Function at 0x10008e84
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Query or enumerate registry value
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf2c
push esi
push edi
mov dword [ebp - 0xb8], 0xca4f833f
mov dword [ebp - 0x48], 0xf3d4210e
mov dword [ebp - 0x334], 0
jmp 0x10008eb9
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 3
jge 0x10008ed5
mov eax, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0xe6c], 1
jmp 0x10008eac
mov dword [ebp - 0xb8], 0
jmp 0x10008eee
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jg 0x10008f28
mov dword [ebp - 0xab0], 6
cmp dword [ebp - 0xab0], 0
jne 0x10008f16
mov dword [ebp - 0x6ac], 1
jmp 0x10008f1d
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x6ac]
mov dword [ebp - 0x48], eax
jmp 0x10008ee1
mov dword [ebp - 0xb8], 0xffffffe3
jmp 0x10008f41
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xfffffff2
jge 0x10008ff7
mov dword [ebp - 0x48], 0
jmp 0x10008f5e
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x10008fa2
mov dword [ebp - 0xb74], 0xa7b051af
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0xe6c], 0x3735b263
jl 0x10008f8a
mov dword [ebp - 0xa44], 1
jmp 0x10008f91
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0xa44]
mov dword [ebp - 0xb74], eax
jmp 0x10008f57
mov dword [ebp - 0x48], 0
jmp 0x10008fb2
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x10008ff2
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x10008fd2
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x10008ff0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x10008fab
jmp 0x10008f34
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x218], 0x97f6af11
mov dword [ebp - 0x218], 0xfffffffe
jmp 0x10009024
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xfffffffd
jge 0x10009089
mov dword [ebp - 0x198], 0
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10009058
push 0x1e48
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x198], 0xffffffec
jmp 0x10009071
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xd
jl 0x10009087
cmp dword [ebp - 0x198], 0
je 0x10009085
jmp 0x10009087
jmp 0x10009064
jmp 0x10009017
mov dword [ebp - 0x7b4], 0x141e4f1f
mov dword [ebp - 0x7a4], 0xfffffffa
mov dword [ebp - 0x20c], 0x1e1e87df
mov dword [ebp - 0x3cc], 0xfffffff7
mov dword [ebp - 0x78], 0
jmp 0x100090c1
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x100090d4
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x3c], 0xfffffff8
jmp 0x100090ba
mov dword [ebp - 0x78], 0
jmp 0x100090e4
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x100090fa
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x104], 0x4888999d
jmp 0x100090dd
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x20c]
cmp dword [ebp + eax - 0x3c], ecx
jle 0x10009118
mov dword [ebp - 0xa4c], 1
jmp 0x1000911f
and dword [ebp - 0xa4c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp dword [ebp - 0xa4c], eax
jge 0x1000913d
mov dword [ebp - 0xa54], 1
jmp 0x10009144
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x20c]
sub eax, dword [ebp - 0xa54]
cmp eax, 0x5689
jne 0x10009163
mov dword [ebp - 0xa64], 1
jmp 0x1000916a
and dword [ebp - 0xa64], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0xa5c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa5c]
mov dword [ebp + eax - 0x104], ecx
mov eax, dword [ebp - 0xa5c]
cmp eax, dword [ebp - 0xa64]
jge 0x100091a7
mov dword [ebp - 0xa6c], 1
jmp 0x100091ae
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0x20c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3c]
imul ecx, dword [ebp - 0xa6c]
add eax, ecx
je 0x100092f9
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x40c], 0x7c57f39c
cmp dword [ebp - 0xfc], 0
je 0x1000923c
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xcb8], eax
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x40c], eax
jge 0x10009210
mov dword [ebp - 0x72c], 1
jmp 0x10009217
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0xfc]
imul eax, dword [ebp - 0x72c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x3c]
jne 0x1000923c
mov dword [ebp - 0x404], 1
jmp 0x10009243
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x404], eax
jg 0x1000925d
mov dword [ebp - 0x734], 1
jmp 0x10009264
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x734]
jl 0x10009287
cmp dword [ebp - 0x40c], 0
je 0x10009287
mov dword [ebp - 0x73c], 1
jmp 0x1000928e
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x73c], eax
jl 0x100092a8
mov dword [ebp - 0x414], 1
jmp 0x100092af
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
sub eax, 0x5900b088
cmp dword [ebp - 0xfc], eax
je 0x100092ce
mov dword [ebp - 0x350], 1
jmp 0x100092d5
and dword [ebp - 0x350], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x350]
mov dword [ebp + eax - 0x104], ecx
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x3cc], eax
jmp 0x100095ea
mov dword [ebp - 0x9c], 0xc214
mov dword [ebp - 0x2a8], 0
jmp 0x1000931c
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 3
jge 0x10009338
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0xdd4], 0x447d0519
jmp 0x1000930f
mov eax, dword [ebp - 0x9c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x3c]
test eax, eax
jne 0x100094dc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 0
je 0x1000940d
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0xcac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 0x395c
jne 0x10009390
mov dword [ebp - 0x744], 1
jmp 0x10009397
and dword [ebp - 0x744], 0
cmp dword [ebp - 0x744], 0
jne 0x100093ac
mov dword [ebp - 0x41c], 1
jmp 0x100093b3
and dword [ebp - 0x41c], 0
cmp dword [ebp - 0x41c], 0xfffb
jbe 0x100093cb
mov dword [ebp - 0x74c], 1
jmp 0x100093d2
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x74c], eax
jne 0x100093ec
mov dword [ebp - 0x424], 1
jmp 0x100093f3
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
sub eax, dword [ebp - 0x9c]
je 0x1000940d
mov dword [ebp - 0x754], 1
jmp 0x10009414
and dword [ebp - 0x754], 0
cmp dword [ebp - 0x754], 0x964e
jle 0x10009439
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
je 0x10009439
mov dword [ebp - 0x42c], 1
jmp 0x10009440
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x42c], eax
je 0x1000945a
mov dword [ebp - 0x75c], 1
jmp 0x10009461
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x75c], eax
jne 0x1000947b
mov dword [ebp - 0x434], 1
jmp 0x10009482
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
sub eax, dword [ebp - 0x3cc]
cmp eax, dword [ebp - 0x9c]
jg 0x100094a2
mov dword [ebp - 0x764], 1
jmp 0x100094a9
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x764], eax
jne 0x100094c3
mov dword [ebp - 0x3d4], 1
jmp 0x100094ca
and dword [ebp - 0x3d4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3d4]
mov dword [ebp + eax - 0xdd4], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, 0xffff
sub ecx, dword [ebp + eax - 0x3c]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x104], ecx
cmp dword [ebp - 0x20c], 0
jne 0x10009517
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
jne 0x10009517
and dword [ebp - 0x43c], 0
jmp 0x10009521
mov dword [ebp - 0x43c], 1
cmp dword [ebp - 0x43c], 6
jae 0x10009536
mov dword [ebp - 0x76c], 1
jmp 0x1000953d
and dword [ebp - 0x76c], 0
cmp dword [ebp - 0x9c], 4
je 0x10009552
mov dword [ebp - 0xb7c], 1
jmp 0x10009559
and dword [ebp - 0xb7c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0xcb4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 9
jl 0x10009585
mov dword [ebp - 0xb84], 1
jmp 0x1000958c
and dword [ebp - 0xb84], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
jl 0x100095a5
mov dword [ebp - 0x444], 1
jmp 0x100095ac
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x444]
mov dword [ebp - 0x774], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x774]
mov dword [ebp + eax - 0xdd4], ecx
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x774]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x104], eax
mov byte [ebp - 0xdb], 0
movzx eax, byte [ebp - 0xdb]
test eax, eax
je 0x1000960d
push 0
push 0
push 0x3ad
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x2b0], 0xffffffff
mov dword [ebp - 0x220], 0
jmp 0x1000963a
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x10009656
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0xb8c], 0xec2e
jmp 0x1000962d
mov dword [ebp - 0x2b0], 0
jmp 0x1000966f
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0
jl 0x10009706
mov dword [ebp - 0x228], 0x32bb11ac
mov dword [ebp - 0x228], 0
jmp 0x1000969f
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jg 0x10009701
mov dword [ebp - 0x1f0], 0x3afc3718
mov byte [ebp - 0x148], 0
movzx eax, byte [ebp - 0x148]
test eax, eax
je 0x100096ca
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x1f0], 0
jmp 0x100096e3
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x100096ff
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0xb8c], 0x425a
jmp 0x100096d6
jmp 0x10009692
jmp 0x10009662
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1000971e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 0xbb8], 0x17716e31
mov dword [ebp - 0xcbc], 8
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000974e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x1000976f
push 0
push 0x1398
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov dword [ebp - 0x1d8], 0x64f14790
mov dword [ebp - 0x784], 0xe468
mov dword [ebp - 0x464], 0xfffffff6
mov dword [ebp - 0x2b8], 0
jmp 0x100097a6
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 1
jge 0x100097c2
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0x1a0], 0xd435
jmp 0x10009799
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x1a0], 0x63f9
mov dword [ebp - 0x1d8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a0], 0x9120
jle 0x100097fd
or eax, 0xffffffff
je 0x100097fd
mov dword [ebp - 0x44c], 1
jmp 0x10009804
and dword [ebp - 0x44c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
add eax, dword [ebp - 0x44c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1a0]
jge 0x10009832
mov dword [ebp - 0x77c], 1
jmp 0x10009839
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x784]
cmp dword [ebp - 0x77c], eax
jl 0x10009853
mov dword [ebp - 0x454], 1
jmp 0x1000985a
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0xc694
jl 0x10009878
mov eax, 0xbf079684
test eax, eax
jne 0x10009878
and dword [ebp - 0x45c], 0
jmp 0x10009882
mov dword [ebp - 0x45c], 1
mov eax, dword [ebp - 0x784]
cmp dword [ebp - 0x45c], eax
jg 0x1000989c
mov dword [ebp - 0x78c], 1
jmp 0x100098a3
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x464], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp - 0x464], eax
jl 0x100098d0
mov dword [ebp - 0x794], 1
jmp 0x100098d7
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 0xd6a5
je 0x10009909
mov dword [ebp - 0xcc4], 0xffffffff
mov dword [ebp - 0x46c], 1
mov eax, dword [ebp - 0x46c]
dec eax
mov dword [ebp - 0x46c], eax
jmp 0x10009997
mov dword [ebp - 0x230], 0
jmp 0x10009922
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x1000993e
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0xb94], 4
jmp 0x10009915
mov dword [ebp - 0x1d8], 0
jmp 0x10009957
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xb
jl 0x10009974
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb94], 0
je 0x10009972
jmp 0x10009974
jmp 0x1000994a
mov byte [ebp - 0x14a], 0
movzx eax, byte [ebp - 0x14a]
test eax, eax
je 0x10009997
push 0xbbb
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
mov dword [ebp - 0x80], 0
jmp 0x100099a7
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x100099bd
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xde4], 0xfffffffc
jmp 0x100099a0
mov dword [ebp - 0xccc], 0xbca6
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x100099e1
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
mov byte [ebp - 0x14e], 0
movzx eax, byte [ebp - 0x14e]
test eax, eax
je 0x100099fd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x80], 0
jmp 0x10009a0d
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x10009a23
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xb9c], 0x5c380a38
jmp 0x10009a06
mov dword [ebp - 0x2c0], 0x97f6af11
mov dword [ebp - 0x2c0], 0xfffffffe
jmp 0x10009a46
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0xfffffffd
jge 0x10009aab
mov dword [ebp - 0x1a8], 0
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x10009a7a
push 0x1e48
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x1a8], 0xffffffec
jmp 0x10009a93
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xd
jl 0x10009aa9
cmp dword [ebp - 0x1a8], 0
je 0x10009aa7
jmp 0x10009aa9
jmp 0x10009a86
jmp 0x10009a39
mov dword [ebp - 0x158], 0
jmp 0x10009ac4
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x17
jl 0x10009cf7
mov dword [ebp - 0xc8], 0x1813f1a0
mov dword [ebp - 0x79c], 1
mov dword [ebp - 0x238], 0
jmp 0x10009afe
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 4
jge 0x10009b1a
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xe60], 0xd3e018eb
jmp 0x10009af1
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x79c], eax
jge 0x10009b4d
mov dword [ebp - 0x474], 1
jmp 0x10009b54
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x7a4], eax
cmp dword [ebp - 0x7a4], 0
jne 0x10009b70
cmp dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0
je 0x10009b8c
cmp dword [ebp - 0xc8], 0
cmp dword [ebp - 0x158], 0xfffd
jbe 0x10009ba4
mov dword [ebp - 0x7ac], 1
jmp 0x10009bab
and dword [ebp - 0x7ac], 0
cmp dword [ebp - 0x7ac], 0x91ba
jl 0x10009bc3
mov dword [ebp - 0x484], 1
jmp 0x10009bca
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0xc8]
imul eax, dword [ebp - 0x484]
cmp eax, 1
je 0x10009be8
mov dword [ebp - 0x48c], 1
jmp 0x10009bef
and dword [ebp - 0x48c], 0
mov dword [ebp - 0x7b4], 0xe08a1101
mov eax, dword [ebp - 0x7b4]
add eax, dword [ebp - 0x48c]
cmp eax, dword [ebp - 0xc8]
jge 0x10009c19
mov dword [ebp - 0x3dc], 1
jmp 0x10009c20
and dword [ebp - 0x3dc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp + eax - 0xe60], ecx
cmp dword [ebp - 0x3dc], 0
jne 0x10009c55
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe60], 0
jne 0x10009c55
and dword [ebp - 0x3c8], 0
jmp 0x10009c5f
mov dword [ebp - 0x3c8], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp + eax - 0xde4], ecx
cmp dword [ebp - 0x3c8], 0
jne 0x10009c89
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xde4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe60]
mov dword [ebp - 0xcd4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb9c], 0xe2c23779
jae 0x10009cbb
mov dword [ebp - 0x7bc], 1
jmp 0x10009cc2
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0xbb8], eax
mov byte [ebp - 0x14c], 0
movzx eax, byte [ebp - 0x14c]
test eax, eax
je 0x10009cf2
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x10009ab7
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x4ac], 0x141e4f1f
mov dword [ebp - 0x49c], 0xfffffffa
mov dword [ebp - 0x7cc], 0
mov dword [ebp - 0xbc8], 0x17716e31
mov dword [ebp - 0xa4], 0
jmp 0x10009d42
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x10009d5e
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xdf4], 0xfffffffc
jmp 0x10009d35
mov dword [ebp - 0xa4], 0
jmp 0x10009d77
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x10009d93
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xbc0], 0x5c380a38
jmp 0x10009d6a
mov dword [ebp - 0x160], 0
jmp 0x10009dac
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x17
jl 0x10009fdf
mov dword [ebp - 0xc0], 0x1813f1a0
mov dword [ebp - 0x494], 1
mov dword [ebp - 0x2c8], 0
jmp 0x10009de6
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 4
jge 0x10009e02
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0xe38], 0xd3e018eb
jmp 0x10009dd9
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x494], eax
jge 0x10009e35
mov dword [ebp - 0x7c4], 1
jmp 0x10009e3c
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0
jne 0x10009e58
cmp dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 0
je 0x10009e74
cmp dword [ebp - 0xc0], 0
cmp dword [ebp - 0x160], 0xfffd
jbe 0x10009e8c
mov dword [ebp - 0x4a4], 1
jmp 0x10009e93
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0x91ba
jl 0x10009eab
mov dword [ebp - 0x7d4], 1
jmp 0x10009eb2
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x7d4]
cmp eax, 1
je 0x10009ed0
mov dword [ebp - 0x7dc], 1
jmp 0x10009ed7
and dword [ebp - 0x7dc], 0
mov dword [ebp - 0x4ac], 0xe08a1101
mov eax, dword [ebp - 0x4ac]
add eax, dword [ebp - 0x7dc]
cmp eax, dword [ebp - 0xc0]
jge 0x10009f01
mov dword [ebp - 0x35c], 1
jmp 0x10009f08
and dword [ebp - 0x35c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x35c]
mov dword [ebp + eax - 0xe38], ecx
cmp dword [ebp - 0x35c], 0
jne 0x10009f3d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe38], 0
jne 0x10009f3d
and dword [ebp - 0x3a4], 0
jmp 0x10009f47
mov dword [ebp - 0x3a4], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3a4]
mov dword [ebp + eax - 0xdf4], ecx
cmp dword [ebp - 0x3a4], 0
jne 0x10009f71
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdf4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe38]
mov dword [ebp - 0xcdc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc0], 0xe2c23779
jae 0x10009fa3
mov dword [ebp - 0x4b4], 1
jmp 0x10009faa
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0xbc8], eax
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10009fda
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x10009d9f
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x7fc], 0x141e4f1f
mov dword [ebp - 0x7ec], 0xfffffffa
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0xbd8], 0x17716e31
mov dword [ebp - 0x88], 0
jmp 0x1000a02a
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1000a046
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xe10], 0xfffffffc
jmp 0x1000a01d
mov dword [ebp - 0x88], 0
jmp 0x1000a05f
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1000a07b
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xbd0], 0x5c380a38
jmp 0x1000a052
mov dword [ebp - 0x178], 0
jmp 0x1000a094
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x17
jl 0x1000a2c7
mov dword [ebp - 0xd0], 0x1813f1a0
mov dword [ebp - 0x7e4], 1
mov dword [ebp - 0x240], 0
jmp 0x1000a0ce
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
jge 0x1000a0ea
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xe04], 0xd3e018eb
jmp 0x1000a0c1
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x7e4], eax
jge 0x1000a11d
mov dword [ebp - 0x4bc], 1
jmp 0x1000a124
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x7ec], 0
jne 0x1000a140
cmp dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0
je 0x1000a15c
cmp dword [ebp - 0xd0], 0
cmp dword [ebp - 0x178], 0xfffd
jbe 0x1000a174
mov dword [ebp - 0x7f4], 1
jmp 0x1000a17b
and dword [ebp - 0x7f4], 0
cmp dword [ebp - 0x7f4], 0x91ba
jl 0x1000a193
mov dword [ebp - 0x4cc], 1
jmp 0x1000a19a
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0xd0]
imul eax, dword [ebp - 0x4cc]
cmp eax, 1
je 0x1000a1b8
mov dword [ebp - 0x4d4], 1
jmp 0x1000a1bf
and dword [ebp - 0x4d4], 0
mov dword [ebp - 0x7fc], 0xe08a1101
mov eax, dword [ebp - 0x7fc]
add eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xd0]
jge 0x1000a1e9
mov dword [ebp - 0x364], 1
jmp 0x1000a1f0
and dword [ebp - 0x364], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x364]
mov dword [ebp + eax - 0xe04], ecx
cmp dword [ebp - 0x364], 0
jne 0x1000a225
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe04], 0
jne 0x1000a225
and dword [ebp - 0x3ec], 0
jmp 0x1000a22f
mov dword [ebp - 0x3ec], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp + eax - 0xe10], ecx
cmp dword [ebp - 0x3ec], 0
jne 0x1000a259
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe10], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe04]
mov dword [ebp - 0xce4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbd0], 0xe2c23779
jae 0x1000a28b
mov dword [ebp - 0x804], 1
jmp 0x1000a292
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0xbd8], eax
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1000a2c2
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1000a087
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x200], 0
mov dword [ebp - 0xac], 0
jmp 0x1000a2f4
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xf
jl 0x1000a67b
mov dword [ebp - 0x54], 0x5efa20bd
mov dword [ebp - 0x168], 0x5fec
mov dword [ebp - 0x2d0], 0
jmp 0x1000a32b
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
jge 0x1000a347
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0x3e8], 0x835357f4
jmp 0x1000a31e
mov eax, 0x1d89
test eax, eax
je 0x1000a362
cmp dword [ebp - 0x54], 0
je 0x1000a362
mov dword [ebp - 0x4dc], 1
jmp 0x1000a369
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x4dc], eax
je 0x1000a380
mov dword [ebp - 0x4e4], 1
jmp 0x1000a387
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x54], 0
je 0x1000a3a2
cmp dword [ebp - 0xac], 0
je 0x1000a3a2
mov dword [ebp - 0x80c], 1
jmp 0x1000a3a9
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x80c]
jl 0x1000a3c0
mov dword [ebp - 0x814], 1
jmp 0x1000a3c7
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x4e4]
cmp eax, dword [ebp - 0x814]
jle 0x1000a3e1
mov dword [ebp - 0x4ec], 1
jmp 0x1000a3e8
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x200], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e8]
cmp dword [ebp - 0x200], eax
jg 0x1000a54c
mov dword [ebp - 0xad4], 0x415fb57a
mov dword [ebp - 0x36c], 0xe3bc
mov dword [ebp - 0x4fc], 0x1cc0e426
mov dword [ebp - 0xac0], 0x7220b739
cmp dword [ebp - 0x36c], 0
jne 0x1000a4a7
cmp dword [ebp - 0x36c], 0
jne 0x1000a453
mov dword [ebp - 0x81c], 1
jmp 0x1000a45a
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x81c]
jl 0x1000a474
mov dword [ebp - 0x4f4], 1
jmp 0x1000a47b
and dword [ebp - 0x4f4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3e8], 0xffff
ja 0x1000a49a
mov dword [ebp - 0xb6c], 1
jmp 0x1000a4a1
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0x36c]
mov eax, dword [ebp - 0xad4]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x3e8]
cmp eax, 0x53bf
jne 0x1000a4da
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3e8], 0
jne 0x1000a4da
and dword [ebp - 0x824], 0
jmp 0x1000a4e4
mov dword [ebp - 0x824], 1
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x824]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0xcec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e8]
mov dword [ebp - 0xcf4], eax
mov eax, 0x5818
add eax, 0x5a27
jne 0x1000a531
cmp dword [ebp - 0x200], 0
jne 0x1000a531
and dword [ebp - 0x82c], 0
jmp 0x1000a53b
mov dword [ebp - 0x82c], 1
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0xac0], eax
jmp 0x1000a666
mov dword [ebp - 0x50c], 0x1d4d0043
mov dword [ebp - 0x168], 0
jmp 0x1000a56f
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x39
jne 0x1000a666
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x54], 0xe
jmp 0x1000a596
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffe8
jg 0x1000a5b8
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1000a5b6
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1000a58f
cmp dword [ebp - 0x248], 0
jne 0x1000a61e
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jne 0x1000a5e2
mov dword [ebp - 0x504], 1
jmp 0x1000a5e9
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0xd6c], eax
mov eax, 0x4f90bf56
cmp eax, 0xfffffff8
jl 0x1000a617
mov dword [ebp - 0x834], 1
jmp 0x1000a61e
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x50c]
sub eax, dword [ebp - 0x248]
cmp eax, dword [ebp - 0x248]
jne 0x1000a647
mov eax, 0x1ede
test eax, eax
je 0x1000a647
mov dword [ebp - 0x83c], 1
jmp 0x1000a64e
and dword [ebp - 0x83c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x83c]
mov dword [ebp + eax - 0x3e8], ecx
jmp 0x1000a562
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x54]
mov dword [ebp + eax - 0x3e8], ecx
jmp 0x1000a2e7
mov dword [ebp - 0xac], 0xffffffea
jmp 0x1000a694
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 8
jl 0x1000a6c5
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1000a6c3
push 0x1a97
push 0
push 0x157
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x1000a687
mov dword [ebp - 0x2d8], 0
jmp 0x1000a6de
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 3
jge 0x1000a6fa
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0xbe8], 1
jmp 0x1000a6d1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbe8], 0xfffffff0
jmp 0x1000a728
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbe8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbe8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbe8], 0xffffffe6
jl 0x1000a796
mov dword [ebp - 0x250], 0
jmp 0x1000a751
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 2
jge 0x1000a76d
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0xd08], 0xea98
jmp 0x1000a744
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbe8], 0
je 0x1000a77f
jmp 0x1000a796
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd08], 0
je 0x1000a791
jmp 0x1000a796
jmp 0x1000a70d
movzx eax, byte [0x10666e70]
test eax, eax
je 0x1000a7b4
mov esi, 0x1007b838
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10010511
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x70], 0
jmp 0x1000a7d5
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xf
jl 0x1000ab56
mov dword [ebp - 0x60], 0x5efa20bd
mov dword [ebp - 0x188], 0x5fec
mov dword [ebp - 0x2e0], 0
jmp 0x1000a809
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 2
jge 0x1000a825
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x3f4], 0x835357f4
jmp 0x1000a7fc
mov eax, 0x1d89
test eax, eax
je 0x1000a840
cmp dword [ebp - 0x60], 0
je 0x1000a840
mov dword [ebp - 0x514], 1
jmp 0x1000a847
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x514], eax
je 0x1000a85e
mov dword [ebp - 0x51c], 1
jmp 0x1000a865
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x60], 0
je 0x1000a87d
cmp dword [ebp - 0x70], 0
je 0x1000a87d
mov dword [ebp - 0x844], 1
jmp 0x1000a884
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x844]
jl 0x1000a89b
mov dword [ebp - 0x84c], 1
jmp 0x1000a8a2
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x51c]
cmp eax, dword [ebp - 0x84c]
jle 0x1000a8bc
mov dword [ebp - 0x524], 1
jmp 0x1000a8c3
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x190], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f4]
cmp dword [ebp - 0x190], eax
jg 0x1000aa27
mov dword [ebp - 0xac8], 0x415fb57a
mov dword [ebp - 0x3ac], 0xe3bc
mov dword [ebp - 0x534], 0x1cc0e426
mov dword [ebp - 0xbb0], 0x7220b739
cmp dword [ebp - 0x3ac], 0
jne 0x1000a982
cmp dword [ebp - 0x3ac], 0
jne 0x1000a92e
mov dword [ebp - 0x854], 1
jmp 0x1000a935
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0x854]
jl 0x1000a94f
mov dword [ebp - 0x52c], 1
jmp 0x1000a956
and dword [ebp - 0x52c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3f4], 0xffff
ja 0x1000a975
mov dword [ebp - 0xb58], 1
jmp 0x1000a97c
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x3ac]
mov eax, dword [ebp - 0xac8]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x3f4]
cmp eax, 0x53bf
jne 0x1000a9b5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3f4], 0
jne 0x1000a9b5
and dword [ebp - 0x85c], 0
jmp 0x1000a9bf
mov dword [ebp - 0x85c], 1
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x85c]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0xd74], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f4]
mov dword [ebp - 0xd7c], eax
mov eax, 0x5818
add eax, 0x5a27
jne 0x1000aa0c
cmp dword [ebp - 0x190], 0
jne 0x1000aa0c
and dword [ebp - 0x864], 0
jmp 0x1000aa16
mov dword [ebp - 0x864], 1
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0xbb0], eax
jmp 0x1000ab41
mov dword [ebp - 0x544], 0x1d4d0043
mov dword [ebp - 0x188], 0
jmp 0x1000aa4a
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x39
jne 0x1000ab41
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x60], 0xe
jmp 0x1000aa71
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xffffffe8
jg 0x1000aa93
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x1000aa91
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1000aa6a
cmp dword [ebp - 0x258], 0
jne 0x1000aaf9
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jne 0x1000aabd
mov dword [ebp - 0x53c], 1
jmp 0x1000aac4
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xd84], eax
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0xd8c], eax
mov eax, 0x4f90bf56
cmp eax, 0xfffffff8
jl 0x1000aaf2
mov dword [ebp - 0x86c], 1
jmp 0x1000aaf9
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x544]
sub eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x258]
jne 0x1000ab22
mov eax, 0x1ede
test eax, eax
je 0x1000ab22
mov dword [ebp - 0x874], 1
jmp 0x1000ab29
and dword [ebp - 0x874], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x874]
mov dword [ebp + eax - 0x3f4], ecx
jmp 0x1000aa3d
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x60]
mov dword [ebp + eax - 0x3f4], ecx
jmp 0x1000a7ce
mov dword [ebp - 0x70], 0xffffffea
jmp 0x1000ab66
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 8
jl 0x1000ab94
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x1000ab92
push 0x1a97
push 0
push 0x157
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x1000ab5f
mov dword [ebp - 0xd94], 0x1007b838
mov dword [ebp - 0x2e8], 0
jmp 0x1000abb7
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 3
jge 0x1000abd3
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0xbf8], 1
jmp 0x1000abaa
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbf8], 0xfffffff0
jmp 0x1000ac01
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbf8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbf8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbf8], 0xffffffe6
jl 0x1000ac6f
mov dword [ebp - 0x260], 0
jmp 0x1000ac2a
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 2
jge 0x1000ac46
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0xd14], 0xea98
jmp 0x1000ac1d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbf8], 0
je 0x1000ac58
jmp 0x1000ac6f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd14], 0
je 0x1000ac6a
jmp 0x1000ac6f
jmp 0x1000abe6
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0xa0], 0
jmp 0x1000ac9c
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xf
jl 0x1000b023
mov dword [ebp - 0x58], 0x5efa20bd
mov dword [ebp - 0x170], 0x5fec
mov dword [ebp - 0x2f4], 0
jmp 0x1000acd3
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 2
jge 0x1000acef
mov eax, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0x3c4], 0x835357f4
jmp 0x1000acc6
mov eax, 0x1d89
test eax, eax
je 0x1000ad0a
cmp dword [ebp - 0x58], 0
je 0x1000ad0a
mov dword [ebp - 0x54c], 1
jmp 0x1000ad11
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x54c], eax
je 0x1000ad28
mov dword [ebp - 0x554], 1
jmp 0x1000ad2f
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x58], 0
je 0x1000ad4a
cmp dword [ebp - 0xa0], 0
je 0x1000ad4a
mov dword [ebp - 0x87c], 1
jmp 0x1000ad51
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x87c]
jl 0x1000ad68
mov dword [ebp - 0x884], 1
jmp 0x1000ad6f
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x554]
cmp eax, dword [ebp - 0x884]
jle 0x1000ad89
mov dword [ebp - 0x55c], 1
jmp 0x1000ad90
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x1b0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c4]
cmp dword [ebp - 0x1b0], eax
jg 0x1000aef4
mov dword [ebp - 0xb60], 0x415fb57a
mov dword [ebp - 0x374], 0xe3bc
mov dword [ebp - 0x56c], 0x1cc0e426
mov dword [ebp - 0xad8], 0x7220b739
cmp dword [ebp - 0x374], 0
jne 0x1000ae4f
cmp dword [ebp - 0x374], 0
jne 0x1000adfb
mov dword [ebp - 0x88c], 1
jmp 0x1000ae02
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x88c]
jl 0x1000ae1c
mov dword [ebp - 0x564], 1
jmp 0x1000ae23
and dword [ebp - 0x564], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c4], 0xffff
ja 0x1000ae42
mov dword [ebp - 0xad0], 1
jmp 0x1000ae49
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0x374]
mov eax, dword [ebp - 0xb60]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x3c4]
cmp eax, 0x53bf
jne 0x1000ae82
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c4], 0
jne 0x1000ae82
and dword [ebp - 0x894], 0
jmp 0x1000ae8c
mov dword [ebp - 0x894], 1
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x894]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0xd9c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c4]
mov dword [ebp - 0xda4], eax
mov eax, 0x5818
add eax, 0x5a27
jne 0x1000aed9
cmp dword [ebp - 0x1b0], 0
jne 0x1000aed9
and dword [ebp - 0x89c], 0
jmp 0x1000aee3
mov dword [ebp - 0x89c], 1
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0xad8], eax
jmp 0x1000b00e
mov dword [ebp - 0x57c], 0x1d4d0043
mov dword [ebp - 0x170], 0
jmp 0x1000af17
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x39
jne 0x1000b00e
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x58], 0xe
jmp 0x1000af3e
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xffffffe8
jg 0x1000af60
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1000af5e
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1000af37
cmp dword [ebp - 0x268], 0
jne 0x1000afc6
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 1
jne 0x1000af8a
mov dword [ebp - 0x574], 1
jmp 0x1000af91
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0xdb4], eax
mov eax, 0x4f90bf56
cmp eax, 0xfffffff8
jl 0x1000afbf
mov dword [ebp - 0x8a4], 1
jmp 0x1000afc6
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x57c]
sub eax, dword [ebp - 0x268]
cmp eax, dword [ebp - 0x268]
jne 0x1000afef
mov eax, 0x1ede
test eax, eax
je 0x1000afef
mov dword [ebp - 0x8ac], 1
jmp 0x1000aff6
and dword [ebp - 0x8ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8ac]
mov dword [ebp + eax - 0x3c4], ecx
jmp 0x1000af0a
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x58]
mov dword [ebp + eax - 0x3c4], ecx
jmp 0x1000ac8f
mov dword [ebp - 0xa0], 0xffffffea
jmp 0x1000b03c
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 8
jl 0x1000b06d
mov byte [ebp - 0x150], 0
movzx eax, byte [ebp - 0x150]
test eax, eax
je 0x1000b06b
push 0x1a97
push 0
push 0x157
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x1000b02f
mov dword [ebp - 0xdbc], 0x1007b83c
mov dword [ebp - 0x270], 1
mov dword [ebp - 0xdc4], 1
mov dword [ebp - 0x2fc], 0
jmp 0x1000b0a4
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 3
jge 0x1000b0c0
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0xea8], 0
jmp 0x1000b097
mov dword [ebp - 0x270], 5
jmp 0x1000b0d9
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xfffffffb
je 0x1000b169
mov dword [ebp - 0xe44], 0xd8d13034
mov dword [ebp - 0xe4c], 1
mov dword [ebp - 0xdc8], 6
mov dword [ebp - 0xc88], 6
mov dword [ebp - 0xd78], 0xffffffff
mov dword [ebp - 0x584], 9
mov dword [ebp - 0x304], 0
jmp 0x1000b13b
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 3
jge 0x1000b157
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0xec0], 4
jmp 0x1000b12e
mov eax, dword [ebp - 0x584]
dec eax
mov dword [ebp - 0x584], eax
jmp 0x1000b0cc
mov dword [ebp - 0x278], 0
jmp 0x1000b182
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jge 0x1000b19e
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xbac], 1
jmp 0x1000b175
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbac], 0xfffffff0
jmp 0x1000b1cc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbac]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbac], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbac], 0xffffffe6
jl 0x1000b23a
mov dword [ebp - 0x30c], 0
jmp 0x1000b1f5
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 2
jge 0x1000b211
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0xd20], 0xea98
jmp 0x1000b1e8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbac], 0
je 0x1000b223
jmp 0x1000b23a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd20], 0
je 0x1000b235
jmp 0x1000b23a
jmp 0x1000b1b1
mov dword [ebp - 0x8b4], 6
mov dword [ebp - 0x98], 0
jmp 0x1000b25d
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x1000b279
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xf0c], 5
jmp 0x1000b250
mov dword [ebp - 0x98], 0
jmp 0x1000b292
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1000b2ae
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xe80], 0x43d837bc
jmp 0x1000b285
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1000b2ca
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov eax, dword [ebp - 0x8b4]
inc eax
mov dword [ebp - 0x8b4], eax
mov dword [ebp - 0x314], 1
mov dword [ebp - 0xc90], 1
mov dword [ebp - 0x280], 0
jmp 0x1000b304
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jge 0x1000b320
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0xed8], 0
jmp 0x1000b2f7
mov dword [ebp - 0x314], 5
jmp 0x1000b339
mov eax, dword [ebp - 0x314]
dec eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0xfffffffb
je 0x1000b3c9
mov dword [ebp - 0xe28], 0xd8d13034
mov dword [ebp - 0xc98], 1
mov dword [ebp - 0xd80], 6
mov dword [ebp - 0xca0], 6
mov dword [ebp - 0xdd8], 0xffffffff
mov dword [ebp - 0x58c], 9
mov dword [ebp - 0x288], 0
jmp 0x1000b39b
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 3
jge 0x1000b3b7
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0xef0], 4
jmp 0x1000b38e
mov eax, dword [ebp - 0x58c]
dec eax
mov dword [ebp - 0x58c], eax
jmp 0x1000b32c
mov byte [0x10666e70], 1
mov dword [ebp - 0xb4], 0x831713b9
mov dword [ebp - 0x180], 0x335c22c9
mov dword [ebp - 0x3b4], 0x598737a
mov dword [ebp - 0xaf0], 0x7ec8a5e7
mov dword [ebp - 0xb4], 0
jmp 0x1000b411
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x1a
jle 0x1000b989
mov dword [ebp - 0x2c], 0xd4e7937
mov dword [ebp - 0x8e4], 3
mov dword [ebp - 0x8fc], 0x6db3
mov dword [ebp - 0xb68], 0x813f8c54
mov dword [ebp - 0x2c], 0
jmp 0x1000b453
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1a
jge 0x1000b984
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x31c], 0
jmp 0x1000b480
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 3
jge 0x1000b49c
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0xaa0], 0
jmp 0x1000b473
cmp dword [ebp - 0x2c], 0xfffffff7
jbe 0x1000b4ae
mov dword [ebp - 0x8c4], 1
jmp 0x1000b4b5
and dword [ebp - 0x8c4], 0
xor eax, eax
jne 0x1000b4c8
cmp dword [ebp - 0x2c], 0
jne 0x1000b4c8
and dword [ebp - 0x8bc], 0
jmp 0x1000b4d2
mov dword [ebp - 0x8bc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaa0]
imul eax, dword [ebp - 0x8bc]
cmp dword [ebp - 0x2c], eax
jle 0x1000b4f7
mov dword [ebp - 0x594], 1
jmp 0x1000b4fe
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x594], eax
je 0x1000b525
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xaa0], 0
je 0x1000b525
mov dword [ebp - 0x59c], 1
jmp 0x1000b52c
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x8c4]
cmp eax, dword [ebp - 0x59c]
jge 0x1000b546
mov dword [ebp - 0x8cc], 1
jmp 0x1000b54d
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x8cc], eax
jne 0x1000b564
mov dword [ebp - 0xbcc], 1
jmp 0x1000b56b
and dword [ebp - 0xbcc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaa0]
mov dword [ebp - 0xca8], eax
imul eax, dword [ebp - 0xb4], 0xb994
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x180], 0x17
jmp 0x1000b5a7
cmp dword [ebp - 0x180], 0x12
je 0x1000b97f
mov dword [ebp - 0x3d0], 0xfffffff7
mov dword [ebp - 0xae0], 0xcb87
mov dword [ebp - 0x290], 0
jmp 0x1000b5e1
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x1000b5fd
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xc60], 0x5269945c
jmp 0x1000b5d4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x8e4], 0xfffffffb
jg 0x1000b752
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0x1e0], eax
jge 0x1000b639
mov dword [ebp - 0x5a4], 1
jmp 0x1000b640
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 0xffff
je 0x1000b658
mov dword [ebp - 0x8d4], 1
jmp 0x1000b65f
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x8fc]
imul eax, dword [ebp - 0x8d4]
cmp eax, dword [ebp - 0x3d0]
jge 0x1000b680
mov dword [ebp - 0x5ac], 1
jmp 0x1000b687
and dword [ebp - 0x5ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaa0]
imul eax, dword [ebp - 0x5ac]
cmp eax, 1
jae 0x1000b6ac
mov dword [ebp - 0x8dc], 1
jmp 0x1000b6b3
and dword [ebp - 0x8dc], 0
cmp dword [ebp - 0x8dc], 0xb182bc9
je 0x1000b6cb
mov dword [ebp - 0x37c], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x37c]
mov dword [ebp + eax - 0xc60], ecx
mov eax, dword [ebp - 0xae0]
cmp dword [ebp - 0x37c], eax
je 0x1000b788
mov dword [ebp - 0x8f4], 1
jmp 0x1000b78f
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x8f4], eax
je 0x1000b7a9
mov dword [ebp - 0x5cc], 1
jmp 0x1000b7b0
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x5cc]
jl 0x1000b94b
mov dword [ebp - 0xae8], 0
mov dword [ebp - 0x384], 0x8b939845
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc60]
mov dword [ebp - 0xb68], eax
push 4
pop eax
test eax, eax
je 0x1000b801
push 4
pop eax
shl eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0xaa0]
jne 0x1000b810
cmp dword [ebp - 0x2c], 0
jne 0x1000b810
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x1000b97a
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1000b59a
jmp 0x1000b44c
jmp 0x1000b404
mov dword [ebp - 0x32c], 1
mov dword [ebp - 0xe3c], 1
mov dword [ebp - 0x324], 0
jmp 0x1000b9b6
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 3
jge 0x1000b9d2
mov eax, dword [ebp - 0x324]
mov dword [ebp + eax*4 - 0xe9c], 0
jmp 0x1000b9a9
mov dword [ebp - 0x32c], 5
jmp 0x1000b9eb
mov eax, dword [ebp - 0x32c]
dec eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0xfffffffb
je 0x1000ba7b
mov dword [ebp - 0xc7c], 0xd8d13034
mov dword [ebp - 0xd90], 1
mov dword [ebp - 0xcc0], 6
mov dword [ebp - 0xde8], 6
mov dword [ebp - 0xcc8], 0xffffffff
mov dword [ebp - 0x91c], 9
mov dword [ebp - 0x29c], 0
jmp 0x1000ba4d
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 3
jge 0x1000ba69
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0xee4], 4
jmp 0x1000ba40
mov eax, dword [ebp - 0x91c]
dec eax
mov dword [ebp - 0x91c], eax
jmp 0x1000b9de
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x10], 0x44ad3740
mov dword [ebp - 0x2a4], 0xffff
mov dword [ebp - 0x3e0], 0xffffffff
mov dword [ebp - 0x644], 0x72be
mov dword [ebp - 0x20], 0
jmp 0x1000babe
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1b
jl 0x1000bc44
mov dword [ebp - 0x1b8], 0xb1658084
cmp dword [ebp - 0x1b8], 0
je 0x1000baf6
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000baf6
mov dword [ebp - 0x5f4], 1
jmp 0x1000bafd
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1b8], eax
jg 0x1000bb1d
mov dword [ebp - 0x604], 1
jmp 0x1000bb24
and dword [ebp - 0x604], 0
mov eax, 0xef6e229e
test eax, eax
je 0x1000bb42
cmp dword [ebp - 0x1b8], 0
je 0x1000bb42
mov dword [ebp - 0x924], 1
jmp 0x1000bb49
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x924], eax
jle 0x1000bb60
mov dword [ebp - 0x5fc], 1
jmp 0x1000bb67
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x5fc]
add eax, 0xffff
cmp dword [ebp - 0x1b8], eax
je 0x1000bb86
mov dword [ebp - 0x92c], 1
jmp 0x1000bb8d
and dword [ebp - 0x92c], 0
cmp dword [ebp - 0x92c], 0xfffffff7
jne 0x1000bba2
mov dword [ebp - 0x934], 1
jmp 0x1000bba9
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x604]
cmp eax, dword [ebp - 0x934]
jne 0x1000bbec
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x1000bbe2
push 0x1a2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
cmp dword [ebp - 0x10], 0
je 0x1000bbea
jmp 0x1000bc44
jmp 0x1000bc3f
mov dword [ebp - 0x10], 0xb6917ab6
mov dword [ebp - 0x14], 0xfffffff7
jmp 0x1000bc03
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 7
jge 0x1000bc3f
mov dword [ebp - 0x10], 0
jmp 0x1000bc19
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 8
jg 0x1000bc3d
mov byte [ebp - 0x152], 0
movzx eax, byte [ebp - 0x152]
test eax, eax
je 0x1000bc3b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x1000bc12
jmp 0x1000bbfc
jmp 0x1000bab7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd98], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0xcd0], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0xe48], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
jl 0x1000bc79
mov dword [ebp - 0x60c], 1
jmp 0x1000bc80
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x60c], eax
jge 0x1000bc97
mov dword [ebp - 0x93c], 1
jmp 0x1000bc9e
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x93c]
jge 0x1000bcb5
mov dword [ebp - 0x614], 1
jmp 0x1000bcbc
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000bce6
cmp dword [ebp - 0x20], 0
je 0x1000bce6
cmp dword [ebp - 0x3e0], 0
je 0x1000bce6
mov dword [ebp - 0x944], 1
jmp 0x1000bced
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x944]
shl eax, 1
cmp eax, dword [ebp - 0x10]
jge 0x1000bd06
mov dword [ebp - 0xb70], 1
jmp 0x1000bd0d
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xcd8], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xda0], eax
cmp dword [ebp - 0x10], 0xbc35
jge 0x1000bd3a
mov dword [ebp - 0x61c], 1
jmp 0x1000bd41
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x20], eax
je 0x1000bd73
mov dword [ebp - 0x94c], 1
jmp 0x1000bd7a
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
add eax, 3
cmp eax, 9
jae 0x1000c049
mov dword [ebp - 0x38c], 0x2d1f
mov dword [ebp - 0x62c], 0xfffffffd
mov dword [ebp - 0x330], 0
jmp 0x1000bdb9
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 1
jge 0x1000bdd5
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0x1f8], 0x624e194e
jmp 0x1000bdac
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f8], 0
je 0x1000bf1e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd28], eax
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, dword [ebp - 0x20]
jle 0x1000be07
mov dword [ebp - 0x624], 1
jmp 0x1000be0e
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 1
jne 0x1000be23
mov dword [ebp - 0x954], 1
jmp 0x1000be2a
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x954]
sub eax, 0x2ad4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp - 0x62c]
sub eax, 0x6f2db44e
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1f8]
cmp eax, 0x3153ed87
jne 0x1000be6c
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x644]
cmp dword [ebp - 0x974], eax
jl 0x1000bf3f
mov dword [ebp - 0x64c], 1
jmp 0x1000bf46
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x64c], eax
jle 0x1000bf60
mov dword [ebp - 0x97c], 1
jmp 0x1000bf67
and dword [ebp - 0x97c], 0
cmp dword [ebp - 0x97c], 8
jge 0x1000bf7c
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1000c078
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0xc5a
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov dword [ebp - 0x66c], 6
mov dword [ebp - 0xa8], 0
jmp 0x1000c09b
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jge 0x1000c0b7
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xf1c], 5
jmp 0x1000c08e
mov dword [ebp - 0xa8], 0
jmp 0x1000c0d0
cmp dword [ebp - 0xa8], 2
jge 0x1000c0ec
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xe90], 0x43d837bc
jmp 0x1000c0c3
mov byte [ebp - 0x147], 0
movzx eax, byte [ebp - 0x147]
test eax, eax
je 0x1000c108
pop edi
pop esi
mov esp, ebp
pop ebp
ret