Function at 0x10009184
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082019
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x12c0
call fcn.1007ded0
push esi
push edi
mov dword [ebp - 0x1fc], 0xb3ae3556
mov dword [ebp - 0x204], 0xb818f8f6
mov dword [ebp - 0xa48], 0xfffffff8
mov dword [ebp - 0xa90], 0xa2fc53d
mov dword [ebp - 0xccc], 0x7054f86f
mov dword [ebp - 0xcc8], 0x7054f86f
mov dword [ebp - 0xcc4], 0x7054f86f
mov dword [ebp - 0xcc0], 0x7054f86f
lea ecx, [ebp - 0x37d]
call fcn.10008f43
push eax
lea eax, [ebp - 0xcbc]
push eax
lea eax, [ebp - 0xccc]
push eax
lea ecx, [ebp - 0x123c]
call fcn.10016fcb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xffc]
call fcn.10016f91
and dword [ebp - 4], 0
mov dword [ebp - 0x1fc], 0xfffffff1
jmp 0x1000924a
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0xe
je 0x1000963a
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x9ec], 0x1c17c774
mov dword [ebp - 0x274], 0
jmp 0x10009281
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jge 0x1000929d
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0x390], 0x73eb905d
jmp 0x10009274
mov dword [ebp - 0x64], 0
jmp 0x100092ad
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jg 0x10009555
push 1
lea ecx, [ebp - 0xa68]
call fcn.10016f4f
mov byte [ebp - 4], 1
mov dword [ebp - 0x9cc], 3
push 4
lea ecx, [ebp - 0xd54]
call fcn.10016f4f
mov byte [ebp - 4], 2
mov dword [ebp - 0xd8], 0
jmp 0x100092fc
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x1000931e
push dword [ebp - 0xd8]
lea ecx, [ebp - 0xa68]
call fcn.10016fbc
mov dword [eax], 0x6d2e8588
jmp 0x100092ef
mov dword [ebp - 0xd8], 0
jmp 0x10009337
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 4
jge 0x10009359
push dword [ebp - 0xd8]
lea ecx, [ebp - 0xd54]
call fcn.10016fbc
mov dword [eax], 0x3ae4c7ba
jmp 0x1000932a
mov byte [ebp - 0x130], 0
movzx eax, byte [ebp - 0x130]
test eax, eax
je 0x1000937d
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
lea ecx, [ebp - 0xa68]
call fcn.10016fbc
and dword [eax], 0
jmp 0x100093b3
push 0
lea ecx, [ebp - 0xa68]
call fcn.10016fbc
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x4e4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4e4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa68]
call fcn.10016fbc
cmp dword [eax], 1
jg 0x10009532
mov dword [ebp - 0x138], 0xe4562513
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x100093ef
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x138], 0
jmp 0x10009408
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 1
jg 0x1000952d
mov dword [ebp - 0x1ac], 0xffffffff
mov dword [ebp - 0x1ac], 0
jmp 0x10009438
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jg 0x10009470
mov dword [ebp - 0x9ec], 1
mov esi, dword [ebp - 0x1ac]
push 0
lea ecx, [ebp - 0xa68]
call fcn.10016fbc
mov eax, dword [eax]
mov ecx, dword [ebp + esi*4 - 0x390]
mov dword [ebp + eax*4 - 0x390], ecx
jmp 0x1000942b
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0x1190], eax
push 0
lea ecx, [ebp - 0xa68]
call fcn.10016fbc
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xfc8], eax
mov eax, dword [ebp - 0x138]
dec eax
cmp eax, dword [ebp - 0x138]
jg 0x100094ba
mov dword [ebp - 0x9bc], 1
jmp 0x100094c1
and dword [ebp - 0x9bc], 0
cmp dword [ebp - 0x9bc], 6
jge 0x100094d6
mov dword [ebp - 0x9c4], 1
jmp 0x100094dd
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0x9cc], eax
mov eax, dword [ebp - 0x9cc]
add eax, 0x27a2
mov ecx, dword [ebp - 0x64]
cmp dword [ebp + ecx*4 - 0x390], eax
jl 0x1000950c
mov dword [ebp - 0x9d4], 1
jmp 0x10009513
and dword [ebp - 0x9d4], 0
push 0
lea ecx, [ebp - 0xd54]
call fcn.10016fbc
mov ecx, dword [ebp - 0x9d4]
mov dword [eax], ecx
jmp 0x100093fb
jmp 0x1000938f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd54]
call fcn.10016fb7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa68]
call fcn.10016fb7
jmp 0x100092a6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x390]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1130], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x390]
cmp dword [ebp - 0xa48], eax
jl 0x10009592
mov dword [ebp - 0x9dc], 1
jmp 0x10009599
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0xa90]
cmp dword [ebp - 0x9dc], eax
jge 0x100095b3
mov dword [ebp - 0x9e4], 1
jmp 0x100095ba
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0x9ec], eax
cmp dword [ebp - 0x204], 0
jne 0x100095de
cmp dword [ebp - 0x64], 0
jne 0x100095de
and dword [ebp - 0xa5c], 0
jmp 0x100095e8
mov dword [ebp - 0xa5c], 1
mov eax, dword [ebp - 0xa5c]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
sub eax, 0x6e57c533
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xa48]
cmp dword [ebp - 0x64], eax
jl 0x10009619
mov dword [ebp - 0x490], 1
jmp 0x10009620
and dword [ebp - 0x490], 0
push 1
lea ecx, [ebp - 0xffc]
call fcn.10016fbc
mov ecx, dword [ebp - 0x490]
mov dword [eax], ecx
jmp 0x1000923d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xffc]
call fcn.10016fb7
mov dword [ebp - 0x44], 0x642c70bb
push 2
lea ecx, [ebp - 0xd90]
call fcn.10016f4f
mov dword [ebp - 4], 3
mov dword [ebp - 0xb4], 0
jmp 0x1000967d
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x10009699
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x9fc], 0xfffffff6
jmp 0x10009670
mov dword [ebp - 0xb4], 0
jmp 0x100096b2
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x100096d4
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xd90]
call fcn.10016fbc
mov dword [eax], 0xb14151c8
jmp 0x100096a5
mov dword [ebp - 0x44], 0
jmp 0x100096e4
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x100096fa
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x9fc], 0xffffffff
jmp 0x100096dd
mov dword [ebp - 0x44], 2
jmp 0x1000970a
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x100098af
mov dword [ebp - 0x6c], 0xffffffff
mov byte [ebp - 0x128], 0
movzx eax, byte [ebp - 0x128]
test eax, eax
je 0x10009737
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x6c], 2
jmp 0x10009747
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x100098aa
mov dword [ebp - 0xb0c], 0xfffffff9
mov eax, dword [ebp - 0x6c]
cmp dword [ebp + eax*4 - 0x9fc], 0
je 0x10009866
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0x9fc]
mov dword [ebp - 0xb0c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x9fc], 1
jg 0x10009797
mov dword [ebp - 0xb14], 1
jmp 0x1000979e
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xfd0], eax
mov eax, dword [ebp - 0x6c]
cmp dword [ebp + eax*4 - 0x9fc], 0
je 0x100097c6
cmp dword [ebp - 0x44], 0
je 0x100097c6
mov dword [ebp - 0x8fc], 1
jmp 0x100097cd
and dword [ebp - 0x8fc], 0
cmp dword [ebp - 0x8fc], 0xa0b59785
jbe 0x100097e9
push 8
pop eax
test eax, eax
jne 0x100097e9
and dword [ebp - 0x3e0], 0
jmp 0x100097f3
mov dword [ebp - 0x3e0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9fc]
cmp dword [ebp - 0x3e0], eax
jl 0x10009814
mov dword [ebp - 0x904], 1
jmp 0x1000981b
and dword [ebp - 0x904], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x6c]
imul ecx, dword [ebp - 0x904]
cmp dword [ebp + eax - 0x9fc], ecx
jge 0x1000983f
mov dword [ebp - 0x3e8], 1
jmp 0x10009846
and dword [ebp - 0x3e8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9fc]
cmp eax, dword [ebp - 0x3e8]
jle 0x10009866
mov dword [ebp - 0x90c], 1
jmp 0x1000986d
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
add eax, 6
cmp eax, 0xd0f0
je 0x10009889
mov dword [ebp - 0x3f0], 1
jmp 0x10009890
and dword [ebp - 0x3f0], 0
push 1
lea ecx, [ebp - 0xd90]
call fcn.10016fbc
mov ecx, dword [ebp - 0x3f0]
mov dword [eax], ecx
jmp 0x10009740
jmp 0x10009703
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd90]
call fcn.10016fb7
mov dword [ebp - 0xfc], 0x3ae35568
mov dword [ebp - 0x924], 0x43eb6069
mov dword [ebp - 0x35c], 0xffffffff
mov dword [ebp - 0xb2c], 0xd62a04f7
mov dword [ebp - 0x1228], 0xffffffff
mov dword [ebp - 0xfc], 0xe
jmp 0x10009909
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xfffffffb
jne 0x10009a75
mov dword [ebp - 0x2b0], 0xd3f7
mov dword [ebp - 0x400], 0xffffffff
mov dword [ebp - 0xb24], 0xffffffff
cmp dword [ebp - 0xfc], 0
je 0x1000997a
cmp dword [ebp - 0xfc], 1
je 0x10009952
mov dword [ebp - 0x914], 1
jmp 0x10009959
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
je 0x1000997a
mov dword [ebp - 0x3f8], 1
jmp 0x10009981
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 4
jb 0x10009996
mov dword [ebp - 0xb1c], 1
jmp 0x1000999d
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xfd8], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x1140], eax
cmp dword [ebp - 0x2b0], 0x8b01
jg 0x100099cd
mov dword [ebp - 0x91c], 1
jmp 0x100099d4
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0xb24]
cmp dword [ebp - 0x400], eax
jge 0x100099fa
mov dword [ebp - 0x408], 1
jmp 0x10009a01
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x924]
mov ecx, dword [ebp - 0x2b0]
sub ecx, dword [ebp - 0xfc]
add eax, ecx
cmp eax, dword [ebp - 0x408]
jle 0x10009a35
mov dword [ebp - 0x92c], 1
jmp 0x10009a3c
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x92c]
neg eax
jne 0x10009a52
mov dword [ebp - 0x410], 1
jmp 0x10009a59
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0xb2c], eax
cmp dword [ebp - 0x35c], 0
je 0x10009a70
jmp 0x10009a75
jmp 0x100098fc
mov dword [ebp - 0x2c], 0x7ca0029b
push 1
lea ecx, [ebp - 0x100c]
call fcn.10016f4f
mov dword [ebp - 4], 4
mov dword [ebp - 0xfe0], 0x12b57e8b
mov dword [ebp - 0x11d8], 0x4b5c
mov dword [ebp - 0xfe8], 0x12aa53f0
mov dword [ebp - 0x1150], 0x678e
mov dword [ebp - 0xe88], 0x574b
mov dword [ebp - 0xe8c], 0
mov dword [ebp - 0xe94], 3
mov dword [ebp - 0x20], 0
jmp 0x10009ae6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10009b02
push dword [ebp - 0x20]
lea ecx, [ebp - 0x100c]
call fcn.10016fbc
mov dword [eax], 0x99ac
jmp 0x10009adf
mov dword [ebp - 0x20], 0
jmp 0x10009b12
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10009b28
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12cc], 0x2edc7555
jmp 0x10009b0b
mov dword [ebp - 0x20], 0
jmp 0x10009b38
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10009b4e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1294], 2
jmp 0x10009b31
mov dword [ebp - 0x20], 0
jmp 0x10009b5e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10009b74
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc44], 0xeeb
jmp 0x10009b57
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc44]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc44], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x100c]
call fcn.10016fb7
mov dword [ebp - 0xe9c], 0xffffffff
mov dword [ebp - 0xe64], 0x7730f94f
mov dword [ebp - 0xe68], 0x9532bb11
mov dword [ebp - 0xecc], 0xffffffff
mov dword [ebp - 0xed4], 0xc23afc37
mov dword [ebp - 0xedc], 0xe3580d41
mov dword [ebp - 0xee4], 0xfffffff6
push 2
lea ecx, [ebp - 0x101c]
call fcn.10016f4f
mov dword [ebp - 4], 5
mov dword [ebp - 0x934], 0xfffffff9
mov dword [ebp - 0x20c], 0
jmp 0x10009c1b
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x10009c3d
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x101c]
call fcn.10016fbc
mov dword [eax], 0x8b5131d8
jmp 0x10009c0e
mov eax, dword [ebp - 0x934]
dec eax
mov dword [ebp - 0x934], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x101c]
call fcn.10016fb7
mov dword [ebp - 0x140], 0xe974a520
mov dword [ebp - 0x214], 0x8ade19d2
mov dword [ebp - 0x27c], 0
jmp 0x10009c86
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 3
jge 0x10009ca2
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x12ac], 0xfffffffe
jmp 0x10009c79
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x10009cc0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [ebp - 0x214], 0
jmp 0x10009cd9
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 2
jg 0x10009cfb
mov dword [ebp - 0x418], 0x34e6
mov eax, dword [ebp - 0x418]
dec eax
mov dword [ebp - 0x418], eax
jmp 0x10009ccc
mov dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xeec], eax
cmp dword [ebp - 0x2c], 0xa3888451
ja 0x10009d23
mov dword [ebp - 0x93c], 1
jmp 0x10009d2a
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x10009d51
cmp dword [ebp - 0x140], 0
jne 0x10009d51
and dword [ebp - 0x420], 0
jmp 0x10009d5b
mov dword [ebp - 0x420], 1
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x420]
jl 0x10009d72
mov dword [ebp - 0x944], 1
jmp 0x10009d79
and dword [ebp - 0x944], 0
mov eax, 0xd853
sub eax, dword [ebp - 0x944]
cmp eax, dword [ebp - 0x2c]
je 0x10009d95
mov dword [ebp - 0x428], 1
jmp 0x10009d9c
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x428], eax
jl 0x10009db3
mov dword [ebp - 0x94c], 1
jmp 0x10009dba
and dword [ebp - 0x94c], 0
cmp dword [ebp - 0x94c], 0x1b17
je 0x10009dd2
mov dword [ebp - 0x430], 1
jmp 0x10009dd9
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x430], eax
jne 0x10009df0
mov dword [ebp - 0x954], 1
jmp 0x10009df7
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x954], eax
jne 0x10009e0e
mov dword [ebp - 0x438], 1
jmp 0x10009e15
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x438]
je 0x10009e2d
xor eax, eax
jne 0x10009e2d
and dword [ebp - 0x95c], 0
jmp 0x10009e37
mov dword [ebp - 0x95c], 1
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x15c], 0xffffffff
mov dword [ebp - 0x48], 0x1d11
mov dword [ebp - 0x24], 0x89a278c0
mov dword [ebp - 0x74], 0x9f42c60e
push 2
lea ecx, [ebp - 0x2f8]
call fcn.10016f4f
mov dword [ebp - 4], 6
mov dword [ebp - 0xb34], 0xbc8b421d
mov dword [ebp - 0x31c], 0x5297f1ff
mov dword [ebp - 0x2b4], 0
jmp 0x10009ea3
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 2
jge 0x10009ec5
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0x2f8]
call fcn.10016fbc
mov dword [eax], 1
jmp 0x10009e96
cmp dword [ebp - 0x15c], 0
je 0x10009eda
mov dword [ebp - 0x96c], 1
jmp 0x10009ee1
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x15c], eax
jge 0x10009efb
mov dword [ebp - 0x440], 1
jmp 0x10009f02
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x440]
jge 0x10009f1c
mov dword [ebp - 0x964], 1
jmp 0x10009f23
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x964]
test eax, eax
jne 0x10009f40
cmp dword [ebp - 0x48], 0
jne 0x10009f40
and dword [ebp - 0x448], 0
jmp 0x10009f4a
mov dword [ebp - 0x448], 1
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x48]
neg eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x450], eax
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10016fbc
mov ecx, dword [ebp - 0x450]
mov dword [eax], ecx
mov eax, dword [ebp - 0x96c]
cmp eax, dword [ebp - 0x450]
jle 0x10009f96
mov dword [ebp - 0x974], 1
jmp 0x10009f9d
and dword [ebp - 0x974], 0
imul eax, dword [ebp - 0x974], 0xc12a
cmp eax, dword [ebp - 0x48]
jle 0x10009fb8
mov dword [ebp - 0x458], 1
jmp 0x10009fbf
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x458], eax
jg 0x10009fd6
mov dword [ebp - 0x97c], 1
jmp 0x10009fdd
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0xb34], eax
mov dword [ebp - 0x24], 1
jmp 0x10009ff9
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1000a69e
mov dword [ebp - 0x394], 0xffffffff
mov dword [ebp - 0xb3c], 0x1ae9c7d4
push 4
lea ecx, [ebp - 0xc0c]
call fcn.10016f4f
mov byte [ebp - 4], 7
mov dword [ebp - 0xef4], 0xffffffff
mov dword [ebp - 0x770], 0xfffd
push 1
lea ecx, [ebp - 0xbdc]
call fcn.10016f4f
mov byte [ebp - 4], 8
mov dword [ebp - 0xe8], 0
jmp 0x1000a066
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 4
jge 0x1000a088
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xc0c]
call fcn.10016fbc
mov dword [eax], 0xb1cc
jmp 0x1000a059
mov dword [ebp - 0xe8], 0
jmp 0x1000a0a1
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x1000a0c3
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xbdc]
call fcn.10016fbc
mov dword [eax], 8
jmp 0x1000a094
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2f8]
call fcn.10016fbc
cmp dword [eax], 0
je 0x1000a126
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2f8]
call fcn.10016fbc
cmp dword [eax], 0
jne 0x1000a105
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2f8]
call fcn.10016fbc
cmp dword [eax], 0
jne 0x1000a105
and dword [ebp - 0x460], 0
jmp 0x1000a10f
mov dword [ebp - 0x460], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x460], eax
jle 0x1000a126
mov dword [ebp - 0x314], 1
jmp 0x1000a12d
and dword [ebp - 0x314], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2f8]
call fcn.10016fbc
mov ecx, dword [ebp - 0x314]
mov dword [eax], ecx
mov eax, dword [ebp - 0x314]
add eax, 0xd857
imul eax, dword [ebp - 0x48]
test eax, eax
je 0x1000a534
mov dword [ebp - 0xd1c], 0xd49acb08
mov dword [ebp - 0xd18], 0xd49acb08
mov dword [ebp - 0xd14], 0xd49acb08
mov dword [ebp - 0xd10], 0xd49acb08
lea ecx, [ebp - 0x365]
call fcn.10008f43
push eax
lea eax, [ebp - 0xd0c]
push eax
lea eax, [ebp - 0xd1c]
push eax
lea ecx, [ebp - 0x1254]
call fcn.10016fcb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb94]
call fcn.10016f91
mov byte [ebp - 4], 9
mov dword [ebp - 0x224], 6
mov dword [ebp - 0xefc], 0xf3ae864e
mov dword [ebp - 0xf04], 0x7713999e
mov dword [ebp - 0xf0c], 0x42fb88b
mov dword [ebp - 0x74], 9
jmp 0x1000a1f3
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffec
jl 0x1000a513
mov dword [ebp - 0x284], 0xffffffff
mov dword [ebp - 0x2cc], 8
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10016fbc
mov ecx, dword [ebp - 0x284]
cmp dword [eax], ecx
jle 0x1000a234
mov dword [ebp - 0x21c], 1
jmp 0x1000a23b
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0x394], eax
je 0x1000a255
mov dword [ebp - 0x984], 1
jmp 0x1000a25c
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x984]
jne 0x1000a276
mov dword [ebp - 0x468], 1
jmp 0x1000a27d
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x468], eax
jge 0x1000a297
mov dword [ebp - 0x98c], 1
jmp 0x1000a29e
and dword [ebp - 0x98c], 0
cmp dword [ebp - 0x98c], 0x8160a871
jae 0x1000a2b6
mov dword [ebp - 0x470], 1
jmp 0x1000a2bd
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0x470], eax
jg 0x1000a2d7
mov dword [ebp - 0x994], 1
jmp 0x1000a2de
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0x994], eax
jge 0x1000a2f8
mov dword [ebp - 0x478], 1
jmp 0x1000a2ff
and dword [ebp - 0x478], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2f8]
call fcn.10016fbc
mov ecx, dword [ebp - 0x21c]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0xb94]
call fcn.10016fbc
mov ecx, dword [ebp - 0x21c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x21c]
sub eax, dword [ebp - 0x478]
je 0x1000a349
xor eax, eax
inc eax
je 0x1000a349
mov dword [ebp - 0x99c], 1
jmp 0x1000a350
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x99c]
jg 0x1000a36a
mov dword [ebp - 0x480], 1
jmp 0x1000a371
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x31c]
sub eax, dword [ebp - 0x284]
je 0x1000a39b
cmp dword [ebp - 0xb3c], 0
je 0x1000a399
jmp 0x1000a513
jmp 0x1000a3be
mov byte [ebp - 0x12c], 0
movzx eax, byte [ebp - 0x12c]
test eax, eax
je 0x1000a3be
push 0
push 0
push 0x1b99
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
cmp dword [ebp - 0x394], 0
je 0x1000a422
cmp dword [ebp - 0x48], 0
jne 0x1000a416
push 2
lea ecx, [ebp - 0xc0c]
call fcn.10016fbc
mov eax, 0x1ca0
test eax, eax
je 0x1000a401
push 1
lea ecx, [ebp - 0xb94]
call fcn.10016fbc
cmp dword [eax], 0
je 0x1000a401
mov dword [ebp - 0x9a4], 1
jmp 0x1000a408
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x9a4], eax
jg 0x1000a422
mov dword [ebp - 0x488], 1
jmp 0x1000a429
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
sub eax, 0xee151ae
cmp eax, dword [ebp - 0x2cc]
jg 0x1000a448
mov dword [ebp - 0x9ac], 1
jmp 0x1000a44f
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x9ac], eax
je 0x1000a469
mov dword [ebp - 0x9b4], 1
jmp 0x1000a470
and dword [ebp - 0x9b4], 0
push 3
lea ecx, [ebp - 0xb94]
call fcn.10016fbc
mov ecx, dword [ebp - 0x9b4]
imul ecx, dword [eax]
mov dword [ebp - 0x224], ecx
mov esi, dword [ebp - 0x224]
push 2
lea ecx, [ebp - 0xc0c]
call fcn.10016fbc
add esi, dword [eax]
push 1
lea ecx, [ebp - 0xb94]
call fcn.10016fbc
cmp esi, dword [eax]
jne 0x1000a4be
mov dword [ebp - 0x8d8], 1
jmp 0x1000a4c5
and dword [ebp - 0x8d8], 0
mov esi, dword [ebp - 0x2cc]
imul esi, dword [ebp - 0x48]
sub esi, dword [ebp - 0x8d8]
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10016fbc
cmp esi, dword [eax]
jge 0x1000a4f2
mov dword [ebp - 0x498], 1
jmp 0x1000a4f9
and dword [ebp - 0x498], 0
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10016fbc
mov ecx, dword [ebp - 0x498]
mov dword [eax], ecx
jmp 0x1000a1ec
mov eax, dword [ebp - 0x770]
inc eax
mov dword [ebp - 0x770], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb94]
call fcn.10016fb7
jmp 0x1000a67b
mov dword [ebp - 0x8e0], 0x1c0e03a8
mov dword [ebp - 0x4b8], 0x4566f38f
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x8e0], eax
jg 0x1000a55f
mov dword [ebp - 0x990], 1
jmp 0x1000a566
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x31c]
jne 0x1000a57d
mov dword [ebp - 0x4a0], 1
jmp 0x1000a584
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x15c]
add ecx, dword [ebp - 0x4a0]
add eax, ecx
cmp eax, 0x9f2e
jle 0x1000a5a8
mov dword [ebp - 0x4a8], 1
jmp 0x1000a5af
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x990]
cmp eax, dword [ebp - 0x4a8]
jne 0x1000a5c9
mov dword [ebp - 0x778], 1
jmp 0x1000a5d0
and dword [ebp - 0x778], 0
push 0
lea ecx, [ebp - 0xbdc]
call fcn.10016fbc
mov ecx, dword [ebp - 0x778]
cmp ecx, dword [eax]
je 0x1000a5f3
mov dword [ebp - 0x4b0], 1
jmp 0x1000a5fa
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0
jle 0x1000a60f
mov dword [ebp - 0xb44], 1
jmp 0x1000a616
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xf14], eax
mov eax, 0x63326eed
test eax, eax
je 0x1000a63d
cmp dword [ebp - 0x8e0], 0
je 0x1000a63d
mov dword [ebp - 0x364], 1
jmp 0x1000a644
and dword [ebp - 0x364], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2f8]
call fcn.10016fbc
mov ecx, dword [ebp - 0x364]
mov dword [eax], ecx
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x4b8], eax
mov esi, dword [ebp - 0x4b8]
push 0
lea ecx, [ebp - 0xbdc]
call fcn.10016fbc
mov dword [eax], esi
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xbdc]
call fcn.10016fb7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xc0c]
call fcn.10016fb7
jmp 0x10009ff2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f8]
call fcn.10016fb7
mov dword [ebp - 0x1e0], 0
jmp 0x1000a6c6
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0xffffffe8
jg 0x1000ad5a
mov dword [ebp - 0x2c], 0
jmp 0x1000a6e3
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1000ad55
mov dword [ebp - 0xb7c], 6
mov dword [ebp - 0x140], 0xb
jmp 0x1000a710
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x18
jne 0x1000ad50
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x7c], 0x6d64bda9
mov dword [ebp - 0x234], 0x40c88307
mov dword [ebp - 0xb6c], 0xffff
mov dword [ebp - 0xb74], 0xf73ecb6a
mov dword [ebp - 0xf1c], 0xfffffff9
mov dword [ebp - 0xf24], 0xfffffffe
push 4
lea ecx, [ebp - 0x103c]
call fcn.10016f4f
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x518], 0
mov dword [ebp - 0x22c], 0
jmp 0x1000a797
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 4
jge 0x1000a7b9
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x103c]
call fcn.10016fbc
mov dword [eax], 0x330c202e
jmp 0x1000a78a
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], eax
jge 0x1000a994
mov dword [ebp - 0x168], 0x664d
mov dword [ebp - 0xa40], 1
mov dword [ebp - 0xb4c], 0xc78ef8a6
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x1000a812
push 0x1367
push 0
push 0x1d62
push 0x1512
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [ebp - 0xbc], 0
jne 0x1000a894
cmp dword [ebp - 0xbc], 0
jne 0x1000a82d
cmp dword [ebp - 0xbc], 0
je 0x1000a842
mov eax, 0x493e
test eax, eax
je 0x1000a842
mov dword [ebp - 0x780], 1
jmp 0x1000a849
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x780], eax
jle 0x1000a863
mov dword [ebp - 0x4c0], 1
jmp 0x1000a86a
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
neg eax
neg eax
sub eax, dword [ebp - 0x168]
sub eax, 0xffff
mov dword [ebp - 0xa40], eax
jne 0x1000a894
xor eax, eax
jne 0x1000a894
and dword [ebp - 0x4c8], 0
jmp 0x1000a89e
mov dword [ebp - 0x4c8], 1
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x4c8]
lea eax, [ecx + eax + 0x30c4e2bf]
cmp eax, 0xf5e3
je 0x1000a8c4
mov dword [ebp - 0x788], 1
jmp 0x1000a8cb
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x788], eax
jl 0x1000a8e5
mov dword [ebp - 0x4d0], 1
jmp 0x1000a8ec
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x4d0], eax
jne 0x1000a906
mov dword [ebp - 0x8e8], 1
jmp 0x1000a90d
and dword [ebp - 0x8e8], 0
cmp dword [ebp - 0x8e8], 0xee1c9741
jne 0x1000a925
mov dword [ebp - 0x4d8], 1
jmp 0x1000a92c
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0xbc]
cmp eax, 0xffffffff
jne 0x1000a94f
mov dword [ebp - 0x790], 1
jmp 0x1000a956
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x168]
add eax, dword [ebp - 0x790]
sub eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x168]
je 0x1000a97c
mov dword [ebp - 0x4e0], 1
jmp 0x1000a983
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0xb4c], eax
jmp 0x1000ad25
push 2
lea ecx, [ebp - 0xa0c]
call fcn.10016f4f
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x28c], 0
jmp 0x1000a9be
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 2
jge 0x1000a9e0
push dword [ebp - 0x28c]
lea ecx, [ebp - 0xa0c]
call fcn.10016fbc
mov dword [eax], 0xe8aff65c
jmp 0x1000a9b1
mov dword [ebp - 0x7c], 0xffffffec
jmp 0x1000a9f0
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x17
jge 0x1000ad16
mov dword [ebp - 0x324], 0x16e0
mov dword [ebp - 0x388], 0xfffffff8
mov dword [ebp - 0xb5c], 1
mov dword [ebp - 0xca4], 0xfdcb
mov dword [ebp - 0xca0], 0xfdcb
mov dword [ebp - 0xc9c], 0xfdcb
mov dword [ebp - 0xc98], 0xfdcb
lea ecx, [ebp - 0x36d]
call fcn.10008f43
push eax
lea eax, [ebp - 0xc94]
push eax
lea eax, [ebp - 0xca4]
push eax
lea ecx, [ebp - 0x1244]
call fcn.10016fcb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x102c]
call fcn.10016f91
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x1000ab70
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x388], eax
jl 0x1000aaa9
mov dword [ebp - 0x998], 1
jmp 0x1000aab0
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x998]
inc eax
imul eax, eax, 0x31a2
test eax, eax
jne 0x1000aacf
xor eax, eax
inc eax
jne 0x1000aacf
and dword [ebp - 0x4e8], 0
jmp 0x1000aad9
mov dword [ebp - 0x4e8], 1
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x4e8], eax
je 0x1000aaf3
mov dword [ebp - 0xb54], 1
jmp 0x1000aafa
and dword [ebp - 0xb54], 0
push 1
lea ecx, [ebp - 0xa0c]
call fcn.10016fbc
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xf2c], eax
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0x234], eax
jne 0x1000ab33
cmp dword [ebp - 0xb5c], 0
je 0x1000ab33
mov dword [ebp - 0xb64], 1
jmp 0x1000ab3a
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xf34], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0xf3c], eax
push 1
lea ecx, [ebp - 0xa0c]
call fcn.10016fbc
cmp dword [eax], 0
je 0x1000ab70
mov dword [ebp - 0x798], 1
jmp 0x1000ab77
and dword [ebp - 0x798], 0
push 1
lea ecx, [ebp - 0xa0c]
call fcn.10016fbc
mov ecx, dword [ebp - 0x798]
cmp ecx, dword [eax]
jl 0x1000ab9a
mov dword [ebp - 0x4f0], 1
jmp 0x1000aba1
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0xb6c]
cmp dword [ebp - 0x4f0], eax
jne 0x1000abbb
mov dword [ebp - 0x8f0], 1
jmp 0x1000abc2
and dword [ebp - 0x8f0], 0
push 0
lea ecx, [ebp - 0xa0c]
call fcn.10016fbc
mov eax, dword [eax]
mov ecx, dword [ebp - 0x8f0]
lea eax, [ecx + eax - 0xffff]
test eax, eax
jne 0x1000abfd
push 0
lea ecx, [ebp - 0xa0c]
call fcn.10016fbc
cmp dword [eax], 0
jne 0x1000abfd
and dword [ebp - 0x4f8], 0
jmp 0x1000ac07
mov dword [ebp - 0x4f8], 1
cmp dword [ebp - 0x4f8], 0x2102
jge 0x1000ac1f
mov dword [ebp - 0x7a0], 1
jmp 0x1000ac26
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x7a0], eax
jle 0x1000ac3d
mov dword [ebp - 0x500], 1
jmp 0x1000ac44
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 5
je 0x1000ac59
mov dword [ebp - 0x9f0], 1
jmp 0x1000ac60
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x324]
cmp eax, dword [ebp - 0x9f0]
je 0x1000ac7a
mov dword [ebp - 0x508], 1
jmp 0x1000ac81
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x508], eax
je 0x1000ac9b
mov dword [ebp - 0x7a8], 1
jmp 0x1000aca2
and dword [ebp - 0x7a8], 0
push 1
lea ecx, [ebp - 0xa0c]
call fcn.10016fbc
mov ecx, dword [ebp - 0x7a8]
cmp ecx, dword [eax]
je 0x1000acc5
mov dword [ebp - 0x510], 1
jmp 0x1000accc
and dword [ebp - 0x510], 0
push 0
lea ecx, [ebp - 0x102c]
call fcn.10016fbc
mov ecx, dword [ebp - 0x510]
cmp ecx, dword [eax]
jle 0x1000acef
mov dword [ebp - 0x8f8], 1
jmp 0x1000acf6
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0xb74], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x102c]
call fcn.10016fb7
jmp 0x1000a9e9
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa0c]
call fcn.10016fb7
mov eax, dword [ebp - 0x518]
dec eax
mov dword [ebp - 0x518], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x103c]
call fcn.10016fb7
mov dword [ebp - 0xb7c], 0xffffffff
jmp 0x1000a703
jmp 0x1000a6dc
jmp 0x1000a6b9
mov dword [ebp - 0x2bc], 8
mov dword [ebp - 0x2bc], 0
jmp 0x1000ad7d
mov eax, dword [ebp - 0x2bc]
dec eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0xffffffe2
je 0x1000ae83
push 4
lea ecx, [ebp - 0xa8c]
call fcn.10016f4f
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xcc], 0
jmp 0x1000adb7
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x1000add3
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0xe74], 0xde0b4074
jmp 0x1000adaa
mov dword [ebp - 0xcc], 0
jmp 0x1000adec
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 4
jge 0x1000ae0b
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xa8c]
call fcn.10016fbc
and dword [eax], 0
jmp 0x1000addf
push 1
lea ecx, [ebp - 0xa8c]
call fcn.10016fbc
and dword [eax], 0
jmp 0x1000ae41
push 1
lea ecx, [ebp - 0xa8c]
call fcn.10016fbc
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x7b0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7b0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xa8c]
call fcn.10016fbc
cmp dword [eax], 2
jge 0x1000ae6f
push 1
lea ecx, [ebp - 0xa8c]
call fcn.10016fbc
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0xe74], 0
jmp 0x1000ae1d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8c]
call fcn.10016fb7
jmp 0x1000ad70
mov dword [ebp - 0x23c], 0xb3ae3556
mov dword [ebp - 0x244], 0xb818f8f6
mov dword [ebp - 0xa4c], 0xfffffff8
mov dword [ebp - 0xb84], 0xa2fc53d
mov dword [ebp - 0xcb8], 0x7054f86f
mov dword [ebp - 0xcb4], 0x7054f86f
mov dword [ebp - 0xcb0], 0x7054f86f
mov dword [ebp - 0xcac], 0x7054f86f
lea ecx, [ebp - 0x35d]
call fcn.10008f43
push eax
lea eax, [ebp - 0xca8]
push eax
lea eax, [ebp - 0xcb8]
push eax
lea ecx, [ebp - 0x124c]
call fcn.10016fcb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x104c]
call fcn.10016f91
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x23c], 0xfffffff1
jmp 0x1000af28
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xe
je 0x1000b336
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0x7c0], 0x1c17c774
mov dword [ebp - 0x294], 0
jmp 0x1000af62
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 2
jge 0x1000af7e
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0x39c], 0x73eb905d
jmp 0x1000af55
mov dword [ebp - 0xc4], 0
jmp 0x1000af97
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jg 0x1000b245
push 1
lea ecx, [ebp - 0xa74]
call fcn.10016f4f
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x7b8], 3
push 4
lea ecx, [ebp - 0xdf0]
call fcn.10016f4f
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x84], 0
jmp 0x1000afe9
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1000b00b
push dword [ebp - 0x84]
lea ecx, [ebp - 0xa74]
call fcn.10016fbc
mov dword [eax], 0x6d2e8588
jmp 0x1000afdc
mov dword [ebp - 0x84], 0
jmp 0x1000b024
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1000b046
push dword [ebp - 0x84]
lea ecx, [ebp - 0xdf0]
call fcn.10016fbc
mov dword [eax], 0x3ae4c7ba
jmp 0x1000b017
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x1000b06a
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
lea ecx, [ebp - 0xa74]
call fcn.10016fbc
and dword [eax], 0
jmp 0x1000b0a0
push 0
lea ecx, [ebp - 0xa74]
call fcn.10016fbc
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x520]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa74]
call fcn.10016fbc
cmp dword [eax], 1
jg 0x1000b222
mov dword [ebp - 0x148], 0xe4562513
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x1000b0dc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x148], 0
jmp 0x1000b0f5
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jg 0x1000b21d
mov dword [ebp - 0x1e8], 0xffffffff
mov dword [ebp - 0x1e8], 0
jmp 0x1000b125
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jg 0x1000b15d
mov dword [ebp - 0x7c0], 1
mov esi, dword [ebp - 0x1e8]
push 0
lea ecx, [ebp - 0xa74]
call fcn.10016fbc
mov eax, dword [eax]
mov ecx, dword [ebp + esi*4 - 0x39c]
mov dword [ebp + eax*4 - 0x39c], ecx
jmp 0x1000b118
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp + eax*4 - 0x39c]
mov dword [ebp - 0xf44], eax
push 0
lea ecx, [ebp - 0xa74]
call fcn.10016fbc
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x39c]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0x148]
dec eax
cmp eax, dword [ebp - 0x148]
jg 0x1000b1a7
mov dword [ebp - 0x9a0], 1
jmp 0x1000b1ae
and dword [ebp - 0x9a0], 0
cmp dword [ebp - 0x9a0], 6
jge 0x1000b1c3
mov dword [ebp - 0x528], 1
jmp 0x1000b1ca
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x7b8]
add eax, 0x27a2
mov ecx, dword [ebp - 0xc4]
cmp dword [ebp + ecx*4 - 0x39c], eax
jl 0x1000b1fc
mov dword [ebp - 0x530], 1
jmp 0x1000b203
and dword [ebp - 0x530], 0
push 0
lea ecx, [ebp - 0xdf0]
call fcn.10016fbc
mov ecx, dword [ebp - 0x530]
mov dword [eax], ecx
jmp 0x1000b0e8
jmp 0x1000b07c
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xdf0]
call fcn.10016fb7
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xa74]
call fcn.10016fb7
jmp 0x1000af8a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x39c]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xf54], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x39c]
cmp dword [ebp - 0xa4c], eax
jl 0x1000b285
mov dword [ebp - 0x900], 1
jmp 0x1000b28c
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0xb84]
cmp dword [ebp - 0x900], eax
jge 0x1000b2a6
mov dword [ebp - 0x538], 1
jmp 0x1000b2ad
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x7c0], eax
cmp dword [ebp - 0x244], 0
jne 0x1000b2d4
cmp dword [ebp - 0xc4], 0
jne 0x1000b2d4
and dword [ebp - 0x540], 0
jmp 0x1000b2de
mov dword [ebp - 0x540], 1
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
sub eax, 0x6e57c533
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xa4c]
cmp dword [ebp - 0xc4], eax
jl 0x1000b315
mov dword [ebp - 0x548], 1
jmp 0x1000b31c
and dword [ebp - 0x548], 0
push 1
lea ecx, [ebp - 0x104c]
call fcn.10016fbc
mov ecx, dword [ebp - 0x548]
mov dword [eax], ecx
jmp 0x1000af1b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x104c]
call fcn.10016fb7
mov dword [ebp - 0x36c], 0xfffffffc
mov dword [ebp - 0xf4], 0x3ae35568
mov dword [ebp - 0x7d0], 0x43eb6069
mov dword [ebp - 0x32c], 0xffffffff
mov dword [ebp - 0xa98], 0xd62a04f7
mov dword [ebp - 0xf5c], 0xffffffff
mov dword [ebp - 0xf4], 0xe
jmp 0x1000b39a
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xfffffffb
jne 0x1000b506
mov dword [ebp - 0x2dc], 0xd3f7
mov dword [ebp - 0x558], 0xffffffff
mov dword [ebp - 0xbcc], 0xffffffff
cmp dword [ebp - 0xf4], 0
je 0x1000b40b
cmp dword [ebp - 0xf4], 1
je 0x1000b3e3
mov dword [ebp - 0x7c8], 1
jmp 0x1000b3ea
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x1000b40b
mov dword [ebp - 0x550], 1
jmp 0x1000b412
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 4
jb 0x1000b427
mov dword [ebp - 0xbd0], 1
jmp 0x1000b42e
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf64], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0xf6c], eax
cmp dword [ebp - 0x2dc], 0x8b01
jg 0x1000b45e
mov dword [ebp - 0x908], 1
jmp 0x1000b465
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0xbcc]
cmp dword [ebp - 0x558], eax
jge 0x1000b48b
mov dword [ebp - 0x560], 1
jmp 0x1000b492
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0x7d0]
mov ecx, dword [ebp - 0x2dc]
sub ecx, dword [ebp - 0xf4]
add eax, ecx
cmp eax, dword [ebp - 0x560]
jle 0x1000b4c6
mov dword [ebp - 0x9a8], 1
jmp 0x1000b4cd
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x9a8]
neg eax
jne 0x1000b4e3
mov dword [ebp - 0x568], 1
jmp 0x1000b4ea
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0xa98], eax
cmp dword [ebp - 0x32c], 0
je 0x1000b501
jmp 0x1000b506
jmp 0x1000b38d
push 1
lea ecx, [ebp - 0x105c]
call fcn.10016f4f
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xf74], 0x12b57e8b
mov dword [ebp - 0xf7c], 0x4b5c
mov dword [ebp - 0xf84], 0x12aa53f0
mov dword [ebp - 0xf8c], 0x678e
mov dword [ebp - 0xf94], 0x574b
mov dword [ebp - 0xf9c], 0
mov dword [ebp - 0xfa4], 3
mov dword [ebp - 0x1c], 0
jmp 0x1000b570
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000b58c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x105c]
call fcn.10016fbc
mov dword [eax], 0x99ac
jmp 0x1000b569
mov dword [ebp - 0x1c], 0
jmp 0x1000b59c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1000b5b2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x12bc], 0x2edc7555
jmp 0x1000b595
mov dword [ebp - 0x1c], 0
jmp 0x1000b5c2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1000b5d8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1288], 2
jmp 0x1000b5bb
mov dword [ebp - 0x1c], 0
jmp 0x1000b5e8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000b5fe
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc2c], 0xeeb
jmp 0x1000b5e1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc2c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc2c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x105c]
call fcn.10016fb7
mov dword [ebp - 0x24c], 0
jmp 0x1000b641
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x1000b65d
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x198], 1
jmp 0x1000b634
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x198], 0
jne 0x1000b7f7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
mov dword [ebp - 0xfac], eax
mov dword [ebp - 0x36c], 0x83cc47d1
cmp dword [ebp - 0x36c], 0
je 0x1000b6ac
mov eax, 0xc829ed89
test eax, eax
je 0x1000b6ac
mov dword [ebp - 0x7d8], 1
jmp 0x1000b6b3
and dword [ebp - 0x7d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp dword [ebp - 0x7d8], eax
jge 0x1000b6d4
mov dword [ebp - 0x570], 1
jmp 0x1000b6db
and dword [ebp - 0x570], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp dword [ebp - 0x570], eax
je 0x1000b6fc
mov dword [ebp - 0x910], 1
jmp 0x1000b703
and dword [ebp - 0x910], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp dword [ebp - 0x910], eax
jle 0x1000b724
mov dword [ebp - 0xb04], 1
jmp 0x1000b72b
and dword [ebp - 0xb04], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
mov dword [ebp - 0xfb4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x198], 0
je 0x1000b763
cmp dword [ebp - 0x36c], 0
je 0x1000b763
mov dword [ebp - 0x578], 1
jmp 0x1000b76a
and dword [ebp - 0x578], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp dword [ebp - 0x578], eax
je 0x1000b78b
mov dword [ebp - 0x7e0], 1
jmp 0x1000b792
and dword [ebp - 0x7e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp eax, dword [ebp - 0x7e0]
jne 0x1000b7b3
mov dword [ebp - 0x580], 1
jmp 0x1000b7ba
and dword [ebp - 0x580], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp dword [ebp - 0x580], eax
jl 0x1000b7db
mov dword [ebp - 0xa00], 1
jmp 0x1000b7e2
and dword [ebp - 0xa00], 0
cmp dword [ebp - 0xa00], 0xfffd
je 0x1000b7f7
and dword [ebp - 0x588], 0
jmp 0x1000b801
mov dword [ebp - 0x588], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp eax, dword [ebp - 0x588]
je 0x1000b822
mov dword [ebp - 0x7e8], 1
jmp 0x1000b829
and dword [ebp - 0x7e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp dword [ebp - 0x7e8], eax
jle 0x1000b878
mov dword [ebp - 0x590], 0x26fb
mov byte [ebp - 0x132], 0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x1000b869
push 0x1551
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
jmp 0x1000b899
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x1000b899
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [ebp - 0x34], 0x7ca0029b
mov dword [ebp - 0x150], 0xe974a520
mov dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xfbc], eax
cmp dword [ebp - 0x34], 0xa3888451
ja 0x1000b8d2
mov dword [ebp - 0x918], 1
jmp 0x1000b8d9
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jne 0x1000b900
cmp dword [ebp - 0x150], 0
jne 0x1000b900
and dword [ebp - 0x598], 0
jmp 0x1000b90a
mov dword [ebp - 0x598], 1
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x598]
jl 0x1000b921
mov dword [ebp - 0x7f0], 1
jmp 0x1000b928
and dword [ebp - 0x7f0], 0
mov eax, 0xd853
sub eax, dword [ebp - 0x7f0]
cmp eax, dword [ebp - 0x34]
je 0x1000b944
mov dword [ebp - 0x5a0], 1
jmp 0x1000b94b
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x5a0], eax
jl 0x1000b962
mov dword [ebp - 0x9b0], 1
jmp 0x1000b969
and dword [ebp - 0x9b0], 0
cmp dword [ebp - 0x9b0], 0x1b17
je 0x1000b981
mov dword [ebp - 0x5a8], 1
jmp 0x1000b988
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x5a8], eax
jne 0x1000b99f
mov dword [ebp - 0x7f8], 1
jmp 0x1000b9a6
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x7f8], eax
jne 0x1000b9bd
mov dword [ebp - 0x5b0], 1
jmp 0x1000b9c4
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x5b0]
je 0x1000b9dc
xor eax, eax
jne 0x1000b9dc
and dword [ebp - 0x920], 0
jmp 0x1000b9e6
mov dword [ebp - 0x920], 1
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a4], 0
jmp 0x1000ba0b
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0xffffffe8
jg 0x1000ba66
mov dword [ebp - 0x34], 0
jmp 0x1000ba24
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1000ba64
mov dword [ebp - 0xbb0], 6
mov dword [ebp - 0x150], 0xb
jmp 0x1000ba4d
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x18
jne 0x1000ba62
mov dword [ebp - 0xbb0], 0xffffffff
jmp 0x1000ba40
jmp 0x1000ba1d
jmp 0x1000b9fe
mov dword [ebp - 0x28], 0x7ca0029b
mov dword [ebp - 0x158], 0xe974a520
mov dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xfc4], eax
cmp dword [ebp - 0x28], 0xa3888451
ja 0x1000ba9f
mov dword [ebp - 0x5b8], 1
jmp 0x1000baa6
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jne 0x1000bacd
cmp dword [ebp - 0x158], 0
jne 0x1000bacd
and dword [ebp - 0x800], 0
jmp 0x1000bad7
mov dword [ebp - 0x800], 1
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x800]
jl 0x1000baee
mov dword [ebp - 0x5c0], 1
jmp 0x1000baf5
and dword [ebp - 0x5c0], 0
mov eax, 0xd853
sub eax, dword [ebp - 0x5c0]
cmp eax, dword [ebp - 0x28]
je 0x1000bb11
mov dword [ebp - 0xa54], 1
jmp 0x1000bb18
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xa54], eax
jl 0x1000bb2f
mov dword [ebp - 0x5c8], 1
jmp 0x1000bb36
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0x1b17
je 0x1000bb4e
mov dword [ebp - 0x808], 1
jmp 0x1000bb55
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x808], eax
jne 0x1000bb6c
mov dword [ebp - 0x5d0], 1
jmp 0x1000bb73
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x5d0], eax
jne 0x1000bb8a
mov dword [ebp - 0x928], 1
jmp 0x1000bb91
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x928]
je 0x1000bba9
xor eax, eax
jne 0x1000bba9
and dword [ebp - 0x5d8], 0
jmp 0x1000bbb3
mov dword [ebp - 0x5d8], 1
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1e4], 0
jmp 0x1000bbd8
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xffffffe8
jg 0x1000bc33
mov dword [ebp - 0x28], 0
jmp 0x1000bbf1
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000bc31
mov dword [ebp - 0xaa0], 6
mov dword [ebp - 0x158], 0xb
jmp 0x1000bc1a
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x18
jne 0x1000bc2f
mov dword [ebp - 0xaa0], 0xffffffff
jmp 0x1000bc0d
jmp 0x1000bbea
jmp 0x1000bbcb
mov dword [ebp - 0x334], 0xfffffffc
mov dword [ebp - 0x29c], 0
jmp 0x1000bc56
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 2
jge 0x1000bc72
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x188], 1
jmp 0x1000bc49
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x188], 0
jne 0x1000be0c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
mov dword [ebp - 0xfcc], eax
mov dword [ebp - 0x334], 0x83cc47d1
cmp dword [ebp - 0x334], 0
je 0x1000bcc1
mov eax, 0xc829ed89
test eax, eax
je 0x1000bcc1
mov dword [ebp - 0x810], 1
jmp 0x1000bcc8
and dword [ebp - 0x810], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0x810], eax
jge 0x1000bce9
mov dword [ebp - 0x5e0], 1
jmp 0x1000bcf0
and dword [ebp - 0x5e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0x5e0], eax
je 0x1000bd11
mov dword [ebp - 0x9b8], 1
jmp 0x1000bd18
and dword [ebp - 0x9b8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0x9b8], eax
jle 0x1000bd39
mov dword [ebp - 0xb40], 1
jmp 0x1000bd40
and dword [ebp - 0xb40], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
mov dword [ebp - 0xfd4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x188], 0
je 0x1000bd78
cmp dword [ebp - 0x334], 0
je 0x1000bd78
mov dword [ebp - 0x5e8], 1
jmp 0x1000bd7f
and dword [ebp - 0x5e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0x5e8], eax
je 0x1000bda0
mov dword [ebp - 0x818], 1
jmp 0x1000bda7
and dword [ebp - 0x818], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp eax, dword [ebp - 0x818]
jne 0x1000bdc8
mov dword [ebp - 0x5f0], 1
jmp 0x1000bdcf
and dword [ebp - 0x5f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0x5f0], eax
jl 0x1000bdf0
mov dword [ebp - 0x930], 1
jmp 0x1000bdf7
and dword [ebp - 0x930], 0
cmp dword [ebp - 0x930], 0xfffd
je 0x1000be0c
and dword [ebp - 0x5f8], 0
jmp 0x1000be16
mov dword [ebp - 0x5f8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp eax, dword [ebp - 0x5f8]
je 0x1000be37
mov dword [ebp - 0x820], 1
jmp 0x1000be3e
and dword [ebp - 0x820], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0x820], eax
jle 0x1000be8d
mov dword [ebp - 0x600], 0x26fb
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1000be7e
push 0x1551
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x600]
inc eax
mov dword [ebp - 0x600], eax
jmp 0x1000beae
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1000beae
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [ebp - 0x378], 0xfffffffc
mov dword [ebp - 0x254], 0
jmp 0x1000bed1
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 2
jge 0x1000beed
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0x190], 1
jmp 0x1000bec4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x190], 0
jne 0x1000c087
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
mov dword [ebp - 0xfdc], eax
mov dword [ebp - 0x378], 0x83cc47d1
cmp dword [ebp - 0x378], 0
je 0x1000bf3c
mov eax, 0xc829ed89
test eax, eax
je 0x1000bf3c
mov dword [ebp - 0xa10], 1
jmp 0x1000bf43
and dword [ebp - 0xa10], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0xa10], eax
jge 0x1000bf64
mov dword [ebp - 0x608], 1
jmp 0x1000bf6b
and dword [ebp - 0x608], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x608], eax
je 0x1000bf8c
mov dword [ebp - 0x828], 1
jmp 0x1000bf93
and dword [ebp - 0x828], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x828], eax
jle 0x1000bfb4
mov dword [ebp - 0xaa8], 1
jmp 0x1000bfbb
and dword [ebp - 0xaa8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
mov dword [ebp - 0xfe4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x190], 0
je 0x1000bff3
cmp dword [ebp - 0x378], 0
je 0x1000bff3
mov dword [ebp - 0x610], 1
jmp 0x1000bffa
and dword [ebp - 0x610], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x610], eax
je 0x1000c01b
mov dword [ebp - 0x938], 1
jmp 0x1000c022
and dword [ebp - 0x938], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp eax, dword [ebp - 0x938]
jne 0x1000c043
mov dword [ebp - 0x618], 1
jmp 0x1000c04a
and dword [ebp - 0x618], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x618], eax
jl 0x1000c06b
mov dword [ebp - 0x830], 1
jmp 0x1000c072
and dword [ebp - 0x830], 0
cmp dword [ebp - 0x830], 0xfffd
je 0x1000c087
and dword [ebp - 0x620], 0
jmp 0x1000c091
mov dword [ebp - 0x620], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp eax, dword [ebp - 0x620]
je 0x1000c0b2
mov dword [ebp - 0x9c0], 1
jmp 0x1000c0b9
and dword [ebp - 0x9c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x9c0], eax
jle 0x1000c108
mov dword [ebp - 0x628], 0x26fb
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x1000c0f9
push 0x1551
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x628]
inc eax
mov dword [ebp - 0x628], eax
jmp 0x1000c129
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x1000c129
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0xa58], 1
push 2
lea ecx, [ebp - 0xd48]
call fcn.10016f4f
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x8c], 0
jmp 0x1000c167
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1000c183
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x106c], 0x4be76d23
jmp 0x1000c15a
mov dword [ebp - 0x8c], 0
jmp 0x1000c19c
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1000c1be
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xd48]
call fcn.10016fbc
mov dword [eax], 0xfffffff6
jmp 0x1000c18f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xfec], eax
cmp dword [ebp - 0x18], 0
jne 0x1000c27a
cmp dword [ebp - 0x18], 0
je 0x1000c23f
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jl 0x1000c1eb
mov dword [ebp - 0x838], 1
jmp 0x1000c1f2
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x838], eax
je 0x1000c20c
cmp dword [ebp - 0x18], 0
jne 0x1000c20c
and dword [ebp - 0x630], 0
jmp 0x1000c216
mov dword [ebp - 0x630], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x630], eax
jl 0x1000c22d
mov dword [ebp - 0x940], 1
jmp 0x1000c234
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x940], eax
jle 0x1000c24e
cmp dword [ebp - 0x18], 0
jne 0x1000c24e
and dword [ebp - 0x638], 0
jmp 0x1000c258
mov dword [ebp - 0x638], 1
cmp dword [ebp - 0x638], 0x32fd2d1a
jge 0x1000c270
mov dword [ebp - 0x840], 1
jmp 0x1000c277
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
je 0x1000c28f
cmp dword [ebp - 0x18], 0
je 0x1000c28f
and dword [ebp - 0x640], 0
jmp 0x1000c299
mov dword [ebp - 0x640], 1
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x640]
test eax, eax
je 0x1000c2d7
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1000c2d2
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x1000c4c1
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0x18], 2
jmp 0x1000c2f1
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1000c4c1
mov dword [ebp - 0x19c], 0xfffffff9
mov dword [ebp - 0x850], 0xd88101ae
mov dword [ebp - 0x19c], 0
jmp 0x1000c328
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jg 0x1000c49c
mov dword [ebp - 0x1cc], 0xffffffff
mov dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x106c], 0x279e56e
jg 0x1000c365
mov dword [ebp - 0x648], 1
jmp 0x1000c36c
and dword [ebp - 0x648], 0
mov dword [ebp - 0xa58], 0xffffffff
mov eax, dword [ebp - 0xa58]
add eax, dword [ebp - 0x648]
cmp eax, dword [ebp - 0x1cc]
je 0x1000c396
mov dword [ebp - 0x848], 1
jmp 0x1000c39d
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x848], eax
jle 0x1000c3b7
mov dword [ebp - 0x650], 1
jmp 0x1000c3be
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x948], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x106c]
sub eax, dword [ebp - 0x948]
cmp eax, dword [ebp - 0x19c]
jg 0x1000c3ee
mov dword [ebp - 0x658], 1
jmp 0x1000c3f5
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x850], eax
mov esi, dword [ebp - 0x850]
push 1
lea ecx, [ebp - 0xd48]
call fcn.10016fbc
mov dword [eax], esi
mov dword [ebp - 0x1cc], 0
jmp 0x1000c42f
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jg 0x1000c497
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x1000c457
push 0x23c3
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov dword [ebp - 0x1b4], 0
jmp 0x1000c470
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jg 0x1000c495
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x1000c493
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x1000c463
jmp 0x1000c422
jmp 0x1000c31b
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1000c4bc
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x1000c2ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd48]
call fcn.10016fb7
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x678], 1
push 2
lea ecx, [ebp - 0xd6c]
call fcn.10016f4f
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xd4], 0
jmp 0x1000c50e
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x1000c52a
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x107c], 0x4be76d23
jmp 0x1000c501
mov dword [ebp - 0xd4], 0
jmp 0x1000c543
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 2
jge 0x1000c565
push dword [ebp - 0xd4]
lea ecx, [ebp - 0xd6c]
call fcn.10016fbc
mov dword [eax], 0xfffffff6
jmp 0x1000c536
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x11b4], eax
cmp dword [ebp - 0x10], 0
jne 0x1000c621
cmp dword [ebp - 0x10], 0
je 0x1000c5e6
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x1000c592
mov dword [ebp - 0x660], 1
jmp 0x1000c599
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x660], eax
je 0x1000c5b3
cmp dword [ebp - 0x10], 0
jne 0x1000c5b3
and dword [ebp - 0x9c8], 0
jmp 0x1000c5bd
mov dword [ebp - 0x9c8], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x9c8], eax
jl 0x1000c5d4
mov dword [ebp - 0x668], 1
jmp 0x1000c5db
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x668], eax
jle 0x1000c5f5
cmp dword [ebp - 0x10], 0
jne 0x1000c5f5
and dword [ebp - 0x858], 0
jmp 0x1000c5ff
mov dword [ebp - 0x858], 1
cmp dword [ebp - 0x858], 0x32fd2d1a
jge 0x1000c617
mov dword [ebp - 0x670], 1
jmp 0x1000c61e
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
je 0x1000c636
cmp dword [ebp - 0x10], 0
je 0x1000c636
and dword [ebp - 0x950], 0
jmp 0x1000c640
mov dword [ebp - 0x950], 1
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x950]
test eax, eax
je 0x1000c67e
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1000c679
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x1000c868
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 0x10], 2
jmp 0x1000c698
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1000c868
mov dword [ebp - 0x1dc], 0xfffffff9
mov dword [ebp - 0x690], 0xd88101ae
mov dword [ebp - 0x1dc], 0
jmp 0x1000c6cf
cmp dword [ebp - 0x1dc], 2
jg 0x1000c843
mov dword [ebp - 0x1bc], 0xffffffff
mov dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x107c], 0x279e56e
jg 0x1000c70c
mov dword [ebp - 0x860], 1
jmp 0x1000c713
and dword [ebp - 0x860], 0
mov dword [ebp - 0x678], 0xffffffff
mov eax, dword [ebp - 0x678]
add eax, dword [ebp - 0x860]
cmp eax, dword [ebp - 0x1bc]
je 0x1000c73d
mov dword [ebp - 0x680], 1
jmp 0x1000c744
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x680], eax
jle 0x1000c75e
mov dword [ebp - 0xa20], 1
jmp 0x1000c765
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0xa20]
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x107c]
sub eax, dword [ebp - 0x688]
cmp eax, dword [ebp - 0x1dc]
jg 0x1000c795
mov dword [ebp - 0x868], 1
jmp 0x1000c79c
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x690], eax
mov esi, dword [ebp - 0x690]
push 1
lea ecx, [ebp - 0xd6c]
call fcn.10016fbc
mov dword [eax], esi
mov dword [ebp - 0x1bc], 0
jmp 0x1000c7d6
cmp dword [ebp - 0x1bc], 2
jg 0x1000c83e
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1000c863
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x1000c691
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd6c]
call fcn.10016fb7
mov dword [ebp - 0xe3c], 0xf825e7a6
mov dword [ebp - 0xe38], 0xf825e7a6
mov dword [ebp - 0xe34], 0xf825e7a6
mov dword [ebp - 0xe30], 0xf825e7a6
mov dword [ebp - 0xb98], 5
mov dword [ebp - 0x698], 0xffffffff
mov dword [ebp - 0x6a0], 0x4d073ff8
mov dword [ebp - 0x33c], 0xfffc
mov dword [ebp - 0xab0], 0
mov dword [ebp - 0xab8], 0x4b5a
mov dword [ebp - 0x11bc], 1
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe3c], 4
jbe 0x1000c90e
mov dword [ebp - 0x958], 1
jmp 0x1000c915
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x698], eax
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x11c4], eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0x11cc], eax
cmp dword [ebp - 0xab0], 0xfffffff7
jae 0x1000c953
or eax, 0xffffffff
je 0x1000c953
mov dword [ebp - 0xb48], 1
jmp 0x1000c95a
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x11d4], eax
mov eax, dword [ebp - 0xab8]
cmp dword [ebp - 0x6a0], eax
jge 0x1000c980
mov dword [ebp - 0x870], 1
jmp 0x1000c987
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 0x11dc], 0xbca6
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1000c9bc
push 0x10e5
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x1000c9ea
push 0x2301
push 0xcff
push 0x1cd7
push 0x1114
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x880], 1
push 2
lea ecx, [ebp - 0xd84]
call fcn.10016f4f
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x94], 0
jmp 0x1000ca28
cmp dword [ebp - 0x94], 3
jge 0x1000ca44
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x108c], 0x4be76d23
jmp 0x1000ca1b
mov dword [ebp - 0x94], 0
jmp 0x1000ca5d