Function at 0x10008fed
Capabilities:
Create process on windows
Delete file
Get disk information
Get disk size
Modify service
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10ec
call fcn.10076a60
push esi
push edi
mov dword [ebp - 0xac], 0x824a8c6a
mov dword [ebp - 0x14c], 0x57a7c203
mov dword [ebp - 0x154], 0xffffffff
mov dword [ebp - 0xfc], 0xe26b5cfd
mov dword [ebp - 0x9c0], 0x99fa
mov dword [ebp - 0x308], 0
jmp 0x10009047
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jge 0x10009063
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0x9ec], 0x7862fd41
jmp 0x1000903a
mov dword [ebp - 0x14c], 1
jmp 0x1000907c
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jl 0x10009413
mov dword [ebp - 0x834], 0x17b4d2c2
mov dword [ebp - 0x1e8], 0
jmp 0x100090ac
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 4
jge 0x100090c8
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0xa3c], 0xa756
jmp 0x1000909f
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xef0], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa3c]
mov dword [ebp - 0xe50], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xa3c]
cmp dword [ebp + eax - 0xa3c], ecx
jne 0x1000910f
mov dword [ebp - 0x6b8], 1
jmp 0x10009116
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
add eax, 0xfffb
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x9ec]
jl 0x1000913c
mov dword [ebp - 0xa40], 1
jmp 0x10009143
and dword [ebp - 0xa40], 0
mov dword [ebp - 0x154], 0xfffffffc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9ec]
cmp dword [ebp - 0x154], eax
jl 0x1000916e
mov dword [ebp - 0x924], 1
jmp 0x10009175
and dword [ebp - 0x924], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa3c]
cmp dword [ebp - 0x924], eax
jg 0x10009196
mov dword [ebp - 0x92c], 1
jmp 0x1000919d
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x9c0]
cmp dword [ebp - 0xfc], eax
jg 0x100091c3
mov dword [ebp - 0x9c8], 1
jmp 0x100091ca
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x9c0]
cmp dword [ebp - 0x9c8], eax
jne 0x100091e4
mov dword [ebp - 0x9d0], 1
jmp 0x100091eb
and dword [ebp - 0x9d0], 0
cmp dword [ebp - 0x9d0], 0x3ff14eb4
jle 0x10009203
mov dword [ebp - 0x81c], 1
jmp 0x1000920a
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 8
je 0x1000921f
mov dword [ebp - 0x3f8], 1
jmp 0x10009226
and dword [ebp - 0x3f8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa3c]
sub eax, dword [ebp - 0x3f8]
add eax, 9
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0xa3c]
jg 0x10009259
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xa3c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa3c]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x9ec]
je 0x100092fc
mov dword [ebp - 0xfc], 1
jmp 0x10009292
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x100092cc
mov eax, dword [ebp - 0x14c]
cmp dword [ebp + eax*4 - 0x9ec], 0
jne 0x100092b7
mov dword [ebp - 0x824], 1
jmp 0x100092be
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0x834], eax
jmp 0x10009285
mov byte [ebp - 0xdb], 0
movzx eax, byte [ebp - 0xdb]
test eax, eax
je 0x100092f7
push 0x748
push 0x85
push 0
push 0xfdf
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
jmp 0x1000940e
mov dword [ebp - 0x2d4], 0
jmp 0x10009315
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 1
jge 0x10009331
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0xa7c], 0x5d0
jmp 0x10009308
mov dword [ebp - 0x154], 0
jmp 0x1000934a
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jg 0x1000940e
mov dword [ebp - 0x34c], 0xffffffff
cmp dword [ebp - 0x34c], 0
je 0x1000937f
mov eax, 0xd441
test eax, eax
je 0x1000937f
mov dword [ebp - 0x400], 1
jmp 0x10009386
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x34c]
cmp eax, dword [ebp - 0x400]
jle 0x100093a0
mov dword [ebp - 0x344], 1
jmp 0x100093a7
and dword [ebp - 0x344], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x344]
mov dword [ebp + eax - 0xa7c], ecx
mov eax, dword [ebp - 0x344]
inc eax
cmp dword [ebp - 0xfc], eax
jge 0x100093d5
mov dword [ebp - 0x82c], 1
jmp 0x100093dc
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x34c]
cmp dword [ebp - 0x82c], eax
jg 0x100093f6
mov dword [ebp - 0x408], 1
jmp 0x100093fd
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x834], eax
jmp 0x1000933d
jmp 0x1000906f
mov dword [ebp - 0xac], 0
jmp 0x1000942c
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 9
je 0x100096c8
mov dword [ebp - 0xe44], 0xa684
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1000945f
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov byte [ebp - 0x143], 0
movzx eax, byte [ebp - 0x143]
test eax, eax
je 0x1000948f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x1f0], 0x1d69f428
mov dword [ebp - 0x1f0], 0
jmp 0x100094b2
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 8
jg 0x100096c3
mov dword [ebp - 0xa94], 0xffffffff
mov dword [ebp - 0x1b0], 0xffffffff
mov dword [ebp - 0x410], 3
mov dword [ebp - 0x844], 0xfffffffb
mov dword [ebp - 0x54], 0
jmp 0x100094f7
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x1000950d
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xc30], 6
jmp 0x100094f0
mov dword [ebp - 0x54], 0
jmp 0x1000951d
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x10009533
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xfe4], 0xa6aed1d2
jmp 0x10009516
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0xf80], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc30]
mov dword [ebp - 0xe4c], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0xed8], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0xe54], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc30], 0
je 0x1000958f
mov eax, 0xfad5
test eax, eax
je 0x1000958f
mov dword [ebp - 0xa84], 1
jmp 0x10009596
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0xcec], eax
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x844], eax
je 0x100095c8
mov dword [ebp - 0x83c], 1
jmp 0x100095cf
and dword [ebp - 0x83c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc30]
cmp eax, dword [ebp - 0x83c]
jg 0x100095f0
mov dword [ebp - 0xa8c], 1
jmp 0x100095f7
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0xcf4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfe4]
cmp dword [ebp - 0xa94], eax
jl 0x10009624
mov dword [ebp - 0x418], 1
jmp 0x1000962b
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 0
ja 0x10009670
mov dword [ebp - 0xc70], 0xfffffff6
mov dword [ebp - 0xc6c], 0xfffffff6
mov dword [ebp - 0xc68], 0xfffffff6
mov dword [ebp - 0xc64], 0xfffffff6
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc70]
mov dword [ebp - 0x844], eax
jmp 0x10009688
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x10009688
call dword [sym.imp.KERNEL32.dll_GetACP]
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x100096a2
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x100096be
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
jmp 0x100094a5
jmp 0x1000941f
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x188], 0xfffffffb
mov dword [ebp - 0xc], 0
jmp 0x100096ec
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x100096ff
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x44], 0
jmp 0x100096e5
mov dword [ebp - 0xc], 0
jmp 0x1000970f
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x10009725
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1dc], 0xa6d0811
jmp 0x10009708
mov dword [ebp - 0xc], 0
jmp 0x10009735
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x1000974b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa10], 1
jmp 0x1000972e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebp - 0xa0]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x44]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xebf8
jge 0x10009789
mov dword [ebp - 0x420], 1
jmp 0x10009790
and dword [ebp - 0x420], 0
cmp dword [ebp - 0x420], 2
jl 0x100097a5
mov dword [ebp - 0x84c], 1
jmp 0x100097ac
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 0xc422
je 0x100097c4
mov dword [ebp - 0x428], 1
jmp 0x100097cb
and dword [ebp - 0x428], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0x428], eax
jle 0x100097e9
mov dword [ebp - 0xa9c], 1
jmp 0x100097f0
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xd04], eax
xor eax, eax
cmp eax, 0x1a6b719d
je 0x10009811
mov dword [ebp - 0x854], 1
jmp 0x10009818
and dword [ebp - 0x854], 0
cmp dword [ebp - 0x854], 0
jg 0x1000982d
mov dword [ebp - 0x37c], 1
jmp 0x10009834
and dword [ebp - 0x37c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x37c]
mov dword [ebp + eax - 0x1dc], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x44]
add ecx, dword [ebp - 0x37c]
sub ecx, dword [ebp + eax - 0x44]
cmp ecx, dword [ebp - 0xa0]
jle 0x10009875
mov dword [ebp - 0x430], 1
jmp 0x1000987c
and dword [ebp - 0x430], 0
cmp dword [ebp - 0x430], 0xe2db58e4
ja 0x10009bbe
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x1f8], 7
mov dword [ebp - 0x354], 0xc964b5ad
mov dword [ebp - 0x338], 0
jmp 0x100098c0
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 3
jge 0x100098dc
mov eax, dword [ebp - 0x338]
mov dword [ebp + eax*4 - 0xf9c], 0xfffffffc
jmp 0x100098b3
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xd0c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa10]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xa10]
cmp eax, 0xd6b22149
jb 0x10009917
mov dword [ebp - 0x85c], 1
jmp 0x1000991e
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x85c], eax
jg 0x10009935
mov dword [ebp - 0x438], 1
jmp 0x1000993c
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x438]
jne 0x10009953
mov dword [ebp - 0x864], 1
jmp 0x1000995a
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x864]
add eax, 7
mov dword [ebp - 0x1f8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x34]
cmp dword [ebp + eax - 0x44], ecx
jge 0x10009988
mov dword [ebp - 0x440], 1
jmp 0x1000998f
and dword [ebp - 0x440], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0x440], eax
jg 0x100099ad
mov dword [ebp - 0x86c], 1
jmp 0x100099b4
and dword [ebp - 0x86c], 0
cmp dword [ebp - 0x86c], 0xc844fc3
jle 0x100099cc
mov dword [ebp - 0x448], 1
jmp 0x100099d3
and dword [ebp - 0x448], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc]
cmp dword [ebp - 0x448], eax
jle 0x100099f4
mov dword [ebp - 0x874], 1
jmp 0x100099fb
and dword [ebp - 0x874], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
add eax, dword [ebp - 0x874]
cmp eax, dword [ebp - 0x34]
je 0x10009a1c
mov dword [ebp - 0x450], 1
jmp 0x10009a23
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x188], 0x23fe2983
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0x1f8]
jl 0x10009a5c
mov dword [ebp - 0x87c], 1
jmp 0x10009a63
and dword [ebp - 0x87c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa10]
add eax, dword [ebp - 0x87c]
je 0x10009a7b
cmp dword [ebp - 0x34], 0
mov eax, 0x32651ef2
cmp eax, 0xfffffff9
jge 0x10009a91
mov dword [ebp - 0x458], 1
jmp 0x10009a98
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
sub eax, 0xc575e2b
cmp eax, dword [ebp - 0x1f8]
jne 0x10009ab7
mov dword [ebp - 0x884], 1
jmp 0x10009abe
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x354], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0x354], eax
jl 0x10009ae8
mov dword [ebp - 0xaa4], 1
jmp 0x10009aef
and dword [ebp - 0xaa4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc]
mov dword [ebp - 0xd14], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa10]
mov dword [ebp - 0xd1c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa10]
mov dword [ebp - 0xd24], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa10]
mov dword [ebp - 0xd2c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc]
mov dword [ebp - 0xd34], eax
cmp dword [ebp - 0x34], 0
jne 0x10009b65
cmp dword [ebp - 0x354], 0
jne 0x10009b65
and dword [ebp - 0x460], 0
jmp 0x10009b6f
mov dword [ebp - 0x460], 1
cmp dword [ebp - 0x460], 0x594a39b7
je 0x10009b87
mov dword [ebp - 0x88c], 1
jmp 0x10009b8e
and dword [ebp - 0x88c], 0
cmp dword [ebp - 0x88c], 7
ja 0x10009ba3
mov dword [ebp - 0x468], 1
jmp 0x10009baa
and dword [ebp - 0x468], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x468]
mov dword [ebp + eax - 0xf9c], ecx
jmp 0x10009be9
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x10009be9
push 0
push 0
push 0
push 0
push 0
push 0
push 0x100a
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0xa0], 0
jmp 0x10009c02
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jg 0x10009ca5
mov dword [ebp - 0xaac], 0xb78960bd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1dc], 0
je 0x10009c2b
jmp 0x10009ca5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x44], 0
je 0x10009c4d
mov eax, 0x7809
test eax, eax
je 0x10009c4d
mov dword [ebp - 0x894], 1
jmp 0x10009c54
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x894], eax
je 0x10009c6e
mov dword [ebp - 0x470], 1
jmp 0x10009c75
and dword [ebp - 0x470], 0
cmp dword [ebp - 0x470], 0xffc8ecea
jne 0x10009c8d
mov dword [ebp - 0x89c], 1
jmp 0x10009c94
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0xaac], eax
jmp 0x10009bf5
mov dword [ebp - 0xac], 9
jmp 0x10009cbe
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xffffffe6
jl 0x10009cde
mov dword [ebp - 0xab4], 0x66c93ee
cmp dword [ebp - 0xab4], 0
je 0x10009cdc
jmp 0x10009cde
jmp 0x10009cb1
mov dword [ebp - 0xbc], 0x824a8c6a
mov dword [ebp - 0xbc], 0
jmp 0x10009d01
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 9
je 0x10009d56
mov dword [ebp - 0x2dc], 0x1d69f428
mov dword [ebp - 0x2dc], 0
jmp 0x10009d2d
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 8
jg 0x10009d54
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x10009d52
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
jmp 0x10009d20
jmp 0x10009cf4
mov dword [ebp - 0xbc], 9
jmp 0x10009d6f
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffe6
jl 0x10009d8f
mov dword [ebp - 0xabc], 0x66c93ee
cmp dword [ebp - 0xabc], 0
je 0x10009d8d
jmp 0x10009d8f
jmp 0x10009d62
mov dword [ebp - 0xb4], 0x824a8c6a
mov dword [ebp - 0xb4], 0
jmp 0x10009db2
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 9
je 0x10009e07
mov dword [ebp - 0x200], 0x1d69f428
mov dword [ebp - 0x200], 0
jmp 0x10009dde
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 8
jg 0x10009e05
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10009e03
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
jmp 0x10009dd1
jmp 0x10009da5
mov dword [ebp - 0xb4], 9
jmp 0x10009e20
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xffffffe6
jl 0x10009e40
mov dword [ebp - 0xac4], 0x66c93ee
cmp dword [ebp - 0xac4], 0
je 0x10009e3e
jmp 0x10009e40
jmp 0x10009e13
mov dword [ebp - 0x9e4], 0xfffffffd
mov dword [ebp - 0x9e0], 0xfffffffd
mov dword [ebp - 0x9dc], 0xfffffffd
mov dword [ebp - 0x9d8], 0xfffffffd
mov dword [ebp - 0x478], 0xb24ce554
mov dword [ebp - 0x80], 0
jmp 0x10009e82
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x10009e98
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xacc], 2
jmp 0x10009e7b
mov dword [ebp - 0x80], 0
jmp 0x10009ea8
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x10009ebe
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xff4], 0x5a83d87
jmp 0x10009ea1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9e4], 7
jmp 0x10009eec
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9e4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9e4], 5
jl 0x1000a01e
mov dword [ebp - 0xcd0], 0x2415
mov dword [ebp - 0xccc], 0x2415
mov dword [ebp - 0xcc8], 0x2415
mov dword [ebp - 0xcc4], 0x2415
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9e4]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0xffffffff
je 0x10009f50
mov dword [ebp - 0x480], 1
jmp 0x10009f57
and dword [ebp - 0x480], 0
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x9e4]
mov dword [ebp - 0x8a4], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8a4]
mov dword [ebp + eax - 0xacc], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9e4]
cmp dword [ebp - 0x8a4], eax
jne 0x10009fa0
mov dword [ebp - 0x8ac], 1
jmp 0x10009fa7
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x480]
cmp eax, dword [ebp - 0x8ac]
jle 0x10009fc5
xor eax, eax
je 0x10009fc5
mov dword [ebp - 0x394], 1
jmp 0x10009fcc
and dword [ebp - 0x394], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x394]
mov dword [ebp + eax - 0xcd0], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x9e4]
cmp dword [ebp - 0x394], eax
jle 0x10009fff
mov dword [ebp - 0x488], 1
jmp 0x1000a006
and dword [ebp - 0x488], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x488]
mov dword [ebp + eax - 0xff4], ecx
jmp 0x10009ed1
mov dword [ebp - 0x8b4], 1
mov dword [ebp - 0x340], 0
mov dword [ebp - 0xadc], 0x5a74d4b4
mov dword [ebp - 0x5c], 0
jmp 0x1000a04c
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1000a062
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x174], 0x9c9fb37b
jmp 0x1000a045
mov dword [ebp - 0x5c], 0
jmp 0x1000a072
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x1000a088
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xb6c], 0x83989226
jmp 0x1000a06b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x174], 0
jne 0x1000a1b0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb6c]
sub eax, 5
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
add eax, 0x7356a0b3
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0xb6c]
test eax, eax
jne 0x1000a0f3
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb6c], 0
jne 0x1000a0f3
and dword [ebp - 0xad4], 0
jmp 0x1000a0fd
mov dword [ebp - 0xad4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x174]
mov dword [ebp - 0xd3c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb6c]
mov dword [ebp - 0xd44], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x174]
cmp dword [ebp - 0x340], eax
jne 0x1000a144
mov dword [ebp - 0x490], 1
jmp 0x1000a14b
and dword [ebp - 0x490], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb6c]
cmp eax, dword [ebp - 0x490]
jle 0x1000a16c
mov dword [ebp - 0x8bc], 1
jmp 0x1000a173
and dword [ebp - 0x8bc], 0
cmp dword [ebp - 0x8bc], 0xb333
jne 0x1000a18b
mov dword [ebp - 0x498], 1
jmp 0x1000a192
and dword [ebp - 0x498], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x498]
sub ecx, dword [ebp + eax - 0x174]
jne 0x1000a1b0
and dword [ebp - 0x8c4], 0
jmp 0x1000a1ba
mov dword [ebp - 0x8c4], 1
cmp dword [ebp - 0x8c4], 0x3f6a0837
jne 0x1000a1d2
mov dword [ebp - 0x4a0], 1
jmp 0x1000a1d9
and dword [ebp - 0x4a0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb6c]
cmp dword [ebp - 0x4a0], eax
jge 0x1000a201
push 8
pop eax
test eax, eax
je 0x1000a201
mov dword [ebp - 0x8cc], 1
jmp 0x1000a208
and dword [ebp - 0x8cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x174]
cmp dword [ebp - 0x8cc], eax
jle 0x1000a22f
cmp dword [ebp - 0x340], 0
jne 0x1000a22f
and dword [ebp - 0x35c], 0
jmp 0x1000a239
mov dword [ebp - 0x35c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x35c]
mov dword [ebp + eax - 0x174], ecx
cmp dword [ebp - 0x35c], 0
je 0x1000a26a
mov eax, 0x61fb9a31
test eax, eax
je 0x1000a26a
mov dword [ebp - 0x4a8], 1
jmp 0x1000a271
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0xadc], eax
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1000a297
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov dword [ebp - 0x968], 0xfffffffd
mov dword [ebp - 0x964], 0xfffffffd
mov dword [ebp - 0x960], 0xfffffffd
mov dword [ebp - 0x95c], 0xfffffffd
mov dword [ebp - 0x8d4], 0xb24ce554
mov dword [ebp - 0x84], 0
jmp 0x1000a2e2
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1000a2fe
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xae4], 2
jmp 0x1000a2d5
mov dword [ebp - 0x84], 0
jmp 0x1000a317
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1000a333
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x1034], 0x5a83d87
jmp 0x1000a30a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x968], 7
jmp 0x1000a361
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x968]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x968], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x968], 5
jl 0x1000a493
mov dword [ebp - 0xcb0], 0x2415
mov dword [ebp - 0xcac], 0x2415
mov dword [ebp - 0xca8], 0x2415
mov dword [ebp - 0xca4], 0x2415
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x968]
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x8d4], 0xffffffff
je 0x1000a3c5
mov dword [ebp - 0x8dc], 1
jmp 0x1000a3cc
and dword [ebp - 0x8dc], 0
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x968]
mov dword [ebp - 0x4b0], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4b0]
mov dword [ebp + eax - 0xae4], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x968]
cmp dword [ebp - 0x4b0], eax
jne 0x1000a415
mov dword [ebp - 0x4b8], 1
jmp 0x1000a41c
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x8dc]
cmp eax, dword [ebp - 0x4b8]
jle 0x1000a43a
xor eax, eax
je 0x1000a43a
mov dword [ebp - 0x384], 1
jmp 0x1000a441
and dword [ebp - 0x384], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x384]
mov dword [ebp + eax - 0xcb0], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x968]
cmp dword [ebp - 0x384], eax
jle 0x1000a474
mov dword [ebp - 0x8e4], 1
jmp 0x1000a47b
and dword [ebp - 0x8e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8e4]
mov dword [ebp + eax - 0x1034], ecx
jmp 0x1000a346
mov dword [ebp - 0x98c], 0xfffffffd
mov dword [ebp - 0x988], 0xfffffffd
mov dword [ebp - 0x984], 0xfffffffd
mov dword [ebp - 0x980], 0xfffffffd
mov dword [ebp - 0x4c0], 0xb24ce554
mov dword [ebp - 0x64], 0
jmp 0x1000a4d5
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1000a4eb
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xaec], 2
jmp 0x1000a4ce
mov dword [ebp - 0x64], 0
jmp 0x1000a4fb
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x1000a511
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x1004], 0x5a83d87
jmp 0x1000a4f4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x98c], 7
jmp 0x1000a53f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x98c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x98c], 5
jl 0x1000a671
mov dword [ebp - 0xc80], 0x2415
mov dword [ebp - 0xc7c], 0x2415
mov dword [ebp - 0xc78], 0x2415
mov dword [ebp - 0xc74], 0x2415
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98c]
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0xffffffff
je 0x1000a5a3
mov dword [ebp - 0x4c8], 1
jmp 0x1000a5aa
and dword [ebp - 0x4c8], 0
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x98c]
mov dword [ebp - 0x8ec], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8ec]
mov dword [ebp + eax - 0xaec], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x98c]
cmp dword [ebp - 0x8ec], eax
jne 0x1000a5f3
mov dword [ebp - 0x8f4], 1
jmp 0x1000a5fa
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x8f4]
jle 0x1000a618
xor eax, eax
je 0x1000a618
mov dword [ebp - 0x364], 1
jmp 0x1000a61f
and dword [ebp - 0x364], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x364]
mov dword [ebp + eax - 0xc80], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x98c]
cmp dword [ebp - 0x364], eax
jle 0x1000a652
mov dword [ebp - 0x4d0], 1
jmp 0x1000a659
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp + eax - 0x1004], ecx
jmp 0x1000a524
mov dword [ebp - 0x1c8], 0x6915a136
mov dword [ebp - 0x208], 0
jmp 0x1000a694
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jge 0x1000a6b0
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0xc60], 0x8ec0
jmp 0x1000a687
mov dword [ebp - 0x1c8], 2
jmp 0x1000a6c9
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jl 0x1000a853
mov dword [ebp - 0x17c], 0xcd53bc6e
mov dword [ebp - 0xaf4], 0xfada
mov dword [ebp - 0x8fc], 0xe75cb554
mov dword [ebp - 0x17c], 2
jmp 0x1000a70d
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x1000a83a
mov dword [ebp - 0xafc], 1
mov dword [ebp - 0xb04], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc60], 4
jae 0x1000a74a
mov dword [ebp - 0x90c], 1
jmp 0x1000a751
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xd4c], eax
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0x8fc], eax
cmp dword [ebp - 0x8fc], 0
je 0x1000a787
cmp dword [ebp - 0xafc], 0
je 0x1000a787
mov dword [ebp - 0x4d8], 1
jmp 0x1000a78e
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x17c]
add eax, dword [ebp - 0x4d8]
je 0x1000a7af
push 8
pop eax
test eax, eax
je 0x1000a7af
mov dword [ebp - 0x904], 1
jmp 0x1000a7b6
and dword [ebp - 0x904], 0
imul eax, dword [ebp - 0x904], 0xfffe
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc60]
jle 0x1000a7df
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1000a7df
and dword [ebp - 0x4e0], 0
jmp 0x1000a7e9
mov dword [ebp - 0x4e0], 1
cmp dword [ebp - 0x4e0], 0xfff9
ja 0x1000a801
mov dword [ebp - 0x4e8], 1
jmp 0x1000a808
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x90c]
cmp eax, dword [ebp - 0x4e8]
jl 0x1000a822
mov dword [ebp - 0x914], 1
jmp 0x1000a829
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0xb04], eax
jmp 0x1000a700
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc60], 0
je 0x1000a84e
jmp 0x1000a6bc
jmp 0x1000a6bc
mov byte [ebp - 0x140], 0
movzx eax, byte [ebp - 0x140]
test eax, eax
je 0x1000a882
push 0
push 0
push 0
push 0
push 0x26fd
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x91c], 1
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0xb14], 0x5a74d4b4
mov dword [ebp - 0x8c], 0
jmp 0x1000a8b9
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1000a8d5
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x15c], 0x9c9fb37b
jmp 0x1000a8ac
mov dword [ebp - 0x8c], 0
jmp 0x1000a8ee
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x1000a90a
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xb7c], 0x83989226
jmp 0x1000a8e1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x15c], 0
jne 0x1000aa32
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb7c]
sub eax, 5
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
add eax, 0x7356a0b3
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0xb7c]
test eax, eax
jne 0x1000a975
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb7c], 0
jne 0x1000a975
and dword [ebp - 0xb0c], 0
jmp 0x1000a97f
mov dword [ebp - 0xb0c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x15c]
mov dword [ebp - 0xdec], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb7c]
mov dword [ebp - 0xdf4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x15c]
cmp dword [ebp - 0x2e4], eax
jne 0x1000a9c6
mov dword [ebp - 0x4f4], 1
jmp 0x1000a9cd
and dword [ebp - 0x4f4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb7c]
cmp eax, dword [ebp - 0x4f4]
jle 0x1000a9ee
mov dword [ebp - 0x4f8], 1
jmp 0x1000a9f5
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 0xb333
jne 0x1000aa0d
mov dword [ebp - 0x758], 1
jmp 0x1000aa14
and dword [ebp - 0x758], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x758]
sub ecx, dword [ebp + eax - 0x15c]
jne 0x1000aa32
and dword [ebp - 0x500], 0
jmp 0x1000aa3c
mov dword [ebp - 0x500], 1
cmp dword [ebp - 0x500], 0x3f6a0837
jne 0x1000aa54
mov dword [ebp - 0x888], 1
jmp 0x1000aa5b
and dword [ebp - 0x888], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb7c]
cmp dword [ebp - 0x888], eax
jge 0x1000aa83
push 8
pop eax
test eax, eax
je 0x1000aa83
mov dword [ebp - 0x508], 1
jmp 0x1000aa8a
and dword [ebp - 0x508], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x15c]
cmp dword [ebp - 0x508], eax
jle 0x1000aab1
cmp dword [ebp - 0x2e4], 0
jne 0x1000aab1
and dword [ebp - 0x3a4], 0
jmp 0x1000aabb
mov dword [ebp - 0x3a4], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3a4]
mov dword [ebp + eax - 0x15c], ecx
cmp dword [ebp - 0x3a4], 0
je 0x1000aaec
mov eax, 0x61fb9a31
test eax, eax
je 0x1000aaec
mov dword [ebp - 0x760], 1
jmp 0x1000aaf3
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xb14], eax
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x1000ab19
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov dword [ebp - 0x190], 0xa66fe7d8
mov dword [ebp - 0x210], 0
jmp 0x1000ab3c
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x1000ab58
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0xb8c], 6
jmp 0x1000ab2f
mov dword [ebp - 0x190], 1
jmp 0x1000ab71
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jl 0x1000acf5
mov dword [ebp - 0x1b8], 0xfffffffd
mov eax, dword [ebp - 0x190]
cmp dword [ebp + eax*4 - 0xb8c], 0
je 0x1000ab9d
jmp 0x1000acf5
mov dword [ebp - 0x1b8], 1
jmp 0x1000abb6
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x1000acf0
mov dword [ebp - 0x314], 0
jmp 0x1000abdc
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 4
jge 0x1000abf8
mov eax, dword [ebp - 0x314]
mov dword [ebp + eax*4 - 0xca0], 0xfffffff8
jmp 0x1000abcf
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xca0], 1
jmp 0x1000ac26
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xca0]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xca0], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xca0], 0
jl 0x1000aceb
mov dword [ebp - 0x218], 0xd2ab60e7
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0xb8c], 3
mov dword [ebp - 0x218], 0xffffffe2
jmp 0x1000ac6e
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffe5
jl 0x1000ace6
mov dword [ebp - 0x2ec], 0x84217059
mov dword [ebp - 0x2ec], 1
jmp 0x1000ac9a
mov eax, dword [ebp - 0x2ec]
dec eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jl 0x1000acbd
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000acbb
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x1000ac8d
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1000ace1
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1000ac61
jmp 0x1000ac0b
jmp 0x1000aba9
jmp 0x1000ab64
mov dword [ebp - 0x510], 1
mov dword [ebp - 0x220], 0
mov dword [ebp - 0xb24], 0x5a74d4b4
mov dword [ebp - 0x6c], 0
jmp 0x1000ad23
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1000ad39
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x16c], 0x9c9fb37b
jmp 0x1000ad1c
mov dword [ebp - 0x6c], 0
jmp 0x1000ad49
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x1000ad5f
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xb5c], 0x83989226
jmp 0x1000ad42
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x16c], 0
jne 0x1000ae87
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb5c]
sub eax, 5
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
add eax, 0x7356a0b3
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0xb5c]
test eax, eax
jne 0x1000adca
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb5c], 0
jne 0x1000adca
and dword [ebp - 0xb1c], 0
jmp 0x1000add4
mov dword [ebp - 0xb1c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x16c]
mov dword [ebp - 0xdfc], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb5c]
mov dword [ebp - 0xe04], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x16c]
cmp dword [ebp - 0x220], eax
jne 0x1000ae1b
mov dword [ebp - 0x920], 1
jmp 0x1000ae22
and dword [ebp - 0x920], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb5c]
cmp eax, dword [ebp - 0x920]
jle 0x1000ae43
mov dword [ebp - 0x518], 1
jmp 0x1000ae4a
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0xb333
jne 0x1000ae62
mov dword [ebp - 0x768], 1
jmp 0x1000ae69
and dword [ebp - 0x768], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x768]
sub ecx, dword [ebp + eax - 0x16c]
jne 0x1000ae87
and dword [ebp - 0x520], 0
jmp 0x1000ae91
mov dword [ebp - 0x520], 1
cmp dword [ebp - 0x520], 0x3f6a0837
jne 0x1000aea9
mov dword [ebp - 0x890], 1
jmp 0x1000aeb0
and dword [ebp - 0x890], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb5c]
cmp dword [ebp - 0x890], eax
jge 0x1000aed8
push 8
pop eax
test eax, eax
je 0x1000aed8
mov dword [ebp - 0x528], 1
jmp 0x1000aedf
and dword [ebp - 0x528], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x16c]
cmp dword [ebp - 0x528], eax
jle 0x1000af06
cmp dword [ebp - 0x220], 0
jne 0x1000af06
and dword [ebp - 0x36c], 0
jmp 0x1000af10
mov dword [ebp - 0x36c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x36c]
mov dword [ebp + eax - 0x16c], ecx
cmp dword [ebp - 0x36c], 0
je 0x1000af41
mov eax, 0x61fb9a31
test eax, eax
je 0x1000af41
mov dword [ebp - 0x770], 1
jmp 0x1000af48
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0xb24], eax
mov byte [ebp - 0x142], 0
movzx eax, byte [ebp - 0x142]
test eax, eax
je 0x1000af6e
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov dword [ebp - 0x198], 0x6915a136
mov dword [ebp - 0x32c], 0
jmp 0x1000af91
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 3
jge 0x1000afad
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0xc54], 0x8ec0
jmp 0x1000af84
mov dword [ebp - 0x198], 2
jmp 0x1000afc6
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x1000b150
mov dword [ebp - 0x1d8], 0xcd53bc6e
mov dword [ebp - 0xa74], 0xfada
mov dword [ebp - 0x530], 0xe75cb554
mov dword [ebp - 0x1d8], 2
jmp 0x1000b00a
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
jl 0x1000b137
mov dword [ebp - 0xa5c], 1
mov dword [ebp - 0xac8], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc54], 4
jae 0x1000b047
mov dword [ebp - 0x540], 1
jmp 0x1000b04e
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xe0c], eax
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 0
je 0x1000b084
cmp dword [ebp - 0xa5c], 0
je 0x1000b084
mov dword [ebp - 0x9cc], 1
jmp 0x1000b08b
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x1d8]
add eax, dword [ebp - 0x9cc]
je 0x1000b0ac
push 8
pop eax
test eax, eax
je 0x1000b0ac
mov dword [ebp - 0x538], 1
jmp 0x1000b0b3
and dword [ebp - 0x538], 0
imul eax, dword [ebp - 0x538], 0xfffe
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc54]
jle 0x1000b0dc
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1000b0dc
and dword [ebp - 0x778], 0
jmp 0x1000b0e6
mov dword [ebp - 0x778], 1
cmp dword [ebp - 0x778], 0xfff9
ja 0x1000b0fe
mov dword [ebp - 0x898], 1
jmp 0x1000b105
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x540]
cmp eax, dword [ebp - 0x898]
jl 0x1000b11f
mov dword [ebp - 0x548], 1
jmp 0x1000b126
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0xac8], eax
jmp 0x1000affd
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc54], 0
je 0x1000b14b
jmp 0x1000afb9
jmp 0x1000afb9
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x1000b17f
push 0
push 0
push 0
push 0
push 0x26fd
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x228], 0
jmp 0x1000b198
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x1000b1b4
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x938], 0xac204e2d
jmp 0x1000b18b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x938], 0
jmp 0x1000b1e2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x938]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x938], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x938], 0x13
jle 0x1000b262
mov dword [ebp - 0x2f4], 0
jmp 0x1000b20b
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 3
jge 0x1000b227
mov eax, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0xfc0], 0x97f0a290
jmp 0x1000b1fe
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000b243
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x938]
mov dword [ebp + ecx - 0xfc0], eax
jmp 0x1000b1c7
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1000b27c
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x1a0], 0x33a4
mov dword [ebp - 0xe14], 0xffffffff
mov dword [ebp - 0xe1c], 0xeda58528
mov dword [ebp - 0xe24], 0x52aa0a5d
mov dword [ebp - 0xe2c], 0x7e813a3d
mov dword [ebp - 0xe34], 0x63782845
mov dword [ebp - 0x230], 0
jmp 0x1000b2d1
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x1000b2ed
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0xe58], 0x2e65251c
jmp 0x1000b2c4
cmp dword [ebp - 0x1a0], 0
je 0x1000b405
mov dword [ebp - 0x31c], 0
jmp 0x1000b313
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 3
jge 0x1000b32f
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0x108c], 0xffffffff
jmp 0x1000b306
mov dword [ebp - 0x1a0], 7
jmp 0x1000b348
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xfffffff5
jge 0x1000b403
mov dword [ebp - 0x238], 0x8c9f3690
mov dword [ebp - 0xe60], 3
mov dword [ebp - 0xe68], 0xfffffff6
mov dword [ebp - 0xf54], 1
mov dword [ebp - 0xf50], 1
mov dword [ebp - 0xf4c], 1
mov dword [ebp - 0xf48], 1
mov dword [ebp - 0x238], 0
jmp 0x1000b3b4
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jg 0x1000b3fe
mov dword [ebp - 0xf68], 0xfffffffe
mov dword [ebp - 0xf64], 0xfffffffe
mov dword [ebp - 0xf60], 0xfffffffe
mov dword [ebp - 0xf5c], 0xfffffffe
mov dword [ebp - 0x780], 0xf1fc
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x780], eax
jmp 0x1000b3a7
jmp 0x1000b33b
jmp 0x1000b421
mov byte [ebp - 0x144], 0
movzx eax, byte [ebp - 0x144]
test eax, eax
je 0x1000b421
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov dword [ebp - 0x1c0], 0xa66fe7d8
mov dword [ebp - 0x2fc], 0
jmp 0x1000b444
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 2
jge 0x1000b460
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0xb84], 6
jmp 0x1000b437
mov dword [ebp - 0x1c0], 1
jmp 0x1000b479
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x1000b5fd
mov dword [ebp - 0x1a8], 0xfffffffd
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp + eax*4 - 0xb84], 0
je 0x1000b4a5
jmp 0x1000b5fd
mov dword [ebp - 0x1a8], 1
jmp 0x1000b4be
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jl 0x1000b5f8
mov dword [ebp - 0x240], 0
jmp 0x1000b4e4
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
jge 0x1000b500
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xcc0], 0xfffffff8
jmp 0x1000b4d7
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xcc0], 1
jmp 0x1000b52e
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xcc0]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xcc0], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xcc0], 0
jl 0x1000b5f3
mov dword [ebp - 0x33c], 0xd2ab60e7
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0xb84], 3
mov dword [ebp - 0x33c], 0xffffffe2
jmp 0x1000b576
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0xffffffe5
jl 0x1000b5ee
mov dword [ebp - 0x248], 0x84217059
mov dword [ebp - 0x248], 1
jmp 0x1000b5a2
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x1000b5c5
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x1000b5c3
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x1000b595
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1000b5e9
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1000b569
jmp 0x1000b513
jmp 0x1000b4b1
jmp 0x1000b46c
mov dword [ebp - 0x304], 1
mov dword [ebp - 0x4c], 0
jmp 0x1000b617
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x1000b62d
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x1024], 0xffffffff
jmp 0x1000b610
mov dword [ebp - 0x4c], 0
jmp 0x1000b63d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1000b653
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x10b0], 0
jmp 0x1000b636
mov dword [ebp - 0x304], 0
jmp 0x1000b66c
mov eax, dword [ebp - 0x304]
dec eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0xffffffe2
jge 0x1000b766
mov dword [ebp - 0x324], 0x33843046
mov dword [ebp - 0x250], 0
jmp 0x1000b69c
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 4
jge 0x1000b6b8
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0xbdc], 0xffffffff
jmp 0x1000b68f
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xbdc], 0
jmp 0x1000b6e6
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xbdc]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xbdc], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xbdc], 3
jg 0x1000b711
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xbdc]
cmp dword [ebp + eax*4 - 0x1024], 0
je 0x1000b70f
jmp 0x1000b711
jmp 0x1000b6cb
mov dword [ebp - 0x324], 0xc
jmp 0x1000b72a
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0xc
jl 0x1000b761
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1000b75f
push 0x5c7
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1000b71d
jmp 0x1000b65f
mov dword [ebp - 0x1d0], 0x6915a136
mov dword [ebp - 0x258], 0
jmp 0x1000b789
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x1000b7a5
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xc48], 0x8ec0
jmp 0x1000b77c
mov dword [ebp - 0x1d0], 2
jmp 0x1000b7be
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jl 0x1000b948
mov dword [ebp - 0x180], 0xcd53bc6e
mov dword [ebp - 0xa60], 0xfada
mov dword [ebp - 0x550], 0xe75cb554
mov dword [ebp - 0x180], 2
jmp 0x1000b802
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jl 0x1000b92f
mov dword [ebp - 0xb00], 1
mov dword [ebp - 0xa68], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc48], 4
jae 0x1000b83f
mov dword [ebp - 0x560], 1
jmp 0x1000b846
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0xe70], eax
mov eax, dword [ebp - 0xa60]
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 0
je 0x1000b87c
cmp dword [ebp - 0xb00], 0
je 0x1000b87c
mov dword [ebp - 0x928], 1
jmp 0x1000b883
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x180]
add eax, dword [ebp - 0x928]
je 0x1000b8a4
push 8
pop eax
test eax, eax
je 0x1000b8a4
mov dword [ebp - 0x558], 1
jmp 0x1000b8ab
and dword [ebp - 0x558], 0
imul eax, dword [ebp - 0x558], 0xfffe
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc48]
jle 0x1000b8d4
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1000b8d4
and dword [ebp - 0x788], 0
jmp 0x1000b8de
mov dword [ebp - 0x788], 1
cmp dword [ebp - 0x788], 0xfff9
ja 0x1000b8f6
mov dword [ebp - 0x8a0], 1
jmp 0x1000b8fd
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x560]
cmp eax, dword [ebp - 0x8a0]
jl 0x1000b917
mov dword [ebp - 0x568], 1
jmp 0x1000b91e
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0xa68], eax
jmp 0x1000b7f5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc48], 0
je 0x1000b943
jmp 0x1000b7b1
jmp 0x1000b7b1
mov byte [ebp - 0x146], 0
movzx eax, byte [ebp - 0x146]
test eax, eax
je 0x1000b977
push 0
push 0
push 0
push 0
push 0x26fd
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0xa8], 0x7e2799ac
mov dword [ebp - 0x8b0], 0
mov dword [ebp - 0x930], 0xfffffffe
mov dword [ebp - 0x74], 0
jmp 0x1000b9a5
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1000b9bb
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x374], 0x92657cf7
jmp 0x1000b99e
mov dword [ebp - 0x74], 0
jmp 0x1000b9cb
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1000b9e1
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x590], 0xfff9
jmp 0x1000b9c4
mov dword [ebp - 0xa8], 0
jmp 0x1000b9fa
cmp dword [ebp - 0xa8], 6
jl 0x1000be44
mov dword [ebp - 0xa4], 0xfd4914d2
mov dword [ebp - 0x260], 0xfff8
mov dword [ebp - 0x94], 0
jmp 0x1000ba34
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x1000ba50
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x10cc], 0x71fda660
jmp 0x1000ba27
mov dword [ebp - 0x94], 0
jmp 0x1000ba69
cmp dword [ebp - 0x94], 2
jge 0x1000ba85
movzx eax, byte [0x10669928]
test eax, eax
je 0x1000be62
mov esi, 0x1007d638
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10010a46
mov dword [ebp - 0x184], 0xa66fe7d8
mov dword [ebp - 0x334], 0
jmp 0x1000be85
cmp dword [ebp - 0x334], 2
jge 0x1000bea1
mov eax, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0xbc4], 6
jmp 0x1000be78
mov dword [ebp - 0x184], 1
jmp 0x1000beba
pop edi
pop esi
mov esp, ebp
pop ebp
ret