Function at 0x10008bb2
Capabilities:
Check os version
Create directory
Create pipe
Delete registry key
Enumerate files on windows
Extract resource via kernel32 functions
Get common file path
Get disk information
Get geographical location
Identify system language via api
Parse pe header
Query environment variable
Set registry value
Terminate process

Disassembly:
mov eax, 0x10074b79
call fcn.10073fd0
mov eax, 0x120c
call fcn.10070780
push ebx
push esi
push edi
or eax, 0xffffffff
mov byte [ebp - 0x5d], dl
mov dword [ebp - 0x3c], eax
xor ebx, ebx
mov edi, 0x2cb3a3fc
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x28], edi
inc ebx
push 0
mov dword [ebp - 0x38], ebx
mov esi, 0x9f4
mov dword [ebp - 0x3c], 0xffffffe5
pop eax
jmp 0x10008c09
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10008c06
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 7
jne 0x10008bf4
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setle dl
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [ebp - 0x3c], ecx
jg 0x10008c3a
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x10008c3c
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
je 0x10008c80
mov dword [ebp - 0x40], 0xafbd13d
mov dword [ebp - 0x38], 0x7eb8e136
cmp dword [ebp - 0x40], eax
je 0x10008c65
mov eax, ebx
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10008c9f
push eax
push 0x10a8
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10008c9d
mov dword [ebp - 0x38], 0x58c458a9
xor ecx, ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add edx, 0x69d1fe90
cmp edx, eax
setg cl
mov dword [ebp - 0x28], ecx
xor eax, eax
or edx, 0xffffffff
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], 0xffffffe5
jmp 0x10008cc9
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10008cc6
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 7
jne 0x10008cb4
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setle dl
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [ebp - 0x3c], ecx
jg 0x10008cfa
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x10008cfc
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
je 0x10008d40
mov dword [ebp - 0x40], 0xafbd13d
mov dword [ebp - 0x38], 0x7eb8e136
cmp dword [ebp - 0x40], eax
je 0x10008d25
mov eax, ebx
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10008d5f
push eax
push 0x10a8
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10008d5d
mov dword [ebp - 0x38], 0x58c458a9
xor ecx, ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add edx, 0x69d1fe90
cmp edx, eax
setg cl
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10008d7f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xce8], 0x1c08901f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10008d67
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10008d95
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10008da7
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], 0xffffffe5
jmp 0x10008dd1
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10008dce
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 7
jne 0x10008dbc
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setle dl
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [ebp - 0x3c], ecx
jg 0x10008e02
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x10008e04
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
je 0x10008e48
mov dword [ebp - 0x40], 0xafbd13d
mov dword [ebp - 0x38], 0x7eb8e136
cmp dword [ebp - 0x40], eax
je 0x10008e2d
mov eax, ebx
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10008e67
push eax
push 0x10a8
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10008e65
mov dword [ebp - 0x38], 0x58c458a9
xor ecx, ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add edx, 0x69d1fe90
cmp edx, eax
setg cl
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10008e87
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcf8], 0x1c08901f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10008e6f
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10008e9d
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10008ead
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov dword [ebp - 0x20], 0xaeef20fe
lea ecx, [ebp - 0x3f4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], 0x57497f3c
mov dword [ebp - 0x38], 0xbd5d
push 3
call fcn.10022f94
xor eax, eax
lea ecx, [ebp - 0xb90]
push ebx
mov dword [ebp - 4], eax
call fcn.10022f94
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x30], 0xadd1eb10
mov dword [ebp - 0x40], 0x549e1f9a
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10008f24
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3f4]
call fcn.10023032
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10008f09
xor eax, eax
mov dword [ebp - 0x18], eax
or esi, 0xffffffff
cmp dword [ebp - 0x18], ebx
jge 0x10008f44
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb90]
call fcn.10023032
mov dword [eax], esi
inc dword [ebp - 0x18]
jmp 0x10008f2a
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10008f51
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
cmp dword [ebp - 0x20], ecx
jge 0x10008f6d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
cmp eax, 0xfffffff7
setne cl
cmp ecx, 9
jbe 0x10008f8c
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x10008f8e
mov ecx, ebx
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
push 4
setle dl
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
pop ecx
cmp eax, dword [ebp - 0x20]
jg 0x100090c6
xor eax, eax
mov dword [ebp - 0x1c], 0x9ee52129
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10008fe8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3dc], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10008fd3
xor eax, eax
push 2
pop ebx
cmp dword [ebp - 0x3dc], eax
jne 0x1000906c
cmp dword [ebp - 0x20], eax
je 0x10009004
cmp dword [ebp - 0x38], eax
je 0x10009004
xor eax, eax
lea edi, [eax + 1]
jmp 0x10009006
mov edi, eax
push ebx
lea ecx, [ebp - 0x3f4]
call fcn.10023032
mov ecx, dword [ebp - 0x20]
mov esi, eax
xor eax, eax
xor edx, edx
inc eax
cmp ecx, eax
mov ecx, dword [ebp - 0x3dc]
push ebx
setl dl
xor eax, eax
add edx, ecx
mov ecx, dword [ebp - 0x3dc]
cmp edx, ecx
setle al
xor ecx, ecx
cmp eax, dword [esi]
setge cl
sub edi, ecx
lea ecx, [ebp - 0x3f4]
call fcn.10023032
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp edi, ecx
setne dl
sub edx, 0x6daafd55
add edx, dword [eax]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
inc edx
sub edx, eax
jne 0x1000906c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3dc]
lea ecx, [ebp - 0x3f4]
imul eax, dword [ebp - 0x1c]
push ebx
mov dword [ebp - 0x10], eax
call fcn.10023032
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x3f4]
push ebx
call fcn.10023032
push ebx
lea ecx, [ebp - 0x3f4]
call fcn.10023032
mov eax, dword [ebp - 0x3dc]
xor edi, edi
mov eax, dword [ebp - 0x3d8]
inc edi
mov eax, dword [ebp - 0x3d4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
jmp 0x1000913c
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff9
push ecx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xc7c]
call fcn.10022f94
push 2
pop ebx
xor eax, eax
mov byte [ebp - 4], bl
xor edi, edi
mov dword [ebp - 0x18], eax
inc edi
cmp dword [ebp - 0x18], edi
jge 0x10009109
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd08], 0x478c2ba2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100090f1
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop esi
jmp 0x10009122
push dword [ebp - 0x18]
call fcn.10023032
mov dword [eax], 6
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xc7c]
cmp dword [ebp - 0x18], esi
jl 0x10009111
mov dword [ebp - 0x38], 0x45e4bba
dec dword [ebp - 0x40]
call fcn.10023016
lea ecx, [ebp - 0xb90]
call fcn.10023016
or esi, 0xffffffff
lea ecx, [ebp - 0x3f4]
mov dword [ebp - 4], esi
call fcn.10023016
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x76c]
mov dword [ebp - 0x30], 0xca631852
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0xc4b4e126
mov dword [ebp - 0x30], 0xa624cdb8
push ebx
call fcn.10022f94
mov dword [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x40], 0xe4d9
mov dword [ebp - 0x10], eax
jmp 0x100091a5
push dword [ebp - 0x10]
call fcn.10023032
mov dword [eax], 0xae77ab39
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x76c]
cmp dword [ebp - 0x10], ebx
jl 0x10009194
dec dword [ebp - 0x40]
push edi
call fcn.10023032
push edi
lea ecx, [ebp - 0x76c]
mov esi, eax
call fcn.10023032
mov ecx, dword [esi]
or esi, 0xffffffff
mov dword [ebp - 4], esi
mov dword [eax], ecx
lea ecx, [ebp - 0x76c]
call fcn.10023016
mov dword [ebp - 0x34], 0x2cb3a3fc
xor eax, eax
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x24], 0x1ac3dc99
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x38], edi
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10009220
push eax
push eax
push 0x2070
push eax
push 0x1b10
push eax
push 0x20eb
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10009250
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
imul eax, dword [ebp - 0x1c], 0x36de
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x2dd78f4f
setg cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
push 4
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
sub eax, ecx
lea ecx, [ebp - 0x854]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
pop eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x2c], eax
push 3
mov dword [ebp - 0x10], esi
pop esi
mov dword [ebp - 0x1c], 6
push esi
call fcn.10022f94
push 4
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x28], 0xec767dbf
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100092f2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3b8], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100092da
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10009318
push dword [ebp - 0x18]
lea ecx, [ebp - 0x854]
call fcn.10023032
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100092fa
xor eax, eax
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x10009348
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10009343
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3b8], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000932b
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x10009320
mov eax, dword [ebp - 0x3b8]
mov ecx, 0xfffd
cmp ecx, eax
mov edx, edi
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfffffff6
setne cl
xor eax, eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jne 0x1000936f
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0x8ff7673e
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffff7
setle al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x100093a5
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100093a7
mov esi, edi
jmp 0x100093a9
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x854]
call fcn.10023032
mov ecx, dword [ebp - 0x2c]
imul ecx, esi
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x2c]
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, eax, 0xce5f
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100093dd
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x3b4]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
sub ecx, dword [ebp - 0x3b8]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setne dl
xor eax, eax
neg edx
je 0x1000942b
cmp dword [ebp - 0x3b0], eax
je 0x1000942b
xor esi, esi
inc esi
mov eax, esi
jmp 0x1000942e
xor esi, esi
inc esi
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x854]
mov eax, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3b0]
mov eax, dword [ebp - 0x28]
or eax, 0xffffffff
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 4], eax
call fcn.10023016
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x28], 0xffffffe5
jmp 0x10009a0d
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
jmp 0x10009490
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x468], 0xf3b0639e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000947f
mov dword [ebp - 0x20], 0x13
cmp dword [ebp - 0x20], 0xfffffff3
jle 0x10009543
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x38], 0x6193
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
je 0x100094c7
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100094c9
mov eax, esi
jmp 0x100094c9
xor eax, eax
add eax, 6
cmp eax, dword [ebp - 0x10]
jl 0x100094da
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x100094dc
mov ecx, esi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
inc edx
neg edx
push 4
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setle bl
xor ecx, ecx
cmp eax, ebx
pop eax
setne cl
cmp ecx, eax
je 0x10009520
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
test eax, eax
setle cl
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x468], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff3
jg 0x100094a7
push 2
pop ebx
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10009559
mov eax, dword [ebp - 0x460]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x460]
mov eax, dword [ebp - 0x468]
xor edx, edx
sub eax, 0x528b6b3
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x468]
mov eax, dword [ebp - 0x48]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sete dl
xor ecx, ecx
cmp eax, edx
setl cl
imul eax, ecx, 0xca8c
sub eax, dword [ebp - 0x468]
mov dword [ebp - 0x20], eax
or eax, 0xffffffff
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0x2cb3a3fc
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], 0xffffffe5
cmp dword [ebp - 0x3c], 7
je 0x100095cf
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100095c6
push 0x9f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 7
jne 0x100095b0
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setle dl
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [ebp - 0x3c], ecx
jg 0x100095fa
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x100095fc
mov edx, esi
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
je 0x10009640
mov dword [ebp - 0x40], 0xafbd13d
mov dword [ebp - 0x38], 0x7eb8e136
cmp dword [ebp - 0x40], eax
je 0x10009625
mov eax, esi
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000965f
push eax
push 0x10a8
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x1000965d
mov dword [ebp - 0x38], 0x58c458a9
xor ecx, ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add edx, 0x69d1fe90
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
xor eax, eax
mov byte [ebp - 0x41], al
lea ecx, [ebp - 0x9a4]
push 4
pop eax
mov dword [ebp - 0x2c], eax
or eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 6
push 3
call fcn.10022f94
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x3c], 0xec767dbf
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100096c9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3c4], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100096b0
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100096f1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9a4]
call fcn.10023032
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100096d2
xor eax, eax
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x10009723
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1000971e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3c4], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10009705
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x100096f9
mov eax, dword [ebp - 0x3c4]
mov ecx, 0xfffd
cmp ecx, eax
mov edx, esi
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfffffff6
setne cl
xor eax, eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jne 0x1000974a
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0x8ff7673e
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffff7
setle al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x1000977e
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10009780
jmp 0x10009782
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x9a4]
call fcn.10023032
mov ecx, dword [ebp - 0x2c]
imul ecx, esi
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x2c]
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, eax, 0xce5f
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100097b6
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x3c0]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
sub ecx, dword [ebp - 0x3c4]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setne dl
xor eax, eax
neg edx
je 0x10009804
cmp dword [ebp - 0x3bc], eax
je 0x10009804
xor esi, esi
inc esi
mov eax, esi
jmp 0x10009807
xor esi, esi
inc esi
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x9a4]
mov eax, dword [ebp - 0x3c4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x3c]
or eax, 0xffffffff
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 4], eax
call fcn.10023016
cmp byte [ebp - 0x41], 0
je 0x10009a0a
mov dword [ebp - 0x20], 0x58e1
or eax, 0xffffffff
mov dword [ebp - 0x10], 0x6dd3ed23
xor edx, edx
mov dword [ebp - 0x18], 0xbf81606d
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], 0x8188558b
mov dword [ebp - 0x24], 0xa237ff9b
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
imul ecx, eax, 0x271d
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor eax, eax
inc edx
imul edx, dword [ebp - 0x20]
cmp edx, 0x627
setg al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x89276496
je 0x100098be
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x100098c0
mov ecx, esi
xor eax, eax
test ecx, ecx
setle al
cmp eax, dword [ebp - 0x20]
jne 0x100098cf
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
xor eax, eax
neg edx
cmp edx, 0xed680444
jne 0x100098f8
mov edx, esi
cmp dword [ebp - 0x18], eax
jne 0x100098fa
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
sete cl
xor ebx, ebx
cmp ecx, 0xab3e90a6
setne bl
xor edx, edx
imul ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x3c]
je 0x10009940
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
je 0x1000998c
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1000998e
mov eax, esi
jmp 0x1000998e
xor eax, eax
add eax, 0xc50e
xor ecx, ecx
cmp eax, 0x38dbec8b
setg cl
xor eax, eax
cmp ecx, esi
setle al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100099d1
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x100099fc
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
jmp 0x100099fc
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x100099ef
push 0xfdb
push 0x144
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
push 0x9f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
pop ebx
inc dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], 7
jne 0x1000946d
mov dword [ebp - 0x10], 0x90ac204e
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], 0x948b0815
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff3
jg 0x10009a76
or esi, 0xffffffff
mov dword [ebp - 0x38], 0x29bf390
mov dword [ebp - 0x48], esi
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xfffffff1
jmp 0x10009a62
mov dword [ebp - 0x40], 0x43e95aad
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 8
jl 0x10009a4f
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff3
jle 0x10009a36
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009a95
push 0xf52
push 0x19c9
push 0x11c7
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [ebp - 0x28], ecx
jg 0x10009ac0
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x10009ac2
mov edx, esi
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov edi, dword [sym.imp.USER32.dll_DrawFocusRect]
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
je 0x1000a446
mov eax, 0xd6c0
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xadc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10009b1f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x174], 0x8da8e97e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10009b07
xor eax, eax
mov dword [ebp - 0x170], eax
jmp 0x10009b3d
mov eax, dword [ebp - 0x170]
cmp dword [ebp + eax*4 - 0xae8], 0
jne 0x10009b46
inc dword [ebp - 0x170]
cmp dword [ebp - 0x170], 3
jle 0x10009b27
mov dword [ebp - 0x170], 0xfffffffe
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x34], 0xafbd13d
mov dword [ebp - 0x2c], 0xe1a3622b
push ebx
call fcn.10022f94
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], 0x1361131e
mov dword [ebp - 0x24], 0xa603d2cf
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10009baa
push dword [ebp - 0x18]
lea ecx, [ebp - 0x188]
call fcn.10023032
mov dword [eax], 0xdf98
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10009b8c
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10009bc0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd18], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10009baf
push esi
lea ecx, [ebp - 0x188]
call fcn.10023032
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10009d7a
mov dword [ebp - 0x20], 0xcb8ce3e6
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x10009d77
push esi
lea ecx, [ebp - 0x784]
call fcn.10022f94
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x48], 0xa3bd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10009c32
push dword [ebp - 0x10]
lea ecx, [ebp - 0x784]
call fcn.10023032
mov dword [eax], 0xa6c9cd49
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10009c14
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10009c3a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x188]
push dword [ebp - 0x2c]
call fcn.10023032
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x188]
call fcn.10023032
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x188]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x20]
call fcn.10023032
xor ebx, ebx
lea ecx, [ebp - 0x784]
cmp dword [eax], ebx
sete bl
xor eax, eax
push eax
call fcn.10023032
lea ecx, [ebp - 0x188]
mov dword [eax], ebx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x2c]
call fcn.10023032
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x188]
push dword [ebp - 0x2c]
call fcn.10023032
push 2
pop ebx
mov eax, dword [eax]
inc eax
je 0x10009ccc
mov dword [ebp - 0x30], 0xf162
inc dword [ebp - 0x24]
jmp 0x10009d5d
xor eax, eax
mov dword [ebp - 0x4c], 0xe161e417
mov dword [ebp - 0x10], eax
jmp 0x10009ceb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x78c], 0xd14a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10009cda
push esi
lea ecx, [ebp - 0x188]
call fcn.10023032
cmp dword [eax], 0x6128b293
jl 0x10009d0d
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10009d0d
mov esi, eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x188]
call fcn.10023032
mov eax, dword [ebp - 0x788]
lea ecx, [ebp - 0x784]
add eax, 0x31db6ab
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
xor eax, eax
push eax
call fcn.10023032
mov ecx, dword [ebp - 0x2c]
xor edx, edx
sub esi, ecx
mov ecx, dword [ebp - 0x48]
cmp ecx, esi
setl dl
xor esi, esi
mov dword [eax], edx
inc esi
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x4c], 0x9d3b05e2
lea ecx, [ebp - 0x784]
mov byte [ebp - 4], 6
call fcn.10023016
dec dword [ebp - 0x20]
jns 0x10009bf3
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x10009be0
or eax, 0xffffffff
lea ecx, [ebp - 0x188]
mov dword [ebp - 4], eax
call fcn.10023016
mov dword [ebp - 0x4c], 0x7eb8e136
lea ecx, [ebp - 0xc94]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x1c], 0x97a4a12b
push esi
call fcn.10022f94
xor eax, eax
mov dword [ebp - 4], 8
mov dword [ebp - 0x10], eax
jmp 0x10009dd2
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc94]
call fcn.10023032
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10009dbf
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10009e43
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009e2b
push 0x946
push 0x23c0
push 0x15fd
push 0x181f
push 0xdff
push 0x173
push 0xb6d
push 0x7e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009e40
push esi
push eax
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10009de4
or eax, 0xffffffff
lea ecx, [ebp - 0xc94]
mov dword [ebp - 4], eax
call fcn.10023016
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10009e62
mov eax, esi
mov dword [ebp - 0x4c], eax
push 0x11
pop eax
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jle 0x1000a057
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x4c], 0xaffa898c
dec dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
neg eax
je 0x10009eb7
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000a04a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
jmp 0x1000a04a
push 3
lea ecx, [ebp - 0x5cc]
call fcn.10022f94
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10009ef8
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5cc]
call fcn.10023032
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10009ed9
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1000a02f
push ebx
lea ecx, [ebp - 0x438]
call fcn.10022f94
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x1c], 0xa18e418a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10009f3f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x438]
call fcn.10023032
mov dword [eax], 0xfffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10009f21
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x10009f75
mov dword [ebp - 0x10], 0x17c10977
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10009f70
push dword [ebp - 0x10]
lea ecx, [ebp - 0x438]
call fcn.10023032
cmp dword [eax], 0
jne 0x10009f6e
dec dword [ebp - 0x10]
jns 0x10009f56
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10009f47
cmp dword [ebp - 0x3c], eax
je 0x10009fbd
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x438]
xor eax, eax
push eax
call fcn.10023032
push esi
lea ecx, [ebp - 0x438]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.10023032
xor eax, eax
lea ecx, [ebp - 0x5cc]
push eax
call fcn.10023032
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [eax]
jle 0x10009fbb
xor eax, eax
jmp 0x10009fbf
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x5cc]
call fcn.10023032
xor edx, edx
lea ecx, [ebp - 0x5cc]
inc edx
mov eax, dword [eax]
sub eax, esi
cmp edx, eax
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.10023032
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0x438]
setge dl
sub edx, dword [eax]
xor eax, eax
mov dword [ebp - 0x40], edx
push eax
call fcn.10023032
mov ecx, dword [ebp - 0x40]
inc ecx
neg ecx
sbb ecx, ecx
xor esi, esi
inc ecx
inc esi
cmp ecx, esi
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x438]
setg dl
mov dword [ebp - 0x4c], edx
mov byte [ebp - 4], 9
call fcn.10023016
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x2e
jge 0x10009f00
or eax, 0xffffffff
lea ecx, [ebp - 0x5cc]
mov dword [ebp - 4], eax
call fcn.10023016
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x11
jg 0x10009e7b
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000a082
push eax
push 0x4ed
push 0xac2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x86c]
mov eax, 0xfff6
mov dword [ebp - 0x1c], eax
push esi
call fcn.10022f94
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x30], 0xdb8e9646
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000a0cf
push dword [ebp - 0x10]
lea ecx, [ebp - 0x86c]
call fcn.10023032
mov dword [eax], 0xcc895931
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a0b1
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000a0ee
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000a1ad
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
jmp 0x1000a1ab
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x1c], 0x17
cmp dword [ebp - 0x1c], 0xe
jg 0x1000a1ad
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0xba8]
mov dword [ebp - 0x30], 0x4fc2285f
push esi
call fcn.10022f94
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000a148
push dword [ebp - 0x10]
lea ecx, [ebp - 0xba8]
call fcn.10023032
mov dword [eax], 0x5872d9ee
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a12a
xor eax, eax
mov dword [ebp - 0x18], 9
jmp 0x1000a178
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000a175
push 0x419
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff5
jge 0x1000a151
mov dword [ebp - 0x18], eax
jmp 0x1000a189
inc dword [ebp - 0x40]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x16
jne 0x1000a183
lea ecx, [ebp - 0xba8]
mov byte [ebp - 4], 0xb
call fcn.10023016
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
jle 0x1000a106
xor eax, eax
push eax
lea ecx, [ebp - 0x86c]
call fcn.10023032
lea ecx, [ebp - 0x86c]
mov dword [eax], esi
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10023016
cmp byte [ebp - 0x11], 0
je 0x1000a3c3
push ebx
lea ecx, [ebp - 0x200]
call fcn.10022f94
or eax, 0xffffffff
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000a21a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x200]
call fcn.10023032
mov dword [eax], 0x13b91020
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000a1fc
xor eax, eax
push eax
lea ecx, [ebp - 0x200]
call fcn.10023032
lea ecx, [ebp - 0x200]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10023032
cmp dword [eax], 0x1a
jge 0x1000a3a4
jmp 0x1000a245
xor esi, esi
inc esi
xor eax, eax
lea ecx, [ebp - 0xa4c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0x3923ccde
mov dword [ebp - 0x40], 0xb994b748
mov dword [ebp - 0x24], 0xfffffff9
push 3
call fcn.10022f94
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x40], 0x30b91300
mov dword [ebp - 0x4c], 0xad5b481d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1000a2aa
or esi, 0xffffffff
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa4c]
call fcn.10023032
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000a28c
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000a2c4
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea eax, [eax*8 - 5]
cmp eax, 0xc22c
jle 0x1000a2e9
xor eax, eax
lea ecx, [ebp - 0x200]
push eax
call fcn.10023032
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
dec eax
jne 0x1000a30a
push eax
lea ecx, [ebp - 0x200]
call fcn.10023032
cmp dword [eax], 0
jne 0x1000a30a
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0xa4c]
call fcn.10023032
lea ecx, [ebp - 0x200]
mov dword [eax], esi
xor esi, esi
mov eax, dword [ebp - 0x24]
inc esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x1c], esi
push eax
call fcn.10023032
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1000a346
mov esi, eax
push eax
lea ecx, [ebp - 0x200]
call fcn.10023032
xor ecx, ecx
sub esi, dword [eax]
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0x51c76d7b
setg cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xa4c]
mov byte [ebp - 4], 0xd
call fcn.10023016
xor eax, eax
lea ecx, [ebp - 0x200]
push eax
call fcn.10023032
lea ecx, [ebp - 0x200]
inc dword [eax]
xor eax, eax
push eax
call fcn.10023032
cmp dword [eax], 0x1a
jl 0x1000a242
or eax, 0xffffffff
lea ecx, [ebp - 0x200]
mov dword [ebp - 4], eax
call fcn.10023016
xor eax, eax
push eax
push 0x10a8
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 3
pop esi
mov dword [ebp - 0x20], 0x7f6af112
xor eax, eax
mov dword [ebp - 0x10], 0x2978d8ef
mov dword [ebp - 0x4c], 0x5d64
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000a3fd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcac], 0xa553fc2f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a3e5
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x11
jne 0x1000a6ce
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x40], 0x78c3
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1000a636
cmp dword [ebp - 0x40], eax
jne 0x1000a636
xor esi, esi
mov edx, eax
inc esi
jmp 0x1000a63b
mov dword [ebp - 0x1c], 0x25b9b55b
lea ecx, [ebp - 0x9bc]
mov dword [ebp - 0x30], 0x89351f20
push ebx
call fcn.10022f94
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x40], 0x4c266d8f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000a496
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9bc]
call fcn.10023032
mov dword [eax], 0x417be18
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000a478
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff0
jne 0x1000a523
push 3
pop edi
or eax, 0xffffffff
lea ecx, [ebp - 0x884]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], eax
push edi
call fcn.10022f94
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], eax
jmp 0x1000a4e0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x884]
call fcn.10023032
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000a4cc
inc dword [ebp - 0x40]
lea ecx, [ebp - 0x9bc]
push esi
call fcn.10023032
mov esi, eax
lea ecx, [ebp - 0x884]
xor eax, eax
push eax
call fcn.10023032
mov ecx, dword [esi]
mov byte [ebp - 4], 0xf
mov dword [eax], ecx
lea ecx, [ebp - 0x884]
call fcn.10023016
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
push 1
pop esi
je 0x1000a4a6
or edi, 0xffffffff
lea ecx, [ebp - 0x9bc]
mov dword [ebp - 4], edi
call fcn.10023016
mov dword [ebp - 0x38], 0x58c458a9
xor eax, eax
mov dword [ebp - 0x18], 0x20f89b54
mov dword [ebp - 0x24], 0xfffffff6
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1000a56e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe44], 0xc85f70ad
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000a556
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1000a58e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc34], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000a576
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jg 0x1000a5d6
mov dword [ebp - 0x4c], 5
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000a5b4
push 0x1411
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov eax, dword [ebp - 0x18]
push 0
mov ecx, dword [ebp + eax*4 - 0xe44]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe44], ecx
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], esi
jle 0x1000a599
cmp dword [ebp - 0x24], eax
je 0x1000a5e0
cmp dword [ebp - 0x18], eax
jne 0x1000a5e5
cmp dword [ebp - 0x18], eax
je 0x1000a5e8
xor eax, eax
inc eax
cmp eax, dword [ebp - 0xc30]
jne 0x1000a5f3
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov edx, edi
mov ecx, dword [ebp - 0xe44]
sub edx, eax
neg edx
sbb edx, edx
sub ecx, 0xd058a835
neg edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setle al
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
add edx, 0x69d1fe90
cmp edx, eax
setg cl
mov dword [ebp - 0x34], ecx
jmp 0x1000a3c6
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
sub ecx, dword [ebp - 0x34]
cmp ecx, 0xfff6
setne al
cmp eax, dword [ebp - 0x40]
jne 0x1000a65f
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000a661
mov eax, esi
mov edx, dword [ebp - 0x34]
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x34]
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0xca8], eax
jne 0x1000a69c
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x24]
cmp eax, ecx
jg 0x1000a68e
mov eax, esi
jmp 0x1000a690
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x10], eax
jne 0x1000a69e
mov edx, esi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0x8993dd61
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x11
je 0x1000a40a
push 3
xor eax, eax
pop esi
mov dword [ebp - 0x20], ebx
jmp 0x1000a6de
cmp dword [ebp - 0xca8], eax
jne 0x1000a6e4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
jg 0x1000a6d3
xor edi, edi
mov dword [ebp - 0x10], eax
inc edi
cmp dword [ebp - 0x10], edi
jge 0x1000a707
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd28], 0x1c08901f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000a6ef
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000a71d
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000a72f
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000a756
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a73e
xor eax, eax
mov dword [ebp - 0x2c], eax
mov edx, 0xffff
cmp dword [ebp - 0x2c], ebx
jg 0x1000a8d0
mov dword [ebp - 0x4c], 0x3922cbd4
xor ecx, ecx
mov eax, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp eax, 7
mov eax, dword [ebp - 0x2c]
setge cl
cmp edx, ecx
mov eax, dword [ebp + eax*4 - 0x1f4]
sbb ecx, ecx
neg ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1f4]
setle dl
xor ebx, ebx
sub edx, 0x2ae7b79f
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setl bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp eax, ebx
setg cl
cmp ecx, 0x647c
jle 0x1000a82d
push 2
mov dword [ebp - 0x10], 0xe3b372ba
xor eax, eax
pop ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x1000a8bd
mov dword [ebp - 0x18], 0x9b3a00d0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000a804
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1f4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000a7f0
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1000a823
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000a81e
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1000a80c
dec dword [ebp - 0x10]
jns 0x1000a7e1
jmp 0x1000a8bd
mov dword [ebp - 0x34], 0x23b16aac
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x1f4], 0
jne 0x1000a880
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setle dl
imul eax, edx
test eax, eax
jne 0x1000a867
cmp dword [ebp - 0x2c], eax
je 0x1000a869
mov ecx, edi
jmp 0x1000a86b
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, dword [ebp + eax*4 - 0x1f4]
jne 0x1000a880
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x1000a882
mov edx, edi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
push 2
sete cl
xor edx, edx
cmp ecx, eax
pop ebx
setg dl
imul edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x1f0]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x5367
setne al
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], 0x12afbcae
inc dword [ebp - 0x2c]
mov edx, 0xffff
cmp dword [ebp - 0x2c], ebx
jle 0x1000a767
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000a8e9
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov dword [ebp - 0x20], 0x7f6af112
mov dword [ebp - 0x10], 0x2978d8ef
mov dword [ebp - 0x4c], 0x5d64
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000a91e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcc4], 0xa553fc2f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a906
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x11
jne 0x1000a9e9
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x40], 0x78c3
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1000a957
mov edx, eax
cmp dword [ebp - 0x40], eax
je 0x1000a959
mov edx, edi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
sub ecx, dword [ebp - 0x34]
cmp ecx, 0xfff6
setne al
cmp eax, dword [ebp - 0x40]
jne 0x1000a97d
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000a97f
mov eax, edi
mov edx, dword [ebp - 0x34]
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x34]
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0xcc0], eax
jne 0x1000a9ba
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x24]
cmp eax, ecx
jg 0x1000a9ac
mov eax, edi
jmp 0x1000a9ae
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x10], eax
jne 0x1000a9bc
mov edx, edi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0x8993dd61
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x11
je 0x1000a92b
xor eax, eax
mov dword [ebp - 0x20], ebx
jmp 0x1000a9f9
cmp dword [ebp - 0xcc0], eax
jne 0x1000a9ff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
jg 0x1000a9ee
mov dword [ebp - 0x10], 0xcea5d6c0
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x1c], 0x3248c66f
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xa3df
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000aa40
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1134], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000aa2c
xor eax, eax
mov dword [ebp - 0x10], edi
jmp 0x1000aa4e
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x40]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x10
jle 0x1000aa45
mov dword [ebp - 0x1c], 0xfffffffd
cmp dword [ebp - 0x1c], 0x12
je 0x1000aad8
jmp 0x1000aa68
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x4c], 0xc118
mov dword [ebp - 0x38], 0x44a7
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x3c6fe23a
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xbcc]
push edi
call fcn.10022f94
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x10], eax
jmp 0x1000aab0
push dword [ebp - 0x10]
call fcn.10023032
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xbcc]
cmp dword [ebp - 0x10], edi
jl 0x1000aaa0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], eax
or eax, 0xffffffff
dec dword [ebp - 0x48]
mov dword [ebp - 4], eax
call fcn.10023016
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x12
jne 0x1000aa63
mov dword [ebp - 0x20], 0x7f6af112
xor eax, eax
mov dword [ebp - 0x10], 0x2978d8ef
mov dword [ebp - 0x4c], 0x5d64
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000ab0f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd24], 0xa553fc2f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000aaf7
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x11
jne 0x1000abda
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x40], 0x78c3
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1000ab48
mov edx, eax
cmp dword [ebp - 0x40], eax
je 0x1000ab4a
mov edx, edi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
sub ecx, dword [ebp - 0x34]
cmp ecx, 0xfff6
setne al
cmp eax, dword [ebp - 0x40]
jne 0x1000ab6e
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000ab70
mov eax, edi
mov edx, dword [ebp - 0x34]
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x34]
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0xd20], eax
jne 0x1000abab
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x24]
cmp eax, ecx
jg 0x1000ab9d
mov eax, edi
jmp 0x1000ab9f
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x10], eax
jne 0x1000abad
mov edx, edi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0x8993dd61
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x11
je 0x1000ab1c
xor eax, eax
mov dword [ebp - 0x20], ebx
jmp 0x1000abea
cmp dword [ebp - 0xd20], eax
jne 0x1000abf0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
jg 0x1000abdf
mov dword [ebp - 0x34], 0x1928c176
lea ecx, [ebp - 0x89c]
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x48], eax
or eax, 0xffffffff
mov dword [ebp - 0x30], 0xf93bd5de
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x30], 0x50270f9e
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x6270e7ad
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0xb6084edc
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x30], 0x26a9d9e1
mov dword [ebp - 0x40], 0xfffffffa
push ebx
call fcn.10022f94
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x4c], 0xfffffff7
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1000ac8a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xebc], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000ac76
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000aca6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x89c]
call fcn.10023032
mov dword [eax], 0xdf39281c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000ac8f
mov dword [ebp - 0x34], 0x12
cmp dword [ebp - 0x34], 0xfffffff1
jg 0x1000acd7
or edi, 0xffffffff
mov dword [ebp - 0x4c], 0x99cfe04
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff1
jle 0x1000acbb
xor edi, edi
inc edi
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xeb4]
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1000acf1
mov esi, eax
cmp dword [ebp - 0x40], eax
je 0x1000acf3
mov esi, edi
push eax
lea ecx, [ebp - 0x89c]
call fcn.10023032
xor ecx, ecx
cmp esi, dword [eax]
setl cl
mov dword [ebp - 0x40], ecx
mov ecx, edi
mov eax, dword [ebp - 0x40]
sub ecx, eax
jne 0x1000ad15
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x89c]
mov eax, dword [ebp - 0xeb8]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10023016
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffc
push 3
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x1000ad64
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1ac], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000ad4c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jg 0x1000aed9
mov dword [ebp - 0x4c], 0x3922cbd4
xor ecx, ecx
mov eax, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x1ac]
cmp eax, 7
mov eax, 0xffff
setge cl
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
sbb ecx, ecx
xor edx, edx
neg ecx
mov eax, dword [ebp + eax*4 - 0x1ac]
cmp ecx, eax
mov eax, dword [ebp - 0x1ac]
setle dl
xor ebx, ebx
sub edx, 0x2ae7b79f
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setl bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1ac]
cmp eax, ebx
setg cl
cmp ecx, 0x647c
jle 0x1000ae3b
push 2
mov dword [ebp - 0x10], 0xe3b372ba
xor eax, eax
pop ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x1000aecb
mov dword [ebp - 0x18], 0x9b3a00d0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000ae12
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1ac], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000adfe
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1000ae31
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000ae2c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1000ae1a
dec dword [ebp - 0x10]
jns 0x1000adef
jmp 0x1000aecb
mov dword [ebp - 0x34], 0x23b16aac
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x1ac], 0
jne 0x1000ae8e
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1a4]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
imul eax, edx
test eax, eax
jne 0x1000ae75
cmp dword [ebp - 0x2c], eax
je 0x1000ae77
mov ecx, edi
jmp 0x1000ae79
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, dword [ebp + eax*4 - 0x1ac]
jne 0x1000ae8e
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x1000ae90
mov edx, edi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
push 2
sete cl
xor edx, edx
cmp ecx, eax
pop ebx
setg dl
imul edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x1a8]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x5367
setne al
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], 0x12afbcae
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1000ad70
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000aef0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 4
pop eax
push eax
lea ecx, [ebp - 0x144]
call fcn.10022f94
push ebx
lea ecx, [ebp - 0x480]
mov dword [ebp - 4], 0x13
call fcn.10022f94
xor eax, eax
mov byte [ebp - 4], 0x14
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1000af3b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x79c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000af23
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1000af67
push 4
pop edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x144]
call fcn.10023032
mov dword [eax], 0x743d837b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000af46
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000af8d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x480]
call fcn.10023032
mov dword [eax], 0x5c29478c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000af6f
xor eax, eax
push eax
lea ecx, [ebp - 0x144]
call fcn.10023032
mov dword [eax], esi
jmp 0x1000b086
mov dword [ebp - 0x28], 0x61c0f806
xor eax, eax
mov dword [ebp - 0x4c], edi
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1000afc1
push 0x1411
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x1000b078
mov dword [ebp - 0x4c], 0xfc6088b9
lea ecx, [ebp - 0x144]
push eax
call fcn.10023032
lea ecx, [ebp - 0x144]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x79c]
xor eax, eax
push eax
call fcn.10023032
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x79c]
xor eax, eax
cmp dword [ebp - 0x28], eax
jl 0x1000b025
push eax
lea ecx, [ebp - 0x144]
call fcn.10023032
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x79c], 0
jne 0x1000b025
xor eax, eax
mov esi, eax
jmp 0x1000b029
mov esi, edi
xor eax, eax
push eax
lea ecx, [ebp - 0x144]
call fcn.10023032
push 3
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x79c]
mov eax, 0xf1fdbd01
cmp eax, esi
pop esi
sbb eax, eax
neg eax
add ecx, eax
mov eax, dword [ebp - 0x28]
push 0
mov dword [ebp + eax*4 - 0x79c], ecx
mov eax, dword [ebp - 0x4c]
imul eax, ecx
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x28]
pop eax
cmp dword [ebp - 0x28], esi
jle 0x1000afcd
push eax
lea ecx, [ebp - 0x144]
call fcn.10023032
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x144]
push eax
call fcn.10023032
cmp dword [eax], 0
jge 0x1000afa0
push edi
lea ecx, [ebp - 0x480]
call fcn.10023032
and dword [eax], 0
jmp 0x1000b0f1
xor eax, eax
mov dword [ebp - 0x1c], 0xcd9796a
mov dword [ebp - 0x1c], eax
push 4
pop eax
cmp dword [ebp - 0x1c], eax
jge 0x1000b0e3
push eax
pop edi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x144]
call fcn.10023032
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000b0c4
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0x480]
call fcn.10023032
inc dword [eax]
push edi
lea ecx, [ebp - 0x480]
call fcn.10023032
cmp dword [eax], esi
jle 0x1000b0ae
lea ecx, [ebp - 0x480]
call fcn.10023016
or eax, 0xffffffff
lea ecx, [ebp - 0x144]
mov dword [ebp - 4], eax
call fcn.10023016
xor eax, eax
mov dword [ebp - 0x18], 0x2eb90da1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe3
jne 0x1000b284
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], 0xffffffeb
jmp 0x1000b26b
cmp dword [ebp - 0x28], 8
jle 0x1000b145
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x10], 0xf0796840
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000b2ae
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x814], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000b29c
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
add eax, 0xc4d3a819
neg ecx
mov dword [ebp - 0x814], eax
add eax, 0xa31e
imul eax, eax, 0x7c69
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x10]
jge 0x1000b2e7