Function at 0x10008f49
Capabilities:
Enumerate gui resources
Get file attributes
Query or enumerate registry value
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100823d1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x10d4
call fcn.1007e9e0
push esi
push edi
mov dword [ebp - 0xfc], 0xfffffffa
mov dword [ebp - 0x24], 0
mov dword [ebp - 0xff4], 0xa023703a
mov dword [ebp - 0x2f4], 0
jmp 0x10008fa1
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 3
jge 0x10008fbd
mov eax, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0xf90], 0x600d5493
jmp 0x10008f94
mov dword [ebp - 0xfc], 0xffffffe2
jmp 0x10008fd6
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jne 0x1000916e
mov dword [ebp - 0xbe4], 0xee1c
mov dword [ebp - 0xbe0], 0xee1c
mov dword [ebp - 0xbdc], 0xee1c
mov dword [ebp - 0xbd8], 0xee1c
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xbe4], 0xb6fd
jl 0x1000902a
mov dword [ebp - 0x744], 1
jmp 0x10009031
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x744]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0xbe4]
je 0x1000905d
or eax, 0xffffffff
je 0x1000905d
mov dword [ebp - 0x950], 1
jmp 0x10009064
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x950], eax
je 0x1000907e
mov dword [ebp - 0x958], 1
jmp 0x10009085
and dword [ebp - 0x958], 0
imul eax, dword [ebp - 0x958], 0xfffe
mov dword [ebp - 0x960], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x960]
mov dword [ebp + eax - 0xf90], ecx
cmp dword [ebp - 0x960], 0
je 0x100090c2
xor eax, eax
inc eax
je 0x100090c2
mov dword [ebp - 0x9a4], 1
jmp 0x100090c9
and dword [ebp - 0x9a4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xbe4]
cmp dword [ebp - 0x9a4], eax
jl 0x100090ea
mov dword [ebp - 0x9ac], 1
jmp 0x100090f1
and dword [ebp - 0x9ac], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xbe4]
add eax, dword [ebp - 0x9ac]
sub eax, dword [ebp - 0xfc]
cmp eax, 0x4e6c
jle 0x1000911d
mov dword [ebp - 0x9b4], 1
jmp 0x10009124
and dword [ebp - 0x9b4], 0
cmp dword [ebp - 0x9b4], 0xffffffff
jne 0x10009139
mov dword [ebp - 0x990], 1
jmp 0x10009140
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0
jmp 0x10009159
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jg 0x10009169
cmp dword [ebp - 0x24], 0
je 0x10009167
jmp 0x10009169
jmp 0x10009152
jmp 0x10008fc9
mov dword [ebp - 0x24], 0
jmp 0x1000917e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10009194
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf90], 0
jmp 0x10009177
mov dword [ebp - 0x104], 0xfffffffa
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xe00], 0xa023703a
mov dword [ebp - 0x1f8], 0
jmp 0x100091c8
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x100091e4
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0xfa0], 0x600d5493
jmp 0x100091bb
mov dword [ebp - 0x104], 0xffffffe2
jmp 0x100091fd
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jne 0x10009395
mov dword [ebp - 0xbf8], 0xee1c
mov dword [ebp - 0xbf4], 0xee1c
mov dword [ebp - 0xbf0], 0xee1c
mov dword [ebp - 0xbec], 0xee1c
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xbf8], 0xb6fd
jl 0x10009251
mov dword [ebp - 0x4bc], 1
jmp 0x10009258
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0x4bc]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0xbf8]
je 0x10009284
or eax, 0xffffffff
je 0x10009284
mov dword [ebp - 0x43c], 1
jmp 0x1000928b
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x43c], eax
je 0x100092a5
mov dword [ebp - 0x8c8], 1
jmp 0x100092ac
and dword [ebp - 0x8c8], 0
imul eax, dword [ebp - 0x8c8], 0xfffe
mov dword [ebp - 0x444], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x444]
mov dword [ebp + eax - 0xfa0], ecx
cmp dword [ebp - 0x444], 0
je 0x100092e9
xor eax, eax
inc eax
je 0x100092e9
mov dword [ebp - 0x8d0], 1
jmp 0x100092f0
and dword [ebp - 0x8d0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xbf8]
cmp dword [ebp - 0x8d0], eax
jl 0x10009311
mov dword [ebp - 0x44c], 1
jmp 0x10009318
and dword [ebp - 0x44c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xbf8]
add eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0x104]
cmp eax, 0x4e6c
jle 0x10009344
mov dword [ebp - 0x8d8], 1
jmp 0x1000934b
and dword [ebp - 0x8d8], 0
cmp dword [ebp - 0x8d8], 0xffffffff
jne 0x10009360
mov dword [ebp - 0x454], 1
jmp 0x10009367
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0
jmp 0x10009380
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jg 0x10009390
cmp dword [ebp - 0x2c], 0
je 0x1000938e
jmp 0x10009390
jmp 0x10009379
jmp 0x100091f0
mov dword [ebp - 0x2c], 0
jmp 0x100093a5
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x100093bb
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xfa0], 0
jmp 0x1000939e
mov dword [ebp - 0x1c], 0x42eb90da
mov dword [ebp - 0x918], 1
cmp dword [ebp - 0x1c], 0
je 0x1000955b
mov dword [ebp - 0x10c], 0x6535
mov dword [ebp - 0x324], 0x218e9934
mov dword [ebp - 0xa54], 0
cmp dword [ebp - 0x10c], 0
je 0x10009420
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x1c]
jl 0x10009420
mov dword [ebp - 0x8e0], 1
jmp 0x10009427
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x8e0], eax
jg 0x1000943e
mov dword [ebp - 0x45c], 1
jmp 0x10009445
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x45c]
jl 0x1000945f
mov dword [ebp - 0x8e8], 1
jmp 0x10009466
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x324], eax
jl 0x10009489
mov dword [ebp - 0x464], 1
jmp 0x10009490
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x464], eax
je 0x100094aa
mov dword [ebp - 0x8f0], 1
jmp 0x100094b1
and dword [ebp - 0x8f0], 0
cmp dword [ebp - 0x8f0], 0xe80d68f9
jae 0x100094c9
mov dword [ebp - 0x46c], 1
jmp 0x100094d0
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x46c], eax
jne 0x100094f6
mov eax, 0x58331c58
test eax, eax
jne 0x100094f6
cmp dword [ebp - 0x324], 0
jne 0x100094f6
and dword [ebp - 0x8f8], 0
jmp 0x10009500
mov dword [ebp - 0x8f8], 1
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x8f8], eax
jl 0x1000951a
mov dword [ebp - 0x474], 1
jmp 0x10009521
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0xa54], eax
mov byte [ebp - 0x168], 0
movzx eax, byte [ebp - 0x168]
test eax, eax
je 0x10009556
push 0xa30
push 0x1cba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x100096bd
mov dword [ebp - 0xb00], 0xb09b
mov dword [ebp - 0x900], 0x258d0336
mov dword [ebp - 0x484], 5
mov dword [ebp - 0x1c], 0
jmp 0x10009589
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff9
jne 0x100096bd
mov dword [ebp - 0xa8], 0x5261fc42
mov dword [ebp - 0xa8], 0xfffffff9
jmp 0x100095b6
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffff
jne 0x100095cc
cmp dword [ebp - 0xb00], 0
je 0x100095ca
jmp 0x100095cc
jmp 0x100095a9
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xe08], eax
cmp dword [ebp - 0xa8], 0
jne 0x10009656
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xe10], eax
mov dword [ebp - 0x900], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x900], eax
jl 0x1000960e
mov dword [ebp - 0x47c], 1
jmp 0x10009615
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
neg eax
cmp dword [ebp - 0x1c], eax
je 0x1000962e
mov dword [ebp - 0x908], 1
jmp 0x10009635
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0x52772010
jge 0x10009656
and dword [ebp - 0x910], 0
jmp 0x10009660
mov dword [ebp - 0x910], 1
cmp dword [ebp - 0x910], 0x3ea3
jge 0x10009678
mov dword [ebp - 0x48c], 1
jmp 0x1000967f
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
sub eax, 0xfff8
mov dword [ebp - 0x918], eax
cmp dword [ebp - 0x918], 0xffffffff
jge 0x100096a5
mov dword [ebp - 0x494], 1
jmp 0x100096ac
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0xa8], eax
jmp 0x10009582
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x100096e1
push 0xc35
push 0x1fde
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
mov dword [ebp - 0x114], 0xfffffffa
mov dword [ebp - 0x30], 0
mov dword [ebp - 0xe18], 0xa023703a
mov dword [ebp - 0x2a8], 0
jmp 0x10009715
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 3
jge 0x10009731
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0xfb0], 0x600d5493
jmp 0x10009708
mov dword [ebp - 0x114], 0xffffffe2
jmp 0x1000974a
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jne 0x100098e2
mov dword [ebp - 0xa6c], 0xee1c
mov dword [ebp - 0xa68], 0xee1c
mov dword [ebp - 0xa64], 0xee1c
mov dword [ebp - 0xa60], 0xee1c
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xa6c], 0xb6fd
jl 0x1000979e
mov dword [ebp - 0x920], 1
jmp 0x100097a5
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x920]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0xa6c]
je 0x100097d1
or eax, 0xffffffff
je 0x100097d1
mov dword [ebp - 0x49c], 1
jmp 0x100097d8
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x49c], eax
je 0x100097f2
mov dword [ebp - 0x928], 1
jmp 0x100097f9
and dword [ebp - 0x928], 0
imul eax, dword [ebp - 0x928], 0xfffe
mov dword [ebp - 0x4a4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4a4]
mov dword [ebp + eax - 0xfb0], ecx
cmp dword [ebp - 0x4a4], 0
je 0x10009836
xor eax, eax
inc eax
je 0x10009836
mov dword [ebp - 0x930], 1
jmp 0x1000983d
and dword [ebp - 0x930], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa6c]
cmp dword [ebp - 0x930], eax
jl 0x1000985e
mov dword [ebp - 0x4ac], 1
jmp 0x10009865
and dword [ebp - 0x4ac], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa6c]
add eax, dword [ebp - 0x4ac]
sub eax, dword [ebp - 0x114]
cmp eax, 0x4e6c
jle 0x10009891
mov dword [ebp - 0x938], 1
jmp 0x10009898
and dword [ebp - 0x938], 0
cmp dword [ebp - 0x938], 0xffffffff
jne 0x100098ad
mov dword [ebp - 0x4b4], 1
jmp 0x100098b4
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0
jmp 0x100098cd
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jg 0x100098dd
cmp dword [ebp - 0x30], 0
je 0x100098db
jmp 0x100098dd
jmp 0x100098c6
jmp 0x1000973d
mov dword [ebp - 0x30], 0
jmp 0x100098f2
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10009908
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xfb0], 0
jmp 0x100098eb
mov dword [ebp - 0x940], 0x9696
mov dword [ebp - 0xe20], 1
mov dword [ebp - 0xb18], 0xa756a336
mov dword [ebp - 0xe28], 0xffffffff
mov dword [ebp - 0xe30], 0
push 2
lea ecx, [ebp - 0xfc0]
call fcn.10018cbc
and dword [ebp - 4], 0
mov dword [ebp - 0x330], 0xfffa
mov dword [ebp - 0x3bc], 0x1eb64d0
mov dword [ebp - 0x200], 0
jmp 0x10009978
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 2
jge 0x1000999a
push dword [ebp - 0x200]
lea ecx, [ebp - 0xfc0]
call fcn.10018d20
mov dword [eax], 6
jmp 0x1000996b
mov eax, dword [ebp - 0x3bc]
dec eax
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0x330]
dec eax
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0xb08]
cmp eax, dword [ebp - 0xb10]
jge 0x100099e6
mov dword [ebp - 0x948], 1
jmp 0x100099ed
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x940]
mov ecx, dword [ebp - 0x940]
sub ecx, dword [ebp - 0x948]
sub eax, ecx
mov dword [ebp - 0xb18], eax
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x10009a21
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc0]
call fcn.10018d1b
mov dword [ebp - 0x20], 0x42eb90da
mov dword [ebp - 0x8ac], 1
cmp dword [ebp - 0x20], 0
je 0x10009bd0
mov dword [ebp - 0x11c], 0x6535
mov dword [ebp - 0x388], 0x218e9934
mov dword [ebp - 0xb20], 0
cmp dword [ebp - 0x11c], 0
je 0x10009a95
mov eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x20]
jl 0x10009a95
mov dword [ebp - 0x754], 1
jmp 0x10009a9c
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x754], eax
jg 0x10009ab3
mov dword [ebp - 0x4c4], 1
jmp 0x10009aba
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x4c4]
jl 0x10009ad4
mov dword [ebp - 0x944], 1
jmp 0x10009adb
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x944]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x388], eax
jl 0x10009afe
mov dword [ebp - 0x4cc], 1
jmp 0x10009b05
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x4cc], eax
je 0x10009b1f
mov dword [ebp - 0x75c], 1
jmp 0x10009b26
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x75c], 0xe80d68f9
jae 0x10009b3e
mov dword [ebp - 0x4d4], 1
jmp 0x10009b45
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4d4], eax
jne 0x10009b6b
mov eax, 0x58331c58
test eax, eax
jne 0x10009b6b
cmp dword [ebp - 0x388], 0
jne 0x10009b6b
and dword [ebp - 0x8a4], 0
jmp 0x10009b75
mov dword [ebp - 0x8a4], 1
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x8a4], eax
jl 0x10009b8f
mov dword [ebp - 0x4dc], 1
jmp 0x10009b96
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0xb20], eax
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x10009bcb
push 0xa30
push 0x1cba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x10009d32
mov dword [ebp - 0xb28], 0xb09b
mov dword [ebp - 0x764], 0x258d0336
mov dword [ebp - 0x4ec], 5
mov dword [ebp - 0x20], 0
jmp 0x10009bfe
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff9
jne 0x10009d32
mov dword [ebp - 0xd0], 0x5261fc42
mov dword [ebp - 0xd0], 0xfffffff9
jmp 0x10009c2b
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffff
jne 0x10009c41
cmp dword [ebp - 0xb28], 0
je 0x10009c3f
jmp 0x10009c41
jmp 0x10009c1e
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xe38], eax
cmp dword [ebp - 0xd0], 0
jne 0x10009ccb
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xe40], eax
mov dword [ebp - 0x764], 0xffffffff
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x764], eax
jl 0x10009c83
mov dword [ebp - 0x4e4], 1
jmp 0x10009c8a
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
neg eax
cmp dword [ebp - 0x20], eax
je 0x10009ca3
mov dword [ebp - 0x974], 1
jmp 0x10009caa
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0x52772010
jge 0x10009ccb
and dword [ebp - 0x76c], 0
jmp 0x10009cd5
mov dword [ebp - 0x76c], 1
cmp dword [ebp - 0x76c], 0x3ea3
jge 0x10009ced
mov dword [ebp - 0x4f4], 1
jmp 0x10009cf4
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
sub eax, 0xfff8
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 0xffffffff
jge 0x10009d1a
mov dword [ebp - 0x4fc], 1
jmp 0x10009d21
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0xd0], eax
jmp 0x10009bf7
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x10009d56
push 0xc35
push 0x1fde
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x2b0], 0
jmp 0x10009d79
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 1
jge 0x10009d95
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0xb30], 0xb457
jmp 0x10009d6c
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x10009daf
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [ebp - 0x208], 0
jmp 0x10009dc8
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x11
jl 0x10009f02
push 3
lea ecx, [ebp - 0xb88]
call fcn.10018cbc
mov dword [ebp - 4], 1
mov dword [ebp - 0x2b8], 0
jmp 0x10009e02
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x10009e24
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0xb88]
call fcn.10018d20
mov dword [eax], 0xfebb6748
jmp 0x10009df5
push 0
lea ecx, [ebp - 0xb88]
call fcn.10018d20
and dword [eax], 0
jmp 0x10009e5a
push 0
lea ecx, [ebp - 0xb88]
call fcn.10018d20
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x774]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x774]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb88]
call fcn.10018d20
cmp dword [eax], 0
jl 0x10009ed0
mov dword [ebp - 0x1e0], 0xfffffffb
mov dword [ebp - 0x1e0], 0
jmp 0x10009e8f
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x10009eab
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0xb30], 0
jmp 0x10009e82
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x10009ecb
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
jmp 0x10009e36
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x10009eee
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb88]
call fcn.10018d1b
jmp 0x10009dbb
mov dword [ebp - 0x504], 0x9696
mov dword [ebp - 0xe48], 1
mov dword [ebp - 0xb48], 0xa756a336
mov dword [ebp - 0xe50], 0xffffffff
mov dword [ebp - 0xe58], 0
push 2
lea ecx, [ebp - 0xfd0]
call fcn.10018cbc
mov dword [ebp - 4], 2
mov dword [ebp - 0x3b4], 0xfffa
mov dword [ebp - 0x338], 0x1eb64d0
mov dword [ebp - 0x210], 0
jmp 0x10009f75
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x10009f97
push dword [ebp - 0x210]
lea ecx, [ebp - 0xfd0]
call fcn.10018d20
mov dword [eax], 6
jmp 0x10009f68
mov eax, dword [ebp - 0x338]
dec eax
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0xb40], eax
mov eax, dword [ebp - 0x3b4]
dec eax
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0xb38]
cmp eax, dword [ebp - 0xb40]
jge 0x10009fe3
mov dword [ebp - 0x94c], 1
jmp 0x10009fea
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x504]
mov ecx, dword [ebp - 0x504]
sub ecx, dword [ebp - 0x94c]
sub eax, ecx
mov dword [ebp - 0xb48], eax
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x1000a01e
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfd0]
call fcn.10018d1b
mov dword [ebp - 0x2c0], 0xe1757117
mov dword [ebp - 0x2c0], 0x14
jmp 0x1000a050
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0xfffffffa
jge 0x1000a0cd
mov dword [ebp - 0x218], 5
mov dword [ebp - 0xb50], 0xb363f9e9
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1000a08e
push 0
push 0x15d2
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov dword [ebp - 0x218], 0
jmp 0x1000a0a7
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xfffffffa
jl 0x1000a0c8
mov dword [ebp - 0xb58], 0x9b79
mov eax, dword [ebp - 0xb50]
mov dword [ebp - 0xb58], eax
jmp 0x1000a09a
jmp 0x1000a043
mov dword [ebp - 0x28], 0x42eb90da
mov dword [ebp - 0x544], 1
cmp dword [ebp - 0x28], 0
je 0x1000a26d
mov dword [ebp - 0x124], 0x6535
mov dword [ebp - 0x340], 0x218e9934
mov dword [ebp - 0xb60], 0
cmp dword [ebp - 0x124], 0
je 0x1000a132
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x28]
jl 0x1000a132
mov dword [ebp - 0x50c], 1
jmp 0x1000a139
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x50c], eax
jg 0x1000a150
mov dword [ebp - 0x77c], 1
jmp 0x1000a157
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x77c]
jl 0x1000a171
mov dword [ebp - 0x514], 1
jmp 0x1000a178
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x340], eax
jl 0x1000a19b
mov dword [ebp - 0x8b4], 1
jmp 0x1000a1a2
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x8b4], eax
je 0x1000a1bc
mov dword [ebp - 0x51c], 1
jmp 0x1000a1c3
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0xe80d68f9
jae 0x1000a1db
mov dword [ebp - 0x784], 1
jmp 0x1000a1e2
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x784], eax
jne 0x1000a208
mov eax, 0x58331c58
test eax, eax
jne 0x1000a208
cmp dword [ebp - 0x340], 0
jne 0x1000a208
and dword [ebp - 0x524], 0
jmp 0x1000a212
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x524], eax
jl 0x1000a22c
mov dword [ebp - 0x97c], 1
jmp 0x1000a233
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0xb60], eax
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x1000a268
push 0xa30
push 0x1cba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x1000a3cf
mov dword [ebp - 0xb68], 0xb09b
mov dword [ebp - 0x52c], 0x258d0336
mov dword [ebp - 0x8bc], 5
mov dword [ebp - 0x28], 0
jmp 0x1000a29b
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff9
jne 0x1000a3cf
mov dword [ebp - 0xb0], 0x5261fc42
mov dword [ebp - 0xb0], 0xfffffff9
jmp 0x1000a2c8
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xffffffff
jne 0x1000a2de
cmp dword [ebp - 0xb68], 0
je 0x1000a2dc
jmp 0x1000a2de
jmp 0x1000a2bb
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xe60], eax
cmp dword [ebp - 0xb0], 0
jne 0x1000a368
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xe68], eax
mov dword [ebp - 0x52c], 0xffffffff
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x52c], eax
jl 0x1000a320
mov dword [ebp - 0x78c], 1
jmp 0x1000a327
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x78c]
neg eax
cmp dword [ebp - 0x28], eax
je 0x1000a340
mov dword [ebp - 0x534], 1
jmp 0x1000a347
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x8bc], eax
cmp dword [ebp - 0x8bc], 0x52772010
jge 0x1000a368
and dword [ebp - 0x53c], 0
jmp 0x1000a372
mov dword [ebp - 0x53c], 1
cmp dword [ebp - 0x53c], 0x3ea3
jge 0x1000a38a
mov dword [ebp - 0x794], 1
jmp 0x1000a391
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
sub eax, 0xfff8
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0xffffffff
jge 0x1000a3b7
mov dword [ebp - 0x954], 1
jmp 0x1000a3be
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0xb0], eax
jmp 0x1000a294
mov byte [ebp - 0xe0], 0
movzx eax, byte [ebp - 0xe0]
test eax, eax
je 0x1000a3f3
push 0xc35
push 0x1fde
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 3
lea ecx, [ebp - 0xc40]
call fcn.10018cbc
mov dword [ebp - 4], 3
mov dword [ebp - 0xc8], 7
mov dword [ebp - 0x44], 0
jmp 0x1000a421
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1000a43d
push dword [ebp - 0x44]
lea ecx, [ebp - 0xc40]
call fcn.10018d20
mov dword [eax], 0x4a8c
jmp 0x1000a41a
mov dword [ebp - 0x44], 0
jmp 0x1000a44d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1000a463
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xc94], 3
jmp 0x1000a446
mov dword [ebp - 0xc8], 0
jmp 0x1000a47c
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jg 0x1000a4ae
mov dword [ebp - 0x54c], 0x82a1836c
mov dword [ebp - 0x54c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x54c]
mov dword [ebp + eax - 0xc94], ecx
jmp 0x1000a46f
push 0
lea ecx, [ebp - 0xc40]
call fcn.10018d20
mov ecx, dword [ebp - 0xc8]
cmp dword [eax], ecx
jle 0x1000a4d1
mov dword [ebp - 0x79c], 1
jmp 0x1000a4d8
and dword [ebp - 0x79c], 0
cmp dword [ebp - 0x79c], 0x110e
jne 0x1000a4f0
mov dword [ebp - 0x554], 1
jmp 0x1000a4f7
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0x61fc2da8
jle 0x1000a50f
mov dword [ebp - 0xb70], 1
jmp 0x1000a516
and dword [ebp - 0xb70], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc94]
mov dword [ebp - 0xe70], eax
mov eax, 0x8a06
sub eax, dword [ebp - 0xc8]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xc94]
jne 0x1000a54e
mov dword [ebp - 0x390], 1
jmp 0x1000a555
and dword [ebp - 0x390], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x390]
mov dword [ebp + eax - 0xc94], ecx
push 0
lea ecx, [ebp - 0xc40]
call fcn.10018d20
mov ecx, dword [ebp - 0x390]
add ecx, dword [eax]
cmp dword [ebp - 0xc8], ecx
jge 0x1000a590
mov dword [ebp - 0x8c4], 1
jmp 0x1000a597
and dword [ebp - 0x8c4], 0
cmp dword [ebp - 0x8c4], 0xe327
je 0x1000a5af
mov dword [ebp - 0x55c], 1
jmp 0x1000a5b6
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0xc8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.10018d1b
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x2c8], 0
jmp 0x1000a5f4
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x1000a610
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0xb78], 0xb457
jmp 0x1000a5e7
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1000a62a
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [ebp - 0x220], 0
jmp 0x1000a643
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x11
jl 0x1000a77d
push 3
lea ecx, [ebp - 0xb98]
call fcn.10018cbc
mov dword [ebp - 4], 4
mov dword [ebp - 0x2d0], 0
jmp 0x1000a67d
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 3
jge 0x1000a69f
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0xb98]
call fcn.10018d20
mov dword [eax], 0xfebb6748
jmp 0x1000a670
push 0
lea ecx, [ebp - 0xb98]
call fcn.10018d20
and dword [eax], 0
jmp 0x1000a6d5
push 0
lea ecx, [ebp - 0xb98]
call fcn.10018d20
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x7a4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x7a4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb98]
call fcn.10018d20
cmp dword [eax], 0
jl 0x1000a74b
mov dword [ebp - 0x1ec], 0xfffffffb
mov dword [ebp - 0x1ec], 0
jmp 0x1000a70a
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 1
jge 0x1000a726
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0xb78], 0
jmp 0x1000a6fd
mov byte [ebp - 0xe2], 0
movzx eax, byte [ebp - 0xe2]
test eax, eax
je 0x1000a746
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
jmp 0x1000a6b1
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1000a769
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb98]
call fcn.10018d1b
jmp 0x1000a636
mov dword [ebp - 0xb8], 0xfffffff8
mov dword [ebp - 0x56c], 0xa61bf079
mov dword [ebp - 0xbb8], 0xb489f7a9
mov dword [ebp - 0x8c], 0
jmp 0x1000a7b4
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x1000a7d0
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xc18], 0
jmp 0x1000a7a7
mov dword [ebp - 0x8c], 0
jmp 0x1000a7e9
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1000a805
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xda4], 0x89d2
jmp 0x1000a7dc
mov dword [ebp - 0xb8], 0
jmp 0x1000a81e
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jg 0x1000a96b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc18], 0
je 0x1000a84b
xor eax, eax
je 0x1000a84b
mov dword [ebp - 0x564], 1
jmp 0x1000a852
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 1
jle 0x1000a867
mov dword [ebp - 0x984], 1
jmp 0x1000a86e
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0xc18]
cmp eax, dword [ebp - 0x56c]
jl 0x1000a89b
mov dword [ebp - 0x7ac], 1
jmp 0x1000a8a2
and dword [ebp - 0x7ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xda4]
cmp eax, dword [ebp - 0x7ac]
je 0x1000a8c3
mov dword [ebp - 0x574], 1
jmp 0x1000a8ca
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0xc18]
cmp eax, dword [ebp - 0x574]
jg 0x1000a8eb
mov dword [ebp - 0xbb0], 1
jmp 0x1000a8f2
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp + eax*4 - 0xc18], 0xffff
jbe 0x1000a911
mov dword [ebp - 0x8cc], 1
jmp 0x1000a918
and dword [ebp - 0x8cc], 0
cmp dword [ebp - 0x8cc], 0x9beab1d6
ja 0x1000a937
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1000a937
mov dword [ebp - 0x57c], 1
jmp 0x1000a93e
and dword [ebp - 0x57c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xc18]
imul eax, dword [ebp - 0x57c]
mov ecx, dword [ebp - 0xb8]
imul eax, dword [ebp + ecx*4 - 0xc18]
mov dword [ebp - 0xbb8], eax
jmp 0x1000a811
mov dword [ebp - 0x2d8], 0x24a8c6a5
mov dword [ebp - 0xe78], 0xfffffff6
mov dword [ebp - 0xe80], 0x7be9fb1c
mov dword [ebp - 0xe88], 0x5739
mov dword [ebp - 0xe90], 0xffffffff
mov dword [ebp - 0xe98], 0xedd1edb6
mov dword [ebp - 0x7b4], 0
mov dword [ebp - 0x228], 0
jmp 0x1000a9ca
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x1000a9e6
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x1098], 0x1078932
jmp 0x1000a9bd
mov dword [ebp - 0x2d8], 0x17
jmp 0x1000a9ff
mov eax, dword [ebp - 0x2d8]
dec eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0xfffffff6
jle 0x1000ab2b
mov dword [ebp - 0x190], 2
push 2
lea ecx, [ebp - 0xc58]
call fcn.10018cbc
mov dword [ebp - 4], 5
mov dword [ebp - 0x230], 0
jmp 0x1000aa43
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x1000aa62
push dword [ebp - 0x230]
lea ecx, [ebp - 0xc58]
call fcn.10018d20
and dword [eax], 0
jmp 0x1000aa36
cmp dword [ebp - 0x190], 0
je 0x1000aa7f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc58]
call fcn.10018d1b
jmp 0x1000ab2b
mov dword [ebp - 0x190], 0
jmp 0x1000aa98
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jg 0x1000ab17
mov dword [ebp - 0x1c0], 7
mov dword [ebp - 0x1c0], 1
jmp 0x1000aac4
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x1000ab12
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1000aaf8
push 0x186e
push 0xc9a
push 0
push 0x21da
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0xc58]
call fcn.10018d20
cmp dword [eax], 0
je 0x1000ab10
jmp 0x1000aab7
jmp 0x1000aab7
jmp 0x1000aa8b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc58]
call fcn.10018d1b
jmp 0x1000a9f2
mov eax, dword [ebp - 0x7b4]
inc eax
mov dword [ebp - 0x7b4], eax
mov dword [ebp - 0x584], 0x9696
mov dword [ebp - 0xea0], 1
mov dword [ebp - 0xbd0], 0xa756a336
mov dword [ebp - 0xea8], 0xffffffff
mov dword [ebp - 0xeb0], 0
push 2
lea ecx, [ebp - 0xfe0]
call fcn.10018cbc
mov dword [ebp - 4], 6
mov dword [ebp - 0x3a4], 0xfffa
mov dword [ebp - 0x348], 0x1eb64d0
mov dword [ebp - 0x2e0], 0
jmp 0x1000abab
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 2
jge 0x1000abcd
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xfe0]
call fcn.10018d20
mov dword [eax], 6
jmp 0x1000ab9e
mov eax, dword [ebp - 0x348]
dec eax
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0xbc8], eax
mov eax, dword [ebp - 0x3a4]
dec eax
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0xbc0]
cmp eax, dword [ebp - 0xbc8]
jge 0x1000ac19
mov dword [ebp - 0x95c], 1
jmp 0x1000ac20
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x584]
mov ecx, dword [ebp - 0x584]
sub ecx, dword [ebp - 0x95c]
sub eax, ecx
mov dword [ebp - 0xbd0], eax
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x1000ac54
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfe0]
call fcn.10018d1b
mov dword [ebp - 0xae8], 0x97e780ca
mov dword [ebp - 0xeb8], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x98c], 0x3631e19e
mov dword [ebp - 0x350], 1
mov dword [ebp - 0x58], 0
jmp 0x1000aca2
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1000acb8
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x3c8], 0xfffffffc
jmp 0x1000ac9b
mov dword [ebp - 0x58], 0
jmp 0x1000acc8
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1000acde
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x9c0], 0x58bdfadf
jmp 0x1000acc1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c8]
mov dword [ebp - 0xec0], eax
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c8]
add eax, dword [ebp - 0x350]
je 0x1000ad65
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3c8], 0
jb 0x1000ad2e
mov dword [ebp - 0x58c], 1
jmp 0x1000ad35
and dword [ebp - 0x58c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c8]
add eax, dword [ebp - 0x58c]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x9c0]
test eax, eax
je 0x1000ad65
mov dword [ebp - 0x7bc], 1
jmp 0x1000ad6c
and dword [ebp - 0x7bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7bc]
add ecx, 0x2fc4eb
cmp dword [ebp + eax - 0x3c8], ecx
jge 0x1000ada0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9c0], 0
jne 0x1000ada0
and dword [ebp - 0xaf8], 0
jmp 0x1000adaa
mov dword [ebp - 0xaf8], 1
cmp dword [ebp - 0x10], 0
jne 0x1000adc0
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1000adc0
and dword [ebp - 0x594], 0
jmp 0x1000adca
mov dword [ebp - 0x594], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3c8]
cmp dword [ebp - 0x594], eax
jne 0x1000adea
mov dword [ebp - 0x8d4], 1
jmp 0x1000adf1
and dword [ebp - 0x8d4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8d4]
mov dword [ebp + eax - 0x9c0], ecx
mov dword [ebp - 0x10], 0
jmp 0x1000ae14
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x1000af92
mov dword [ebp - 0x5ac], 0x289ed5b6
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1000ae4c
push 0x19f4
push 0x2499
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3c8]
mov dword [ebp - 0xec8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x9c0]
cmp dword [ebp + eax*4 - 0x3c8], ecx
je 0x1000ae7e
mov dword [ebp - 0x59c], 1
jmp 0x1000ae85
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3c8]
cmp dword [ebp - 0x59c], eax
jle 0x1000aea3
mov dword [ebp - 0x5b4], 1
jmp 0x1000aeaa
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3c8]
add eax, dword [ebp - 0xae8]
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0x3c8]
jge 0x1000aed2
mov dword [ebp - 0x7c4], 1
jmp 0x1000aed9
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x7c4], eax
jg 0x1000aef0
mov dword [ebp - 0x5a4], 1
jmp 0x1000aef7
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 7
jae 0x1000af24
mov dword [ebp - 0x7cc], 1
jmp 0x1000af2b
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x9c0]
add eax, dword [ebp - 0x7cc]
je 0x1000af52
mov eax, 0x52ad14ca
test eax, eax
je 0x1000af52
mov dword [ebp - 0x8dc], 1
jmp 0x1000af59
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x5b4]
cmp eax, dword [ebp - 0x8dc]
jge 0x1000af73
mov dword [ebp - 0x5bc], 1
jmp 0x1000af7a
and dword [ebp - 0x5bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5bc]
mov dword [ebp + eax - 0x9c0], ecx
jmp 0x1000ae0d
mov dword [ebp - 0x238], 0xe1757117
mov dword [ebp - 0x238], 0x14
jmp 0x1000afb5
mov eax, dword [ebp - 0x238]
dec eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0xfffffffa
jge 0x1000b032
mov dword [ebp - 0x2e8], 5
mov dword [ebp - 0xb1c], 0xb363f9e9
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x1000aff3
push 0
push 0x15d2
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov dword [ebp - 0x2e8], 0
jmp 0x1000b00c
mov eax, dword [ebp - 0x2e8]
dec eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0xfffffffa
jl 0x1000b02d
mov dword [ebp - 0xa74], 0x9b79
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xa74], eax
jmp 0x1000afff
jmp 0x1000afa8
push 2
lea ecx, [ebp - 0xc70]
call fcn.10018cbc
mov dword [ebp - 4], 7
mov dword [ebp - 0x170], 0xdf2f4a8b
mov dword [ebp - 0x240], 0
jmp 0x1000b069
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x1000b08b
push dword [ebp - 0x240]
lea ecx, [ebp - 0xc70]
call fcn.10018d20
mov dword [eax], 0xf0ea75c9
jmp 0x1000b05c
mov dword [ebp - 0x170], 0
jmp 0x1000b0a4
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jg 0x1000b0df
push dword [ebp - 0x170]
lea ecx, [ebp - 0xc70]
call fcn.10018d20
cmp dword [eax], 0
je 0x1000b0c5
jmp 0x1000b0df
push dword [ebp - 0x170]
lea ecx, [ebp - 0xc70]
call fcn.10018d20
cmp dword [eax], 0
je 0x1000b0dd
jmp 0x1000b0df
jmp 0x1000b097
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc70]
call fcn.10018d1b
mov dword [ebp - 0xd8], 0xfffffffc
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x2f0], 0
jmp 0x1000b11b
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 4
jge 0x1000b137
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x420], 0xe57ad95e
jmp 0x1000b10e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x420], 0xc204e2db
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x420]
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0x420]
cmp eax, 0xfffffff7
je 0x1000b174
mov dword [ebp - 0x7d4], 1
jmp 0x1000b17b
and dword [ebp - 0x7d4], 0
imul eax, dword [ebp - 0x7d4], 0x6baf
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x420]
jl 0x1000b350
mov dword [ebp - 0x398], 0x361a
mov dword [ebp - 0x8e4], 0
mov dword [ebp - 0x5e4], 0x6a5b5cf0
mov dword [ebp - 0x248], 0
jmp 0x1000b1d2
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 2
jge 0x1000b1ee
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0xdb0], 0xcadfb1af
jmp 0x1000b1c5
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0xed0], eax
mov dword [ebp - 0xd8], 0xffff
mov eax, dword [ebp - 0xd8]
neg eax
mov ecx, dword [ebp - 0x398]
sub ecx, eax
mov dword [ebp - 0x5c4], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5c4]
mov dword [ebp + eax - 0xdb0], ecx
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x5c4], eax
je 0x1000b247
mov dword [ebp - 0x964], 1
jmp 0x1000b24e
and dword [ebp - 0x964], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x420]
imul eax, dword [ebp - 0x964]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x420]
je 0x1000b27c
mov dword [ebp - 0x5cc], 1
jmp 0x1000b283
and dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 0xb90f
jne 0x1000b29b
mov dword [ebp - 0x7dc], 1
jmp 0x1000b2a2
and dword [ebp - 0x7dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x420]
cmp dword [ebp - 0x7dc], eax
jle 0x1000b2c3
mov dword [ebp - 0x5d4], 1
jmp 0x1000b2ca
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x8e4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x420]
cmp dword [ebp - 0x8e4], eax
je 0x1000b2f7
mov dword [ebp - 0x5dc], 1
jmp 0x1000b2fe
and dword [ebp - 0x5dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x420]
imul eax, dword [ebp - 0x5dc]
cmp eax, 0xffff
jae 0x1000b325
mov dword [ebp - 0x7e4], 1
jmp 0x1000b32c
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x5e4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5e4]
mov dword [ebp + eax - 0x420], ecx
jmp 0x1000b67b
mov dword [ebp - 0x250], 0xdee94ccb
mov dword [ebp - 0x1d8], 0x5e3970c0
mov dword [ebp - 0x300], 0x744fa755
cmp dword [ebp - 0x250], 0xfff9
je 0x1000b386
mov dword [ebp - 0x994], 1
jmp 0x1000b38d
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x994], eax
jle 0x1000b3ad
mov eax, 0xdcfe
test eax, eax
jne 0x1000b3ad
and dword [ebp - 0x358], 0
jmp 0x1000b3b7
mov dword [ebp - 0x358], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x358]
mov dword [ebp + eax - 0x420], ecx
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x358], eax
jg 0x1000b3e4
mov dword [ebp - 0x5ec], 1
jmp 0x1000b3eb
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0xd8]
neg eax
cmp eax, dword [ebp - 0x300]
jne 0x1000b413
mov dword [ebp - 0xb74], 1
jmp 0x1000b41a
and dword [ebp - 0xb74], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x420]
cmp dword [ebp - 0xd8], eax
jl 0x1000b43b
mov dword [ebp - 0x7ec], 1
jmp 0x1000b442
and dword [ebp - 0x7ec], 0
cmp dword [ebp - 0x7ec], 0
ja 0x1000b457
mov dword [ebp - 0x5f4], 1
jmp 0x1000b45e
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x5f4], eax
jg 0x1000b478
mov dword [ebp - 0x8ec], 1
jmp 0x1000b47f
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x8ec], eax
je 0x1000b499
mov dword [ebp - 0x5fc], 1
jmp 0x1000b4a0
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x5fc]
sub eax, 0xd0294e
cmp eax, dword [ebp - 0x198]
jg 0x1000b4bf
mov dword [ebp - 0x7f4], 1
jmp 0x1000b4c6
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jae 0x1000b4e7
mov dword [ebp - 0xa7c], 1
jmp 0x1000b4ee
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0xed8], eax
mov eax, dword [ebp - 0x300]
add eax, dword [ebp - 0x198]
cmp eax, dword [ebp - 0x198]
je 0x1000b51a
mov dword [ebp - 0x604], 1
jmp 0x1000b521
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x250]
cmp eax, dword [ebp - 0x604]
jle 0x1000b53b
mov dword [ebp - 0xb24], 1
jmp 0x1000b542
and dword [ebp - 0xb24], 0
cmp dword [ebp - 0x198], 0
je 0x1000b65f
mov dword [ebp - 0x2f8], 0
jmp 0x1000b568
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 3
jge 0x1000b584
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0xd48], 0x6abe
jmp 0x1000b55b
cmp dword [ebp - 0x250], 0
je 0x1000b646
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x420], 0x4b5a
jle 0x1000b5b0
mov dword [ebp - 0x60c], 1
jmp 0x1000b5b7
and dword [ebp - 0x60c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd48]
mov dword [ebp - 0xee0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d8]
cmp dword [ebp + eax - 0xd48], ecx
je 0x1000b5ea
mov dword [ebp - 0xa84], 1
jmp 0x1000b5f1
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xee8], eax
mov eax, 0x6db78960
test eax, eax
ja 0x1000b612
mov dword [ebp - 0x99c], 1
jmp 0x1000b619
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x250]
imul eax, dword [ebp - 0x99c]
test eax, eax
jne 0x1000b63f
cmp dword [ebp - 0x1d8], 0
je 0x1000b63f
mov dword [ebp - 0x7fc], 1
jmp 0x1000b646
and dword [ebp - 0x7fc], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0xd48], 0xaf71
mov dword [ebp - 0x300], eax
jmp 0x1000b67b
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1000b67b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 3
lea ecx, [ebp - 0xca0]
call fcn.10018cbc
mov dword [ebp - 4], 8
mov dword [ebp - 0xc0], 7
mov dword [ebp - 0x98], 0
jmp 0x1000b6b2
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1000b6d4
push dword [ebp - 0x98]
lea ecx, [ebp - 0xca0]
call fcn.10018d20
mov dword [eax], 0x4a8c
jmp 0x1000b6a5
mov dword [ebp - 0x98], 0
jmp 0x1000b6ed
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1000b709
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xc88], 3
jmp 0x1000b6e0
mov dword [ebp - 0xc0], 0
jmp 0x1000b722
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jg 0x1000b754
mov dword [ebp - 0x614], 0x82a1836c
mov dword [ebp - 0x614], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x614]
mov dword [ebp + eax - 0xc88], ecx
jmp 0x1000b715
push 0
lea ecx, [ebp - 0xca0]
call fcn.10018d20
mov ecx, dword [ebp - 0xc0]
cmp dword [eax], ecx
jle 0x1000b777
mov dword [ebp - 0x8f4], 1
jmp 0x1000b77e
and dword [ebp - 0x8f4], 0
cmp dword [ebp - 0x8f4], 0x110e
jne 0x1000b796
mov dword [ebp - 0x61c], 1
jmp 0x1000b79d
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0x61fc2da8
jle 0x1000b7b5
mov dword [ebp - 0xbcc], 1
jmp 0x1000b7bc
and dword [ebp - 0xbcc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc88]
mov dword [ebp - 0xef0], eax
mov eax, 0x8a06
sub eax, dword [ebp - 0xc0]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xc88]
jne 0x1000b7f4
mov dword [ebp - 0x3a8], 1
jmp 0x1000b7fb
and dword [ebp - 0x3a8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3a8]
mov dword [ebp + eax - 0xc88], ecx
push 0
lea ecx, [ebp - 0xca0]
call fcn.10018d20
mov ecx, dword [ebp - 0x3a8]
add ecx, dword [eax]
cmp dword [ebp - 0xc0], ecx
jge 0x1000b836
mov dword [ebp - 0x804], 1
jmp 0x1000b83d
and dword [ebp - 0x804], 0
cmp dword [ebp - 0x804], 0xe327
je 0x1000b855
mov dword [ebp - 0x624], 1
jmp 0x1000b85c
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0xc0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca0]
call fcn.10018d1b
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x258], 0
jmp 0x1000b89a
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x1000b8b6
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xa8c], 0xb457
jmp 0x1000b88d
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1000b8d0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [ebp - 0x308], 0
jmp 0x1000b8e9
cmp dword [ebp - 0x308], 0x11
jl 0x1000ba23
push 3
lea ecx, [ebp - 0xba8]
call fcn.10018cbc
mov dword [ebp - 4], 9
mov dword [ebp - 0x260], 0
jmp 0x1000b923
cmp dword [ebp - 0x260], 3
jge 0x1000b945
push 3
lea ecx, [ebp - 0xa08]
call fcn.10018cbc
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 0
jmp 0x1000ba47
cmp dword [ebp - 0x60], 4
jge 0x1000ba5d