Function at 0x10008e69
Capabilities:
Get disk information
Get memory capacity
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087073
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1570
call fcn.10083270
push esi
push edi
mov dword [ebp - 0x10], 0x5c68ec0a
mov dword [ebp - 0x24], 0xeec54165
mov dword [ebp - 0x4c0], 0x47c4d145
mov dword [ebp - 0x4bc], 0x47c4d145
mov dword [ebp - 0x4b8], 0x47c4d145
mov dword [ebp - 0x4b4], 0x47c4d145
mov dword [ebp - 0x208], 0x1521
mov dword [ebp - 0xbb4], 0x534ce5fe
mov dword [ebp - 0xdc8], 0
mov dword [ebp - 0x10], 0
jmp 0x10008ef1
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffef
jg 0x10008fbf
mov dword [ebp - 0x1c0], 0xa0d72276
mov dword [ebp - 0x26c], 0
jmp 0x10008f1e
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 3
jge 0x10008f3a
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x1314], 0x53bc6e5c
jmp 0x10008f11
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1314]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x24], eax
jle 0x10008f5d
mov dword [ebp - 0x6f8], 1
jmp 0x10008f64
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1c0], 0
jmp 0x10008f89
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jg 0x10008fba
mov dword [ebp - 0x24], 0
jmp 0x10008fa2
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10008fb8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1314], 0
jmp 0x10008f9b
jmp 0x10008f7c
jmp 0x10008eea
mov dword [ebp - 0x24], 0
jmp 0x10008fcf
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x100092f6
mov dword [ebp - 0xbac], 0
mov dword [ebp - 0xb8], 0
jmp 0x10008ffc
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x10009018
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x14d0], 0x5cb5542a
jmp 0x10008fef
mov dword [ebp - 0xb8], 0
jmp 0x10009031
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1000904d
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xec8], 0x68fc786c
jmp 0x10009024
mov dword [ebp - 0x10], 0
jmp 0x1000905d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x100092f1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec8]
mov dword [ebp - 0x10e4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c0]
dec eax
je 0x1000909c
mov eax, 0xe12f
test eax, eax
je 0x1000909c
mov dword [ebp - 0xb9c], 1
jmp 0x100090a3
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c0]
cmp dword [ebp - 0xb9c], eax
je 0x100090c7
mov eax, 0x50b
test eax, eax
jne 0x100090c7
and dword [ebp - 0xba4], 0
jmp 0x100090d1
mov dword [ebp - 0xba4], 1
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbb4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4c0]
cmp dword [ebp - 0xbb4], eax
jg 0x10009114
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x4c0], 0
jne 0x10009114
and dword [ebp - 0xbbc], 0
jmp 0x1000911e
mov dword [ebp - 0xbbc], 1
mov eax, dword [ebp - 0xdc8]
cmp dword [ebp - 0xbbc], eax
jl 0x10009138
mov dword [ebp - 0xd28], 1
jmp 0x1000913f
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1148], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1150], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c0]
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c0]
neg eax
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0x4c0]
jge 0x10009188
mov dword [ebp - 0xbc4], 1
jmp 0x1000918f
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xbc4]
sub ecx, dword [ebp + eax*4 - 0x4c0]
cmp ecx, dword [ebp - 0x24]
jg 0x100091b0
mov dword [ebp - 0xbe4], 1
jmp 0x100091b7
and dword [ebp - 0xbe4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec8]
cmp dword [ebp - 0xbe4], eax
jl 0x100091d8
mov dword [ebp - 0xbec], 1
jmp 0x100091df
and dword [ebp - 0xbec], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xec8]
cmp dword [ebp - 0xbec], eax
jne 0x100091ff
mov dword [ebp - 0xbf4], 1
jmp 0x10009206
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xbf4], eax
jge 0x1000921d
mov dword [ebp - 0xbfc], 1
jmp 0x10009224
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c0]
cmp dword [ebp - 0xbfc], eax
jl 0x10009242
mov dword [ebp - 0xbd0], 1
jmp 0x10009249
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xbd0], eax
je 0x10009260
mov dword [ebp - 0x4dc], 1
jmp 0x10009267
and dword [ebp - 0x4dc], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x14d0], 5
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c0]
add eax, dword [ebp - 0x4dc]
cmp eax, 5
jg 0x10009299
mov dword [ebp - 0xb70], 1
jmp 0x100092a0
and dword [ebp - 0xb70], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb70]
mov dword [ebp + eax - 0xec8], ecx
mov dword [ebp - 0x208], 0
jmp 0x100092cc
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jg 0x100092ec
mov dword [ebp - 0xd30], 0x7629
cmp dword [ebp - 0xd30], 0
je 0x100092ea
jmp 0x100092ec
jmp 0x100092bf
jmp 0x10009056
jmp 0x10008fc8
push 4
lea ecx, [ebp - 0xc08]
call fcn.10015bd6
and dword [ebp - 4], 0
mov dword [ebp - 0xb1c], 0x80c3414b
mov dword [ebp - 0x80], 0
jmp 0x10009321
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x1000933a
push dword [ebp - 0x80]
lea ecx, [ebp - 0xc08]
call fcn.10015c74
or dword [eax], 0xffffffff
jmp 0x1000931a
mov dword [ebp - 0x80], 0
jmp 0x1000934a
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x10009360
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xf8], 0xada439be
jmp 0x10009343
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xf8], 3
jmp 0x1000938e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf8], 0
jl 0x1000951a
mov dword [ebp - 0xd38], 0x21de
push 4
lea ecx, [ebp - 0xfb4]
call fcn.10015bd6
mov byte [ebp - 4], 1
mov dword [ebp - 0x3bc], 0
jmp 0x100093d6
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 4
jge 0x100093f8
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0xfb4]
call fcn.10015c74
mov dword [eax], 0xfffffff8
jmp 0x100093c9
mov eax, dword [ebp - 0xd38]
mov dword [ebp - 0x1160], eax
push 0
lea ecx, [ebp - 0xc08]
call fcn.10015c74
cmp dword [eax], 0
jne 0x10009422
mov dword [ebp - 0x874], 1
jmp 0x10009429
and dword [ebp - 0x874], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
mov dword [ebp - 0x1168], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf8], 0
jne 0x10009464
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xf8]
lea ecx, [ebp - 0xc08]
call fcn.10015c74
push 1
lea ecx, [ebp - 0xc08]
call fcn.10015c74
mov eax, dword [eax]
mov dword [ebp - 0xb1c], eax
mov esi, dword [ebp - 0xb1c]
push 0
lea ecx, [ebp - 0xc08]
call fcn.10015c74
add esi, dword [eax]
cmp esi, 0xffffffff
jl 0x1000949f
mov dword [ebp - 0x4e4], 1
jmp 0x100094a6
and dword [ebp - 0x4e4], 0
push 2
lea ecx, [ebp - 0xc08]
call fcn.10015c74
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [eax]
jne 0x100094c9
mov dword [ebp - 0x4ec], 1
jmp 0x100094d0
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x874]
cmp eax, dword [ebp - 0x4ec]
jg 0x100094ea
mov dword [ebp - 0xa3c], 1
jmp 0x100094f1
and dword [ebp - 0xa3c], 0
push 1
lea ecx, [ebp - 0xfb4]
call fcn.10015c74
mov ecx, dword [ebp - 0xa3c]
mov dword [eax], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xfb4]
call fcn.10015c58
jmp 0x10009373
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc08]
call fcn.10015c58
mov dword [ebp - 0x18], 0x5c68ec0a
mov dword [ebp - 0x28], 0xeec54165
mov dword [ebp - 0x4d0], 0x47c4d145
mov dword [ebp - 0x4cc], 0x47c4d145
mov dword [ebp - 0x4c8], 0x47c4d145
mov dword [ebp - 0x4c4], 0x47c4d145
mov dword [ebp - 0x1c], 0x56915a13
mov dword [ebp - 0x274], 0
jmp 0x1000957f
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jge 0x1000959b
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0x420], 0
jmp 0x10009572
mov byte [ebp - 0x17e], 0
movzx eax, byte [ebp - 0x17e]
test eax, eax
je 0x100095c6
push 0x1a26
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov dword [ebp - 0x1c], 0
jmp 0x100095d6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x10009766
mov dword [ebp - 0x36c], 0
jmp 0x100095f9
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 1
jge 0x10009615
mov eax, dword [ebp - 0x36c]
mov dword [ebp + eax*4 - 0xda8], 0xee61780e
jmp 0x100095ec
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x420]
cmp dword [ebp + eax*4 - 0x420], ecx
je 0x10009637
mov dword [ebp - 0xbe8], 1
jmp 0x1000963e
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x420]
mov dword [ebp - 0x1170], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x420]
cmp dword [ebp + eax*4 - 0x420], ecx
jne 0x10009670
mov dword [ebp - 0x4f4], 1
jmp 0x10009677
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x420]
cmp dword [ebp - 0x4f4], eax
jge 0x10009695
mov dword [ebp - 0x87c], 1
jmp 0x1000969c
and dword [ebp - 0x87c], 0
cmp dword [ebp - 0x87c], 6
ja 0x100096b1
mov dword [ebp - 0x4fc], 1
jmp 0x100096b8
and dword [ebp - 0x4fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x420]
cmp dword [ebp - 0x4fc], eax
jl 0x100096d9
mov dword [ebp - 0x504], 1
jmp 0x100096e0
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xbe8]
sub ecx, dword [ebp + eax*4 - 0x420]
cmp ecx, dword [ebp - 0x504]
jl 0x10009703
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x420], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x420]
mov dword [ebp - 0x1178], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1180], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x420]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x884]
mov dword [ebp + eax*4 - 0x420], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x884]
mov dword [ebp + eax - 0xda8], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x420], 0
je 0x10009761
jmp 0x10009766
jmp 0x100095cf
mov dword [ebp - 0x1d0], 0x1521
mov dword [ebp - 0x8c4], 0x534ce5fe
mov dword [ebp - 0x488], 0x9d29
mov dword [ebp - 0x11cc], 0x887cf2e5
mov dword [ebp - 0x11d4], 0x9ed9ba07
mov dword [ebp - 0x27c], 0x285faafe
mov dword [ebp - 0x11dc], 0
mov dword [ebp - 0x11e4], 0x97412df3
mov dword [ebp - 0xdb0], 1
mov dword [ebp - 0x11ec], 0x59cdc345
push 2
lea ecx, [ebp - 0x1324]
call fcn.10015bd6
mov dword [ebp - 4], 2
push 2
lea ecx, [ebp - 0xfcc]
call fcn.10015bd6
mov byte [ebp - 4], 3
mov dword [ebp - 0xb0], 0
jmp 0x10009808
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1000982a
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x1324]
call fcn.10015c74
mov dword [eax], 0x2e7ccc89
jmp 0x100097fb
mov dword [ebp - 0xb0], 0
jmp 0x10009843
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x10009865
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xfcc]
call fcn.10015c74
mov dword [eax], 0xfffa
jmp 0x10009836
cmp dword [ebp - 0x488], 0
jne 0x10009880
cmp dword [ebp - 0x488], 0
jne 0x10009880
and dword [ebp - 0x50c], 0
jmp 0x1000988a
mov dword [ebp - 0x50c], 1
push 0
lea ecx, [ebp - 0xfcc]
call fcn.10015c74
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x470]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x470]
mov dword [ecx], eax
mov eax, dword [ebp - 0x470]
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [eax]
jle 0x100098ca
mov dword [ebp - 0xa44], 1
jmp 0x100098d1
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x488]
cmp eax, dword [ebp - 0xa44]
jge 0x100098eb
mov dword [ebp - 0x514], 1
jmp 0x100098f2
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0xdb0], eax
mov dword [ebp - 0x27c], 0
jmp 0x10009917
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 5
jne 0x1000995e
mov dword [ebp - 0x11f4], 0xffffffff
mov dword [ebp - 0x11fc], 0xffffffff
mov dword [ebp - 0x1204], 0x58d8
mov dword [ebp - 0x120c], 0xfffffff8
mov dword [ebp - 0xdb8], 0xfffffffd
mov dword [ebp - 0xdb8], 0
jmp 0x1000990a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xfcc]
call fcn.10015c58
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1324]
call fcn.10015c58
mov dword [ebp - 0xde8], 0
mov dword [ebp - 0xf68], 0xfffffff7
mov dword [ebp - 0xf64], 0xfffffff7
mov dword [ebp - 0xf60], 0xfffffff7
mov dword [ebp - 0xf5c], 0xfffffff7
lea ecx, [ebp - 0x441]
call fcn.10008c23
push eax
lea eax, [ebp - 0xf58]
push eax
lea eax, [ebp - 0xf68]
push eax
lea ecx, [ebp - 0x1520]
call fcn.10015c83
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x25c]
call fcn.10015c32
mov dword [ebp - 4], 4
mov dword [ebp - 0xc4], 0x81320f2d
mov dword [ebp - 0x524], 0xfffffffc
mov dword [ebp - 0x8ac], 0xffffffff
mov dword [ebp - 0xdd8], 0
mov dword [ebp - 0x88], 0
jmp 0x10009a2b
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x10009a47
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xe00], 0xffff
jmp 0x10009a1e
mov dword [ebp - 0x88], 0
jmp 0x10009a60
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x10009a7c
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x1540], 0x2499e68f
jmp 0x10009a53
push 1
lea ecx, [ebp - 0x25c]
call fcn.10015c74
cmp dword [eax], 0
jne 0x10009aa9
push 0
lea ecx, [ebp - 0x25c]
call fcn.10015c74
cmp dword [eax], 0
jne 0x10009aa9
and dword [ebp - 0xa4c], 0
jmp 0x10009ab3
mov dword [ebp - 0xa4c], 1
mov eax, 0x6eea
test eax, eax
je 0x10009b81
push 0
lea ecx, [ebp - 0x25c]
call fcn.10015c74
mov eax, 0xeec299e
cmp eax, 4
jne 0x10009ae3
mov dword [ebp - 0x88c], 1
jmp 0x10009aea
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
je 0x10009b0c
push 0
lea ecx, [ebp - 0x25c]
call fcn.10015c74
mov esi, dword [ebp - 0xc4]
push 3
lea ecx, [ebp - 0x25c]
call fcn.10015c74
cmp esi, dword [eax]
jl 0x10009b2f
mov dword [ebp - 0x51c], 1
jmp 0x10009b36
and dword [ebp - 0x51c], 0
push 0
lea ecx, [ebp - 0x25c]
call fcn.10015c74
mov ecx, dword [ebp - 0x51c]
cmp ecx, dword [eax]
jge 0x10009b59
mov dword [ebp - 0xb24], 1
jmp 0x10009b60
and dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x10009b81
mov dword [ebp - 0x894], 1
jmp 0x10009b88
and dword [ebp - 0x894], 0
push 0
lea ecx, [ebp - 0x25c]
call fcn.10015c74
mov ecx, dword [ebp - 0x894]
imul ecx, dword [eax]
test ecx, ecx
jne 0x10009bb4
cmp dword [ebp - 0xc4], 0
jne 0x10009bb4
and dword [ebp - 0x52c], 0
jmp 0x10009bbe
mov dword [ebp - 0x52c], 1
push 1
lea ecx, [ebp - 0x25c]
call fcn.10015c74
mov ecx, dword [ebp - 0x52c]
cmp ecx, dword [eax]
jne 0x10009be1
mov dword [ebp - 0x534], 1
jmp 0x10009be8
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0xa4c]
cmp eax, dword [ebp - 0x534]
jg 0x10009c02
mov dword [ebp - 0x89c], 1
jmp 0x10009c09
and dword [ebp - 0x89c], 0
cmp dword [ebp - 0x89c], 0xffff
jae 0x10009c21
mov dword [ebp - 0x53c], 1
jmp 0x10009c28
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
neg eax
cmp eax, 0x698d
jge 0x10009c43
mov dword [ebp - 0xba0], 1
jmp 0x10009c4a
and dword [ebp - 0xba0], 0
cmp dword [ebp - 0xba0], 0x9ca4f06
jl 0x10009c62
mov dword [ebp - 0xdc0], 1
jmp 0x10009c69
and dword [ebp - 0xdc0], 0
push 0
lea ecx, [ebp - 0x25c]
call fcn.10015c74
push 3
lea ecx, [ebp - 0x25c]
call fcn.10015c74
push 0
lea ecx, [ebp - 0x25c]
call fcn.10015c74
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0xe00]
mov dword [ebp - 0x544], eax
push 0
lea ecx, [ebp - 0x25c]
call fcn.10015c74
mov ecx, dword [ebp - 0x544]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x544]
mov ecx, dword [ecx]
mov dword [ebp + eax - 0x1540], ecx
mov dword [ebp - 0xc4], 0x12
jmp 0x10009ce8
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x14
jl 0x10009f2a
mov dword [ebp - 0x8a4], 0x98c5
mov dword [ebp - 0x1c8], 0xabee
mov dword [ebp - 0x554], 0xffffffff
mov dword [ebp - 0xa5c], 0xffffffff
mov dword [ebp - 0xde0], 2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe00]
mov dword [ebp - 0x1214], eax
cmp dword [ebp - 0x8a4], 0xbab92a1d
jne 0x10009d52
mov dword [ebp - 0xc30], 1
jmp 0x10009d59
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0x8ac]
mov ecx, 0xbae54fd5
sub ecx, 8
imul eax, ecx
cmp eax, dword [ebp - 0x8a4]
jge 0x10009d7e
mov dword [ebp - 0x54c], 1
jmp 0x10009d85
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
add eax, 0x796fb6c7
jne 0x10009db0
push 1
lea ecx, [ebp - 0x25c]
call fcn.10015c74
cmp dword [eax], 0
jne 0x10009db0
mov dword [ebp - 0xa54], 1
jmp 0x10009db7
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x1c8]
add eax, dword [ebp - 0xa54]
sub eax, dword [ebp - 0x1c8]
imul eax, eax, 0x74b4
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x554]
imul eax, dword [ebp - 0x8ac]
cmp eax, 0x1bd053a6
jle 0x10009df5
mov dword [ebp - 0x55c], 1
jmp 0x10009dfc
and dword [ebp - 0x55c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe00]
cmp dword [ebp - 0x55c], eax
jne 0x10009e1d
mov dword [ebp - 0xb2c], 1
jmp 0x10009e24
and dword [ebp - 0xb2c], 0
push 0
lea ecx, [ebp - 0x25c]
call fcn.10015c74
mov ecx, dword [ebp - 0xb2c]
cmp ecx, dword [eax]
jne 0x10009e47
mov dword [ebp - 0x564], 1
jmp 0x10009e4e
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
neg eax
jne 0x10009e6b
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x10009e6b
mov dword [ebp - 0x8b4], 1
jmp 0x10009e72
and dword [ebp - 0x8b4], 0
push 0
lea ecx, [ebp - 0x25c]
call fcn.10015c74
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8b4]
jg 0x10009e95
mov dword [ebp - 0x56c], 1
jmp 0x10009e9c
and dword [ebp - 0x56c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x56c]
sub ecx, dword [ebp + eax - 0xe00]
mov dword [ebp - 0xa5c], ecx
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0xa5c], eax
jle 0x10009ece
mov dword [ebp - 0xdd0], 1
jmp 0x10009ed5
and dword [ebp - 0xdd0], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x121c], eax
mov eax, dword [ebp - 0xdd8]
mov dword [ebp - 0x1224], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe00], 0
je 0x10009f12
cmp dword [ebp - 0x1c8], 0
je 0x10009f12
mov dword [ebp - 0x574], 1
jmp 0x10009f19
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0xde0], eax
jmp 0x10009cdb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x25c]
call fcn.10015c58
mov dword [ebp - 0x18], 0
jmp 0x10009f49
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffef
jg 0x1000a017
mov dword [ebp - 0x22c], 0xa0d72276
mov dword [ebp - 0x3a4], 0
jmp 0x10009f76
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 3
jge 0x10009f92
mov eax, dword [ebp - 0x3a4]
mov dword [ebp + eax*4 - 0x1334], 0x53bc6e5c
jmp 0x10009f69
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1334]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x28], eax
jle 0x10009fb5
mov dword [ebp - 0x8bc], 1
jmp 0x10009fbc
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x22c], 0
jmp 0x10009fe1
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jg 0x1000a012
mov dword [ebp - 0x28], 0
jmp 0x10009ffa
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000a010
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1334], 0
jmp 0x10009ff3
jmp 0x10009fd4
jmp 0x10009f42
mov dword [ebp - 0x28], 0
jmp 0x1000a027
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x1000a34e
mov dword [ebp - 0x584], 0
mov dword [ebp - 0xc0], 0
jmp 0x1000a054
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1000a070
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x150c], 0x5cb5542a
jmp 0x1000a047
mov dword [ebp - 0xc0], 0
jmp 0x1000a089
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1000a0a5
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0xed4], 0x68fc786c
jmp 0x1000a07c
mov dword [ebp - 0x18], 0
jmp 0x1000a0b5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x1000a349
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xed4]
mov dword [ebp - 0x122c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4d0]
dec eax
je 0x1000a0f4
mov eax, 0xe12f
test eax, eax
je 0x1000a0f4
mov dword [ebp - 0x57c], 1
jmp 0x1000a0fb
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4d0]
cmp dword [ebp - 0x57c], eax
je 0x1000a11f
mov eax, 0x50b
test eax, eax
jne 0x1000a11f
and dword [ebp - 0xbd8], 0
jmp 0x1000a129
mov dword [ebp - 0xbd8], 1
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x8c4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4d0]
cmp dword [ebp - 0x8c4], eax
jg 0x1000a16c
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x4d0], 0
jne 0x1000a16c
and dword [ebp - 0x58c], 0
jmp 0x1000a176
mov dword [ebp - 0x58c], 1
mov eax, dword [ebp - 0xde8]
cmp dword [ebp - 0x58c], eax
jl 0x1000a190
mov dword [ebp - 0xdf0], 1
jmp 0x1000a197
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1234], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x123c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4d0]
mov dword [ebp - 0x1244], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4d0]
neg eax
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ebp + ecx*4 - 0x4d0]
jge 0x1000a1e0
mov dword [ebp - 0xa64], 1
jmp 0x1000a1e7
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xa64]
sub ecx, dword [ebp + eax*4 - 0x4d0]
cmp ecx, dword [ebp - 0x28]
jg 0x1000a208
mov dword [ebp - 0x594], 1
jmp 0x1000a20f
and dword [ebp - 0x594], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xed4]
cmp dword [ebp - 0x594], eax
jl 0x1000a230
mov dword [ebp - 0x8cc], 1
jmp 0x1000a237
and dword [ebp - 0x8cc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xed4]
cmp dword [ebp - 0x8cc], eax
jne 0x1000a257
mov dword [ebp - 0x59c], 1
jmp 0x1000a25e
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x59c], eax
jge 0x1000a275
mov dword [ebp - 0xb34], 1
jmp 0x1000a27c
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4d0]
cmp dword [ebp - 0xb34], eax
jl 0x1000a29a
mov dword [ebp - 0x5a4], 1
jmp 0x1000a2a1
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x5a4], eax
je 0x1000a2b8
mov dword [ebp - 0x8d4], 1
jmp 0x1000a2bf
and dword [ebp - 0x8d4], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x150c], 5
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4d0]
add eax, dword [ebp - 0x8d4]
cmp eax, 5
jg 0x1000a2f1
mov dword [ebp - 0x5ac], 1
jmp 0x1000a2f8
and dword [ebp - 0x5ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5ac]
mov dword [ebp + eax - 0xed4], ecx
mov dword [ebp - 0x1d0], 0
jmp 0x1000a324
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jg 0x1000a344
mov dword [ebp - 0xea4], 0x7629
cmp dword [ebp - 0xea4], 0
je 0x1000a342
jmp 0x1000a344
jmp 0x1000a317
jmp 0x1000a0ae
jmp 0x1000a020
mov dword [ebp - 0x14], 0x5c68ec0a
mov dword [ebp - 0x124c], 0xffff
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1000a379
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x1000a39a
push 0x2b9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov dword [ebp - 0x34], 0xeec54165
mov dword [ebp - 0x4b0], 0x47c4d145
mov dword [ebp - 0x4ac], 0x47c4d145
mov dword [ebp - 0x4a8], 0x47c4d145
mov dword [ebp - 0x4a4], 0x47c4d145
mov dword [ebp - 0x230], 0x1521
mov dword [ebp - 0x69c], 0x534ce5fe
mov dword [ebp - 0xe7c], 0
mov dword [ebp - 0x14], 0
jmp 0x1000a3f7
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffef
jg 0x1000ac84
push 1
lea ecx, [ebp - 0x494]
call fcn.10015bd6
mov dword [ebp - 4], 5
mov dword [ebp - 0xa74], 0
mov dword [ebp - 0x8dc], 0x3fc4b03e
push 2
lea ecx, [ebp - 0xc2c]
call fcn.10015bd6
mov byte [ebp - 4], 6
mov dword [ebp - 0x8e4], 0x80d1c1d6
mov dword [ebp - 0xeb4], 0xfedaacda
mov dword [ebp - 0x2c], 0
jmp 0x1000a45e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1000a47a
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x494]
call fcn.10015c74
mov dword [eax], 0xfffffffa
jmp 0x1000a457
mov dword [ebp - 0x2c], 0
jmp 0x1000a48a
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000a4a0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x14f4], 0
jmp 0x1000a483
mov dword [ebp - 0x2c], 0
jmp 0x1000a4b0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1000a4cc
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc2c]
call fcn.10015c74
mov dword [eax], 0xfffffffa
jmp 0x1000a4a9
push 0
lea ecx, [ebp - 0x494]
call fcn.10015c74
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0xa6c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa6c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x494]
call fcn.10015c74
cmp dword [eax], 0
jne 0x1000a53f
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x5b4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5b4]
mov dword [ebp + eax - 0x14f4], ecx
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x8dc], eax
cmp dword [ebp - 0x8dc], 0
jne 0x1000a53f
and dword [ebp - 0x8ec], 0
jmp 0x1000a549
mov dword [ebp - 0x8ec], 1
push 0
lea ecx, [ebp - 0xc2c]
call fcn.10015c74
mov esi, eax
push 0
lea ecx, [ebp - 0x494]
call fcn.10015c74
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1000a577
mov dword [ebp - 0x5bc], 1
jmp 0x1000a57e
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0x4365
je 0x1000a5b1
mov eax, 0xa311c3fc
test eax, eax
je 0x1000a5b1
push 0
lea ecx, [ebp - 0x494]
call fcn.10015c74
cmp dword [eax], 0
je 0x1000a5b1
mov dword [ebp - 0xba8], 1
jmp 0x1000a5b8
and dword [ebp - 0xba8], 0
push 0
lea ecx, [ebp - 0xc2c]
call fcn.10015c74
mov ecx, dword [ebp - 0xba8]
cmp ecx, dword [eax]
jg 0x1000a5db
mov dword [ebp - 0x5c4], 1
jmp 0x1000a5e2
and dword [ebp - 0x5c4], 0
push 0
lea ecx, [ebp - 0x494]
call fcn.10015c74
mov eax, dword [eax]
sub eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x8e4], eax
mov esi, dword [ebp - 0x8e4]
push 0
lea ecx, [ebp - 0x494]
call fcn.10015c74
cmp esi, dword [eax]
jl 0x1000a620
mov dword [ebp - 0x5cc], 1
jmp 0x1000a627
and dword [ebp - 0x5cc], 0
push 0
lea ecx, [ebp - 0x494]
call fcn.10015c74
mov ecx, dword [ebp - 0x5cc]
cmp ecx, dword [eax]
jne 0x1000a64a
mov dword [ebp - 0x5d4], 1
jmp 0x1000a651
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0xa74]
sub eax, dword [ebp - 0x5d4]
cmp eax, 0x7a94
jle 0x1000a670
mov dword [ebp - 0x5dc], 1
jmp 0x1000a677
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x8ec]
cmp eax, dword [ebp - 0x5dc]
je 0x1000a691
mov dword [ebp - 0xeac], 1
jmp 0x1000a698
and dword [ebp - 0xeac], 0
push 1
lea ecx, [ebp - 0xc2c]
call fcn.10015c74
cmp dword [eax], 8
jae 0x1000a6b6
mov dword [ebp - 0xb3c], 1
jmp 0x1000a6bd
and dword [ebp - 0xb3c], 0
push 0
lea ecx, [ebp - 0x494]
call fcn.10015c74
mov ecx, dword [ebp - 0xb3c]
cmp ecx, dword [eax]
jge 0x1000a6e0
mov dword [ebp - 0x5e4], 1
jmp 0x1000a6e7
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0xfffffff7
jl 0x1000a6fc
mov dword [ebp - 0x8f4], 1
jmp 0x1000a703
and dword [ebp - 0x8f4], 0
push 0
lea ecx, [ebp - 0xc2c]
call fcn.10015c74
mov ecx, dword [ebp - 0x8f4]
cmp ecx, dword [eax]
jge 0x1000a726
mov dword [ebp - 0x5ec], 1
jmp 0x1000a72d
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0xeb4], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc2c]
call fcn.10015c58
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x494]
call fcn.10015c58
mov dword [ebp - 0x210], 0xa0d72276
push 4
lea ecx, [ebp - 0xc14]
call fcn.10015bd6
mov dword [ebp - 4], 7
mov dword [ebp - 0xa7c], 0x80c3414b
mov dword [ebp - 0x90], 0
jmp 0x1000a798
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x1000a7b7
push dword [ebp - 0x90]
lea ecx, [ebp - 0xc14]
call fcn.10015c74
or dword [eax], 0xffffffff
jmp 0x1000a78b
mov dword [ebp - 0x90], 0
jmp 0x1000a7d0
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x1000a7ec
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x100], 0xada439be
jmp 0x1000a7c3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x100], 3
jmp 0x1000a81a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x100], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x100], 0
jl 0x1000a9a6
mov dword [ebp - 0xebc], 0x21de
push 4
lea ecx, [ebp - 0xfe4]
call fcn.10015bd6
mov byte [ebp - 4], 8
mov dword [ebp - 0x284], 0
jmp 0x1000a862
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 4
jge 0x1000a884
push dword [ebp - 0x284]
lea ecx, [ebp - 0xfe4]
call fcn.10015c74
mov dword [eax], 0xfffffff8
jmp 0x1000a855
mov eax, dword [ebp - 0xebc]
mov dword [ebp - 0x1254], eax
push 0
lea ecx, [ebp - 0xc14]
call fcn.10015c74
cmp dword [eax], 0
jne 0x1000a8ae
mov dword [ebp - 0x8fc], 1
jmp 0x1000a8b5
and dword [ebp - 0x8fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
mov dword [ebp - 0x125c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x100], 0
jne 0x1000a8f0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x100]
lea ecx, [ebp - 0xc14]
call fcn.10015c74
push 1
lea ecx, [ebp - 0xc14]
call fcn.10015c74
mov eax, dword [eax]
mov dword [ebp - 0xa7c], eax
mov esi, dword [ebp - 0xa7c]
push 0
lea ecx, [ebp - 0xc14]
call fcn.10015c74
add esi, dword [eax]
cmp esi, 0xffffffff
jl 0x1000a92b
mov dword [ebp - 0x5f4], 1
jmp 0x1000a932
and dword [ebp - 0x5f4], 0
push 2
lea ecx, [ebp - 0xc14]
call fcn.10015c74
mov ecx, dword [ebp - 0x5f4]
cmp ecx, dword [eax]
jne 0x1000a955
mov dword [ebp - 0x5fc], 1
jmp 0x1000a95c
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x8fc]
cmp eax, dword [ebp - 0x5fc]
jg 0x1000a976
mov dword [ebp - 0xbf8], 1
jmp 0x1000a97d
and dword [ebp - 0xbf8], 0
push 1
lea ecx, [ebp - 0xfe4]
call fcn.10015c74
mov ecx, dword [ebp - 0xbf8]
mov dword [eax], ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xfe4]
call fcn.10015c58
jmp 0x1000a7ff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc14]
call fcn.10015c58
mov dword [ebp - 0x374], 0
jmp 0x1000a9ce
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 3
jge 0x1000a9ea
mov eax, dword [ebp - 0x374]
mov dword [ebp + eax*4 - 0x1344], 0x53bc6e5c
jmp 0x1000a9c1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1344]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x34], eax
jle 0x1000aa0d
mov dword [ebp - 0x604], 1
jmp 0x1000aa14
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x210], 0
jmp 0x1000aa39
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jg 0x1000ac7f
mov dword [ebp - 0x34], 0
jmp 0x1000aa56
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1000ac7a
mov dword [ebp - 0x20], 0x56915a13
mov dword [ebp - 0x28c], 0
jmp 0x1000aa80
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 3
jge 0x1000aa9c
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0x414], 0
jmp 0x1000aa73
mov byte [ebp - 0x182], 0
movzx eax, byte [ebp - 0x182]
test eax, eax
je 0x1000aac7
push 0x1a26
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov dword [ebp - 0x20], 0
jmp 0x1000aad7
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x1000ac67
mov dword [ebp - 0x3cc], 0
jmp 0x1000aafa
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 1
jge 0x1000ab16
mov eax, dword [ebp - 0x3cc]
mov dword [ebp + eax*4 - 0xeb8], 0xee61780e
jmp 0x1000aaed
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x414]
cmp dword [ebp + eax*4 - 0x414], ecx
je 0x1000ab38
mov dword [ebp - 0x614], 1
jmp 0x1000ab3f
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x414]
mov dword [ebp - 0x1264], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x414]
cmp dword [ebp + eax*4 - 0x414], ecx
jne 0x1000ab71
mov dword [ebp - 0x904], 1
jmp 0x1000ab78
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x414]
cmp dword [ebp - 0x904], eax
jge 0x1000ab96
mov dword [ebp - 0x60c], 1
jmp 0x1000ab9d
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 6
ja 0x1000abb2
mov dword [ebp - 0xa84], 1
jmp 0x1000abb9
and dword [ebp - 0xa84], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x414]
cmp dword [ebp - 0xa84], eax
jl 0x1000abda
mov dword [ebp - 0x90c], 1
jmp 0x1000abe1
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x614]
sub ecx, dword [ebp + eax*4 - 0x414]
cmp ecx, dword [ebp - 0x90c]
jl 0x1000ac04
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x414], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x414]
mov dword [ebp - 0x126c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x414]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x61c]
mov dword [ebp + eax*4 - 0x414], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x61c]
mov dword [ebp + eax - 0xeb8], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x414], 0
je 0x1000ac62
jmp 0x1000ac67
jmp 0x1000aad0
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1344], 0
jmp 0x1000aa4f
jmp 0x1000aa2c
jmp 0x1000a3f0
mov dword [ebp - 0x294], 0x477862fd
mov dword [ebp - 0x127c], 0x151c3c39
mov dword [ebp - 0xf90], 8
mov dword [ebp - 0xf8c], 8
mov dword [ebp - 0xf88], 8
mov dword [ebp - 0xf84], 8
lea ecx, [ebp - 0x421]
call fcn.10008c23
push eax
lea eax, [ebp - 0xf80]
push eax
lea eax, [ebp - 0xf90]
push eax
lea ecx, [ebp - 0x1548]
call fcn.10015c83
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x14dc]
call fcn.10015c32
mov dword [ebp - 4], 9
mov dword [ebp - 0x2a4], 0xfffffffb
mov dword [ebp - 0x294], 0
jmp 0x1000ad1f
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xffffffeb
jge 0x1000ae90
mov dword [ebp - 0x29c], 0x398070a
mov dword [ebp - 0x1284], 0xe3ff14eb
mov dword [ebp - 0x128c], 0x714ad38
mov dword [ebp - 0x1294], 8
mov dword [ebp - 0x129c], 9
push 4
lea ecx, [ebp - 0x1364]
call fcn.10015bd6
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x37c], 0
jmp 0x1000ad88
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 4
jge 0x1000ada7
push dword [ebp - 0x37c]
lea ecx, [ebp - 0x1364]
call fcn.10015c74
and dword [eax], 0
jmp 0x1000ad7b
mov dword [ebp - 0x29c], 0x10
jmp 0x1000adc0
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 4
jg 0x1000ae40
push 3
lea ecx, [ebp - 0x1354]
call fcn.10015bd6
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xb44], 0x450b
mov dword [ebp - 0x320], 0
jmp 0x1000adfd
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 3
jge 0x1000ae1f
push dword [ebp - 0x320]
lea ecx, [ebp - 0x1354]
call fcn.10015c74
mov dword [eax], 0x56a3367f
jmp 0x1000adf0
mov eax, dword [ebp - 0xb44]
dec eax
mov dword [ebp - 0xb44], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1354]
call fcn.10015c58
jmp 0x1000adb3
mov dword [ebp - 0x2a4], 0
jmp 0x1000ae59
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 3
jg 0x1000ae7c
mov byte [ebp - 0xe0], 0
movzx eax, byte [ebp - 0xe0]
test eax, eax
je 0x1000ae7a
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
jmp 0x1000ae4c
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1364]
call fcn.10015c58
jmp 0x1000ad12
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14dc]
call fcn.10015c58
mov dword [ebp - 0x34], 0
jmp 0x1000aeaf
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x1000b98b
mov dword [ebp - 0x478], 0x9d29
mov dword [ebp - 0x12a4], 0x887cf2e5
mov dword [ebp - 0x12ac], 0x9ed9ba07
mov dword [ebp - 0x328], 0x285faafe
mov dword [ebp - 0x12b4], 0
mov dword [ebp - 0x12bc], 0x97412df3
mov dword [ebp - 0xd5c], 1
mov dword [ebp - 0x12c4], 0x59cdc345
push 2
lea ecx, [ebp - 0x1374]
call fcn.10015bd6
mov dword [ebp - 4], 0xc
push 2
lea ecx, [ebp - 0x1020]
call fcn.10015bd6
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xbc], 0
jmp 0x1000af47
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1000af69
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x1374]
call fcn.10015c74
mov dword [eax], 0x2e7ccc89
jmp 0x1000af3a
mov dword [ebp - 0xbc], 0
jmp 0x1000af82
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1000afa4
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x1020]
call fcn.10015c74
mov dword [eax], 0xfffa
jmp 0x1000af75
cmp dword [ebp - 0x478], 0
jne 0x1000afbf
cmp dword [ebp - 0x478], 0
jne 0x1000afbf
and dword [ebp - 0x624], 0
jmp 0x1000afc9
mov dword [ebp - 0x624], 1
push 0
lea ecx, [ebp - 0x1020]
call fcn.10015c74
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x47c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x47c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0x624]
cmp ecx, dword [eax]
jle 0x1000b009
mov dword [ebp - 0x914], 1
jmp 0x1000b010
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x478]
cmp eax, dword [ebp - 0x914]
jge 0x1000b02a
mov dword [ebp - 0x62c], 1
jmp 0x1000b031
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0xd5c], eax
mov dword [ebp - 0x328], 0
jmp 0x1000b056
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 5
jne 0x1000b09d
mov dword [ebp - 0x12cc], 0xffffffff
mov dword [ebp - 0x12d4], 0xffffffff
mov dword [ebp - 0x12dc], 0x58d8
mov dword [ebp - 0x12e4], 0xfffffff8
mov dword [ebp - 0xd20], 0xfffffffd
mov dword [ebp - 0xd20], 0
jmp 0x1000b049
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1020]
call fcn.10015c58
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1374]
call fcn.10015c58
mov dword [ebp - 0x94c], 0
mov dword [ebp - 0xf7c], 0xfffffff7
mov dword [ebp - 0xf78], 0xfffffff7
mov dword [ebp - 0xf74], 0xfffffff7
mov dword [ebp - 0xf70], 0xfffffff7
lea ecx, [ebp - 0x451]
call fcn.10008c23
push eax
lea eax, [ebp - 0xf6c]
push eax
lea eax, [ebp - 0xf7c]
push eax
lea ecx, [ebp - 0x1558]
call fcn.10015c83
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x250]
call fcn.10015c32
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xd0], 0x81320f2d
mov dword [ebp - 0x63c], 0xfffffffc
mov dword [ebp - 0xa9c], 0xffffffff
mov dword [ebp - 0xd9c], 0
mov dword [ebp - 0x98], 0
jmp 0x1000b16a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1000b186
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xe10], 0xffff
jmp 0x1000b15d
mov dword [ebp - 0x98], 0
jmp 0x1000b19f
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x1000b1bb
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1530], 0x2499e68f
jmp 0x1000b192
push 1
lea ecx, [ebp - 0x250]
call fcn.10015c74
cmp dword [eax], 0
jne 0x1000b1e8
push 0
lea ecx, [ebp - 0x250]
call fcn.10015c74
cmp dword [eax], 0
jne 0x1000b1e8
and dword [ebp - 0x924], 0
jmp 0x1000b1f2
mov dword [ebp - 0x924], 1
mov eax, 0x6eea
test eax, eax
je 0x1000b2c0
push 0
lea ecx, [ebp - 0x250]
call fcn.10015c74
mov eax, 0xeec299e
cmp eax, 4
jne 0x1000b222
mov dword [ebp - 0xa8c], 1
jmp 0x1000b229
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x1000b24b
push 0
lea ecx, [ebp - 0x250]
call fcn.10015c74
mov esi, dword [ebp - 0xd0]
push 3
lea ecx, [ebp - 0x250]
call fcn.10015c74
cmp esi, dword [eax]
jl 0x1000b26e
mov dword [ebp - 0x634], 1
jmp 0x1000b275
and dword [ebp - 0x634], 0
push 0
lea ecx, [ebp - 0x250]
call fcn.10015c74
mov ecx, dword [ebp - 0x634]
cmp ecx, dword [eax]
jge 0x1000b298
mov dword [ebp - 0x91c], 1
jmp 0x1000b29f
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0
je 0x1000b2c0
mov dword [ebp - 0xbb0], 1
jmp 0x1000b2c7
and dword [ebp - 0xbb0], 0
push 0
lea ecx, [ebp - 0x250]
call fcn.10015c74
mov ecx, dword [ebp - 0xbb0]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1000b2f3
cmp dword [ebp - 0xd0], 0
jne 0x1000b2f3
and dword [ebp - 0x644], 0
jmp 0x1000b2fd
mov dword [ebp - 0x644], 1
push 1
lea ecx, [ebp - 0x250]
call fcn.10015c74
mov ecx, dword [ebp - 0x644]
cmp ecx, dword [eax]
jne 0x1000b320
mov dword [ebp - 0x64c], 1
jmp 0x1000b327
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x924]
cmp eax, dword [ebp - 0x64c]
jg 0x1000b341
mov dword [ebp - 0xa94], 1
jmp 0x1000b348
and dword [ebp - 0xa94], 0
cmp dword [ebp - 0xa94], 0xffff
jae 0x1000b360
mov dword [ebp - 0x654], 1
jmp 0x1000b367
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x654]
neg eax
cmp eax, 0x698d
jge 0x1000b382
mov dword [ebp - 0x92c], 1
jmp 0x1000b389
and dword [ebp - 0x92c], 0
cmp dword [ebp - 0x92c], 0x9ca4f06
jl 0x1000b3a1
mov dword [ebp - 0xc3c], 1
jmp 0x1000b3a8
and dword [ebp - 0xc3c], 0
push 0
lea ecx, [ebp - 0x250]
call fcn.10015c74
push 3
lea ecx, [ebp - 0x250]
call fcn.10015c74
push 0
lea ecx, [ebp - 0x250]
call fcn.10015c74
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0xe10]
mov dword [ebp - 0x65c], eax
push 0
lea ecx, [ebp - 0x250]
call fcn.10015c74
mov ecx, dword [ebp - 0x65c]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x65c]
mov ecx, dword [ecx]
mov dword [ebp + eax - 0x1530], ecx
mov dword [ebp - 0xd0], 0x12
jmp 0x1000b427
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x14
jl 0x1000b669
mov dword [ebp - 0xb4c], 0x98c5
mov dword [ebp - 0x1d8], 0xabee
mov dword [ebp - 0x66c], 0xffffffff
mov dword [ebp - 0x944], 0xffffffff
mov dword [ebp - 0xc4c], 2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe10]
mov dword [ebp - 0x12ec], eax
cmp dword [ebp - 0xb4c], 0xbab92a1d
jne 0x1000b491
mov dword [ebp - 0xe44], 1
jmp 0x1000b498
and dword [ebp - 0xe44], 0
mov eax, dword [ebp - 0xa9c]
mov ecx, 0xbae54fd5
sub ecx, 8
imul eax, ecx
cmp eax, dword [ebp - 0xb4c]
jge 0x1000b4bd
mov dword [ebp - 0x664], 1
jmp 0x1000b4c4
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
add eax, 0x796fb6c7
jne 0x1000b4ef
push 1
lea ecx, [ebp - 0x250]
call fcn.10015c74
cmp dword [eax], 0
jne 0x1000b4ef
mov dword [ebp - 0x934], 1
jmp 0x1000b4f6
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x1d8]
add eax, dword [ebp - 0x934]
sub eax, dword [ebp - 0x1d8]
imul eax, eax, 0x74b4
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x66c]
imul eax, dword [ebp - 0xa9c]
cmp eax, 0x1bd053a6
jle 0x1000b534
mov dword [ebp - 0x674], 1
jmp 0x1000b53b
and dword [ebp - 0x674], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe10]
cmp dword [ebp - 0x674], eax
jne 0x1000b55c
mov dword [ebp - 0x93c], 1
jmp 0x1000b563
and dword [ebp - 0x93c], 0
push 0
lea ecx, [ebp - 0x250]
call fcn.10015c74
mov ecx, dword [ebp - 0x93c]
cmp ecx, dword [eax]
jne 0x1000b586
mov dword [ebp - 0x67c], 1
jmp 0x1000b58d
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
neg eax
jne 0x1000b5aa
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x1000b5aa
mov dword [ebp - 0xbe0], 1
jmp 0x1000b5b1
and dword [ebp - 0xbe0], 0
push 0
lea ecx, [ebp - 0x250]
call fcn.10015c74
mov eax, dword [eax]
cmp eax, dword [ebp - 0xbe0]
jg 0x1000b5d4
mov dword [ebp - 0x684], 1
jmp 0x1000b5db
and dword [ebp - 0x684], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x684]
sub ecx, dword [ebp + eax - 0xe10]
mov dword [ebp - 0x944], ecx
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x944], eax
jle 0x1000b60d
mov dword [ebp - 0xc44], 1
jmp 0x1000b614
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x12f4], eax
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0x12fc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe10], 0
je 0x1000b651
cmp dword [ebp - 0x1d8], 0
je 0x1000b651
mov dword [ebp - 0x68c], 1
jmp 0x1000b658
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0xc4c], eax
jmp 0x1000b41a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.10015c58
mov dword [ebp - 0xb4], 0
jmp 0x1000b691
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1000b6ad
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x14e8], 0x5cb5542a
jmp 0x1000b684
mov dword [ebp - 0xb4], 0
jmp 0x1000b6c6
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1000b6e2
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0xee0], 0x68fc786c
jmp 0x1000b6b9
mov dword [ebp - 0x14], 0
jmp 0x1000b6f2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1000b986
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xee0]
mov dword [ebp - 0x1304], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4b0]
dec eax
je 0x1000b731
mov eax, 0xe12f
test eax, eax
je 0x1000b731
mov dword [ebp - 0xaa4], 1
jmp 0x1000b738
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4b0]
cmp dword [ebp - 0xaa4], eax
je 0x1000b75c
mov eax, 0x50b
test eax, eax
jne 0x1000b75c
and dword [ebp - 0x694], 0
jmp 0x1000b766
mov dword [ebp - 0x694], 1
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x94c], eax
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x69c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b0]
cmp dword [ebp - 0x69c], eax
jg 0x1000b7a9
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x4b0], 0
jne 0x1000b7a9
and dword [ebp - 0xb54], 0
jmp 0x1000b7b3
mov dword [ebp - 0xb54], 1
mov eax, dword [ebp - 0xe7c]
cmp dword [ebp - 0xb54], eax
jl 0x1000b7cd
mov dword [ebp - 0xc54], 1
jmp 0x1000b7d4
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x1450], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1458], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4b0]
mov dword [ebp - 0x1460], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4b0]
neg eax
mov ecx, dword [ebp - 0x14]
cmp eax, dword [ebp + ecx*4 - 0x4b0]
jge 0x1000b81d
mov dword [ebp - 0x6a4], 1
jmp 0x1000b824
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x6a4]
sub ecx, dword [ebp + eax*4 - 0x4b0]
cmp ecx, dword [ebp - 0x34]
jg 0x1000b845
mov dword [ebp - 0x954], 1
jmp 0x1000b84c
and dword [ebp - 0x954], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xee0]
cmp dword [ebp - 0x954], eax
jl 0x1000b86d
mov dword [ebp - 0x6ac], 1
jmp 0x1000b874
and dword [ebp - 0x6ac], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xee0]
cmp dword [ebp - 0x6ac], eax
jne 0x1000b894
mov dword [ebp - 0xaac], 1
jmp 0x1000b89b
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xaac], eax
jge 0x1000b8b2
mov dword [ebp - 0x6b4], 1
jmp 0x1000b8b9
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4b0]
cmp dword [ebp - 0x6b4], eax
jl 0x1000b8d7
mov dword [ebp - 0x95c], 1
jmp 0x1000b8de
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x95c], eax
je 0x1000b8f5
mov dword [ebp - 0x6bc], 1
jmp 0x1000b8fc
and dword [ebp - 0x6bc], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x14e8], 5
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4b0]
add eax, dword [ebp - 0x6bc]
cmp eax, 5
jg 0x1000b92e
mov dword [ebp - 0xbb8], 1
jmp 0x1000b935
and dword [ebp - 0xbb8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbb8]
mov dword [ebp + eax - 0xee0], ecx
mov dword [ebp - 0x230], 0
jmp 0x1000b961
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jg 0x1000b981
mov dword [ebp - 0xda4], 0x7629
cmp dword [ebp - 0xda4], 0
je 0x1000b97f
jmp 0x1000b981
jmp 0x1000b954
jmp 0x1000b6eb
jmp 0x1000aea8
mov dword [ebp - 0x408], 1
mov dword [ebp - 0x404], 1
mov dword [ebp - 0x400], 1
mov dword [ebp - 0x3fc], 1
mov dword [ebp - 0x31c], 0xffffffff
mov dword [ebp - 0x1e0], 7
mov dword [ebp - 0x218], 0xacc4b7c7
push 3
lea ecx, [ebp - 0xfd8]
call fcn.10015bd6
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x2ac], 0
jmp 0x1000b9fe
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jge 0x1000ba20
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0xfd8]
call fcn.10015c74
mov dword [eax], 0xfffffffa
jmp 0x1000b9f1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x408]
mov dword [ebp - 0x1468], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x408]
mov dword [ebp - 0x1470], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x408]
cmp dword [ebp + eax - 0x408], ecx
jg 0x1000ba6f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x408], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x408], 0
je 0x1000ba88
cmp dword [ebp - 0x31c], 0
jne 0x1000ba9a
cmp dword [ebp - 0x31c], 0
jne 0x1000ba9a
and dword [ebp - 0x6c4], 0
jmp 0x1000baa4
mov dword [ebp - 0x6c4], 1
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x218], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x408], 0x8b15
je 0x1000badb
mov dword [ebp - 0x964], 1
jmp 0x1000bae2
and dword [ebp - 0x964], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x408]
cmp dword [ebp - 0x964], eax
jge 0x1000bb03
mov dword [ebp - 0x6cc], 1
jmp 0x1000bb0a
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x31c]
cmp dword [ebp - 0x6cc], eax
jne 0x1000bb24
mov dword [ebp - 0xab4], 1
jmp 0x1000bb2b
and dword [ebp - 0xab4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xab4]
sub ecx, dword [ebp + eax - 0x408]
je 0x1000bd6b
mov dword [ebp - 0x108], 0x9843
mov dword [ebp - 0xc64], 0x20b2de47
cmp dword [ebp - 0x108], 0
jne 0x1000bc56
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x408], 0
je 0x1000bc42
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x1e0], eax
jl 0x1000bb9f
mov dword [ebp - 0xc5c], 1
jmp 0x1000bba6
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x1478], eax
mov eax, dword [ebp - 0x108]
imul eax, dword [ebp - 0x218]
test eax, eax
jge 0x1000bbd8
cmp dword [ebp - 0x31c], 0
je 0x1000bbd8
mov dword [ebp - 0x6d4], 1
jmp 0x1000bbdf
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x6d4], eax
jge 0x1000bbf9
mov dword [ebp - 0x96c], 1
jmp 0x1000bc00
and dword [ebp - 0x96c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x408]
cmp dword [ebp - 0x96c], eax
je 0x1000bc21
mov dword [ebp - 0x6dc], 1
jmp 0x1000bc28
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x6dc], eax
jge 0x1000bc42
mov dword [ebp - 0xb5c], 1
jmp 0x1000bc49
and dword [ebp - 0xb5c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x408]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x408]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x408]
cmp eax, 0xffff
jne 0x1000bc83
mov dword [ebp - 0x6e4], 1
jmp 0x1000bc8a
and dword [ebp - 0x6e4], 0
push 1
lea ecx, [ebp - 0xfd8]
call fcn.10015c74
mov ecx, dword [ebp - 0x6e4]
add ecx, dword [eax]
cmp ecx, 0xfffffffe
jg 0x1000bcb0
mov dword [ebp - 0xe54], 1
jmp 0x1000bcb7
and dword [ebp - 0xe54], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x14bc], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x14c4], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x1490], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x408], 0xfffffff6
jbe 0x1000bcf7
mov dword [ebp - 0x974], 1
jmp 0x1000bcfe
and dword [ebp - 0x974], 0
cmp dword [ebp - 0x974], 0xfffffff8
je 0x1000bd13
mov dword [ebp - 0x6ec], 1
jmp 0x1000bd1a
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x6ec], eax
jl 0x1000bd34
mov dword [ebp - 0xabc], 1
jmp 0x1000bd3b
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0xabc]
sub eax, 0x31219595
test eax, eax
jg 0x1000bd56
mov dword [ebp - 0x6f4], 1
jmp 0x1000bd5d
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0xc64], eax
jmp 0x1000bdbb
mov dword [ebp - 0x2b4], 0
jmp 0x1000bd84
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 2
jge 0x1000bda0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0xf30], 4
jmp 0x1000bd77
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf30]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf30], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfd8]
call fcn.10015c58
mov dword [ebp - 0xa0], 0xfffffffe
mov dword [ebp - 0x2bc], 0x4f84b811
cmp dword [ebp - 0xa0], 0
je 0x1000bf54
mov dword [ebp - 0x338], 0
jmp 0x1000be04
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 1
jge 0x1000be20
mov eax, dword [ebp - 0x338]
mov dword [ebp + eax*4 - 0x12e8], 0x374b1b05
jmp 0x1000bdf7
mov dword [ebp - 0xa0], 0
jmp 0x1000be39
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xffffffed
jne 0x1000be5b
mov dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x97c]
dec eax
mov dword [ebp - 0x97c], eax
jmp 0x1000be2c
mov dword [ebp - 0x2bc], 0
jmp 0x1000be74
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0x16
jl 0x1000bf4f
push 3
lea ecx, [ebp - 0x1008]
call fcn.10015bd6
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xdac], 0x870a
mov dword [ebp - 0x340], 0
jmp 0x1000beb8
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 3
jge 0x1000beda
push dword [ebp - 0x340]
lea ecx, [ebp - 0x1008]
call fcn.10015c74
mov dword [eax], 0xe21a
jmp 0x1000beab
mov dword [ebp - 0xa0], 0
jmp 0x1000bef3
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x1000bf26
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x1000bf24
push 0
push 0
push 0x2702
push 0xa04
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
jmp 0x1000bee6
push 1
lea ecx, [ebp - 0x1008]
call fcn.10015c74
mov eax, dword [eax]
mov dword [ebp - 0xdac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1008]
call fcn.10015c58
jmp 0x1000be67
jmp 0x1000c00e
mov dword [ebp - 0xc6c], 0xc9751580
push 3
lea ecx, [ebp - 0xfa8]
call fcn.10015bd6
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x2c4], 0
jmp 0x1000bf8b
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 3
jge 0x1000bfad
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0xfa8]
call fcn.10015c74
mov dword [eax], 0xe34edf6b
jmp 0x1000bf7e
mov byte [ebp - 0xe2], 0
movzx eax, byte [ebp - 0xe2]
test eax, eax
je 0x1000bfce
push 0
push 0x1519
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [ebp - 0xc6c], 0
je 0x1000bfe3
mov dword [ebp - 0x6fc], 1
jmp 0x1000bfea
and dword [ebp - 0x6fc], 0
push 2
lea ecx, [ebp - 0xfa8]
call fcn.10015c74
mov ecx, dword [ebp - 0x6fc]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfa8]
call fcn.10015c58
mov dword [ebp - 0x3f8], 1
mov dword [ebp - 0x3f4], 1
mov dword [ebp - 0x3f0], 1
mov dword [ebp - 0x3ec], 1
mov dword [ebp - 0x2cc], 0xffffffff
mov dword [ebp - 0x1e8], 7
mov dword [ebp - 0x240], 0xacc4b7c7
push 3
lea ecx, [ebp - 0xffc]
call fcn.10015bd6
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x348], 0
jmp 0x1000c081
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 3
jge 0x1000c0a3
push dword [ebp - 0x348]
lea ecx, [ebp - 0xffc]
call fcn.10015c74
mov dword [eax], 0xfffffffa
jmp 0x1000c074
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0x1248], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0x103c], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3f8]
cmp dword [ebp + eax - 0x3f8], ecx
jg 0x1000c0f2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3f8], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3f8], 0
je 0x1000c10b
cmp dword [ebp - 0x2cc], 0
jne 0x1000c11d
cmp dword [ebp - 0x2cc], 0
jne 0x1000c11d
and dword [ebp - 0xbf0], 0
jmp 0x1000c127
mov dword [ebp - 0xbf0], 1
mov eax, dword [ebp - 0xbf0]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x240], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3f8], 0x8b15
je 0x1000c15e
mov dword [ebp - 0x704], 1
jmp 0x1000c165
and dword [ebp - 0x704], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x704], eax
jge 0x1000c186
mov dword [ebp - 0x984], 1
jmp 0x1000c18d
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x984], eax
jne 0x1000c1a7
mov dword [ebp - 0x70c], 1
jmp 0x1000c1ae
and dword [ebp - 0x70c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x70c]
sub ecx, dword [ebp + eax - 0x3f8]
je 0x1000c3ee
mov dword [ebp - 0x110], 0x9843
mov dword [ebp - 0xdb4], 0x20b2de47
cmp dword [ebp - 0x110], 0
jne 0x1000c2d9
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x3f8], 0
je 0x1000c2c5
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x1e8], eax
jl 0x1000c222
mov dword [ebp - 0xe84], 1
jmp 0x1000c229
and dword [ebp - 0xe84], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x1444], eax
mov eax, dword [ebp - 0x110]
imul eax, dword [ebp - 0x240]
test eax, eax
jge 0x1000c25b
cmp dword [ebp - 0x2cc], 0
je 0x1000c25b
mov dword [ebp - 0xac4], 1
jmp 0x1000c262
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0xac4], eax
jge 0x1000c27c
mov dword [ebp - 0x714], 1
jmp 0x1000c283
and dword [ebp - 0x714], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x714], eax
je 0x1000c2a4
mov dword [ebp - 0x98c], 1
jmp 0x1000c2ab
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x98c], eax
jge 0x1000c2c5
mov dword [ebp - 0x71c], 1
jmp 0x1000c2cc
and dword [ebp - 0x71c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3f8]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x3f8]
cmp eax, 0xffff
jne 0x1000c306
mov dword [ebp - 0xb64], 1
jmp 0x1000c30d
and dword [ebp - 0xb64], 0
push 1
lea ecx, [ebp - 0xffc]
call fcn.10015c74
mov ecx, dword [ebp - 0xb64]
add ecx, dword [eax]
cmp ecx, 0xfffffffe
jg 0x1000c333
mov dword [ebp - 0xc74], 1
jmp 0x1000c33a
and dword [ebp - 0xc74], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x1044], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x1250], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x104c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3f8], 0xfffffff6
jbe 0x1000c37a
mov dword [ebp - 0x724], 1
jmp 0x1000c381
and dword [ebp - 0x724], 0
cmp dword [ebp - 0x724], 0xfffffff8
je 0x1000c396
mov dword [ebp - 0x994], 1
jmp 0x1000c39d
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x994], eax
jl 0x1000c3b7
mov dword [ebp - 0x72c], 1
jmp 0x1000c3be
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
sub eax, 0x31219595
test eax, eax
jg 0x1000c3d9
mov dword [ebp - 0xacc], 1
jmp 0x1000c3e0
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0xdb4], eax
jmp 0x1000c43e
mov dword [ebp - 0x350], 0
jmp 0x1000c407
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 2
jge 0x1000c423
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0xf38], 4
jmp 0x1000c3fa
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf38]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf38], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xffc]
call fcn.10015c58
mov dword [ebp - 0x3e8], 1
mov dword [ebp - 0x3e4], 1
mov dword [ebp - 0x3e0], 1
mov dword [ebp - 0x3dc], 1
mov dword [ebp - 0x358], 0xffffffff
mov dword [ebp - 0x1f0], 7
mov dword [ebp - 0x220], 0xacc4b7c7
push 3
lea ecx, [ebp - 0x1014]
call fcn.10015bd6
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x2d4], 0
jmp 0x1000c4c0
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 3
jge 0x1000c4e2
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x1014]
call fcn.10015c74
mov dword [eax], 0xfffffffa
jmp 0x1000c4b3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e8]
mov dword [ebp - 0x1378], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3e8]
mov dword [ebp - 0x1054], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3e8]
cmp dword [ebp + eax - 0x3e8], ecx
jg 0x1000c531
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e8], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e8], 0
je 0x1000c54a
cmp dword [ebp - 0x358], 0
jne 0x1000c55c
cmp dword [ebp - 0x358], 0
jne 0x1000c55c
and dword [ebp - 0x734], 0
jmp 0x1000c566
mov dword [ebp - 0x734], 1
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x220], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e8], 0x8b15
je 0x1000c59d
mov dword [ebp - 0x99c], 1
jmp 0x1000c5a4
and dword [ebp - 0x99c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e8]
cmp dword [ebp - 0x99c], eax
jge 0x1000c5c5
mov dword [ebp - 0x73c], 1
jmp 0x1000c5cc
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x73c], eax
jne 0x1000c5e6
mov dword [ebp - 0xbc0], 1
jmp 0x1000c5ed
and dword [ebp - 0xbc0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbc0]
sub ecx, dword [ebp + eax - 0x3e8]
je 0x1000c82d
mov dword [ebp - 0x118], 0x9843
mov dword [ebp - 0xc84], 0x20b2de47
cmp dword [ebp - 0x118], 0
jne 0x1000c718
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x3e8], 0
je 0x1000c704
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x1f0], eax
jl 0x1000c661
mov dword [ebp - 0xc7c], 1
jmp 0x1000c668
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x1258], eax
mov eax, dword [ebp - 0x118]
imul eax, dword [ebp - 0x220]
test eax, eax
jge 0x1000c69a
cmp dword [ebp - 0x358], 0
je 0x1000c69a
mov dword [ebp - 0x744], 1
jmp 0x1000c6a1
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x744], eax
jge 0x1000c6bb
mov dword [ebp - 0x9a4], 1
jmp 0x1000c6c2
and dword [ebp - 0x9a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e8]
cmp dword [ebp - 0x9a4], eax
je 0x1000c6e3
mov dword [ebp - 0x74c], 1
jmp 0x1000c6ea
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x74c], eax
jge 0x1000c704
mov dword [ebp - 0xad4], 1
jmp 0x1000c70b
and dword [ebp - 0xad4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3e8]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3e8]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x3e8]
cmp eax, 0xffff
jne 0x1000c745
mov dword [ebp - 0x754], 1
jmp 0x1000c74c
and dword [ebp - 0x754], 0
push 1
lea ecx, [ebp - 0x1014]
call fcn.10015c74
mov ecx, dword [ebp - 0x754]
add ecx, dword [eax]
cmp ecx, 0xfffffffe
jg 0x1000c772
mov dword [ebp - 0xe64], 1
jmp 0x1000c779
and dword [ebp - 0xe64], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x1474], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1064], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e8], 0xfffffff6
jbe 0x1000c7b9
mov dword [ebp - 0x9ac], 1
jmp 0x1000c7c0
and dword [ebp - 0x9ac], 0
cmp dword [ebp - 0x9ac], 0xfffffff8
je 0x1000c7d5
mov dword [ebp - 0x75c], 1
jmp 0x1000c7dc
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x75c], eax
jl 0x1000c7f6
mov dword [ebp - 0xb6c], 1
jmp 0x1000c7fd
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0xb6c]
sub eax, 0x31219595
test eax, eax
jg 0x1000c818
mov dword [ebp - 0x764], 1
jmp 0x1000c81f
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0xc84], eax
jmp 0x1000c87d
mov dword [ebp - 0x2dc], 0
jmp 0x1000c846
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x1000c862
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0xf40], 4
jmp 0x1000c839
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf40]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf40], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1014]
call fcn.10015c58
mov dword [ebp - 0xdbc], 0x283066c9
mov dword [ebp - 0x360], 0
jmp 0x1000c8af
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 3
jge 0x1000c8cb
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0xe20], 0
jmp 0x1000c8a2
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xe20], 0xfffffff7
jmp 0x1000c8f9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe20]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xe20], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe20], 0xfffffff5
jg 0x1000c988
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x1260], 0xb036
mov dword [ebp - 0x106c], 0
mov dword [ebp - 0x2e4], 7
jmp 0x1000c940
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x11
jle 0x1000c983
mov dword [ebp - 0x9b4], 0
mov byte [ebp - 0x17c], 0
movzx eax, byte [ebp - 0x17c]
test eax, eax
je 0x1000c974
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x9b4]
inc eax
mov dword [ebp - 0x9b4], eax
jmp 0x1000c933
jmp 0x1000c8de
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0xe20], 0xe9fb
mov dword [ebp - 0xdbc], eax
mov dword [ebp - 0x74], 0xfffffffe
mov dword [ebp - 0x2ec], 0x4f84b811
cmp dword [ebp - 0x74], 0
je 0x1000cb0b
mov dword [ebp - 0x368], 0
jmp 0x1000c9d3
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 1
jge 0x1000c9ef
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0x1388], 0x374b1b05
jmp 0x1000c9c6
mov dword [ebp - 0x74], 0
jmp 0x1000c9ff
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffed
jne 0x1000ca1e
mov dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x76c]
dec eax
mov dword [ebp - 0x76c], eax
jmp 0x1000c9f8
mov dword [ebp - 0x2ec], 0
jmp 0x1000ca37
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x16
jl 0x1000cb06
push 3
lea ecx, [ebp - 0x102c]
call fcn.10015bd6
mov dword [ebp - 4], 0x14
mov dword [ebp - 0xc8c], 0x870a
mov dword [ebp - 0x370], 0
jmp 0x1000ca7b
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 3
jge 0x1000ca9d
push dword [ebp - 0x370]
lea ecx, [ebp - 0x102c]
call fcn.10015c74
mov dword [eax], 0xe21a
jmp 0x1000ca6e
mov dword [ebp - 0x74], 0
jmp 0x1000caad
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x1000cadd
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x1000cadb
push 0
push 0
push 0x2702
push 0xa04
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
jmp 0x1000caa6
push 1
lea ecx, [ebp - 0x102c]
call fcn.10015c74
mov eax, dword [eax]
mov dword [ebp - 0xc8c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x102c]
call fcn.10015c58
jmp 0x1000ca2a
jmp 0x1000cbc5
mov dword [ebp - 0xe8c], 0xc9751580
push 3
lea ecx, [ebp - 0xff0]
call fcn.10015bd6
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x2f4], 0
jmp 0x1000cb42
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 3
jge 0x1000cb64
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0xff0]
call fcn.10015c74
mov dword [eax], 0xe34edf6b
jmp 0x1000cb35
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1000cb85
push 0
push 0x1519
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [ebp - 0xe8c], 0
je 0x1000cb9a
mov dword [ebp - 0xadc], 1
jmp 0x1000cba1
and dword [ebp - 0xadc], 0
push 2
lea ecx, [ebp - 0xff0]
call fcn.10015c74
mov ecx, dword [ebp - 0xadc]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xff0]
call fcn.10015c58
push 1
lea ecx, [ebp - 0xef8]
call fcn.10015bd6
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x390], 0x74dd032
mov dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0x388], 0x91c5534b
push 3
lea ecx, [ebp - 0x1384]
call fcn.10015bd6
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x464], 0x864b91bf
mov dword [ebp - 0xca4], 0xf8e1
mov dword [ebp - 0xa8], 0
jmp 0x1000cc3c
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x1000cc5e
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xef8]
call fcn.10015c74
mov dword [eax], 0xa5d6
jmp 0x1000cc2f
mov dword [ebp - 0xa8], 0
jmp 0x1000cc77
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1000cc99
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x1384]
call fcn.10015c74
mov dword [eax], 1
jmp 0x1000cc6a
mov dword [ebp - 0x44], 0
jmp 0x1000cca9
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1000cce5
mov eax, dword [ebp - 0x388]
dec eax
mov dword [ebp - 0x388], eax
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x1000cce3
push 0
push 0x2532
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1000cca2
mov dword [ebp - 0x120], 0
jmp 0x1000ccfe
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x1000d111
mov dword [ebp - 0x1f8], 2
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x380], 0xffffffff
push 1
lea ecx, [ebp - 0xe30]
call fcn.10015bd6
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x378], 0
jmp 0x1000cd5d
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 1
jge 0x1000cd7f
push dword [ebp - 0x378]
lea ecx, [ebp - 0xe30]
call fcn.10015c74
mov dword [eax], 5
jmp 0x1000cd50
mov dword [ebp - 0x44], 0
jmp 0x1000cd8f
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1000cf8c
mov dword [ebp - 0x2fc], 1
mov dword [ebp - 0xc9c], 0x2f8b
push dword [ebp - 0x120]
lea ecx, [ebp - 0xef8]
call fcn.10015c74
mov dword [eax], 0x9ee4
mov eax, 0x9ee4
cmp eax, 0x6b42
jne 0x1000cddc
mov dword [ebp - 0xbcc], 1
jmp 0x1000cde3
and dword [ebp - 0xbcc], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x390], eax
jl 0x1000cdfd
mov dword [ebp - 0x774], 1
jmp 0x1000ce04
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x2fc]
cmp eax, dword [ebp - 0x774]
jl 0x1000ce1e
mov dword [ebp - 0xc94], 1
jmp 0x1000ce25
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1074], eax
cmp dword [ebp - 0x388], 0x4fa72d50
jl 0x1000ce49
mov dword [ebp - 0x9bc], 1
jmp 0x1000ce50
and dword [ebp - 0x9bc], 0
imul eax, dword [ebp - 0x9bc], 0x6671
sub eax, dword [ebp - 0x2fc]
je 0x1000ce77
cmp dword [ebp - 0x1f8], 0
je 0x1000ce77
mov dword [ebp - 0x77c], 1
jmp 0x1000ce7e
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0xbcc]
add eax, 0x7c91
cmp eax, 0x6d7d0454
je 0x1000cea8
mov dword [ebp - 0x784], 1
jmp 0x1000ceaf
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x784], eax
jne 0x1000cec9
mov dword [ebp - 0xdc4], 1
jmp 0x1000ced0
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1268], eax
push 0
lea ecx, [ebp - 0xef8]
call fcn.10015c74
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x107c], eax
mov dword [ebp - 0x380], 4
cmp dword [ebp - 0x380], 0x39150040
jle 0x1000cf11
mov dword [ebp - 0x9c4], 1
jmp 0x1000cf18
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0xc9c], eax
cmp dword [ebp - 0x120], 0
cmp dword [ebp - 0x44], 0
jne 0x1000cf43
cmp dword [ebp - 0x390], 0
jne 0x1000cf43
and dword [ebp - 0x78c], 0
jmp 0x1000cf4d
mov dword [ebp - 0x78c], 1
mov eax, dword [ebp - 0x1f8]
imul eax, dword [ebp - 0x78c]
cmp eax, 1
jbe 0x1000cf6b
mov dword [ebp - 0xe74], 1
jmp 0x1000cf72
and dword [ebp - 0xe74], 0
mov esi, dword [ebp - 0x1f8]
push 0
lea ecx, [ebp - 0xe30]
call fcn.10015c74
mov dword [eax], esi
jmp 0x1000cd88
push 0
lea ecx, [ebp - 0xe30]
call fcn.10015c74
mov eax, dword [ebp - 0x464]
dec eax
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x390], eax
jge 0x1000cfcc
mov dword [ebp - 0xae4], 1
jmp 0x1000cfd3
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0x304], eax
jg 0x1000cfed
mov dword [ebp - 0x430], 1
jmp 0x1000cff4
and dword [ebp - 0x430], 0
push 0
lea ecx, [ebp - 0xe30]
call fcn.10015c74
mov ecx, dword [ebp - 0x430]
mov dword [eax], ecx
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0xca4]
sub eax, dword [ebp - 0x304]
je 0x1000d02f
mov dword [ebp - 0x794], 1
jmp 0x1000d036
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0xae4]
cmp eax, dword [ebp - 0x794]
jne 0x1000d050
mov dword [ebp - 0x9cc], 1
jmp 0x1000d057
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x30c]
add eax, dword [ebp - 0x388]
cmp eax, 1
jge 0x1000d080
mov dword [ebp - 0x79c], 1
jmp 0x1000d087
and dword [ebp - 0x79c], 0
cmp dword [ebp - 0x79c], 3
ja 0x1000d09c
mov dword [ebp - 0xb74], 1
jmp 0x1000d0a3
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x30c], eax
jg 0x1000d0c9
mov dword [ebp - 0x7a4], 1
jmp 0x1000d0d0
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x7a4], eax
jl 0x1000d0ea
mov dword [ebp - 0x9d4], 1
jmp 0x1000d0f1
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x9d4]
mov dword [ebp - 0x390], eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xe30]
call fcn.10015c58
jmp 0x1000ccf1
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1384]
call fcn.10015c58
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xef8]
call fcn.10015c58
mov dword [ebp - 0x78], 0xfffffffe
mov dword [ebp - 0x398], 0x4f84b811
cmp dword [ebp - 0x78], 0
je 0x1000d29b
mov dword [ebp - 0x314], 0
jmp 0x1000d163
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 1
jge 0x1000d17f
mov eax, dword [ebp - 0x314]
mov dword [ebp + eax*4 - 0x144c], 0x374b1b05
jmp 0x1000d156
mov dword [ebp - 0x78], 0
jmp 0x1000d18f
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xffffffed
jne 0x1000d1ae
mov dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
dec eax
mov dword [ebp - 0x7ac], eax
jmp 0x1000d188
mov dword [ebp - 0x398], 0
jmp 0x1000d1c7
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0x16
jl 0x1000d296
push 3
lea ecx, [ebp - 0xfc0]
call fcn.10015bd6
mov dword [ebp - 4], 0x19
mov dword [ebp - 0xdcc], 0x870a
mov dword [ebp - 0x260], 0
jmp 0x1000d20b
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x1000d22d
push dword [ebp - 0x260]
lea ecx, [ebp - 0xfc0]
call fcn.10015c74
mov dword [eax], 0xe21a
jmp 0x1000d1fe
mov dword [ebp - 0x78], 0
jmp 0x1000d23d
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x1000d26d
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x1000d26b
push 0
push 0
push 0x2702
push 0xa04
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
jmp 0x1000d236
push 1
lea ecx, [ebp - 0xfc0]
call fcn.10015c74
mov eax, dword [eax]
mov dword [ebp - 0xdcc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc0]
call fcn.10015c58
jmp 0x1000d1ba
jmp 0x1000d355
mov dword [ebp - 0xcac], 0xc9751580
push 3
lea ecx, [ebp - 0xf9c]
call fcn.10015bd6
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x3a0], 0
jmp 0x1000d2d2
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 3
jge 0x1000d2f4
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0xf9c]
call fcn.10015c74
mov dword [eax], 0xe34edf6b
jmp 0x1000d2c5
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x1000d315
push 0
push 0x1519
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [ebp - 0xcac], 0
je 0x1000d32a
mov dword [ebp - 0xaec], 1
jmp 0x1000d331
and dword [ebp - 0xaec], 0
push 2
lea ecx, [ebp - 0xf9c]
call fcn.10015c74
mov ecx, dword [ebp - 0xaec]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf9c]
call fcn.10015c58
mov dword [ebp - 0xe94], 0x283066c9
mov dword [ebp - 0x330], 0
jmp 0x1000d378
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 3
jge 0x1000d394
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0xe40], 0
jmp 0x1000d36b
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xe40], 0xfffffff7
jmp 0x1000d3c2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe40]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xe40], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe40], 0xfffffff5
jg 0x1000d451
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 0x1084], 0xb036
mov dword [ebp - 0x1270], 0
mov dword [ebp - 0x3ac], 7
jmp 0x1000d409
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0x11
jle 0x1000d44c
mov dword [ebp - 0x7b4], 0
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1000d43d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x7b4]
inc eax
mov dword [ebp - 0x7b4], eax
jmp 0x1000d3fc
jmp 0x1000d3a7
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0xe40], 0xe9fb
mov dword [ebp - 0xe94], eax
mov dword [ebp - 0x108c], 0xffff
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1000d48c
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1000d4ad
push 0x2b9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov dword [ebp - 0x5c], 0xcd453606
mov dword [ebp - 0x228], 0xac89
mov dword [ebp - 0x32c], 0
jmp 0x1000d4d7
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 3
jge 0x1000d4f3
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0xf10], 0xffffffff
jmp 0x1000d4ca
mov dword [ebp - 0x5c], 2
jmp 0x1000d503
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1000d7ba
mov dword [ebp - 0x4c], 0x11738ab6
mov dword [ebp - 0x4c], 0
jmp 0x1000d524
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x1000d557
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1000d546
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0xf10], 0
je 0x1000d555
jmp 0x1000d51d
jmp 0x1000d51d
mov dword [ebp - 0x4c], 2
jmp 0x1000d567
cmp dword [ebp - 0x4c], 0
jl 0x1000d7b5
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0xcb4], 0x1c3d
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1000d5ae
push 0x1de4
push 0x2053
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
jne 0x1000d685
cmp dword [ebp - 0x228], 0xffff
je 0x1000d5ce
mov dword [ebp - 0x9dc], 1
jmp 0x1000d5d5
and dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x9dc], 0xe4c7ba3f
jb 0x1000d5ed
mov dword [ebp - 0x7bc], 1
jmp 0x1000d5f4
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x7bc], eax
jne 0x1000d606
mov dword [ebp - 0x7cc], 1
cmp dword [ebp - 0x7cc], 0xa2e71cc5
jb 0x1000d6a7
mov dword [ebp - 0xaf4], 1
jmp 0x1000d6ae
and dword [ebp - 0xaf4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf10]
cmp dword [ebp - 0xaf4], eax
jl 0x1000d6ce
mov dword [ebp - 0x7d4], 1
jmp 0x1000d6d5
and dword [ebp - 0x7d4], 0
cmp dword [ebp - 0x7d4], 3
jbe 0x1000d6f0
jmp 0x1000d4fc
mov dword [ebp - 0x5c], 7
jmp 0x1000d7ca
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffffffe3
jl 0x1000d874
mov dword [ebp - 0x228], 2
jmp 0x1000d7ed
mov eax, dword [ebp - 0x228]
dec eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jl 0x1000d86f
mov dword [ebp - 0x384], 0x7228d029
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1000d825
push 0
push 0
push 0x662
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x384], 0
jmp 0x1000d83e
cmp dword [ebp - 0x384], 2
jg 0x1000d86a
mov byte [ebp - 0x17a], 0
movzx eax, byte [ebp - 0x17a]
test eax, eax
je 0x1000d868
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x1000d831
jmp 0x1000d7e0
jmp 0x1000d7c3
mov dword [ebp - 0xdd4], 0x283066c9
mov dword [ebp - 0x334], 0
jmp 0x1000d897
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 3
jge 0x1000d8b3
mov eax, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0xe50], 0
jmp 0x1000d88a
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xe50], 0xfffffff7
jmp 0x1000d8e1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe50], 0xfffffff5
jg 0x1000d970
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 0x1398], 0xb036
mov dword [ebp - 0x1094], 0
mov dword [ebp - 0x3c4], 7
jmp 0x1000d928
cmp dword [ebp - 0x3c4], 0x11
jle 0x1000d96b
mov dword [ebp - 0xafc], 0
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1000d95c
jmp 0x1000d8c6
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0xe50], 0xe9fb
mov dword [ebp - 0xdd4], eax
push 1
lea ecx, [ebp - 0xf28]
call fcn.10015bd6
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x354], 0x74dd032
mov dword [ebp - 0x128], 0xffffffff
mov dword [ebp - 0x34c], 0x91c5534b
push 3
lea ecx, [ebp - 0x1394]
call fcn.10015bd6
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x480], 0x864b91bf
mov dword [ebp - 0xccc], 0xf8e1
mov dword [ebp - 0x7c], 0
jmp 0x1000d9f5
cmp dword [ebp - 0x7c], 1
jge 0x1000da11
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xf28]
call fcn.10015c74
mov dword [eax], 0xa5d6
jmp 0x1000d9ee
mov dword [ebp - 0x7c], 0
jmp 0x1000da21