Function at 0x10008ee4
Capabilities:
Check for time delay via gettickcount
Check os version
Create process on windows
Delete registry key
Extract resource via kernel32 functions
Get common file path
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100842f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x11b4
call fcn.10080470
push esi
push edi
mov dword [ebp - 0x180], 0
mov dword [ebp - 0xae0], 0xffffffff
mov dword [ebp - 0x7c], 0xa8360e56
mov dword [ebp - 0x9ac], 1
mov dword [ebp - 0x270], 0
jmp 0x10008f46
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jge 0x10008f62
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0xab8], 1
jmp 0x10008f39
mov dword [ebp - 0x180], 0
jmp 0x10008f7b
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jg 0x1000907c
push 3
lea ecx, [ebp - 0xee0]
call fcn.10017abd
and dword [ebp - 4], 0
mov dword [ebp - 0x1104], 0x263d
mov dword [ebp - 0xd88], 0xfffffffb
mov dword [ebp - 0xd90], 0xfffffffc
mov dword [ebp - 0xd98], 0x451f1e28
mov dword [ebp - 0xda0], 0xb4cf22a1
push 2
lea ecx, [ebp - 0xed0]
call fcn.10017abd
mov byte [ebp - 4], 1
mov dword [ebp - 0xa0], 0
jmp 0x10008ff5
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x10009017
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xee0]
call fcn.10017b2a
mov dword [eax], 0xe77dd688
jmp 0x10008fe8
mov dword [ebp - 0xa0], 0
jmp 0x10009030
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x10009052
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xed0]
call fcn.10017b2a
mov dword [eax], 9
jmp 0x10009023
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xed0]
call fcn.10017b25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee0]
call fcn.10017b25
jmp 0x10008f6e
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xae0]
cmp dword [ebp + eax - 0xab8], ecx
jg 0x100091f7
mov dword [ebp - 0x1c0], 0xe510b2d4
mov dword [ebp - 0xaf0], 0
cmp dword [ebp - 0x1c0], 0xfffffffe
je 0x100090bd
mov dword [ebp - 0x9ec], 1
jmp 0x100090c4
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0xdb0], eax
cmp dword [ebp - 0x7c], 8
jl 0x100090dd
cmp dword [ebp - 0x1c0], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xab8], 0xfffffffc
jne 0x100090ff
cmp dword [ebp - 0x7c], 0
je 0x100090ff
mov dword [ebp - 0x738], 1
jmp 0x10009106
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x9ac], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xab8]
cmp dword [ebp - 0x9ac], eax
jl 0x10009133
mov dword [ebp - 0x9b4], 1
jmp 0x1000913a
and dword [ebp - 0x9b4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xab8]
cmp dword [ebp - 0x9b4], eax
je 0x1000915a
mov dword [ebp - 0x9d4], 1
jmp 0x10009161
and dword [ebp - 0x9d4], 0
cmp dword [ebp - 0x9d4], 0xdd50170a
jbe 0x10009179
mov dword [ebp - 0x9dc], 1
jmp 0x10009180
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0x9dc]
sub eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x1c0]
jl 0x100091a0
mov dword [ebp - 0x9e4], 1
jmp 0x100091a7
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x9e4], eax
jg 0x100091c1
mov dword [ebp - 0x9f4], 1
jmp 0x100091c8
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x9ec]
cmp eax, dword [ebp - 0x9f4]
je 0x100091e2
mov dword [ebp - 0x9fc], 1
jmp 0x100091e9
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0xaf0], eax
jmp 0x1000924b
mov dword [ebp - 0x7c], 0
jmp 0x10009207
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000921d
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xab8], 2
jmp 0x10009200
cmp dword [ebp - 0x7c], 0xfffd
jb 0x10009232
mov dword [ebp - 0xa04], 1
jmp 0x10009239
and dword [ebp - 0xa04], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa04]
mov dword [ebp + eax - 0xab8], ecx
mov dword [ebp - 0xd0], 0xffffffff
mov dword [ebp - 0x894], 0
push 2
lea ecx, [ebp - 0x3ac]
call fcn.10017abd
mov dword [ebp - 4], 2
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0xb00], 0xbdd4
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x1fc], 0x4752e4a6
mov dword [ebp - 0x8fc], 0
mov dword [ebp - 0x388], 0
mov dword [ebp - 0xb08], 4
mov dword [ebp - 0x324], 0xe67b33df
mov dword [ebp - 0x8d4], 0xa3a768fb
mov dword [ebp - 0x18], 0
jmp 0x100092dd
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100092f9
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3ac]
call fcn.10017b2a
mov dword [eax], 0xde57
jmp 0x100092d6
mov dword [ebp - 0x18], 0
jmp 0x10009309
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1000931f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xef0], 0x1b167519
jmp 0x10009302
mov dword [ebp - 0x18], 0
jmp 0x1000932f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10009345
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb10], 0
jmp 0x10009328
cmp dword [ebp - 0xd0], 0
jle 0x1000935a
mov dword [ebp - 0x3dc], 1
jmp 0x10009361
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x894]
cmp dword [ebp - 0x3dc], eax
jl 0x1000937b
mov dword [ebp - 0x87c], 1
jmp 0x10009382
and dword [ebp - 0x87c], 0
push 1
lea ecx, [ebp - 0x3ac]
call fcn.10017b2a
mov ecx, dword [ebp - 0x87c]
sub ecx, dword [eax]
jne 0x100093b4
push 1
lea ecx, [ebp - 0x3ac]
call fcn.10017b2a
cmp dword [eax], 0
jne 0x100093b4
and dword [ebp - 0x3e4], 0
jmp 0x100093be
mov dword [ebp - 0x3e4], 1
cmp dword [ebp - 0x3e4], 0xfffffffb
je 0x100093d3
mov dword [ebp - 0xaf8], 1
jmp 0x100093da
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xdb8], eax
mov esi, dword [ebp - 0x11c]
push 1
lea ecx, [ebp - 0x3ac]
call fcn.10017b2a
cmp esi, dword [eax]
jg 0x10009409
mov dword [ebp - 0x884], 1
jmp 0x10009410
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0xb00]
cmp dword [ebp - 0x884], eax
jg 0x1000942a
mov dword [ebp - 0x3ec], 1
jmp 0x10009431
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
sub eax, dword [ebp - 0x11c]
cmp eax, 1
je 0x1000944e
mov dword [ebp - 0x88c], 1
jmp 0x10009455
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x88c]
jge 0x1000946f
mov dword [ebp - 0x3f4], 1
jmp 0x10009476
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
add eax, 0x5900
sub eax, dword [ebp - 0x894]
cmp eax, 0xfffa
jae 0x1000949a
mov dword [ebp - 0x3fc], 1
jmp 0x100094a1
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 0xd65121ac
jne 0x100094b9
mov dword [ebp - 0x89c], 1
jmp 0x100094c0
and dword [ebp - 0x89c], 0
push 1
lea ecx, [ebp - 0x3ac]
call fcn.10017b2a
mov ecx, dword [ebp - 0x89c]
add ecx, dword [eax]
mov dword [ebp - 0x188], ecx
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0xd0], eax
jg 0x10009501
mov dword [ebp - 0x404], 1
jmp 0x10009508
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 7
jne 0x1000951d
mov dword [ebp - 0x8a4], 1
jmp 0x10009524
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0xd0]
imul eax, dword [ebp - 0x8a4]
cmp eax, dword [ebp - 0x11c]
jl 0x10009545
mov dword [ebp - 0x40c], 1
jmp 0x1000954c
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x8fc], eax
cmp dword [ebp - 0xd0], 0
je 0x1000976d
mov dword [ebp - 0x1fc], 0xffffffff
mov esi, dword [ebp - 0x324]
mov edi, dword [ebp - 0x1fc]
push 0
lea ecx, [ebp - 0x3ac]
call fcn.10017b2a
sub edi, dword [eax]
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
cmp edi, esi
jle 0x100095bd
cmp dword [ebp - 0xd0], 0
je 0x100095b4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xef0], 0
jne 0x100095bd
and dword [ebp - 0x8ac], 0
jmp 0x100095c7
mov dword [ebp - 0x8ac], 1
mov eax, dword [ebp - 0x388]
imul eax, dword [ebp - 0x8ac]
test eax, eax
jne 0x100095ea
cmp dword [ebp - 0xb08], 0
jne 0x100095ea
and dword [ebp - 0x414], 0
jmp 0x100095f4
mov dword [ebp - 0x414], 1
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x414], eax
jne 0x1000960e
mov dword [ebp - 0x8b4], 1
jmp 0x10009615
and dword [ebp - 0x8b4], 0
cmp dword [ebp - 0x8b4], 0xfffffffe
jg 0x1000962a
mov dword [ebp - 0x41c], 1
jmp 0x10009631
and dword [ebp - 0x41c], 0
cmp dword [ebp - 0x41c], 0xfffffffb
jne 0x10009646
mov dword [ebp - 0x8bc], 1
jmp 0x1000964d
and dword [ebp - 0x8bc], 0
push 1
lea ecx, [ebp - 0x3ac]
call fcn.10017b2a
mov ecx, dword [ebp - 0x8bc]
add ecx, dword [eax]
mov dword [ebp - 0x424], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x424]
mov dword [ebp + eax - 0xef0], ecx
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x424], eax
jne 0x10009695
mov dword [ebp - 0x8c4], 1
jmp 0x1000969c
and dword [ebp - 0x8c4], 0
push 0
lea ecx, [ebp - 0x3ac]
call fcn.10017b2a
mov ecx, dword [ebp - 0x8c4]
cmp ecx, dword [eax]
je 0x100096bf
mov dword [ebp - 0x42c], 1
jmp 0x100096c6
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0
jne 0x100096e4
cmp dword [ebp - 0x11c], 0
je 0x10009702
push 1
lea ecx, [ebp - 0x3ac]
call fcn.10017b2a
cmp dword [eax], 0
je 0x10009702
mov dword [ebp - 0x8cc], 1
jmp 0x10009709
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x8cc], eax
jl 0x10009723
mov dword [ebp - 0x434], 1
jmp 0x1000972a
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x8d4], 0xb2a93f04
jne 0x1000974e
mov dword [ebp - 0x43c], 1
jmp 0x10009755
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0xfff9
jb 0x1000976d
mov dword [ebp - 0x8dc], 1
jmp 0x10009774
and dword [ebp - 0x8dc], 0
cmp dword [ebp - 0x8dc], 0xbc4638b1
jbe 0x1000978c
mov dword [ebp - 0x444], 1
jmp 0x10009793
and dword [ebp - 0x444], 0
push 1
lea ecx, [ebp - 0x3ac]
call fcn.10017b2a
mov ecx, dword [ebp - 0x444]
add ecx, dword [eax]
cmp ecx, 0xfffffffb
jge 0x100097b9
mov dword [ebp - 0x8ec], 1
jmp 0x100097c0
and dword [ebp - 0x8ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8ec]
sub ecx, dword [ebp + eax - 0xb10]
cmp ecx, 0x559c
jne 0x100097e7
mov dword [ebp - 0x44c], 1
jmp 0x100097ee
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x44c], eax
jne 0x10009808
mov dword [ebp - 0x8f4], 1
jmp 0x1000980f
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
sub eax, 0x1c31
cmp eax, dword [ebp - 0xd0]
jg 0x1000982e
mov dword [ebp - 0x454], 1
jmp 0x10009835
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
sub eax, 0x24235991
sub eax, dword [ebp - 0x8fc]
cmp eax, dword [ebp - 0x188]
jge 0x1000985a
mov dword [ebp - 0x45c], 1
jmp 0x10009861
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x188], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ac]
call fcn.10017b25
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0xb18], 0xffffffff
mov dword [ebp - 0x64], 0xa8360e56
push 3
lea ecx, [ebp - 0xd3c]
call fcn.10017abd
mov dword [ebp - 4], 3
mov dword [ebp - 0x90], 0xb457102d
mov dword [ebp - 0x2d0], 0
jmp 0x100098ce
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 3
jge 0x100098f0
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0xd3c]
call fcn.10017b2a
mov dword [eax], 0xc692beaa
jmp 0x100098c1
mov dword [ebp - 0x90], 0
jmp 0x10009909
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1000992b
push dword [ebp - 0x90]
lea ecx, [ebp - 0xd3c]
call fcn.10017b2a
mov dword [eax], 0x9febb674
jmp 0x100098fc
mov dword [ebp - 0x90], 0x14
jmp 0x10009944
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xffffffff
jg 0x100099c0
mov dword [ebp - 0x204], 0xfffffffd
mov dword [ebp - 0x204], 0xfffffff8
jmp 0x10009970
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0xffffffe5
jne 0x1000999d
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1000999b
push 0
push 0
push 0x20
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x10009963
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x100099bb
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x10009937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd3c]
call fcn.10017b25
mov dword [ebp - 0x464], 1
mov dword [ebp - 0x290], 0
jmp 0x100099f2
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x10009a0e
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xaac], 1
jmp 0x100099e5
mov dword [ebp - 0x1b0], 0
jmp 0x10009a27
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jg 0x10009b2b
push 3
lea ecx, [ebp - 0xf10]
call fcn.10017abd
mov dword [ebp - 4], 4
mov dword [ebp - 0xdc0], 0x263d
mov dword [ebp - 0xdc8], 0xfffffffb
mov dword [ebp - 0xdd0], 0xfffffffc
mov dword [ebp - 0xdd8], 0x451f1e28
mov dword [ebp - 0xde0], 0xb4cf22a1
push 2
lea ecx, [ebp - 0xf00]
call fcn.10017abd
mov byte [ebp - 4], 5
mov dword [ebp - 0xa4], 0
jmp 0x10009aa4
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x10009ac6
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xf10]
call fcn.10017b2a
mov dword [eax], 0xe77dd688
jmp 0x10009a97
mov dword [ebp - 0xa4], 0
jmp 0x10009adf
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x10009b01
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xf00]
call fcn.10017b2a
mov dword [eax], 9
jmp 0x10009ad2
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf00]
call fcn.10017b25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf10]
call fcn.10017b25
jmp 0x10009a1a
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xb18]
cmp dword [ebp + eax - 0xaac], ecx
jg 0x10009ca6
mov dword [ebp - 0x190], 0xe510b2d4
mov dword [ebp - 0xb20], 0
cmp dword [ebp - 0x190], 0xfffffffe
je 0x10009b6c
mov dword [ebp - 0x91c], 1
jmp 0x10009b73
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xde8], eax
cmp dword [ebp - 0x64], 8
jl 0x10009b8c
cmp dword [ebp - 0x190], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xaac], 0xfffffffc
jne 0x10009bae
cmp dword [ebp - 0x64], 0
je 0x10009bae
mov dword [ebp - 0x904], 1
jmp 0x10009bb5
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x464], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaac]
cmp dword [ebp - 0x464], eax
jl 0x10009be2
mov dword [ebp - 0x90c], 1
jmp 0x10009be9
and dword [ebp - 0x90c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xaac]
cmp dword [ebp - 0x90c], eax
je 0x10009c09
mov dword [ebp - 0x46c], 1
jmp 0x10009c10
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 0xdd50170a
jbe 0x10009c28
mov dword [ebp - 0x914], 1
jmp 0x10009c2f
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x914]
sub eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x190]
jl 0x10009c4f
mov dword [ebp - 0x474], 1
jmp 0x10009c56
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x474], eax
jg 0x10009c70
mov dword [ebp - 0x47c], 1
jmp 0x10009c77
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x91c]
cmp eax, dword [ebp - 0x47c]
je 0x10009c91
mov dword [ebp - 0x924], 1
jmp 0x10009c98
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x924]
mov dword [ebp - 0xb20], eax
jmp 0x10009cfa
mov dword [ebp - 0x64], 0
jmp 0x10009cb6
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x10009ccc
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xaac], 2
jmp 0x10009caf
cmp dword [ebp - 0x64], 0xfffd
jb 0x10009ce1
mov dword [ebp - 0x484], 1
jmp 0x10009ce8
and dword [ebp - 0x484], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x484]
mov dword [ebp + eax - 0xaac], ecx
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0xc84], 0xffffffff
mov dword [ebp - 0x48], 3
mov dword [ebp - 0xd8], 0xb2ab76d6
mov dword [ebp - 0x170], 0x46c3
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xdf0], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xd8], eax
je 0x10009d52
mov dword [ebp - 0x92c], 1
jmp 0x10009d59
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xdf8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xe00], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xe08], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xe10], eax
cmp dword [ebp - 0x92c], 0x6525
jl 0x10009d95
mov dword [ebp - 0x48c], 1
jmp 0x10009d9c
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48c]
jge 0x10009db3
mov dword [ebp - 0x934], 1
jmp 0x10009dba
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x170]
imul eax, dword [ebp - 0x934]
cmp eax, dword [ebp - 0x170]
jg 0x10009ddc
cmp dword [ebp - 0xd8], 0
je 0x10009e6d
mov dword [ebp - 0x20c], 0
jmp 0x10009df5
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 4
jge 0x10009e11
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0x1180], 0x7b2415fb
jmp 0x10009de8
mov dword [ebp - 0x170], 0
jmp 0x10009e2a
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jg 0x10009e6b
mov dword [ebp - 0xd8], 0
jmp 0x10009e4c
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jg 0x10009e69
mov eax, dword [ebp - 0xd8]
cmp dword [ebp + eax*4 - 0x1180], 0
je 0x10009e67
jmp 0x10009e69
jmp 0x10009e3f
jmp 0x10009e1d
jmp 0x10009ec7
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x10009e93
push 0
push 0x1f73
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dword [ebp - 0x48], 0xa
jmp 0x10009ea3
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 7
je 0x10009ec7
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x10009ec5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x10009e9c
mov dword [ebp - 0x6c], 0xa8360e56
mov dword [ebp - 0x310], 0x4432
mov dword [ebp - 0x2c], 0xfffe
mov dword [ebp - 0x74], 0xb0a3531f
push 2
lea ecx, [ebp - 0xf20]
call fcn.10017abd
mov dword [ebp - 4], 6
mov dword [ebp - 0x98], 0
jmp 0x10009f13
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x10009f2f
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x11b8], 5
jmp 0x10009f06
mov dword [ebp - 0x98], 0
jmp 0x10009f48
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x10009f6a
push dword [ebp - 0x98]
lea ecx, [ebp - 0xf20]
call fcn.10017b2a
mov dword [eax], 0x459c
jmp 0x10009f3b
cmp dword [ebp - 0x310], 0
jne 0x10009f7f
mov dword [ebp - 0xb28], 1
jmp 0x10009f86
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x2c], eax
jg 0x10009f9d
mov dword [ebp - 0xb30], 1
jmp 0x10009fa4
and dword [ebp - 0xb30], 0
xor eax, eax
inc eax
je 0x10009fbb
cmp dword [ebp - 0x2c], 0
je 0x10009fbb
mov dword [ebp - 0xb38], 1
jmp 0x10009fc2
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xe18], eax
cmp dword [ebp - 0x74], 0
jl 0x10009fdd
mov dword [ebp - 0x494], 1
jmp 0x10009fe4
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0
jg 0x10009ff9
mov dword [ebp - 0xb40], 1
jmp 0x1000a000
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe20], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0xe28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe38], eax
cmp dword [ebp - 0x310], 0
je 0x1000a09d
mov dword [ebp - 0x2c], 0
jmp 0x1000a040
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x1000a098
mov dword [ebp - 0x74], 0
jmp 0x1000a056
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jg 0x1000a07a
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x1000a078
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
jmp 0x1000a04f
mov byte [ebp - 0x113], 0
movzx eax, byte [ebp - 0x113]
test eax, eax
je 0x1000a096
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x1000a039
jmp 0x1000a299
mov dword [ebp - 0x4ac], 3
mov dword [ebp - 0x4b4], 8
mov dword [ebp - 0x2c], 0
jmp 0x1000a0c1
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x30
jl 0x1000a299
push 2
lea ecx, [ebp - 0xbb0]
call fcn.10017abd
mov byte [ebp - 4], 7
mov dword [ebp - 0x94c], 0x49f7fae0
mov dword [ebp - 0xb50], 0x6354d184
mov dword [ebp - 0x214], 0
jmp 0x1000a109
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 2
jge 0x1000a128
push dword [ebp - 0x214]
lea ecx, [ebp - 0xbb0]
call fcn.10017b2a
or dword [eax], 0xffffffff
jmp 0x1000a0fc
mov dword [ebp - 0x74], 0xffffffe8
jmp 0x1000a138
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xf
jl 0x1000a285
mov dword [ebp - 0x298], 0x9002fce4
push 0
lea ecx, [ebp - 0xbb0]
call fcn.10017b2a
push 1
lea ecx, [ebp - 0xbb0]
call fcn.10017b2a
mov ecx, dword [ebp - 0x4ac]
cmp dword [eax], ecx
je 0x1000a17c
mov dword [ebp - 0x93c], 1
jmp 0x1000a183
and dword [ebp - 0x93c], 0
cmp dword [ebp - 0x93c], 0xe85dc32c
je 0x1000a19b
mov dword [ebp - 0x49c], 1
jmp 0x1000a1a2
and dword [ebp - 0x49c], 0
push 0
lea ecx, [ebp - 0xbb0]
call fcn.10017b2a
mov ecx, dword [ebp - 0x49c]
cmp ecx, dword [eax]
je 0x1000a1c5
mov dword [ebp - 0x944], 1
jmp 0x1000a1cc
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x944]
add eax, 0xffff
cmp eax, 0xf8d36fbc
ja 0x1000a1ea
mov dword [ebp - 0x4a4], 1
jmp 0x1000a1f1
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x298], eax
imul eax, dword [ebp - 0x298], 0x39bb
mov dword [ebp - 0x94c], eax
cmp dword [ebp - 0x94c], 0
je 0x1000a22b
cmp dword [ebp - 0x4ac], 0
je 0x1000a22b
mov dword [ebp - 0x954], 1
jmp 0x1000a232
and dword [ebp - 0x954], 0
cmp dword [ebp - 0x954], 0x84085efb
je 0x1000a24a
mov dword [ebp - 0xb48], 1
jmp 0x1000a251
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0xe40], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0xe48], eax
mov dword [ebp - 0xb50], 0xa7fcf623
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
jmp 0x1000a131
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xbb0]
call fcn.10017b25
jmp 0x1000a0ba
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1000a2b8
push 0
push 0x257e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf20]
call fcn.10017b25
mov dword [ebp - 0x5c0], 1
mov dword [ebp - 0x21c], 0xb9f9b31
mov dword [ebp - 0xa74], 0
mov dword [ebp - 0xa70], 0
mov dword [ebp - 0xa6c], 0
mov dword [ebp - 0xa68], 0
mov dword [ebp - 0x95c], 1
mov dword [ebp - 0x21c], 6
jmp 0x1000a326
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xc
jle 0x1000a58a
mov dword [ebp - 0x158], 0xc6f1bf50
push 2
lea ecx, [ebp - 0xca8]
call fcn.10017abd
mov dword [ebp - 4], 8
mov dword [ebp - 0x2d8], 0
jmp 0x1000a36a
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 2
jge 0x1000a38c
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0xca8]
call fcn.10017b2a
mov dword [eax], 0x1d686a37
jmp 0x1000a35d
mov dword [ebp - 0x158], 0x10
jmp 0x1000a3a5
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x18
jne 0x1000a561
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xd80], 4
mov dword [ebp - 0xd7c], 4
mov dword [ebp - 0xd78], 4
mov dword [ebp - 0xd74], 4
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x1000a400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xac], 0
jmp 0x1000a419
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jg 0x1000a55c
mov dword [ebp - 0x224], 0
jmp 0x1000a43f
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x1000a45b
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xb58], 0x233fd52
jmp 0x1000a432
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0xa74], 0x3e38693
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xac]
mov ecx, dword [ebp + ecx*4 - 0xa74]
cmp dword [ebp + eax*4 - 0xa74], ecx
jge 0x1000a494
mov dword [ebp - 0x4bc], 1
jmp 0x1000a49b
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0xa74]
mov ecx, dword [ebp - 0xac]
sub eax, dword [ebp + ecx*4 - 0xa74]
jne 0x1000a4d9
mov eax, 0x510afbd1
test eax, eax
jne 0x1000a4d9
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xa74], 0
jne 0x1000a4d9
and dword [ebp - 0x32c], 0
jmp 0x1000a4e3
mov dword [ebp - 0x32c], 1
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x32c]
mov dword [ebp + eax - 0xd80], ecx
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x95c]
cmp dword [ebp - 0x4bc], eax
je 0x1000a525
xor eax, eax
inc eax
jne 0x1000a525
push 3
pop eax
test eax, eax
jne 0x1000a525
and dword [ebp - 0x964], 0
jmp 0x1000a52f
mov dword [ebp - 0x964], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x964]
mov dword [ebp + eax - 0xb58], ecx
mov esi, dword [ebp - 0x158]
push 1
lea ecx, [ebp - 0xca8]
call fcn.10017b2a
mov dword [eax], esi
jmp 0x1000a40c
jmp 0x1000a398
push 0
lea ecx, [ebp - 0xca8]
call fcn.10017b2a
mov eax, dword [eax]
mov dword [ebp - 0x158], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca8]
call fcn.10017b25
jmp 0x1000a319
push 2
lea ecx, [ebp - 0xf30]
call fcn.10017abd
mov dword [ebp - 4], 9
mov dword [ebp - 0xc78], 0
mov dword [ebp - 0xc74], 0
mov dword [ebp - 0xc70], 0
mov dword [ebp - 0xc6c], 0
mov dword [ebp - 0x2a0], 0
jmp 0x1000a5df
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jge 0x1000a5fe
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xf30]
call fcn.10017b2a
or dword [eax], 0xffffffff
jmp 0x1000a5d2
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xc78], 0
jmp 0x1000a629
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc78]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xc78], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc78], 1
jg 0x1000a656
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x1000a654
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1000a610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf30]
call fcn.10017b25
mov dword [ebp - 0x22c], 0
jmp 0x1000a67e
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x1000a69a
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xac4], 1
jmp 0x1000a671
mov dword [ebp - 0x10d4], 0xf112
mov dword [ebp - 0x10d0], 0xf112
mov dword [ebp - 0x10cc], 0xf112
mov dword [ebp - 0x10c8], 0xf112
mov dword [ebp - 0x4c4], 2
mov dword [ebp - 0x96c], 0x8d38
mov dword [ebp - 0x2f8], 0
jmp 0x1000a6ef
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 2
jge 0x1000a70b
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x318], 0
jmp 0x1000a6e2
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x318], 3
jmp 0x1000a739
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x318]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x318], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x318], 0
jl 0x1000a777
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1000a775
push 0x25a
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1000a71e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x318]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x318]
mov dword [ebp - 0x4c4], eax
je 0x1000a7bb
mov dword [ebp - 0xb60], 0xe1dfe009
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x318]
mov dword [ebp - 0xb60], eax
jmp 0x1000a89e
mov dword [ebp - 0xe50], 0
mov dword [ebp - 0xe58], 9
mov dword [ebp - 0x168], 1
mov dword [ebp - 0xe60], 0xfffffffd
mov dword [ebp - 0x234], 0
jmp 0x1000a7fc
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
jge 0x1000a818
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x4cc], 0xafca8629
jmp 0x1000a7ef
mov eax, dword [ebp - 0x96c]
inc eax
mov dword [ebp - 0x96c], eax
mov dword [ebp - 0x168], 1
jmp 0x1000a83e
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x1000a89e
mov eax, dword [ebp - 0x168]
cmp dword [ebp + eax*4 - 0x318], 0
je 0x1000a871
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1000a86f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1000a89c
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x4cc]
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp + eax - 0x4cc]
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x318], ecx
jmp 0x1000a831
mov dword [ebp - 0x1a0], 0
jmp 0x1000a8b7
cmp dword [ebp - 0x1a0], 2
jg 0x1000b835
mov dword [ebp - 0x14], 0xaeb9ae77
mov dword [ebp - 0x54], 0x55595070
mov dword [ebp - 0xa94], 0xbdec7e1
mov dword [ebp - 0xa90], 0xbdec7e1
mov dword [ebp - 0xa8c], 0xbdec7e1
mov dword [ebp - 0xa88], 0xbdec7e1
mov dword [ebp - 0x37c], 0x44fe
mov dword [ebp - 0x198], 0x949e3b93
mov dword [ebp - 0x7b0], 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x14], eax
jne 0x1000a932
mov dword [ebp - 0x974], 1
jmp 0x1000a939
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x974], eax
jne 0x1000a950
mov dword [ebp - 0x4d4], 1
jmp 0x1000a957
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 1
je 0x1000a96c
mov dword [ebp - 0x97c], 1
jmp 0x1000a973
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x97c], eax
je 0x1000abfb
mov dword [ebp - 0x378], 0xfff6
mov dword [ebp - 0x36c], 0xb94d0f4f
mov dword [ebp - 0x334], 2
mov dword [ebp - 0x160], 0xfffffff8
mov dword [ebp - 0x33c], 7
mov dword [ebp - 0x178], 0x89276496
push 2
lea ecx, [ebp - 0xd30]
call fcn.10017abd
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x2a8], 0
jmp 0x1000a9eb
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x1000aa0d
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0xd30]
call fcn.10017b2a
mov dword [eax], 8
jmp 0x1000a9de
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jge 0x1000aa28
mov dword [ebp - 0xb68], 1
jmp 0x1000aa2f
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x54], eax
jle 0x1000aa46
mov dword [ebp - 0x4dc], 1
jmp 0x1000aa4d
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 4
jae 0x1000aa5f
cmp dword [ebp - 0x334], 0
je 0x1000aa74
mov eax, 0x3c5a
test eax, eax
je 0x1000aa74
mov dword [ebp - 0x984], 1
jmp 0x1000aa7b
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xa1d2daff
jae 0x1000aa9f
mov dword [ebp - 0x4e4], 1
jmp 0x1000aaa6
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0xe68], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0xe70], eax
mov eax, 0x2b2faa96
cmp eax, 0xd71b36c9
jae 0x1000aaef
mov dword [ebp - 0x98c], 1
jmp 0x1000aaf6
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x378]
add eax, dword [ebp - 0x98c]
cmp eax, dword [ebp - 0x334]
jne 0x1000ab16
mov dword [ebp - 0x4ec], 1
jmp 0x1000ab1d
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x378]
sub eax, dword [ebp - 0x4ec]
je 0x1000ab40
cmp dword [ebp - 0x178], 0
je 0x1000ab40
mov dword [ebp - 0x994], 1
jmp 0x1000ab47
and dword [ebp - 0x994], 0
mov esi, dword [ebp - 0x14]
imul esi, dword [ebp - 0x994]
push 1
lea ecx, [ebp - 0xd30]
call fcn.10017b2a
mov dword [eax], esi
mov dword [ebp - 0x178], 0xffffffe3
jmp 0x1000ab79
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x16
jl 0x1000abe7
mov dword [ebp - 0xb70], 0xffffffff
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x160], 0xffffffe5
jmp 0x1000abae
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xfffffff9
je 0x1000abe5
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1000abd8
push 0
push 0x1da3
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
cmp dword [ebp - 0xb70], 0
je 0x1000abe3
jmp 0x1000abe5
jmp 0x1000aba1
jmp 0x1000ab6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd30]
call fcn.10017b25
jmp 0x1000ae8f
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x14], 0xffffffe8
jmp 0x1000ac15
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x15
jne 0x1000ae8f
mov dword [ebp - 0x14c], 0xffffffff
mov dword [ebp - 0x84], 0
jmp 0x1000ac42
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1000ac5e
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xb80], 0
jmp 0x1000ac35
mov dword [ebp - 0x84], 0
jmp 0x1000ac77
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1000ac93
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x11a8], 9
jmp 0x1000ac6a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe78], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xe80], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xe88], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xe90], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe98], eax
cmp dword [ebp - 0x54], 0
je 0x1000ace2
push 6
pop eax
test eax, eax
je 0x1000ace2
mov dword [ebp - 0x4f4], 1
jmp 0x1000ace9
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0xfffffffb
jne 0x1000acfe
mov dword [ebp - 0x99c], 1
jmp 0x1000ad05
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x99c], eax
je 0x1000ad1f
mov dword [ebp - 0x9a4], 1
jmp 0x1000ad26
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x9a4], eax
jle 0x1000ad40
mov dword [ebp - 0x500], 1
jmp 0x1000ad47
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x500], eax
jg 0x1000ad5e
mov dword [ebp - 0xb78], 1
jmp 0x1000ad65
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xea8], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x7c4], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x7c4]
mov dword [ebp + eax - 0xa94], ecx
cmp dword [ebp - 0x7c4], 0
je 0x1000adb4
mov eax, 0xab77
test eax, eax
je 0x1000adb4
mov dword [ebp - 0x508], 1
jmp 0x1000adbb
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x508], eax
jle 0x1000add5
mov dword [ebp - 0x344], 1
jmp 0x1000addc
and dword [ebp - 0x344], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x344]
mov dword [ebp + eax - 0xb80], ecx
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x344], eax
jne 0x1000ae09
mov dword [ebp - 0x7a8], 1
jmp 0x1000ae10
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x7a8], eax
jge 0x1000ae2a
mov dword [ebp - 0x510], 1
jmp 0x1000ae31
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x37c]
cmp dword [ebp - 0x510], eax
jle 0x1000ae4b
mov dword [ebp - 0x988], 1
jmp 0x1000ae52
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x988]
sub eax, 0x567d043c
cmp eax, 0x58f2
jg 0x1000ae70
mov dword [ebp - 0x518], 1
jmp 0x1000ae77
and dword [ebp - 0x518], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x518]
mov dword [ebp + eax - 0x11a8], ecx
jmp 0x1000ac0e
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xeb0], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0xeb8], eax
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x7b0], 0xa51e29af
mov eax, dword [ebp - 0x7b0]
sub eax, 9
imul eax, eax, 0xffffffff
cmp eax, dword [ebp - 0x37c]
jl 0x1000aede
mov dword [ebp - 0x520], 1
jmp 0x1000aee5
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x14]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0xa94]
mov edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x520]
imul ecx, edx
add eax, ecx
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0xa94]
jle 0x1000af3b
cmp dword [ebp - 0x198], 0
jne 0x1000af3b
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xa94], 0
jne 0x1000af3b
push 8
pop eax
test eax, eax
jne 0x1000af3b
and dword [ebp - 0x8f0], 0
jmp 0x1000af45
mov dword [ebp - 0x8f0], 1
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x8f0], eax
jl 0x1000af5f
mov dword [ebp - 0x528], 1
jmp 0x1000af66
and dword [ebp - 0x528], 0
imul eax, dword [ebp - 0x528], 0x18bf
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xa94]
mov dword [ebp - 0x7b8], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x7b8]
mov dword [ebp + eax - 0xa94], ecx
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x7b8]
je 0x1000afad
mov dword [ebp - 0x530], 1
jmp 0x1000afb4
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x530], eax
jg 0x1000afcb
mov dword [ebp - 0x9e0], 1
jmp 0x1000afd2
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x54], eax
push 3
lea ecx, [ebp - 0xf60]
call fcn.10017abd
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xec0], 0x263d
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0x990], 0
push 2
lea ecx, [ebp - 0x3a0]
call fcn.10017abd
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x124], 0xffffffff
mov dword [ebp - 0xb90], 0xbdd4
mov dword [ebp - 0x1b8], 1
mov dword [ebp - 0x23c], 0x4752e4a6
mov dword [ebp - 0x9e8], 0
mov dword [ebp - 0x384], 0
mov dword [ebp - 0xb98], 4
mov dword [ebp - 0x34c], 0xe67b33df
mov dword [ebp - 0x998], 0xa3a768fb
mov dword [ebp - 0x1c], 0
jmp 0x1000b088
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000b0a4
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3a0]
call fcn.10017b2a
mov dword [eax], 0xde57
jmp 0x1000b081
mov dword [ebp - 0x1c], 0
jmp 0x1000b0b4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1000b0ca
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf40], 0x1b167519
jmp 0x1000b0ad
mov dword [ebp - 0x1c], 0
jmp 0x1000b0da
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000b0f0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xba0], 0
jmp 0x1000b0d3
cmp dword [ebp - 0xcc], 0
jle 0x1000b105
mov dword [ebp - 0x538], 1
jmp 0x1000b10c
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x990]
cmp dword [ebp - 0x538], eax
jl 0x1000b126
mov dword [ebp - 0x7c0], 1
jmp 0x1000b12d
and dword [ebp - 0x7c0], 0
push 1
lea ecx, [ebp - 0x3a0]
call fcn.10017b2a
mov ecx, dword [ebp - 0x7c0]
sub ecx, dword [eax]
jne 0x1000b15f
push 1
lea ecx, [ebp - 0x3a0]
call fcn.10017b2a
cmp dword [eax], 0
jne 0x1000b15f
and dword [ebp - 0x540], 0
jmp 0x1000b169
mov dword [ebp - 0x540], 1
cmp dword [ebp - 0x540], 0xfffffffb
je 0x1000b17e
mov dword [ebp - 0xb88], 1
jmp 0x1000b185
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x1088], eax
mov esi, dword [ebp - 0x124]
push 1
lea ecx, [ebp - 0x3a0]
call fcn.10017b2a
cmp esi, dword [eax]
jg 0x1000b1b4
mov dword [ebp - 0x8f8], 1
jmp 0x1000b1bb
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0xb90]
cmp dword [ebp - 0x8f8], eax
jg 0x1000b1d5
mov dword [ebp - 0x548], 1
jmp 0x1000b1dc
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
sub eax, dword [ebp - 0x124]
cmp eax, 1
je 0x1000b1f9
mov dword [ebp - 0x7c8], 1
jmp 0x1000b200
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x7c8]
jge 0x1000b21a
mov dword [ebp - 0x550], 1
jmp 0x1000b221
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
add eax, 0x5900
sub eax, dword [ebp - 0x990]
cmp eax, 0xfffa
jae 0x1000b245
mov dword [ebp - 0x558], 1
jmp 0x1000b24c
and dword [ebp - 0x558], 0
cmp dword [ebp - 0x558], 0xd65121ac
jne 0x1000b264
mov dword [ebp - 0x7d0], 1
jmp 0x1000b26b
and dword [ebp - 0x7d0], 0
push 1
lea ecx, [ebp - 0x3a0]
call fcn.10017b2a
mov ecx, dword [ebp - 0x7d0]
add ecx, dword [eax]
mov dword [ebp - 0x1b8], ecx
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0xcc], eax
jg 0x1000b2ac
mov dword [ebp - 0x560], 1
jmp 0x1000b2b3
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 7
jne 0x1000b2c8
mov dword [ebp - 0x900], 1
jmp 0x1000b2cf
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0x900]
cmp eax, dword [ebp - 0x124]
jl 0x1000b2f0
mov dword [ebp - 0x568], 1
jmp 0x1000b2f7
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x9e8], eax
cmp dword [ebp - 0xcc], 0
je 0x1000b518
mov dword [ebp - 0x23c], 0xffffffff
mov esi, dword [ebp - 0x34c]
mov edi, dword [ebp - 0x23c]
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10017b2a
sub edi, dword [eax]
mov eax, dword [ebp - 0x34c]
dec eax
mov dword [ebp - 0x34c], eax
cmp edi, esi
jle 0x1000b368
cmp dword [ebp - 0xcc], 0
je 0x1000b35f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf40], 0
jne 0x1000b368
and dword [ebp - 0x7d8], 0
jmp 0x1000b372
mov dword [ebp - 0x7d8], 1
mov eax, dword [ebp - 0x384]
imul eax, dword [ebp - 0x7d8]
test eax, eax
jne 0x1000b395
cmp dword [ebp - 0xb98], 0
jne 0x1000b395
and dword [ebp - 0x570], 0
jmp 0x1000b39f
mov dword [ebp - 0x570], 1
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x570], eax
jne 0x1000b3b9
mov dword [ebp - 0xa08], 1
jmp 0x1000b3c0
and dword [ebp - 0xa08], 0
cmp dword [ebp - 0xa08], 0xfffffffe
jg 0x1000b3d5
mov dword [ebp - 0x578], 1
jmp 0x1000b3dc
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0xfffffffb
jne 0x1000b3f1
mov dword [ebp - 0x7e0], 1
jmp 0x1000b3f8
and dword [ebp - 0x7e0], 0
push 1
lea ecx, [ebp - 0x3a0]
call fcn.10017b2a
mov ecx, dword [ebp - 0x7e0]
add ecx, dword [eax]
mov dword [ebp - 0x580], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x580]
mov dword [ebp + eax - 0xf40], ecx
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x580], eax
jne 0x1000b440
mov dword [ebp - 0x908], 1
jmp 0x1000b447
and dword [ebp - 0x908], 0
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10017b2a
mov ecx, dword [ebp - 0x908]
cmp ecx, dword [eax]
je 0x1000b46a
mov dword [ebp - 0x588], 1
jmp 0x1000b471
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0
jne 0x1000b48f
cmp dword [ebp - 0x124], 0
je 0x1000b4ad
push 1
lea ecx, [ebp - 0x3a0]
call fcn.10017b2a
cmp dword [eax], 0
je 0x1000b4ad
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0xbc4638b1
jbe 0x1000b537
mov dword [ebp - 0x5a0], 1
jmp 0x1000b53e
and dword [ebp - 0x5a0], 0
push 1
lea ecx, [ebp - 0x3a0]
call fcn.10017b2a
mov ecx, dword [ebp - 0x5a0]
add ecx, dword [eax]
cmp ecx, 0xfffffffb
jge 0x1000b564
mov dword [ebp - 0x910], 1
jmp 0x1000b56b
and dword [ebp - 0x910], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x910]
sub ecx, dword [ebp + eax - 0xba0]
cmp ecx, 0x559c
jne 0x1000b592
mov dword [ebp - 0x5a8], 1
jmp 0x1000b599
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x5a8], eax
jne 0x1000b5b3
mov dword [ebp - 0x7f8], 1
jmp 0x1000b5ba
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x7f8]
sub eax, 0x1c31
cmp eax, dword [ebp - 0xcc]
jg 0x1000b5d9
mov dword [ebp - 0x5b0], 1
jmp 0x1000b5e0
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
sub eax, 0x24235991
sub eax, dword [ebp - 0x9e8]
cmp eax, dword [ebp - 0x1b8]
jge 0x1000b605
mov dword [ebp - 0x5b8], 1
jmp 0x1000b60c
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3a0]
call fcn.10017b25
mov dword [ebp - 0x1090], 0xfffffffb
mov dword [ebp - 0x1098], 0xfffffffc
mov dword [ebp - 0x10a0], 0x451f1e28
mov dword [ebp - 0x10a8], 0xb4cf22a1
push 2
lea ecx, [ebp - 0xf50]
call fcn.10017abd
mov byte [ebp - 4], 0xd
push 3
lea ecx, [ebp - 0xd48]
call fcn.10017abd
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xb4], 0xb457102d
mov dword [ebp - 0x2e0], 0
jmp 0x1000b694
cmp dword [ebp - 0x2e0], 3
jge 0x1000b6b6
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xd48]
call fcn.10017b2a
mov dword [eax], 0xc692beaa
jmp 0x1000b687
mov dword [ebp - 0xb4], 0
jmp 0x1000b6cf
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xc84]
cmp dword [ebp + eax - 0xac4], ecx
jg 0x1000b9b0
mov dword [ebp - 0x1c8], 0xe510b2d4
mov dword [ebp - 0xc8c], 0
cmp dword [ebp - 0x1c8], 0xfffffffe
je 0x1000b876
mov dword [ebp - 0x9a0], 1
jmp 0x1000b87d
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x10b0], eax
cmp dword [ebp - 0x6c], 8
jl 0x1000b896
cmp dword [ebp - 0x1c8], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xac4], 0xfffffffc
jne 0x1000b8b8
cmp dword [ebp - 0x6c], 0
je 0x1000b8b8
mov dword [ebp - 0x800], 1
jmp 0x1000b8bf
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0x5c0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xac4]
cmp dword [ebp - 0x5c0], eax
jl 0x1000b8ec
mov dword [ebp - 0x918], 1
jmp 0x1000b8f3
and dword [ebp - 0x918], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xac4]
cmp dword [ebp - 0x918], eax
je 0x1000b913
mov dword [ebp - 0x5c8], 1
jmp 0x1000b91a
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0xdd50170a
jbe 0x1000b932
mov dword [ebp - 0x808], 1
jmp 0x1000b939
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x808]
sub eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x1c8]
jl 0x1000b959
mov dword [ebp - 0x5d0], 1
jmp 0x1000b960
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x5d0], eax
jg 0x1000b97a
mov dword [ebp - 0x5d8], 1
jmp 0x1000b981
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x9a0]
cmp eax, dword [ebp - 0x5d8]
je 0x1000b99b
mov dword [ebp - 0x810], 1
jmp 0x1000b9a2
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0xc8c], eax
jmp 0x1000ba04
mov dword [ebp - 0x6c], 0
jmp 0x1000b9c0
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1000b9d6
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xac4], 2
jmp 0x1000b9b9
cmp dword [ebp - 0x6c], 0xfffd
jb 0x1000b9eb
mov dword [ebp - 0x5e0], 1
jmp 0x1000b9f2
and dword [ebp - 0x5e0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5e0]
mov dword [ebp + eax - 0xac4], ecx
mov dword [ebp - 0x10b8], 0xd6f2
mov dword [ebp - 0x10c0], 0x20f89b5
push 2
lea ecx, [ebp - 0xf70]
call fcn.10017abd
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x920], 7
mov dword [ebp - 0x2b0], 0
jmp 0x1000ba4f
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 2
jge 0x1000ba71
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0xf70]
call fcn.10017b2a
mov dword [eax], 0xb8c3ad3b
jmp 0x1000ba42
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1000ba90
push 0
push 0x257e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp - 0x920]
inc eax
mov dword [ebp - 0x920], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf70]
call fcn.10017b25
mov dword [ebp - 0x1100], 0xd6f2
mov dword [ebp - 0x1108], 0x20f89b5
push 2
lea ecx, [ebp - 0xf80]
call fcn.10017abd
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x5e8], 7
mov dword [ebp - 0x24c], 0
jmp 0x1000baf7
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x1000bb19
push dword [ebp - 0x24c]
lea ecx, [ebp - 0xf80]
call fcn.10017b2a
mov dword [eax], 0xb8c3ad3b
jmp 0x1000baea
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x1000bb38
push 0
push 0x257e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp - 0x5e8]
inc eax
mov dword [ebp - 0x5e8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf80]
call fcn.10017b25
push 1
lea ecx, [ebp - 0xbc0]
call fcn.10017abd
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x308], 0
jmp 0x1000bb81
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jge 0x1000bba0
push dword [ebp - 0x308]
lea ecx, [ebp - 0xbc0]
call fcn.10017b2a
or dword [eax], 0xffffffff
jmp 0x1000bb74
push 0
lea ecx, [ebp - 0xbc0]
call fcn.10017b2a
and dword [eax], 0
jmp 0x1000bbd6
push 0
lea ecx, [ebp - 0xbc0]
call fcn.10017b2a
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x818]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xbc0]
call fcn.10017b2a
cmp dword [eax], 0xffffffea
jne 0x1000bc09
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1000bc07
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
jmp 0x1000bbb2
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000bc2a
push 0
push 0x1725
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc0]
call fcn.10017b25
movzx eax, byte [0x10cc2eb0]
test eax, eax
je 0x1000bc57
mov esi, 0x1008b7c8
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10010fb5
mov dword [ebp - 0x1110], 0xd6f2
mov dword [ebp - 0x10f4], 0x20f89b5
push 2
lea ecx, [ebp - 0xf90]
call fcn.10017abd
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x5f0], 7
mov dword [ebp - 0x254], 0
jmp 0x1000bca2
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 2
jge 0x1000bcc4
push dword [ebp - 0x254]
lea ecx, [ebp - 0xf90]
call fcn.10017b2a
mov dword [eax], 0xb8c3ad3b
jmp 0x1000bc95
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1000bce3
push 0
push 0x257e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf90]
call fcn.10017b25
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0xc94], 0xffffffff
mov dword [ebp - 0x5c], 0xa8360e56
mov dword [ebp - 0x5f8], 1
mov dword [ebp - 0x2b8], 0
jmp 0x1000bd3d
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x1000bd59
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0xadc], 1
jmp 0x1000bd30
mov dword [ebp - 0x1a8], 0
jmp 0x1000bd72
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 2
jg 0x1000be76
push 3
lea ecx, [ebp - 0xfb0]
call fcn.10017abd
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xd8c], 0x263d
mov dword [ebp - 0xda8], 0xfffffffb
mov dword [ebp - 0x1034], 0xfffffffc
mov dword [ebp - 0xd94], 0x451f1e28
mov dword [ebp - 0xef4], 0xb4cf22a1
push 2
lea ecx, [ebp - 0xfa0]
call fcn.10017abd
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xb8], 0
jmp 0x1000bdef
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1000be11
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xfb0]
call fcn.10017b2a
mov dword [eax], 0xe77dd688
jmp 0x1000bde2
mov dword [ebp - 0xb8], 0
jmp 0x1000be2a
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x1000be4c
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xfa0]
call fcn.10017b2a
mov dword [eax], 9
jmp 0x1000be1d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xfa0]
call fcn.10017b25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfb0]
call fcn.10017b25
jmp 0x1000bd65
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xc94]
cmp dword [ebp + eax - 0xadc], ecx
jg 0x1000bff1
mov dword [ebp - 0x17c], 0xe510b2d4
mov dword [ebp - 0xc9c], 0
cmp dword [ebp - 0x17c], 0xfffffffe
je 0x1000beb7
mov dword [ebp - 0x828], 1
jmp 0x1000bebe
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xd9c], eax
cmp dword [ebp - 0x5c], 8
jl 0x1000bed7
cmp dword [ebp - 0x17c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xadc], 0xfffffffc
jne 0x1000bef9
cmp dword [ebp - 0x5c], 0
je 0x1000bef9
mov dword [ebp - 0xa48], 1
jmp 0x1000bf00
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0x5f8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xadc]
cmp dword [ebp - 0x5f8], eax
jl 0x1000bf2d
mov dword [ebp - 0x820], 1
jmp 0x1000bf34
and dword [ebp - 0x820], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xadc]
cmp dword [ebp - 0x820], eax
je 0x1000bf54
mov dword [ebp - 0x600], 1
jmp 0x1000bf5b
and dword [ebp - 0x600], 0
cmp dword [ebp - 0x600], 0xdd50170a
jbe 0x1000bf73
mov dword [ebp - 0x928], 1
jmp 0x1000bf7a
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x928]
sub eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x17c]
jl 0x1000bf9a
mov dword [ebp - 0x608], 1
jmp 0x1000bfa1
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x608], eax
jg 0x1000bfbb
mov dword [ebp - 0x610], 1
jmp 0x1000bfc2
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x828]
cmp eax, dword [ebp - 0x610]
je 0x1000bfdc
mov dword [ebp - 0x9a8], 1
jmp 0x1000bfe3
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0xc9c], eax
jmp 0x1000c045
mov dword [ebp - 0x5c], 0
jmp 0x1000c001
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1000c017
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xadc], 2
jmp 0x1000bffa
cmp dword [ebp - 0x5c], 0xfffd
jb 0x1000c02c
mov dword [ebp - 0x618], 1
jmp 0x1000c033
and dword [ebp - 0x618], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x618]
mov dword [ebp + eax - 0xadc], ecx
push 1
lea ecx, [ebp - 0xc10]
call fcn.10017abd
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x25c], 0
jmp 0x1000c072
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 1
jge 0x1000c091
push dword [ebp - 0x25c]
lea ecx, [ebp - 0xc10]
call fcn.10017b2a
or dword [eax], 0xffffffff
jmp 0x1000c065
push 0
lea ecx, [ebp - 0xc10]
call fcn.10017b2a
and dword [eax], 0
jmp 0x1000c0c7
push 0
lea ecx, [ebp - 0xc10]
call fcn.10017b2a
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x830]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x830]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc10]
call fcn.10017b2a
cmp dword [eax], 0xffffffea
jne 0x1000c0fa
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1000c0f8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
jmp 0x1000c0a3
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x1000c11b
push 0
push 0x1725
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc10]
call fcn.10017b25
mov dword [ebp - 0x10f0], 0x1008b7c8
mov dword [ebp - 0xda4], 0x42c70bb7
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1000c15d
push 0x73d
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1000c179
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xf04], 0x1008b7cc
mov dword [ebp - 0x2e8], 0x4432
mov dword [ebp - 0x38], 0xfffe
mov dword [ebp - 0x60], 0xb0a3531f
push 2
lea ecx, [ebp - 0xfc0]
call fcn.10017abd
mov dword [ebp - 4], 0x16
mov dword [ebp - 0xb0], 0
jmp 0x1000c1c8
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1000c1e4
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x1190], 5
jmp 0x1000c1bb
mov dword [ebp - 0xb0], 0
jmp 0x1000c1fd
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1000c21f
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xfc0]
call fcn.10017b2a
mov dword [eax], 0x459c
jmp 0x1000c1f0
cmp dword [ebp - 0x2e8], 0
jne 0x1000c234
mov dword [ebp - 0xae8], 1
jmp 0x1000c23b
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x38], eax
jg 0x1000c252
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret