, [ebp - 0x598]
call fcn.100106bf
mov dword [eax], 0xfffffffa
jmp 0x1004b2b1
mov dword [ebp - 0x64], 0
jmp 0x1004b2e4
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1004b300
push dword [ebp - 0x64]
lea ecx, [ebp - 0xc0]
call fcn.100106bf
mov dword [eax], 0xa32b1cec
jmp 0x1004b2dd
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
and dword [eax], 0
jmp 0x1004b336
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x4e4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4e4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
cmp dword [eax], 3
jg 0x1004b544
mov dword [ebp - 0x6ec], 0xfffffffb
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0x598]
call fcn.100106bf
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
cmp dword [eax], 0
jne 0x1004b3e6
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
imul esi, dword [eax], 0xffffffff
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0x598]
call fcn.100106bf
sub esi, dword [eax]
cmp esi, 0xfffffff9
jl 0x1004b3bf
mov dword [ebp - 0x240], 1
jmp 0x1004b3c6
and dword [ebp - 0x240], 0
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
mov ecx, dword [ebp - 0x240]
cmp ecx, dword [eax]
jl 0x1004b3e6
and dword [ebp - 0x4ec], 0
jmp 0x1004b3f0
mov dword [ebp - 0x4ec], 1
mov eax, dword [ebp - 0x4ec]
add eax, 6
jne 0x1004b423
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0x598]
call fcn.100106bf
cmp dword [eax], 0
jne 0x1004b423
and dword [ebp - 0x248], 0
jmp 0x1004b42d
mov dword [ebp - 0x248], 1
cmp dword [ebp - 0x248], 0x6ec7
jl 0x1004b445
mov dword [ebp - 0x6e4], 1
jmp 0x1004b44c
and dword [ebp - 0x6e4], 0
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0x598]
call fcn.100106bf
mov esi, dword [eax]
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
mov eax, dword [eax]
lea eax, [esi + eax - 0xffff]
imul eax, eax, 0xfffffffe
mov dword [ebp - 0x4f4], eax
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0x598]
call fcn.100106bf
mov ecx, dword [ebp - 0x4f4]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
mov ecx, dword [ebp - 0x4f4]
cmp ecx, dword [eax]
jne 0x1004b4d9
mov dword [ebp - 0x250], 1
jmp 0x1004b4e0
and dword [ebp - 0x250], 0
push 0
lea ecx, [ebp - 0xc0]
call fcn.100106bf
mov ecx, dword [ebp - 0x250]
cmp ecx, dword [eax]
jle 0x1004b503
mov dword [ebp - 0x4fc], 1
jmp 0x1004b50a
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x6ec], eax
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x1004b53f
push 0
push 0x1493
push 0xaf0
push 0xd86
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x1004b312
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc0]
call fcn.100106a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x598]
call fcn.100106a3
mov dword [ebp - 0x258], 0x150b
mov dword [ebp - 0x6f4], 0x1000bf10
cmp dword [ebp - 0x258], 0x1564
jle 0x1004b62e
and dword [ebp - 0xe0], 0
jmp 0x1004b59c
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x5a7a
jge 0x1004b62e
and dword [ebp - 0x19c], 0
jmp 0x1004b5c2
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0x3d99
jge 0x1004b629
and dword [ebp - 0xe8], 0
jmp 0x1004b5e4
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x5a6b
jge 0x1004b627
mov eax, dword [ebp - 0xe0]
sub eax, dword [ebp - 0x19c]
xor eax, dword [ebp - 0xe8]
cdq
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], edx
push dword [ebp - 0x64c]
push dword [ebp - 0x650]
mov ecx, 0x10613338
call fcn.1001050c
jmp 0x1004b5d7
jmp 0x1004b5b5
jmp 0x1004b58f
mov dword [ebp - 4], 4
cmp dword [ebp - 0x258], 0x11d9
jge 0x1004b651
mov edx, dword [ebp - 0x6f4]
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x1004b66d
or dword [ebp - 4], 0xffffffff
jmp 0x1004b677
mov dword [ebp - 0x858], 0xea7
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x1004b698
push 0x1f88
call dword [sym.imp.GDI32.dll_GetStockObject]
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x1004b6be
push 0
push 0
push 0x1b68
push 0x67e
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x504], 0x600f
mov dword [ebp - 0x6fc], 0x1000bf74
cmp dword [ebp - 0x504], 0x615a
jle 0x1004b791
and dword [ebp - 0x184], 0
jmp 0x1004b6ff
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x52ae
jge 0x1004b791
and dword [ebp - 0xf0], 0
jmp 0x1004b725
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x4198
jge 0x1004b78c
and dword [ebp - 0x1ac], 0
jmp 0x1004b747
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0x5955
jge 0x1004b78a
mov eax, dword [ebp - 0x184]
or eax, dword [ebp - 0xf0]
or eax, dword [ebp - 0x1ac]
cdq
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x658], edx
push dword [ebp - 0x658]
push dword [ebp - 0x65c]
mov ecx, 0x10613338
call fcn.1001050c
jmp 0x1004b73a
jmp 0x1004b718
jmp 0x1004b6f2
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 6
cmp dword [ebp - 0x504], 0x5c6d
jge 0x1004b7bb
mov edx, dword [ebp - 0x6fc]
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x1004b7d7
or dword [ebp - 4], 0xffffffff
jmp 0x1004b7e1
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x100], 6
mov dword [ebp - 0x2d8], 0x56eff52
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x428], 0
cmp dword [ebp - 0x14], 0
je 0x1004b863
mov eax, dword [ebp - 0x14]
neg eax
jne 0x1004b83f
cmp dword [ebp - 0x14], 0
je 0x1004b836
mov eax, 0x8fb0
test eax, eax
jne 0x1004b83f
and dword [ebp - 0x260], 0
jmp 0x1004b849
mov dword [ebp - 0x260], 1
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x260]
test eax, eax
je 0x1004b863
mov dword [ebp - 0x50c], 1
jmp 0x1004b86a
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x14]
jne 0x1004b88d
cmp dword [ebp - 0x14], 0
je 0x1004b88d
mov dword [ebp - 0x704], 1
jmp 0x1004b894
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x8d4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x8f0], eax
cmp dword [ebp - 0x20], 0
jne 0x1004b8ca
mov dword [ebp - 0x268], 1
jmp 0x1004b8d1
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x268], eax
jge 0x1004b8e8
mov dword [ebp - 0x514], 1
jmp 0x1004b8ef
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x514], eax
jg 0x1004b906
mov dword [ebp - 0x70c], 1
jmp 0x1004b90d
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jne 0x1004b940
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x1004b93b
push 0x2649
call dword [sym.imp.KERNEL32.dll_TlsFree]
jmp 0x1004bb2b
mov dword [ebp - 0xf8], 0xffff
mov dword [ebp - 0x1bc], 0x5296947a
mov dword [ebp - 0x544], 0xffffffff
mov dword [ebp - 0x71c], 0xda9fc5c2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
neg eax
jne 0x1004b987
cmp dword [ebp - 0xf8], 0
jne 0x1004b987
and dword [ebp - 0x52c], 0
jmp 0x1004b991
mov dword [ebp - 0x52c], 1
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jge 0x1004b9a9
mov dword [ebp - 0x270], 1
jmp 0x1004b9b0
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x20]
je 0x1004b9d9
cmp dword [ebp - 0x14], 0
je 0x1004b9d9
mov dword [ebp - 0x51c], 1
jmp 0x1004b9e0
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x51c], eax
jge 0x1004b9fa
mov dword [ebp - 0x278], 1
jmp 0x1004ba01
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x278]
cmp eax, 0x802d
jg 0x1004ba26
cmp dword [ebp - 0x1bc], 0
jne 0x1004ba26
and dword [ebp - 0x524], 0
jmp 0x1004ba30
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x524], eax
jne 0x1004ba47
mov dword [ebp - 0x280], 1
jmp 0x1004ba4e
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x280]
jge 0x1004ba65
mov dword [ebp - 0x288], 1
jmp 0x1004ba6c
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x52c]
cmp eax, dword [ebp - 0x288]
jl 0x1004ba86
mov dword [ebp - 0x53c], 1
jmp 0x1004ba8d
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 0x56218477
jge 0x1004baa5
mov dword [ebp - 0x290], 1
jmp 0x1004baac
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0xf8]
imul eax, dword [ebp - 0x290]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x544]
cmp eax, dword [ebp - 0x14]
jne 0x1004badc
cmp dword [ebp - 0x20], 0
je 0x1004badc
mov dword [ebp - 0x54c], 1
jmp 0x1004bae3
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
add eax, 4
cmp eax, 2
jl 0x1004bafd
mov dword [ebp - 0x2b4], 1
jmp 0x1004bb04
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2b4], eax
jne 0x1004bb1b
mov dword [ebp - 0x714], 1
jmp 0x1004bb22
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x14], 0x1863
jle 0x1004bb40
mov dword [ebp - 0x2c8], 1
jmp 0x1004bb47
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x24], 0x97010273
jne 0x1004bb5c
mov dword [ebp - 0x2a0], 1
jmp 0x1004bb63
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2a0], eax
jne 0x1004bb7a
mov dword [ebp - 0x400], 1
jmp 0x1004bb81
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x400], eax
jle 0x1004bb98
mov dword [ebp - 0x2a8], 1
jmp 0x1004bb9f
and dword [ebp - 0x2a8], 0
cmp dword [ebp - 0x2a8], 0x205a4aac
jge 0x1004bbb7
mov dword [ebp - 0x4b0], 1
jmp 0x1004bbbe
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x4b0], eax
jge 0x1004bbd5
mov dword [ebp - 0x2b0], 1
jmp 0x1004bbdc
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2b0], eax
jge 0x1004bbf3
mov dword [ebp - 0x408], 1
jmp 0x1004bbfa
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jle 0x1004bc1b
mov dword [ebp - 0x2b8], 1
jmp 0x1004bc22
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2b8], eax
je 0x1004bc39
mov dword [ebp - 0x508], 1
jmp 0x1004bc40
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0xffffffff
jbe 0x1004bc4d
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0x100]
jne 0x1004bc6c
or eax, 0xffffffff
je 0x1004bc6c
mov dword [ebp - 0x2c0], 1
jmp 0x1004bc73
and dword [ebp - 0x2c0], 0
mov dword [ebp - 0x20], 0x3e35
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x2c0]
je 0x1004bc91
mov dword [ebp - 0x410], 1
jmp 0x1004bc98
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0
jne 0x1004bcad
mov dword [ebp - 0x4b8], 1
jmp 0x1004bcb4
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x2c8]
add eax, dword [ebp - 0x4b8]
add eax, dword [ebp - 0x100]
jne 0x1004bcd4
mov dword [ebp - 0x2d0], 1
jmp 0x1004bcdb
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x2d0], eax
jg 0x1004bcf5
mov dword [ebp - 0x724], 1
jmp 0x1004bcfc
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jg 0x1004bd10
mov dword [ebp - 0x418], 1
jmp 0x1004bd17
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0xae93
jle 0x1004bd3b
mov dword [ebp - 0x550], 1
jmp 0x1004bd42
and dword [ebp - 0x550], 0
imul eax, dword [ebp - 0x550], 0x95d3
add eax, 0xf0b5
cmp eax, dword [ebp - 0x18c]
jne 0x1004bd65
mov dword [ebp - 0x2e0], 1
jmp 0x1004bd6c
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2e0], eax
je 0x1004bd83
mov dword [ebp - 0x420], 1
jmp 0x1004bd8a
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x420], eax
jge 0x1004bda4
mov dword [ebp - 0x2e8], 1
jmp 0x1004bdab
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x2e8], eax
jle 0x1004bdce
cmp dword [ebp - 0x18c], 0
je 0x1004bdce
mov dword [ebp - 0x4c0], 1
jmp 0x1004bdd5
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
sub eax, dword [ebp - 0x100]
je 0x1004bdef
mov dword [ebp - 0x2f0], 1
jmp 0x1004bdf6
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
je 0x1004be1f
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1004be1d
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
jmp 0x1004be43
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x1004be43
push 0x189f
push 0
push 0
push 0
push 0x1349
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x8d8], 0xea7
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1004be64
push 0x1f88
call dword [sym.imp.GDI32.dll_GetStockObject]
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1004be8a
push 0
push 0
push 0x1b68
push 0x67e
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x164], 6
mov dword [ebp - 0x370], 0x56eff52
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x18], 0
je 0x1004bf1a
mov eax, dword [ebp - 0x18]
neg eax
jne 0x1004bef6
cmp dword [ebp - 0x18], 0
je 0x1004beed
mov eax, 0x8fb0
test eax, eax
jne 0x1004bef6
and dword [ebp - 0x2f8], 0
jmp 0x1004bf00
mov dword [ebp - 0x2f8], 1
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x2f8]
test eax, eax
je 0x1004bf1a
mov dword [ebp - 0x510], 1
jmp 0x1004bf21
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jne 0x1004bf44
cmp dword [ebp - 0x18], 0
je 0x1004bf44
mov dword [ebp - 0x730], 1
jmp 0x1004bf4b
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x85c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x864], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x890], eax
cmp dword [ebp - 0x1c], 0
jne 0x1004bf81
mov dword [ebp - 0x300], 1
jmp 0x1004bf88
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x300], eax
jge 0x1004bf9f
mov dword [ebp - 0x430], 1
jmp 0x1004bfa6
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x430], eax
jg 0x1004bfbd
mov dword [ebp - 0x6a8], 1
jmp 0x1004bfc4
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jne 0x1004bffd
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1004bff8
push 0x2649
call dword [sym.imp.KERNEL32.dll_TlsFree]
jmp 0x1004c1e8
mov dword [ebp - 0xd4], 0xffff
mov dword [ebp - 0x1d0], 0x5296947a
mov dword [ebp - 0x4d0], 0xffffffff
mov dword [ebp - 0x5fc], 0xda9fc5c2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
neg eax
jne 0x1004c044
cmp dword [ebp - 0xd4], 0
jne 0x1004c044
and dword [ebp - 0x540], 0
jmp 0x1004c04e
mov dword [ebp - 0x540], 1
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jge 0x1004c066
mov dword [ebp - 0x308], 1
jmp 0x1004c06d
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x1c]
je 0x1004c096
cmp dword [ebp - 0x18], 0
je 0x1004c096
mov dword [ebp - 0x4c8], 1
jmp 0x1004c09d
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x4c8], eax
jge 0x1004c0b7
mov dword [ebp - 0x310], 1
jmp 0x1004c0be
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0xd4]
add eax, dword [ebp - 0x310]
cmp eax, 0x802d
jg 0x1004c0e3
cmp dword [ebp - 0x1d0], 0
jne 0x1004c0e3
and dword [ebp - 0x438], 0
jmp 0x1004c0ed
mov dword [ebp - 0x438], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x438], eax
jne 0x1004c104
mov dword [ebp - 0x318], 1
jmp 0x1004c10b
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x318]
jge 0x1004c122
mov dword [ebp - 0x320], 1
jmp 0x1004c129
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x540]
cmp eax, dword [ebp - 0x320]
jl 0x1004c143
mov dword [ebp - 0x440], 1
jmp 0x1004c14a
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0x56218477
jge 0x1004c162
mov dword [ebp - 0x328], 1
jmp 0x1004c169
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x328]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x18]
jne 0x1004c199
cmp dword [ebp - 0x1c], 0
je 0x1004c199
mov dword [ebp - 0x330], 1
jmp 0x1004c1a0
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x330]
add eax, 4
cmp eax, 2
jl 0x1004c1ba
mov dword [ebp - 0x448], 1
jmp 0x1004c1c1
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x448], eax
jne 0x1004c1d8
mov dword [ebp - 0x644], 1
jmp 0x1004c1df
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x18], 0x1863
jle 0x1004c1fd
mov dword [ebp - 0x360], 1
jmp 0x1004c204
and dword [ebp - 0x360], 0
cmp dword [ebp - 0x30], 0x97010273
jne 0x1004c219
mov dword [ebp - 0x338], 1
jmp 0x1004c220
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x338], eax
jne 0x1004c237
mov dword [ebp - 0x518], 1
jmp 0x1004c23e
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x518], eax
jle 0x1004c255
mov dword [ebp - 0x340], 1
jmp 0x1004c25c
and dword [ebp - 0x340], 0
cmp dword [ebp - 0x340], 0x205a4aac
jge 0x1004c274
mov dword [ebp - 0x450], 1
jmp 0x1004c27b
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x450], eax
jge 0x1004c292
mov dword [ebp - 0x348], 1
jmp 0x1004c299
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x348], eax
jge 0x1004c2b0
mov dword [ebp - 0x4d8], 1
jmp 0x1004c2b7
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jle 0x1004c2d8
mov dword [ebp - 0x350], 1
jmp 0x1004c2df
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x350], eax
je 0x1004c2f6
mov dword [ebp - 0x458], 1
jmp 0x1004c2fd
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 0xffffffff
jbe 0x1004c30a
cmp dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x164]
jne 0x1004c329
or eax, 0xffffffff
je 0x1004c329
mov dword [ebp - 0x358], 1
jmp 0x1004c330
and dword [ebp - 0x358], 0
mov dword [ebp - 0x1c], 0x3e35
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x358]
je 0x1004c34e
mov dword [ebp - 0x560], 1
jmp 0x1004c355
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 0
jne 0x1004c36a
mov dword [ebp - 0x460], 1
jmp 0x1004c371
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x360]
add eax, dword [ebp - 0x460]
add eax, dword [ebp - 0x164]
jne 0x1004c391
mov dword [ebp - 0x368], 1
jmp 0x1004c398
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x368], eax
jg 0x1004c3b2
mov dword [ebp - 0x5e8], 1
jmp 0x1004c3b9
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jg 0x1004c3cd
mov dword [ebp - 0x4e0], 1
jmp 0x1004c3d4
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0xae93
jle 0x1004c3f8
mov dword [ebp - 0x468], 1
jmp 0x1004c3ff
and dword [ebp - 0x468], 0
imul eax, dword [ebp - 0x468], 0x95d3
add eax, 0xf0b5
cmp eax, dword [ebp - 0x108]
jne 0x1004c422
mov dword [ebp - 0x378], 1
jmp 0x1004c429
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x378], eax
je 0x1004c440
mov dword [ebp - 0x520], 1
jmp 0x1004c447
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x520], eax
jge 0x1004c461
mov dword [ebp - 0x380], 1
jmp 0x1004c468
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x380], eax
jle 0x1004c48b
cmp dword [ebp - 0x108], 0
je 0x1004c48b
mov dword [ebp - 0x470], 1
jmp 0x1004c492
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x164]
je 0x1004c4ac
mov dword [ebp - 0x388], 1
jmp 0x1004c4b3
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0
je 0x1004c600
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1004c5fe
mov dword [ebp - 0x390], 0x158f
mov dword [ebp - 0x5f0], 0x1000bfc0
cmp dword [ebp - 0x390], 0x173a
jle 0x1004c5b3
and dword [ebp - 0x110], 0
jmp 0x1004c516
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x52a7
jge 0x1004c5a6
and dword [ebp - 0x168], 0
jmp 0x1004c53c
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x3c40
jge 0x1004c5a1
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x168]
sar eax, cl
cdq
mov dword [ebp - 0x668], eax
mov dword [ebp - 0x664], edx
push dword [ebp - 0x664]
push dword [ebp - 0x668]
lea ecx, [ebp - 0x994]
call fcn.1000da20
pop ecx
pop ecx
mov dword [ebp - 0x740], eax
mov ecx, dword [ebp - 0x740]
call fcn.100104ec
push eax
call fcn.100540b6
pop ecx
lea ecx, [ebp - 0x994]
call fcn.100104e2
jmp 0x1004c52f
jmp 0x1004c509
push 0x26be
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [ebp - 4], 8
cmp dword [ebp - 0x390], 0x1359
jge 0x1004c5d8
push dword [ebp - 0x5f0]
call fcn.100540b6
pop ecx
jmp 0x1004c5f4
or dword [ebp - 4], 0xffffffff
jmp 0x1004c5fe
jmp 0x1004c62a
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x1004c62a
push 0x189f
push 0
push 0
push 0
push 0x1349
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x3b0], 0x5609
mov dword [ebp - 0x738], 0x1000c020
cmp dword [ebp - 0x3b0], 0x58bc
jle 0x1004c732
and dword [ebp - 0x120], 0
jmp 0x1004c664
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x1197
jge 0x1004c732
and dword [ebp - 0x178], 0
jmp 0x1004c68a
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x7eae
jge 0x1004c72d
and dword [ebp - 0x118], 0
jmp 0x1004c6b0
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xc18
jge 0x1004c728
and dword [ebp - 0x170], 0
jmp 0x1004c6d2
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x1b3d
jge 0x1004c723
mov eax, dword [ebp - 0x118]
cdq
idiv dword [ebp - 0x170]
mov ecx, edx
mov eax, dword [ebp - 0x120]
cdq
idiv dword [ebp - 0x178]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], edx
push dword [ebp - 0x670]
push dword [ebp - 0x674]
mov ecx, 0x10613338
call fcn.1001050c
jmp 0x1004c6c5
jmp 0x1004c6a3
jmp 0x1004c67d
jmp 0x1004c657
mov dword [ebp - 0xb4], 0x64caf14c
mov dword [ebp - 0x7dc], 0x6a3735b2
mov dword [ebp - 0x7d8], 0x6a3735b2
mov dword [ebp - 0x7d4], 0x6a3735b2
mov dword [ebp - 0x7d0], 0x6a3735b2
lea ecx, [ebp - 0x21d]
call fcn.100106ce
push eax
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x7dc]
push eax
lea ecx, [ebp - 0x94c]
call fcn.100106d1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x56c]
call fcn.1001067d
mov dword [ebp - 4], 0xa
push 4
lea ecx, [ebp - 0x5d4]
call fcn.10010621
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x478], 0x2a4c
mov dword [ebp - 0x5f8], 0x1000c030
cmp dword [ebp - 0x478], 0x2cad
jle 0x1004c87f
and dword [ebp - 0x128], 0
jmp 0x1004c7f5
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x5d91
jge 0x1004c87f
and dword [ebp - 0x180], 0
jmp 0x1004c817
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x1019
jge 0x1004c87a
mov eax, dword [ebp - 0x128]
or eax, dword [ebp - 0x180]
cdq
mov dword [ebp - 0x680], eax
mov dword [ebp - 0x67c], edx
push dword [ebp - 0x67c]
push dword [ebp - 0x680]
lea ecx, [ebp - 0x9c4]
call fcn.1000da20
pop ecx
pop ecx
mov dword [ebp - 0x6b4], eax
mov ecx, dword [ebp - 0x6b4]
call fcn.100104ec
push eax
call fcn.100540b6
pop ecx
lea ecx, [ebp - 0x9c4]
call fcn.100104e2
jmp 0x1004c80a
jmp 0x1004c7e8
mov dword [ebp - 0x1e0], 0x2668451f
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x478], 0x2958
jge 0x1004c8a5
push dword [ebp - 0x5f8]
call fcn.100540b6
pop ecx
jmp 0x1004c8c1
mov dword [ebp - 4], 0xb
jmp 0x1004c8d1
mov dword [ebp - 0x6c0], 0xd1f0dfbc
mov dword [ebp - 0x608], 0xffffffff
mov dword [ebp - 0x130], 0
jmp 0x1004c8fe
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 4
jge 0x1004c920
push dword [ebp - 0x130]
lea ecx, [ebp - 0x5d4]
call fcn.100106bf
mov dword [eax], 2
jmp 0x1004c8f1
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0xb4]
jle 0x1004c946
mov dword [ebp - 0x3a0], 1
jmp 0x1004c94d
and dword [ebp - 0x3a0], 0
push 0
lea ecx, [ebp - 0x56c]
call fcn.100106bf
mov esi, eax
push 0
lea ecx, [ebp - 0x56c]
call fcn.100106bf
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x1004c97b
mov dword [ebp - 0x398], 1
jmp 0x1004c982
and dword [ebp - 0x398], 0
push 1
lea ecx, [ebp - 0x56c]
call fcn.100106bf
mov ecx, dword [ebp - 0x398]
cmp ecx, dword [eax]
je 0x1004c9a5
mov dword [ebp - 0x710], 1
jmp 0x1004c9ac
and dword [ebp - 0x710], 0
push 0
lea ecx, [ebp - 0x56c]
call fcn.100106bf
push 3
lea ecx, [ebp - 0x56c]
call fcn.100106bf
mov dword [ebp - 0x548], eax
push 0
lea ecx, [ebp - 0x56c]
call fcn.100106bf
mov ecx, dword [ebp - 0x548]
mov eax, dword [eax]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x5d4]
call fcn.100106bf
mov ecx, dword [ebp - 0x548]
mov ecx, dword [ecx]
cmp ecx, dword [eax]
jl 0x1004ca08
mov dword [ebp - 0x1d8], 1
jmp 0x1004ca0f
and dword [ebp - 0x1d8], 0
push 2
lea ecx, [ebp - 0x5d4]
call fcn.100106bf
mov ecx, dword [ebp - 0x1d8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x1d8], eax
jne 0x1004ca3e
mov dword [ebp - 0x600], 1
jmp 0x1004ca45
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x894], eax
push 0
lea ecx, [ebp - 0x56c]
call fcn.100106bf
mov eax, dword [eax]
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xa1cf
jl 0x1004ca8a
mov dword [ebp - 0x480], 1
jmp 0x1004ca91
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0xfff9
je 0x1004caa9
mov dword [ebp - 0x3a8], 1
jmp 0x1004cab0
and dword [ebp - 0x3a8], 0
imul eax, dword [ebp - 0x3a8], 0xffff
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x8e0], eax
push 2
lea ecx, [ebp - 0x5d4]
call fcn.100106bf
imul eax, dword [eax], 0x78ed
test eax, eax
je 0x1004cb04
cmp dword [ebp - 0x608], 0
je 0x1004cb04
mov dword [ebp - 0x4f0], 1
jmp 0x1004cb0b
and dword [ebp - 0x4f0], 0
push 1
lea ecx, [ebp - 0x5d4]
call fcn.100106bf
mov ecx, dword [ebp - 0x4f0]
mov dword [eax], ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x5d4]
call fcn.100106a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x56c]
call fcn.100106a3
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x3b0], 0x527e
jge 0x1004cb61
mov edx, dword [ebp - 0x738]
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x1004cb7d
or dword [ebp - 4], 0xffffffff
jmp 0x1004cb87
movzx eax, byte [0x106143cf]
test eax, eax
je 0x1004cba5
mov esi, 0x10612de4
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1004f67b
mov dword [ebp - 0x3d0], 0x9c6
mov dword [ebp - 0x72c], 0x1000c0f8
cmp dword [ebp - 0x3d0], 0xad7
jle 0x1004cc70
and dword [ebp - 0x188], 0
jmp 0x1004cbdf
mov dword [ebp - 0xac], 0x64caf14c
mov dword [ebp - 0x7c8], 0x6a3735b2
mov dword [ebp - 0x7c4], 0x6a3735b2
mov dword [ebp - 0x7c0], 0x6a3735b2
mov dword [ebp - 0x7bc], 0x6a3735b2
lea ecx, [ebp - 0x1c5]
call fcn.100106ce
push eax
lea eax, [ebp - 0x7b8]
push eax
lea eax, [ebp - 0x7c8]
push eax
lea ecx, [ebp - 0x944]
call fcn.100106d1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x538]
call fcn.1001067d
mov dword [ebp - 4], 0x10
push 4
lea ecx, [ebp - 0x5b0]
call fcn.10010621
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x208], 0x2668451f
mov dword [ebp - 0x488], 0x6e33
mov dword [ebp - 0x618], 0x1000c140
cmp dword [ebp - 0x488], 0x70cf
jle 0x1004cdcd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret