Function at 0x10046e2b
Capabilities:
Create directory
Create pipe
Create process on windows
Delete directory
Delete registry value
Get common file path
Get geographical location
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x600
mov dword [ebp - 0x9c], 0x7c20
mov dword [ebp - 0xb8], 0x95a97963
mov dword [ebp - 0x58], 8
mov dword [ebp - 0x10], 0x5336de01
mov dword [ebp - 0x150], 0
jmp 0x10046e6f
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x10046e8b
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x298], 0x23aa
jmp 0x10046e62
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x58]
cmp eax, 0x5ed9a924
jl 0x10046eb0
mov dword [ebp - 0x19c], 1
jmp 0x10046eb7
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xb8]
add ecx, dword [ebp - 0x19c]
add eax, ecx
cmp eax, 1
je 0x10046edc
mov dword [ebp - 0x188], 1
jmp 0x10046ee3
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0x10]
jle 0x10046f00
mov dword [ebp - 0x354], 1
jmp 0x10046f07
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x9c], 0
jmp 0x10046f29
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jl 0x10047191
mov dword [ebp - 0x138], 0x25c7e4dd
mov dword [ebp - 0xb8], 0
jmp 0x10046f59
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jg 0x10047140
mov dword [ebp - 0x35c], 0xf8169c14
mov dword [ebp - 0x36c], 0xf093d7f2
mov dword [ebp - 0x10], 0
jmp 0x10046f8a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x1004713b
mov dword [ebp - 0x364], 0xfffffff8
mov dword [ebp - 0x40c], 0xedbec151
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x298]
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x35c], 0xa14a9c79
jae 0x10046fd0
mov dword [ebp - 0x190], 1
jmp 0x10046fd7
and dword [ebp - 0x190], 0
cmp dword [ebp - 0x190], 0xb5cfda6c
jb 0x10046fef
mov dword [ebp - 0x198], 1
jmp 0x10046ff6
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x35c]
imul eax, dword [ebp - 0x198]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x298]
cmp dword [ebp - 0x364], eax
jg 0x10047030
cmp dword [ebp - 0x36c], 0
je 0x10047030
mov dword [ebp - 0x1a4], 1
jmp 0x10047037
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0x1a4], eax
jl 0x10047051
mov dword [ebp - 0x28c], 1
jmp 0x10047058
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x298]
imul eax, dword [ebp - 0x28c]
mov ecx, dword [ebp - 0x10]
imul eax, dword [ebp + ecx*4 - 0x298]
cmp eax, 0xd2c2
jle 0x10047087
mov dword [ebp - 0x1ac], 1
jmp 0x1004708e
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x1ac], eax
jle 0x100470a8
mov dword [ebp - 0x3a8], 1
jmp 0x100470af
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x4dc], eax
push 4
pop eax
cmp eax, 0xb5fb
ja 0x100470de
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x298], 0
jne 0x100470de
and dword [ebp - 0x29c], 0
jmp 0x100470e8
mov dword [ebp - 0x29c], 1
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x29c], eax
je 0x10047102
mov dword [ebp - 0x1b4], 1
jmp 0x10047109
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x1b4], eax
jne 0x10047123
mov dword [ebp - 0x338], 1
jmp 0x1004712a
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x40c], eax
jmp 0x10046f83
jmp 0x10046f4c
mov dword [ebp - 0x58], 1
jmp 0x10047150
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x1004718c
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x1004718a
push 0
push 0xa0
push 0x3e4
push 0x9d0
push 0xf1d
push 0x19bf
push 0x19e5
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x10047149
jmp 0x10046f1c
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x3d8], 0x89afca86
mov dword [ebp - 0x4e4], 4
mov dword [ebp - 0x414], 0xffffffff
mov dword [ebp - 0x454], 0xedcad208
mov dword [ebp - 0x360], 0xc9e53e58
mov dword [ebp - 0x4ec], 1
mov dword [ebp - 0x4f4], 0xfffffff9
mov dword [ebp - 0x60], 0xc8ddac0f
mov dword [ebp - 0x158], 0xa1434a93
mov dword [ebp - 0x450], 7
mov dword [ebp - 4], 0
jmp 0x10047209
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x1004721f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x468], 0x7d2703d9
jmp 0x10047202
mov dword [ebp - 4], 0
jmp 0x1004722f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x10047245
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x508], 0xab72b21a
jmp 0x10047228
mov dword [ebp - 4], 0
jmp 0x10047255
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x1004726b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x5a8], 0xfffffff6
jmp 0x1004724e
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x60]
inc ecx
mov dword [ebp - 0x60], ecx
test eax, eax
je 0x1004729a
mov eax, 0x9e22401d
test eax, eax
je 0x1004729a
mov dword [ebp - 0x1bc], 1
jmp 0x100472a1
and dword [ebp - 0x1bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x468]
cmp dword [ebp - 0x1bc], eax
jne 0x100472c2
mov dword [ebp - 0x1c4], 1
jmp 0x100472c9
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 6
je 0x100472ea
mov dword [ebp - 0x2a0], 1
jmp 0x100472f1
and dword [ebp - 0x2a0], 0
cmp dword [ebp - 0x2a0], 0x52a2
jle 0x10047309
mov dword [ebp - 0x308], 1
jmp 0x10047310
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x1c4]
sub eax, dword [ebp - 0x308]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x508]
jge 0x10047337
mov dword [ebp - 0x1cc], 1
jmp 0x1004733e
and dword [ebp - 0x1cc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x468]
cmp dword [ebp - 0x1cc], eax
jge 0x1004735f
mov dword [ebp - 0x2a8], 1
jmp 0x10047366
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x60], 0
jmp 0x10047382
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x21
jl 0x1004753e
mov dword [ebp - 0x100], 8
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0xf8], 0
jmp 0x100473c3
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 4
jge 0x100473df
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x5d8], 0x9cbadbef
jmp 0x100473b6
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x100], eax
jl 0x100473f9
mov dword [ebp - 0x1d4], 1
jmp 0x10047400
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x1d4], eax
jne 0x1004741a
mov dword [ebp - 0x1e4], 1
jmp 0x10047421
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x450], eax
jge 0x1004743b
mov dword [ebp - 0x1dc], 1
jmp 0x10047442
and dword [ebp - 0x1dc], 0
cmp dword [ebp - 0x1dc], 1
jne 0x10047457
mov dword [ebp - 0x2b0], 1
jmp 0x1004745e
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x310], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x310]
mov dword [ebp + eax - 0x5d8], ecx
mov eax, dword [ebp - 0x1e4]
imul eax, dword [ebp - 0x310]
test eax, eax
jle 0x1004752d
mov dword [ebp - 0x550], 1
mov dword [ebp - 0x558], 2
mov dword [ebp - 0x560], 0xffffffff
mov dword [ebp - 0x568], 0
mov dword [ebp - 0x570], 0xe85dc32c
mov dword [ebp - 0x578], 0
mov dword [ebp - 0x524], 8
mov dword [ebp - 0x564], 0x7655
mov dword [ebp - 0x148], 0
jmp 0x10047502
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jge 0x1004751e
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x4a8], 0xc0f4fd1a
jmp 0x100474f5
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
jmp 0x10047539
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x448], eax
jmp 0x1004737b
mov dword [ebp - 0x52c], 0xffffffff
mov dword [ebp - 0x4b0], 0xa8e97eed
mov dword [ebp - 0x554], 0xffffffff
mov dword [ebp - 0x28], 0
jmp 0x1004756c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10047582
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5e4], 0xdd03248c
jmp 0x10047565
mov dword [ebp - 0x28], 0
jmp 0x10047592
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x100475a8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x588], 8
jmp 0x1004758b
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x588]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x588], eax
mov dword [ebp - 0x140], 0
jmp 0x100475dc
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x100475f8
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x358], 0xaf11
jmp 0x100475cf
mov dword [ebp - 0x24], 0
jmp 0x10047608
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x100488ef
mov dword [ebp - 0x40], 0xe0091df8
mov dword [ebp - 0xa4], 1
mov dword [ebp - 0x170], 0x2e6c0b33
mov dword [ebp - 0x108], 0x3ae35568
mov dword [ebp - 0x108], 0xa
jmp 0x10047650
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 7
jne 0x1004772e
mov dword [ebp - 0x2b8], 1
mov dword [ebp - 0x404], 0xffffffff
mov dword [ebp - 0xec], 0
jmp 0x1004768a
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x100476a6
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x594], 0xffffffff
jmp 0x1004767d
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x1f4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f4]
mov dword [ebp + eax - 0x594], ecx
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x1f4], eax
je 0x100476df
mov dword [ebp - 0x340], 1
jmp 0x100476e6
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x404], eax
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x10047729
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x10047643
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0x110], 0
jmp 0x10047751
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jge 0x1004776d
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x43c], 0x841b3c69
jmp 0x10047744
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x43c], 0
jmp 0x10047798
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x43c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x43c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x43c], 0xffffffe4
je 0x100477f5
mov dword [ebp - 0x3b4], 0x43046b6e
mov dword [ebp - 0x3b8], 0x464f16ef
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x43c]
sub eax, dword [ebp - 0x3b4]
cmp eax, 0xb9dd952e
jne 0x100477e0
mov dword [ebp - 0x1fc], 1
jmp 0x100477e7
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x3b8], eax
jmp 0x1004777f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x43c], 0
je 0x10047817
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x10047817
mov dword [ebp - 0x2c0], 1
jmp 0x1004781e
and dword [ebp - 0x2c0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2c0]
mov dword [ebp + eax - 0x43c], ecx
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x44c], 0x89afca86
mov dword [ebp - 0x4b8], 4
mov dword [ebp - 0x134], 0
jmp 0x1004786f
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x1004788b
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x20c], 0xaf11
jmp 0x10047862
mov dword [ebp - 0x14], 0
jmp 0x1004789b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x10047b0a
mov dword [ebp - 0x44], 0xe0091df8
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x160], 0x2e6c0b33
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0xe4], 1
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x534], eax
push 0xfffffffffffffff6
pop eax
add eax, 0x7cdedfc4
je 0x100478f9
mov eax, 0xfc2e
test eax, eax
je 0x100478f9
and dword [ebp - 0x204], 0
jmp 0x10047903
mov dword [ebp - 0x204], 1
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x14], eax
jge 0x10047920
mov dword [ebp - 0x408], 1
jmp 0x10047927
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0xa0], 0xffffffff
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
jle 0x10047978
mov dword [ebp - 0x318], 1
jmp 0x1004797f
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x318]
je 0x1004799a
mov dword [ebp - 0x3c0], 1
jmp 0x100479a1
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4d0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20c]
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x44c], 0xf47f28a9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4d8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20c], 1
je 0x10047ab7
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0x410], 0x10b42b8f
mov dword [ebp - 0xc0], 0
jmp 0x10047a11
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jg 0x10047a28
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x410], eax
jmp 0x10047a04
mov dword [ebp - 0x44], 0
jmp 0x10047a38
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x10047ab5
mov dword [ebp - 0xa0], 0
jmp 0x10047a57
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jg 0x10047ab0
mov byte [ebp - 0x4c], 0
movzx eax, byte [ebp - 0x4c]
test eax, eax
je 0x10047a7d
push 0x386
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x10047aae
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x10047a4a
jmp 0x10047a31
jmp 0x10047acd
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x10047acd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0xe4], 0
jmp 0x10047ae6
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jg 0x10047b05
mov byte [ebp - 0x50], 0
movzx eax, byte [ebp - 0x50]
test eax, eax
je 0x10047b03
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x10047ad9
jmp 0x10047894
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x544], eax
push 0xfffffffffffffff6
pop eax
add eax, 0x7cdedfc4
je 0x10047b2f
mov eax, 0xfc2e
test eax, eax
je 0x10047b2f
and dword [ebp - 0x2c8], 0
jmp 0x10047b39
mov dword [ebp - 0x2c8], 1
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x24], eax
jge 0x10047b56
mov dword [ebp - 0x3d0], 1
jmp 0x10047b5d
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x54c], eax
mov dword [ebp - 0xa4], 0xffffffff
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x24]
jle 0x10047bae
mov dword [ebp - 0x214], 1
jmp 0x10047bb5
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x214]
je 0x10047bd0
mov dword [ebp - 0x444], 1
jmp 0x10047bd7
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4f0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x358]
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x3d8], 0xf47f28a9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4f8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x358], 1
je 0x10048896
mov dword [ebp - 0x3f0], 0
mov dword [ebp - 0x3a4], 0x76820624
mov dword [ebp - 0x3a0], 0x76820624
mov dword [ebp - 0x39c], 0x76820624
mov dword [ebp - 0x398], 0x76820624
mov dword [ebp - 0x168], 0xffffffff
mov dword [ebp - 0xcc], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3a4], 0
jmp 0x10047c8e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3a4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a4], 0x17
jge 0x10047d99
mov dword [ebp - 0x118], 0xa986
mov dword [ebp - 0x428], 0x49968cb6
cmp dword [ebp - 0x118], 0
jne 0x10047d3e
mov eax, 0x38d9
test eax, eax
je 0x10047cdf
mov eax, dword [ebp - 0x118]
sub eax, 5
je 0x10047cdf
mov dword [ebp - 0x21c], 1
jmp 0x10047ce6
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x21c], eax
je 0x10047d00
mov dword [ebp - 0x418], 1
jmp 0x10047d07
and dword [ebp - 0x418], 0
mov eax, 0x4142b919
test eax, eax
je 0x10047d25
mov eax, 0xde6fc608
test eax, eax
je 0x10047d25
mov dword [ebp - 0x3e0], 1
jmp 0x10047d2c
and dword [ebp - 0x3e0], 0
cmp dword [ebp - 0x118], 0
jne 0x10047d3e
and dword [ebp - 0x2d0], 0
jmp 0x10047d48
mov dword [ebp - 0x2d0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp - 0x2d0], eax
jg 0x10047d69
mov dword [ebp - 0x224], 1
jmp 0x10047d70
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xcc], eax
jmp 0x10047c73
mov dword [ebp - 0xcc], 0
jmp 0x10047db2
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffff7
jg 0x10047e0d
mov dword [ebp - 0x13c], 0
jmp 0x10047dd4
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x10047df0
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x320], 0x512dc6d0
jmp 0x10047dc7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x320]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x320], eax
jmp 0x10047da5
mov dword [ebp - 0x42c], 0x10b42b8f
mov dword [ebp - 0x394], 1
mov dword [ebp - 0x390], 1
mov dword [ebp - 0x38c], 1
mov dword [ebp - 0x388], 1
mov dword [ebp - 0xb0], 0x68108531
mov dword [ebp - 0x498], 0x598aaf0a
mov dword [ebp - 0x494], 0x598aaf0a
mov dword [ebp - 0x490], 0x598aaf0a
mov dword [ebp - 0x48c], 0x598aaf0a
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x394]
cmp dword [ebp + eax - 0x394], ecx
jne 0x10047e98
mov dword [ebp - 0x22c], 1
jmp 0x10047e9f
and dword [ebp - 0x22c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x394], 0x4320e32c
jge 0x10047ebe
mov dword [ebp - 0x2d8], 1
jmp 0x10047ec5
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x2d8]
jl 0x10047edf
mov dword [ebp - 0x234], 1
jmp 0x10047ee6
and dword [ebp - 0x234], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x394]
cmp eax, dword [ebp - 0x234]
jg 0x10047f06
mov dword [ebp - 0x348], 1
jmp 0x10047f0d
and dword [ebp - 0x348], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x394]
cmp dword [ebp - 0x348], eax
jge 0x10047f2e
mov dword [ebp - 0x23c], 1
jmp 0x10047f35
and dword [ebp - 0x23c], 0
cmp dword [ebp - 0x23c], 0xb963
jl 0x10047f59
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x394], 0
jne 0x10047f59
and dword [ebp - 0x2e0], 0
jmp 0x10047f63
mov dword [ebp - 0x2e0], 1
cmp dword [ebp - 0x2e0], 0xec3203b
jle 0x10047f7b
mov dword [ebp - 0x244], 1
jmp 0x10047f82
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0xb0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb0]
mov dword [ebp + eax - 0x498], ecx
mov dword [ebp - 0xb0], 0xffffffe3
jmp 0x10047fba
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x1b
jl 0x10048009
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0x3e8], 0xf4039ee4
mov dword [ebp - 0xdc], 0
jmp 0x10047ff0
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xfffffffc
jg 0x10048007
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x3e8], eax
jmp 0x10047fe3
jmp 0x10047fad
mov dword [ebp - 0xd4], 0
jmp 0x10048022
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jg 0x1004820a
mov dword [ebp - 0x120], 0xffff
mov dword [ebp - 0x25c], 0xfffffffd
mov dword [ebp - 0x264], 0xfffffffb
mov dword [ebp - 0x424], 0xa2ca335c
mov dword [ebp - 0x34], 0
jmp 0x10048067
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1004807d
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x470], 0xcf8
jmp 0x10048060
mov dword [ebp - 0x34], 0
jmp 0x1004808d
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x100480a3
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x514], 0x95e0e2bf
jmp 0x10048086
cmp dword [ebp - 0x120], 0
je 0x100481df
cmp dword [ebp - 0x120], 0x60a421e0
je 0x100480c8
mov dword [ebp - 0x328], 1
jmp 0x100480cf
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x328]
jne 0x100480e9
mov dword [ebp - 0x24c], 1
jmp 0x100480f0
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x24c], eax
jle 0x1004810a
mov dword [ebp - 0x2e8], 1
jmp 0x10048111
and dword [ebp - 0x2e8], 0
imul eax, dword [ebp - 0x2e8], 0x4d39
test eax, eax
jne 0x1004812b
mov dword [ebp - 0x254], 1
jmp 0x10048132
and dword [ebp - 0x254], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x470]
cmp dword [ebp - 0x254], eax
je 0x10048153
mov dword [ebp - 0x368], 1
jmp 0x1004815a
and dword [ebp - 0x368], 0
cmp dword [ebp - 0x368], 0x63069be5
jle 0x10048172
mov dword [ebp - 0x2f0], 1
jmp 0x10048179
and dword [ebp - 0x2f0], 0
mov dword [ebp - 0x25c], 0x5059b8bc
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x2f0]
add eax, 0x4cbed562
cmp dword [ebp - 0x264], eax
jl 0x100481b7
cmp dword [ebp - 0x424], 0
je 0x100481b7
mov dword [ebp - 0x330], 1
jmp 0x100481be
and dword [ebp - 0x330], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x330]
sub ecx, dword [ebp + eax - 0x470]
je 0x100481df
mov dword [ebp - 0x26c], 1
jmp 0x100481e6
and dword [ebp - 0x26c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x26c]
mov dword [ebp + eax - 0x514], ecx
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x42c], eax
jmp 0x10048015
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x27c], 0xffffffff
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x10048231
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x1c], 0xffffffef
jmp 0x10048241
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xc
jge 0x1004839f
mov dword [ebp - 0x98], 0xffff
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x350], 0xee91b76e
mov dword [ebp - 0x144], 0
jmp 0x10048282
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x1004829e
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x440], 0x2c9bf5e4
jmp 0x10048275
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], eax
jge 0x10048303
mov dword [ebp - 0x3f8], 1
jmp 0x1004830a
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0xa8]
sub eax, 0x3ca3691f
imul eax, dword [ebp - 0x1c]
cmp eax, 5
jne 0x10048336
mov dword [ebp - 0x2f8], 1
jmp 0x1004833d
and dword [ebp - 0x2f8], 0
imul eax, dword [ebp - 0x2f8], 0xdd97
cmp eax, dword [ebp - 0x1c]
jle 0x10048358
mov dword [ebp - 0x274], 1
jmp 0x1004835f
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x98]
neg eax
imul eax, dword [ebp - 0x274]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x27c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x27c]
mov dword [ebp + eax - 0x440], ecx
jmp 0x1004823a
mov dword [ebp - 0x40], 0
jmp 0x100483af
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x10048894
mov dword [ebp - 0x154], 0x34bf8f0a
mov dword [ebp - 0x15c], 0x307d7c11
mov dword [ebp - 0x178], 0xffffffff
mov dword [ebp - 0x68], 0x320e32cf
mov dword [ebp - 0x130], 0x49aaed6b
mov dword [ebp - 0x37c], 1
mov dword [ebp - 0x378], 1
mov dword [ebp - 0x374], 1
mov dword [ebp - 0x370], 1
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x94], 0xffffffff
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 0x1e0], 0x47c914a3
mov dword [ebp - 0x3c4], 5
mov dword [ebp - 0x128], 0
jmp 0x1004845b
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x10048477
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x3cc], 1
jmp 0x1004844e
cmp dword [ebp - 0x178], 0
jne 0x1004852c
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x540], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x37c]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x130], eax
jg 0x100484bd
mov dword [ebp - 0x300], 1
jmp 0x100484c4
and dword [ebp - 0x300], 0
imul eax, dword [ebp - 0x300], 0x5bb0
imul eax, dword [ebp - 0x68]
test eax, eax
je 0x100484e7
or eax, 0xffffffff
je 0x100484e7
mov dword [ebp - 0x284], 1
jmp 0x100484ee
and dword [ebp - 0x284], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x37c]
cmp dword [ebp - 0x284], eax
jl 0x1004850e
mov dword [ebp - 0x290], 1
jmp 0x10048515
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x290]
jle 0x1004852c
and dword [ebp - 0x180], 0
jmp 0x10048536
mov dword [ebp - 0x180], 1
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x180], eax
jne 0x1004854d
mov dword [ebp - 0x1a0], 1
jmp 0x10048554
and dword [ebp - 0x1a0], 0
cmp dword [ebp - 0x1a0], 0xffffffff
je 0x1004856f
cmp dword [ebp - 0xf0], 0
jne 0x1004856f
and dword [ebp - 0x1a8], 0
jmp 0x10048579
mov dword [ebp - 0x1a8], 1
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x400]
cmp eax, dword [ebp - 0x3b0]
jge 0x100485b8
mov dword [ebp - 0x3ac], 1
jmp 0x100485bf
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x154], 0
jne 0x100485f5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x37c], 0
jne 0x100485f5
cmp dword [ebp - 0x130], 0
jne 0x100485f5
and dword [ebp - 0x1b0], 0
jmp 0x100485ff
mov dword [ebp - 0x1b0], 1
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x1b0], eax
jle 0x10048619
mov dword [ebp - 0x1b8], 1
jmp 0x10048620
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x1b8]
sub eax, 6
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
je 0x1004865c
cmp dword [ebp - 0x94], 0
je 0x1004865c
mov dword [ebp - 0x1c0], 1
jmp 0x10048663
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x1c0]
jl 0x1004867d
mov dword [ebp - 0x1c8], 1
jmp 0x10048684
and dword [ebp - 0x1c8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x37c]
add eax, dword [ebp - 0x1c8]
sub eax, dword [ebp - 0x94]
cmp eax, 0x9afff74b
jae 0x100486af
mov dword [ebp - 0x1d0], 1
jmp 0x100486b6
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x14c], eax
jl 0x100486dc
mov dword [ebp - 0x1d8], 1
jmp 0x100486e3
and dword [ebp - 0x1d8], 0
imul eax, dword [ebp - 0x1d8], 6
cmp eax, dword [ebp - 0x68]
jl 0x100486fb
mov dword [ebp - 0x3bc], 1
jmp 0x10048702
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x528], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x37c]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x3c4]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x3cc]
xor ecx, ecx
sub ecx, eax
cmp ecx, 8
jge 0x10048748
mov dword [ebp - 0x1e8], 1
jmp 0x1004874f
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
sub eax, dword [ebp - 0x68]
imul eax, eax, 0x963e
cmp eax, 0xb100
jle 0x10048771
mov dword [ebp - 0x1f0], 1
jmp 0x10048778
and dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 0xcc425f8e
jae 0x10048790
mov dword [ebp - 0x1f8], 1
jmp 0x10048797
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x94]
mov dword [ebp - 0x200], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x200]
mov dword [ebp + eax - 0x37c], ecx
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0xf0]
jg 0x100487e1
cmp dword [ebp - 0x154], 0
jne 0x100487e1
and dword [ebp - 0x208], 0
jmp 0x100487eb
mov dword [ebp - 0x208], 1
mov eax, dword [ebp - 0x208]
sub eax, 0xc660
cmp eax, dword [ebp - 0xf0]
jl 0x1004880a
mov dword [ebp - 0x210], 1
jmp 0x10048811
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0xa4], 0
jmp 0x10048836
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jg 0x1004888f
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1004885c
push 0x386
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x1004888d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x10048829
jmp 0x100483a8
jmp 0x100488b2
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x100488b2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0xc4], 0
jmp 0x100488cb
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jg 0x100488ea
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x100488e8
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x100488be
jmp 0x10047601
mov dword [ebp - 0xf4], 0xfffffffa
mov dword [ebp - 0x20], 0
jmp 0x10048909
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1004891f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5b8], 0
jmp 0x10048902
mov dword [ebp - 0x20], 0
jmp 0x1004892f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10048945
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5b0], 0x8a6b950b
jmp 0x10048928
mov dword [ebp - 0xf4], 1
jmp 0x1004895e
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x1004899a
mov dword [ebp - 0x218], 1
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1004898b
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
jmp 0x10048951
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10049205
mov dword [ebp - 0x38], 0x1c77dcd
mov dword [ebp - 0x280], 0xbf118c84
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x18], 0
jmp 0x100489ce
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x100489e1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78], 0xc03342eb
jmp 0x100489c7
mov dword [ebp - 0x18], 0
jmp 0x100489f1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10048a04
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], 0xfffffff8
jmp 0x100489ea
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x78], 0
jmp 0x10048a29
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x78], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x78], 0xffffffeb
jg 0x10048f07
mov dword [ebp - 0x70], 0xfffffff8
mov dword [ebp - 0x16c], 0xfffffff9
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x2c4], 3
mov dword [ebp - 0x30], 0
jmp 0x10048a6f
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10048a85
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x460], 1
jmp 0x10048a68
mov dword [ebp - 0x30], 0
jmp 0x10048a95
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10048aab
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x420], 0x97736eae
jmp 0x10048a8e
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x70], eax
je 0x10048abf
mov dword [ebp - 0x270], 1
jmp 0x10048ac6
and dword [ebp - 0x270], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10048afd
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x16c]
jne 0x10048afd
and dword [ebp - 0x220], 0
jmp 0x10048b07
mov dword [ebp - 0x220], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x220], eax
jne 0x10048b25
mov dword [ebp - 0x228], 1
jmp 0x10048b2c
and dword [ebp - 0x228], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x228], eax
jne 0x10048b4a
mov dword [ebp - 0x230], 1
jmp 0x10048b51
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
sub eax, 0x36d0
neg eax
cmp eax, dword [ebp - 0x16c]
jg 0x10048b72
mov dword [ebp - 0x164], 1
jmp 0x10048b79
and dword [ebp - 0x164], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x164]
mov dword [ebp + eax - 0x460], ecx
mov eax, dword [ebp - 0x164]
neg eax
cmp eax, dword [ebp - 0x70]
jg 0x10048ba4
mov dword [ebp - 0x238], 1
jmp 0x10048bab
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x238]
jge 0x10048bc5
mov dword [ebp - 0x240], 1
jmp 0x10048bcc
and dword [ebp - 0x240], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x240], eax
jg 0x10048bf0
cmp dword [ebp - 0x38], 0
je 0x10048bf0
mov dword [ebp - 0x248], 1
jmp 0x10048bf7
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x248]
neg eax
cmp eax, dword [ebp - 0x70]
jg 0x10048c10
mov dword [ebp - 0x250], 1
jmp 0x10048c17
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
add eax, 5
imul eax, dword [ebp - 0x70]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x78]
jle 0x10048c45
mov eax, 0xbb1bb30b
test eax, eax
je 0x10048c45
mov dword [ebp - 0x258], 1
jmp 0x10048c4c
and dword [ebp - 0x258], 0
imul eax, dword [ebp - 0x258], 0
mov dword [ebp - 0x260], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x260]
mov dword [ebp + eax - 0x48], ecx
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x260], eax
je 0x10048c80
mov dword [ebp - 0x268], 1
jmp 0x10048c87
and dword [ebp - 0x268], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x420]
cmp dword [ebp - 0x268], eax
jne 0x10048ca8
mov dword [ebp - 0x278], 1
jmp 0x10048caf
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x270]
add eax, dword [ebp - 0x278]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x80], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x420]
cmp dword [ebp + eax - 0x460], ecx
jg 0x10048d64
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x460], 0
je 0x10048d06
or eax, 0xffffffff
je 0x10048d06
mov dword [ebp - 0x288], 1
jmp 0x10048d0d
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x288], eax
jge 0x10048d27
mov dword [ebp - 0x2a4], 1
jmp 0x10048d2e
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x2a4], eax
jl 0x10048d48
mov dword [ebp - 0x2ac], 1
jmp 0x10048d4f
and dword [ebp - 0x2ac], 0
cmp dword [ebp - 0x2ac], 0xfffffffc
jae 0x10048d64
mov dword [ebp - 0x2b4], 1
jmp 0x10048d6b
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x2b4]
je 0x10048d88
cmp dword [ebp - 0x38], 0
je 0x10048d88
mov dword [ebp - 0x2bc], 1
jmp 0x10048d8f
and dword [ebp - 0x2bc], 0
cmp dword [ebp - 0x2bc], 0xe20
jne 0x10048da7
mov dword [ebp - 0x2cc], 1
jmp 0x10048dae
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x2cc], eax
je 0x10048dc8
mov dword [ebp - 0x2d4], 1
jmp 0x10048dcf
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
sub eax, 0xf2ec
cmp eax, dword [ebp - 0x80]
jne 0x10048dee
cmp dword [ebp - 0x38], 0
jne 0x10048dee
and dword [ebp - 0x2dc], 0
jmp 0x10048df8
mov dword [ebp - 0x2dc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x420]
cmp dword [ebp - 0x2dc], eax
je 0x10048e19
mov dword [ebp - 0x2e4], 1
jmp 0x10048e20
and dword [ebp - 0x2e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x2e4], eax
jl 0x10048e47
mov eax, 0xd038cf49
test eax, eax
je 0x10048e47
mov dword [ebp - 0x2ec], 1
jmp 0x10048e4e
and dword [ebp - 0x2ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp eax, dword [ebp - 0x2ec]
jle 0x10048e6c
mov dword [ebp - 0x2f4], 1
jmp 0x10048e73
and dword [ebp - 0x2f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x460]
sub eax, dword [ebp - 0x2f4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x48]
jg 0x10048edf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48], 0
je 0x10048edf
mov dword [ebp - 0x38], 0xfffffff2
jmp 0x10048eaf
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff1
jg 0x10048edd
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x10048edb
push 0x94e
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10048ea8
jmp 0x10048f02
mov dword [ebp - 0x80], 0
jmp 0x10048eef
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x10048f02
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x48], 0
jmp 0x10048ee8
jmp 0x10048a14
mov byte [ebp - 0x4a], 0
movzx eax, byte [ebp - 0x4a]
test eax, eax
je 0x10048f24
push 0
push 0x1bba
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x488], 0xfffffffe
mov dword [ebp - 0x484], 0xfffffffe
mov dword [ebp - 0x480], 0xfffffffe
mov dword [ebp - 0x47c], 0xfffffffe
mov dword [ebp - 0x2c], 0
jmp 0x10048f65
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10048f7b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x384], 0x5b57
jmp 0x10048f5e
mov dword [ebp - 0x2c], 0
jmp 0x10048f8b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10048fa1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc8], 0xc184c506
jmp 0x10048f84
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc8], 1
jmp 0x10048fcf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc8], 0
jl 0x100490a1
mov dword [ebp - 0xac], 1
mov dword [ebp - 0xac], 1
jmp 0x10049006
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x1004909c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc8]
mov ecx, dword [ebp - 0xac]
mov ecx, dword [ebp + ecx*4 - 0x384]
cmp dword [ebp + eax*4 - 0x384], ecx
jg 0x10049066
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp + eax - 0x384]
mov dword [ebp + ecx*4 - 0x384], eax
mov byte [ebp - 0x4b], 0
movzx eax, byte [ebp - 0x4b]
test eax, eax
je 0x10049064
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10049083
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x10049083
push 0
push 0
push 0x2000
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x488], 0
je 0x10049097
jmp 0x10048ff9
jmp 0x10048ff9
jmp 0x10048fb4
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
movzx eax, byte [eax]
test eax, eax
je 0x1004916c
mov dword [ebp - 0x3c], 0xe83c773
mov dword [ebp - 0x104], 0
jmp 0x100490de
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x100490fa
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x5f0], 0xffffffff
jmp 0x100490d1
mov dword [ebp - 0x3c], 0
jmp 0x1004910a
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x1004912f
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x1004912d
push 1
push 0x24d1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
jmp 0x10049103
mov dword [ebp - 0x3c], 0
jmp 0x1004913f
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x1004915b
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x10049159
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x10049138
push 0x386
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0xd0], 0xd29be1d9
mov dword [ebp - 0x10c], 0
jmp 0x1004918f
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jge 0x100491ab
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x5a0], 0x648261f9
jmp 0x10049182
mov byte [ebp - 0x53], 0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x100491ca
push 0
push 0
push 0x1def
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xd0], 2
jmp 0x100491e3
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x10049200
mov eax, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0x5a0], 0
je 0x100491fe
jmp 0x10049200
jmp 0x100491d6
jmp 0x100497b2
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x88], 0
jmp 0x10049228
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x16
je 0x1004946c
mov dword [ebp - 0xd8], 0xeede0b40
mov dword [ebp - 0x114], 0
jmp 0x10049258
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 4
jge 0x10049274
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x5c8], 0xfffffffa
jmp 0x1004924b
mov dword [ebp - 0xd8], 0
jmp 0x1004928d
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x16
je 0x10049467
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x11c], 0
jmp 0x100492bd
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 7
je 0x10049462
mov dword [ebp - 0xc], 0xc1188e17
mov dword [ebp - 0x124], 0
jmp 0x100492ea
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x10049306
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0xb4], 0x121f
jmp 0x100492dd
mov dword [ebp - 0xc], 0
jmp 0x10049316
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x1004945d
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0xb4], 0
je 0x100493a3
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xb4]
mov dword [ebp - 0x4a4], eax
push 4
pop eax
imul eax, eax, 0
push 7
pop ecx
sub ecx, dword [ebp + eax - 0xb4]
je 0x10049362
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x10049362
mov dword [ebp - 0x2fc], 1
jmp 0x10049369
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x2fc], eax
je 0x10049383
mov dword [ebp - 0x3e4], 1
jmp 0x1004938a
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0xb4], 0
je 0x100493a3
mov dword [ebp - 0x304], 1
jmp 0x100493aa
and dword [ebp - 0x304], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x304]
sub ecx, dword [ebp + eax - 0xb4]
add ecx, dword [ebp - 0xc]
jne 0x100493ce
mov dword [ebp - 0x30c], 1
jmp 0x100493d5
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
sub eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x88]
jle 0x100493f5
mov dword [ebp - 0x314], 1
jmp 0x100493fc
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x314]
cmp eax, dword [ebp - 0x88]
jle 0x10049419
mov dword [ebp - 0x31c], 1
jmp 0x10049420
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xb4]
cmp eax, dword [ebp - 0x31c]
jle 0x1004943e
mov dword [ebp - 0x324], 1
jmp 0x10049445
and dword [ebp - 0x324], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x324]
mov dword [ebp + eax - 0x5c8], ecx
jmp 0x1004930f
jmp 0x100492b0
jmp 0x10049280
jmp 0x1004921b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0xe0], 0xfffffff6
mov dword [ebp - 0x33c], 0xcc321a0
mov dword [ebp - 8], 0
jmp 0x10049499
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100494af
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x600], 0xb9b5
jmp 0x10049492
mov dword [ebp - 8], 0
jmp 0x100494bf
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x100494d5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x90], 0x532fe223
jmp 0x100494b8
mov dword [ebp - 8], 0
jmp 0x100494e5
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x100494fb
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x4ac], 0xffffffff
jmp 0x100494de
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x90], 3
jmp 0x10049529
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x90], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x90], 0
jl 0x10049795
mov dword [ebp - 0xbc], 0xfffffffe
mov dword [ebp - 0x344], 4
mov dword [ebp - 0x34c], 0x6b34c266
mov dword [ebp - 0x17c], 0x4ce34aaf
xor eax, eax
jne 0x10049598
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x4b4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90]
mov dword [ebp - 0x4bc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x90], 0
je 0x100495ad
cmp dword [ebp - 0xbc], 0
je 0x100495ad
mov dword [ebp - 0x32c], 1
jmp 0x100495b4
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 1
jne 0x100495cf
mov eax, 0x5da2
test eax, eax
jne 0x100495cf
and dword [ebp - 0x334], 0
jmp 0x100495d9
mov dword [ebp - 0x334], 1
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xe0], 0
jmp 0x100495fe
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jg 0x10049790
mov dword [ebp - 0x174], 0xfe9a5a16
mov dword [ebp - 0xbc], 0
jmp 0x1004962e
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jg 0x1004978b
mov dword [ebp - 0xe8], 0xa0cd95ff
mov dword [ebp - 0x3f4], 0xd4a79744
mov dword [ebp - 0x4c4], 0xbe3d0e72
mov dword [ebp - 0x3ec], 2
mov dword [ebp - 0x12c], 0
jmp 0x1004967c
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jge 0x10049698
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x478], 0xffffffff
jmp 0x1004966f
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
je 0x100496d6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x90], 0
je 0x100496d6
mov dword [ebp - 0x184], 1
jmp 0x100496dd
and dword [ebp - 0x184], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x478]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
cmp eax, dword [ebp - 0x184]
jle 0x1004971b
xor eax, eax
inc eax
je 0x1004971b
mov dword [ebp - 0x18c], 1
jmp 0x10049722
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
je 0x10049751
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x3f4], eax
jmp 0x10049786
mov dword [ebp - 0xe8], 0
jmp 0x1004976a
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x10049786
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x478], 0x2afddf34
jmp 0x1004975d
jmp 0x10049621
jmp 0x100495f1
jmp 0x1004950e
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x194]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret