Function at 0x10009d7c
Capabilities:
Accept command line arguments
Compare security identifiers
Encode data using xor
Get common file path
Modify service
Query environment variable
Resume thread

Disassembly:
mov eax, 0x10070da8
call fcn.100704a8
sub esp, 0xfb4
push ebx
push esi
mov dword [ebp - 0x24], 1
push edi
mov dword [ebp - 0x68], ecx
lea ecx, [ebp - 0x8ec]
mov dword [ebp - 0x34], 0xcae7bf19
mov dword [ebp - 0x2c], 0x324ec2e0
mov dword [ebp - 0x3c], 0xcda2ae7b
push 2
mov byte [ebp - 0x61], dl
call fcn.1001a0d2
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
jmp 0x10009ddb
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8ec]
mov dword [eax + ecx*4], 0x6e71ebd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10009dc8
mov dword [ebp - 0x2c], ebx
jmp 0x10009efe
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], 0x8b9dbea5
mov dword [ebp - 0x54], 0xc4b6369d
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x4c7af5af
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
je 0x10009eb5
mov dword [ebp - 0x54], 7
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10009e34
push ebx
push 0x20f9
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 0x14], ebx
jmp 0x10009ead
mov dword [ebp - 0x18], 0x2589d389
mov eax, dword [ebp - 0x54]
inc eax
je 0x10009ea0
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x14]
sets cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 0xda2a
jle 0x10009e75
cmp dword [ebp - 0x18], ebx
jne 0x10009e75
mov eax, ebx
jmp 0x10009e78
xor eax, eax
inc eax
mov edx, dword [ebp - 0x20]
imul edx, eax
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
imul eax, ecx, 0x3240
cmp eax, dword [ebp - 0x14]
jne 0x10009ea0
xor ecx, ecx
inc ecx
jmp 0x10009ea2
mov ecx, ebx
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jle 0x10009e39
jmp 0x10009efb
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x54]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setle cl
sub ecx, 0x5d48
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x15
mov ecx, 0xffff
jle 0x10009de9
mov dword [ebp - 0x2c], 0xffffffee
jmp 0x10009f75
push 1
lea ecx, [ebp - 0x6e0]
call fcn.1001a0d2
xor edx, edx
mov dword [ebp - 0x5c], 0x62afeddd
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10009f45
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6e0]
mov dword [eax + ecx*4], 0xc22f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10009f32
mov dword [ebp - 0x3c], ebx
jmp 0x10009f5c
mov dword [ebp - 0x34], 0xfffffffa
inc dword [ebp - 0x34]
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x14
jge 0x10009f4f
lea ecx, [ebp - 0x6e0]
cmp dword [ebp - 0x3c], ebx
jne 0x10009f7d
call fcn.1001ad14
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe6
jl 0x10009f16
jmp 0x10009f82
call fcn.1001ad14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8ec]
call fcn.1001ad14
push 2
lea ecx, [ebp - 0x6f8]
call fcn.1001a0d2
xor edx, edx
mov edi, 0x10663d30
inc edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x34], 0xfe3d2f55
mov dword [ebp - 0x54], 0x1cbf
cmp dword [ebp - 0x54], 0xda5
jge 0x1000a15f
lea eax, [ebp - 0x324]
mov ecx, edi
push eax
call fcn.10019717
mov esi, dword [ebp - 0x324]
mov ecx, 0x1182c67c
push esi
call fcn.1001a178
mov edi, ebx
test esi, esi
jle 0x1000a001
mov eax, dword [0x1182c67c]
mov ecx, 0x10663d30
lea eax, [eax + edi*4]
push eax
call fcn.10019717
inc edi
cmp edi, esi
jl 0x10009fe9
mov ebx, dword [0x1182c67c]
xor eax, eax
inc eax
xorps xmm0, xmm0
movlpd qword [0x1111dee0], xmm0
mov ecx, eax
cmp esi, eax
jl 0x1000a04c
push 4
mov edi, ebx
pop ebx
mov eax, dword [edi]
cdq
add eax, dword [ecx*8 + 0x1111ded8]
adc edx, dword [ecx*8 + 0x1111dedc]
add edi, ebx
mov dword [ecx*8 + 0x1111dee0], eax
mov dword [ecx*8 + 0x1111dee4], edx
inc ecx
cmp ecx, esi
jle 0x1000a020
mov ebx, dword [0x1182c67c]
push dword [0x1182c680]
push ebx
call fcn.1001ea96
xor ebx, ebx
xorps xmm0, xmm0
pop ecx
inc ebx
movlpd qword [0x108b97d0], xmm0
pop ecx
mov ecx, ebx
cmp esi, ebx
jl 0x1000a09d
mov edi, dword [0x1182c67c]
mov eax, dword [edi]
cdq
add eax, dword [ecx*8 + 0x108b97c8]
push 4
adc edx, dword [ecx*8 + 0x108b97cc]
mov dword [ecx*8 + 0x108b97d0], eax
mov dword [ecx*8 + 0x108b97d4], edx
inc ecx
pop eax
add edi, eax
cmp ecx, esi
jle 0x1000a074
lea eax, [ebp - 0x1f0]
mov edi, 0x10663d30
push eax
mov ecx, edi
call fcn.10019717
mov esi, dword [ebp - 0x1f0]
jmp 0x1000a14b
lea eax, [ebp - 0x1d0]
dec esi
push eax
push ecx
lea eax, [ebp - 0x200]
push eax
push ecx
lea eax, [ebp - 0x32c]
mov ecx, edi
push eax
call fcn.10019717
pop ecx
mov ecx, eax
call fcn.10019717
pop ecx
mov ecx, eax
call fcn.10019717
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp - 0x200]
cmp dword [ebp - 0x32c], ebx
jne 0x1000a11c
mov edx, dword [eax*8 + 0x1111dee0]
sub edx, dword [ecx*8 + 0x1111ded8]
mov eax, dword [eax*8 + 0x1111dee4]
sbb eax, dword [ecx*8 + 0x1111dedc]
jmp 0x1000a138
mov edx, dword [eax*8 + 0x108b97d0]
sub edx, dword [ecx*8 + 0x108b97c8]
mov eax, dword [eax*8 + 0x108b97d4]
sbb eax, dword [ecx*8 + 0x108b97cc]
push eax
push edx
mov ecx, 0x10663c78
call fcn.10019e8d
push eax
call fcn.1001ea64
pop ecx
test esi, esi
jne 0x1000a0bb
dec esi
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x1f0], esi
inc edx
mov dword [ebp - 0x34], 0xffffffff
mov esi, 0x64939e63
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x20], ebx
jmp 0x1000a186
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6f8]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000a177
cmp dword [ebp - 0x24], ebx
jne 0x1000a194
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov edi, 0x6917900f
dec eax
neg eax
sbb eax, eax
inc eax
sub eax, edi
je 0x1000a1ab
cmp dword [ebp - 0x24], ebx
jne 0x1000a1b2
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x1000a1b4
mov eax, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x6f8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], 0xf6b903cf
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
xor edx, edx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x6f8]
setge dl
neg edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
or dword [ebp - 4], 0xffffffff
call fcn.1001ad14
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x710]
mov dword [ebp - 0x34], 0xcae7bf19
push 2
call fcn.1001a0d2
mov dword [ebp - 0x34], 0xfe3d2f55
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x20], ebx
jmp 0x1000a26e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x710]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000a25f
cmp dword [ebp - 0x24], ebx
jne 0x1000a27c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
inc eax
sub eax, edi
je 0x1000a28e
cmp dword [ebp - 0x24], ebx
jne 0x1000a297
cmp dword [ebp - 0x24], ebx
jne 0x1000a297
mov eax, ebx
jmp 0x1000a29a
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x710]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], 0xf6b903cf
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
xor edx, edx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x710]
setge dl
neg edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
call fcn.1001ad14
push 3
lea ecx, [ebp - 0x904]
call fcn.1001a0d2
mov dword [ebp - 0x14], ebx
jmp 0x1000a32e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x904]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000a31e
push 4
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x1000a34d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84c], 0x1e1e87df
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000a33c
mov dword [ebp - 0x84c], 2
cmp dword [ebp - 0x84c], ebx
jl 0x1000a382
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1000a37a
push 0x24cb
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
dec dword [ebp - 0x84c]
jns 0x1000a364
lea ecx, [ebp - 0x904]
call fcn.1001ad14
mov dword [ebp - 0x1c], 0xe1757117
mov dword [ebp - 0x54], 0x5231fbf6
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jle 0x1000a430
lea esi, [ebp - 0xac8]
lea edi, [ebp - 0xab8]
movdqa xmm0, xmmword [0x100081e0]
push ecx
push edi
push esi
lea ecx, [ebp - 0x8e0]
movdqu xmmword [ebp - 0xac8], xmm0
call fcn.1001a130
xor eax, eax
lea ecx, [ebp - 0x8e0]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x18], 0x96ee4e91
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8e0]
mov dword [eax + 8], ebx
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x4c]
call fcn.1001ad14
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jg 0x1000a3b3
push 4
pop esi
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0xfff6
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x5ca42045
mov dword [ebp - 0x54], 0x17b3
cmp dword [ebp - 0x54], 0x8f9
jge 0x1000a9e3
push 0x10664dc4
push 0x10664dcc
push 0x10007830
mov ebx, eax
call fcn.10058e8b
add esp, 0xc
cmp eax, 0xffffffff
je 0x1000a9e1
push ebx
push 0x10007838
call fcn.100597a7
push 0xc3508
push 0xffffffffffffffff
inc ebx
push 0x107f62c0
mov dword [ebp - 0x54], ebx
call fcn.10050ef6
mov ebx, dword [0x10664dcc]
xor eax, eax
inc eax
add esp, 0x14
mov ecx, eax
cmp ebx, eax
jl 0x1000a4eb
cmp ecx, eax
jne 0x1000a4bf
mov dword [0x107f62cc], 2
jmp 0x1000a4e6
cmp ecx, ebx
jne 0x1000a4cf
lea eax, [ebx - 1]
mov dword [ecx*8 + 0x107f62c0], eax
jmp 0x1000a4e3
lea eax, [ecx - 1]
mov dword [ecx*8 + 0x107f62c0], eax
lea eax, [ecx + 1]
mov dword [ecx*8 + 0x107f62c4], eax
xor eax, eax
inc eax
inc ecx
cmp ecx, ebx
jle 0x1000a4af
xor dl, dl
mov byte [ebp - 0x25], dl
jmp 0x1000a8de
dec eax
mov dword [0x10664dc4], eax
lea eax, [ebp - 0x148]
push eax
push 0x1000780c
call fcn.10058e8b
pop ecx
pop ecx
cmp dword [ebp - 0x148], esi
jne 0x1000a52b
cmp byte [ebp - 0x25], 0
mov ebx, dword [0x10664dcc]
sete dl
mov byte [ebp - 0x25], dl
jmp 0x1000a8de
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x1dc]
push eax
push 0x10007830
call fcn.10058e8b
mov ebx, dword [0x10664dcc]
add esp, 0xc
cmp ebx, 1
je 0x1000a8db
mov edi, dword [ebp - 0x148]
cmp edi, 3
jne 0x1000a66c
mov esi, dword [ebp - 0x1dc]
mov ecx, dword [ebp - 0x1f4]
lea edx, [esi*8 + 0x107f62c0]
mov eax, dword [edx]
cmp eax, 0xffffffff
je 0x1000a589
cmp eax, ecx
je 0x1000a589
mov dword [eax*8 + 0x107f62c4], ecx
mov eax, dword [esi*8 + 0x107f62c4]
cmp eax, 0xffffffff
je 0x1000a5a0
cmp eax, ecx
je 0x1000a5a0
mov dword [eax*8 + 0x107f62c0], ecx
lea edi, [ecx*8 + 0x107f62c0]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x1000a5b9
cmp eax, esi
je 0x1000a5b9
mov dword [eax*8 + 0x107f62c4], esi
mov eax, dword [ecx*8 + 0x107f62c4]
cmp eax, 0xffffffff
je 0x1000a5d0
cmp eax, esi
je 0x1000a5d0
mov dword [eax*8 + 0x107f62c0], esi
cmp dword [esi*8 + 0x107f62c4], ecx
jne 0x1000a5f9
mov eax, dword [ecx*8 + 0x107f62c4]
mov dword [esi*8 + 0x107f62c4], eax
mov eax, dword [edx]
mov dword [edi], eax
mov dword [edx], ecx
mov dword [ecx*8 + 0x107f62c4], esi
jmp 0x1000a8d8
cmp dword [edx], ecx
jne 0x1000a61d
mov eax, dword [edi]
mov dword [edx], eax
mov eax, dword [esi*8 + 0x107f62c4]
mov dword [ecx*8 + 0x107f62c4], eax
mov dword [esi*8 + 0x107f62c4], ecx
mov dword [edi], esi
jmp 0x1000a8d8
cmp edx, edi
je 0x1000a8d8
and dword [ebp - 0x34], 0
lea eax, [edx + 8]
mov esi, eax
xor ecx, ecx
sub esi, edx
add esi, 3
shr esi, 2
cmp edx, eax
cmova esi, ecx
test esi, esi
je 0x1000a8d8
sub edi, edx
mov eax, dword [edx + edi]
mov ecx, dword [edx]
mov dword [edx], eax
push 4
pop eax
mov dword [edx + edi], ecx
add edx, eax
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp eax, esi
jne 0x1000a647
mov ebx, dword [0x10664dcc]
jmp 0x1000a8d8
cmp byte [ebp - 0x25], 0
je 0x1000a67f
push 3
pop eax
sub eax, edi
mov edi, eax
mov dword [ebp - 0x148], edi
mov esi, dword [ebp - 0x1f4]
mov edx, dword [ebp - 0x1dc]
cmp edi, 2
jne 0x1000a7bc
mov eax, dword [esi*8 + 0x107f62c4]
cmp eax, edx
je 0x1000a8d8
cmp dword [esi*8 + 0x107f62c0], edx
jne 0x1000a73b
mov eax, dword [edx*8 + 0x107f62c0]
cmp eax, 0xffffffff
je 0x1000a6c7
cmp eax, esi
je 0x1000a6c7
mov dword [eax*8 + 0x107f62c4], esi
mov eax, dword [edx*8 + 0x107f62c4]
cmp eax, 0xffffffff
je 0x1000a6de
cmp eax, esi
je 0x1000a6de
mov dword [eax*8 + 0x107f62c0], esi
mov eax, dword [esi*8 + 0x107f62c0]
cmp eax, 0xffffffff
je 0x1000a6f5
cmp eax, edx
je 0x1000a6f5
mov dword [eax*8 + 0x107f62c4], edx
mov eax, dword [esi*8 + 0x107f62c4]
cmp eax, 0xffffffff
je 0x1000a70c
cmp eax, edx
je 0x1000a70c
mov dword [eax*8 + 0x107f62c0], edx
mov eax, dword [esi*8 + 0x107f62c4]
mov dword [edx*8 + 0x107f62c4], eax
mov eax, dword [edx*8 + 0x107f62c0]
mov dword [esi*8 + 0x107f62c0], eax
mov dword [edx*8 + 0x107f62c0], esi
mov dword [esi*8 + 0x107f62c4], edx
jmp 0x1000a8d8
cmp eax, 0xffffffff
je 0x1000a747
mov dword [eax*8 + 0x107f62c0], edx
mov eax, dword [edx*8 + 0x107f62c4]
cmp eax, 0xffffffff
je 0x1000a78c
mov ecx, dword [edx*8 + 0x107f62c0]
cmp ecx, 0xffffffff
je 0x1000a77d
mov dword [eax*8 + 0x107f62c0], ecx
mov ecx, dword [edx*8 + 0x107f62c0]
mov eax, dword [edx*8 + 0x107f62c4]
mov dword [ecx*8 + 0x107f62c4], eax
jmp 0x1000a7a0
cmp eax, 0xffffffff
je 0x1000a78c
or dword [eax*8 + 0x107f62c0], 0xffffffff
jmp 0x1000a7a0
mov eax, dword [edx*8 + 0x107f62c0]
cmp eax, 0xffffffff
je 0x1000a7a0
or dword [eax*8 + 0x107f62c4], 0xffffffff
mov eax, dword [esi*8 + 0x107f62c4]
mov dword [edx*8 + 0x107f62c4], eax
mov dword [edx*8 + 0x107f62c0], esi
mov dword [esi*8 + 0x107f62c4], edx
cmp edi, 1
jne 0x1000a8d8
mov eax, dword [esi*8 + 0x107f62c0]
cmp eax, edx
je 0x1000a8d8
cmp dword [esi*8 + 0x107f62c4], edx
jne 0x1000a857
mov eax, dword [edx*8 + 0x107f62c0]
cmp eax, 0xffffffff
je 0x1000a7f4
cmp eax, esi
je 0x1000a7f4
mov dword [eax*8 + 0x107f62c4], esi
mov eax, dword [edx*8 + 0x107f62c4]
cmp eax, 0xffffffff
je 0x1000a80b
cmp eax, esi
je 0x1000a80b
mov dword [eax*8 + 0x107f62c0], esi
mov eax, dword [esi*8 + 0x107f62c0]
cmp eax, 0xffffffff
je 0x1000a822
cmp eax, edx
je 0x1000a822
mov dword [eax*8 + 0x107f62c4], edx
mov eax, dword [esi*8 + 0x107f62c4]
cmp eax, 0xffffffff
je 0x1000a839
cmp eax, edx
je 0x1000a839
mov dword [eax*8 + 0x107f62c0], edx
mov eax, dword [esi*8 + 0x107f62c0]
mov dword [edx*8 + 0x107f62c0], eax
mov eax, dword [edx*8 + 0x107f62c4]
mov dword [esi*8 + 0x107f62c4], eax
jmp 0x1000a8ca
cmp eax, 0xffffffff
je 0x1000a863
mov dword [eax*8 + 0x107f62c4], edx
mov eax, dword [edx*8 + 0x107f62c0]
cmp eax, 0xffffffff
je 0x1000a8a8
mov ecx, dword [edx*8 + 0x107f62c4]
cmp ecx, 0xffffffff
je 0x1000a899
mov dword [eax*8 + 0x107f62c4], ecx
mov ecx, dword [edx*8 + 0x107f62c4]
mov eax, dword [edx*8 + 0x107f62c0]
mov dword [ecx*8 + 0x107f62c0], eax
jmp 0x1000a8bc
cmp eax, 0xffffffff
je 0x1000a8a8
or dword [eax*8 + 0x107f62c4], 0xffffffff
jmp 0x1000a8bc
mov eax, dword [edx*8 + 0x107f62c4]
cmp eax, 0xffffffff
je 0x1000a8bc
or dword [eax*8 + 0x107f62c0], 0xffffffff
mov eax, dword [esi*8 + 0x107f62c0]
mov dword [edx*8 + 0x107f62c0], eax
mov dword [edx*8 + 0x107f62c4], esi
mov dword [esi*8 + 0x107f62c0], edx
push 4
pop esi
mov dl, byte [ebp - 0x25]
mov eax, dword [0x10664dc4]
test eax, eax
jne 0x1000a4f5
dec eax
mov dword [0x10664dc4], eax
xor eax, eax
inc eax
cmp ebx, eax
jne 0x1000a908
push 0x10007844
call fcn.10059c06
pop ecx
jmp 0x1000a9bf
or ecx, 0xffffffff
cmp ebx, 1
jl 0x1000a923
cmp dword [eax*8 + 0x107f62c0], 0xffffffff
je 0x1000a921
inc eax
cmp eax, ebx
jle 0x1000a910
jmp 0x1000a923
mov ecx, eax
xorps xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
test bl, 1
je 0x1000a955
test ecx, ecx
jle 0x1000a9aa
mov esi, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x60]
mov eax, ecx
cdq
add edi, eax
mov eax, dword [ecx*8 + 0x107f62c4]
adc esi, edx
mov ecx, dword [eax*8 + 0x107f62c4]
test ecx, ecx
jg 0x1000a93a
jmp 0x1000a9b0
test dl, dl
jne 0x1000a97e
test ecx, ecx
jle 0x1000a9aa
mov esi, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x60]
mov eax, ecx
cdq
add edi, eax
mov eax, dword [ecx*8 + 0x107f62c4]
adc esi, edx
mov ecx, dword [eax*8 + 0x107f62c4]
test ecx, ecx
jg 0x1000a963
jmp 0x1000a9b0
mov ecx, dword [ecx*8 + 0x107f62c4]
test ecx, ecx
jle 0x1000a9aa
mov esi, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x60]
mov eax, ecx
cdq
add edi, eax
mov eax, dword [ecx*8 + 0x107f62c4]
adc esi, edx
mov ecx, dword [eax*8 + 0x107f62c4]
test ecx, ecx
jg 0x1000a98f
jmp 0x1000a9b0
mov esi, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x60]
push esi
push edi
push 0x10007848
call fcn.100597a7
add esp, 0xc
push 0x10664dc4
push 0x10664dcc
push 0x10007830
call fcn.10058e8b
mov ebx, dword [ebp - 0x54]
add esp, 0xc
push 4
pop esi
jmp 0x1000a474
xor ebx, ebx
mov dword [ebp - 0x54], 0xc8dd
mov dword [ebp - 0x4c], 0xae4f
push 8
mov dword [ebp - 0x30], 0xfffffffa
pop eax
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x20], 0x8f738f58
push 3
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x1000aa25
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x92c], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000aa14
push 2
mov dword [ebp - 0x14], ebx
pop edi
jmp 0x1000aa43
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4dc], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000aa32
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1000aa67
push 0xe89
push 0x1a8d
push 0xa2
push ebx
call dword [sym.imp.USER32.dll_GetMessageA]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jle 0x1000aa72
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x34]
add eax, 0x3d9
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
jne 0x1000aac7
mov eax, dword [ebp - 0x92c]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, 0xbe4
lea ecx, [ebp - 0x740]
setle dl
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0xcae7bf19
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x1c], 0x15898f01
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x20], 0x74952f34
push esi
call fcn.1001a0d2
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], ebx
jmp 0x1000ab3b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x740]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000ab2b
mov esi, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x17c]
neg esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sbb esi, esi
mov dword [ebp - 0x30], eax
xor edx, edx
mov eax, dword [ebp - 0x17c]
neg esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x17c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
imul eax, dword [ebp - 0x30]
neg edx
sub eax, edx
mov edx, 0xfffc
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x170]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
neg eax
cmp esi, eax
mov eax, dword [ebp - 0x178]
setg cl
add eax, ecx
mov ecx, dword [ebp - 0x17c]
imul ecx, eax
test ecx, ecx
je 0x1000acec
mov dword [ebp - 0x14], 9
xor ecx, ecx
mov dword [ebp - 0x18], 0x1cd1ac8c
inc ecx
mov dword [ebp - 0x54], 0xc844fc3
mov dword [ebp - 0x20], ebx
jmp 0x1000abed
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x33c], 5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000abdc
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x30]
cmp dword [ebp - 0x14], eax
jge 0x1000ac45
cmp dword [ebp - 0x14], ebx
je 0x1000ac42
mov eax, dword [ebp - 0x17c]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, edx
setne cl
lea eax, [ecx + 0x6e3268d]
mov dword [ebp - 0x33c], eax
imul eax, eax, 0xfffffffb
sub eax, dword [ebp - 0x17c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0x7cf16886
test eax, eax
jne 0x1000ac45
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x14], ebx
jmp 0x1000ace0
mov dword [ebp - 0x20], ebx
jmp 0x1000ac73
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa28], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000ac62
mov dword [ebp - 0x1c], 0xffffffe8
cmp dword [ebp - 0x1c], 0x16
jge 0x1000acd7
lea esi, [ebp - 0xb28]
lea edi, [ebp - 0xb18]
movdqa xmm0, xmmword [0x100081f0]
push ecx
push edi
push esi
lea ecx, [ebp - 0x728]
movdqu xmmword [ebp - 0xb28], xmm0
call fcn.1001a130
mov eax, dword [ebp - 0x728]
lea ecx, [ebp - 0x728]
cmp dword [eax], ebx
jne 0x1000accf
call fcn.1001ad14
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
jl 0x1000ac91
jmp 0x1000acd4
call fcn.1001ad14
push 2
pop edi
mov eax, dword [ebp - 0xa28]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff2
jle 0x1000ac5d
jmp 0x1000ad66
xor ecx, ecx
mov dword [ebp - 0x54], 0x44fa
mov dword [ebp - 0x20], ebx
inc ecx
jmp 0x1000ad08
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x204], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000acfb
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1000ad1d
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x740]
xor edx, edx
mov ecx, dword [eax]
lea eax, [ecx + 4]
cmp eax, ecx
mov ecx, dword [ebp - 0x204]
mov eax, dword [ebp - 0x54]
setge dl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x204]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setne dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x170]
xor ecx, ecx
dec eax
cmp eax, 0xfffffffa
setne cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x740]
or dword [ebp - 4], 0xffffffff
call fcn.1001ad14
push edi
lea ecx, [ebp - 0x7dc]
call fcn.1001a0d2
push 3
pop esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x34], 0xfe3d2f55
mov dword [ebp - 0x1c], 0xfffffff7
push esi
call fcn.1001a0d2
mov dword [ebp - 0x14], 0x9b4e
xor edx, edx
mov dword [ebp - 0x34], 0x415dbe4b
inc edx
mov dword [ebp - 0x18], 0xb11f
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jge 0x1000ade4
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2b0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x20]
jmp 0x1000adce
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x2b0]
mov dword [eax], ebx
mov eax, dword [ebp - 0x1c]
test eax, eax
setle cl
cmp ecx, 0xde0bcd8c
jae 0x1000ae37
mov dword [ebp - 0x14], ebx
jmp 0x1000ae2d
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1000ae2a
push 0x13b2
push 0x2514
push 0x63b
call dword [sym.imp.GDI32.dll_GetPixel]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1000ae0c
jmp 0x1000af98
mov dword [ebp - 0x34], 0x25a1b582
mov dword [ebp - 0x4c], 0xa0d0a060
mov dword [ebp - 0x54], 0xfffffff8
mov dword [ebp - 0x2c], ebx
jmp 0x1000ae62
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x144], 0x45c761b8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1000ae51
mov dword [ebp - 0x2c], ebx
jmp 0x1000ae7d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1e4], 0xf88197c5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1000ae6c
cmp dword [ebp - 0x14], ebx
je 0x1000af60
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x14]
sub eax, 0xa784
cmp eax, 0x386b
jg 0x1000aea6
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x13c]
sub eax, 0xdf936bb3
neg eax
sbb eax, eax
inc eax
cmp eax, edx
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x140]
cmp eax, edx
mov eax, dword [ebp - 0x140]
mov edx, dword [ebp - 0x2b0]
setg cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [edx + 4]
jl 0x1000af07
mov eax, dword [ebp - 0x2b0]
cmp dword [eax], ebx
jne 0x1000af07
mov eax, ebx
jmp 0x1000af0a
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x14]
setge cl
mov dword [edx + 4], 1
add eax, ecx
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x140]
jg 0x1000af60
mov eax, dword [ebp - 0x2b0]
cmp dword [eax], ebx
je 0x1000af60
xor eax, eax
inc eax
jmp 0x1000af62
mov eax, ebx
add eax, 0xfffffffa
cmp eax, dword [ebp - 0x1c]
je 0x1000af6f
dec dword [ebp - 0x18]
jmp 0x1000af98
mov dword [ebp - 0x5c], 0x6aefbdd5
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1000af92
push ebx
push ebx
push 0x1cab
push 0x75b
push ebx
call dword [sym.imp.USER32.dll_ModifyMenuW]
inc dword [ebp - 0x1e4]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1000afa8
push ebx
call dword [sym.imp.USER32.dll_SetKeyboardState]
lea ecx, [ebp - 0x2b0]
call fcn.1001ad14
xor eax, eax
mov dword [ebp - 0x34], 0xffffffff
inc eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x7c4]
push eax
call fcn.1001a0d2
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1000afeb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7c4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000afdb
push 4
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x1000b009
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc50], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000aff8
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
neg edx
push 4
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ebx, ebx
cmp edx, 0x71a0513
setl bl
xor ecx, ecx
cmp eax, ebx
pop eax
setl cl
cmp ecx, eax
jbe 0x1000b04f
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
sub edx, esi
cmp edx, eax
mov eax, dword [ebp - 0x38]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x7c4]
setle dl
xor ebx, ebx
mov dword [eax], edx
mov dword [ebp - 0xc50], edx
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x1000b09d
call dword [sym.imp.USER32.dll_CreateMenu]
lea ecx, [ebp - 0x7c4]
call fcn.1001ad14
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x20], ebx
jmp 0x1000b0c7
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7dc]
mov dword [eax + ecx*4], 0x64939e63
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000b0b4
cmp dword [ebp - 0x24], ebx
jne 0x1000b0d4
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
inc eax
sub eax, 0x6917900f
je 0x1000b0e9
cmp dword [ebp - 0x24], ebx
jne 0x1000b0f2
cmp dword [ebp - 0x24], ebx
jne 0x1000b0f2
mov eax, ebx
jmp 0x1000b0f5
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x7dc]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], 0xf6b903cf
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
xor edx, edx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x7dc]
setge dl
neg edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
or dword [ebp - 4], 0xffffffff
call fcn.1001ad14
mov dword [ebp - 0x20], 5
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x1000b181
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x20], 1
jmp 0x1000b1a1
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x1000b19e
push 0x824
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x18
jl 0x1000b18a
mov dword [ebp - 0x54], 0x231a
cmp dword [ebp - 0x54], 0x545
jge 0x1000b3d9
push 0x10664dc8
push 0x1000780c
call fcn.10058e8b
mov eax, dword [0x10664dc8]
mov edi, ebx
pop ecx
pop ecx
test eax, eax
jle 0x1000b20a
mov esi, 0x111e39b0
push esi
push 0x1000780c
call fcn.10058e8b
pop ecx
pop ecx
push esi
lea eax, [ebp - 0xc40]
mov ecx, 0x1182c674
push eax
call fcn.1001a1f8
push 4
pop eax
add esi, eax
inc edi
mov eax, dword [0x10664dc8]
cmp edi, eax
jl 0x1000b1dc
cmp eax, 1
jne 0x1000b21f
push 0x10007850
call fcn.10059c06
mov eax, dword [0x10664dc8]
pop ecx
lea edx, [eax*4 + 0x111e39b0]
mov ecx, 0x111e39b0
call fcn.1001eaba
cmp dword [0x10664dc8], 2
mov edi, 0x10007868
jne 0x1000b29c
mov ecx, dword [0x111e39b0]
mov esi, dword [0x111e39b4]
cmp ecx, esi
jne 0x1000b25d
push ecx
push 0x10007854
call fcn.100597a7
pop ecx
pop ecx
jmp 0x1000b29c
mov eax, esi
sub eax, ecx
dec eax
test al, 1
lea eax, [esi + esi]
je 0x1000b28a
sub eax, ecx
push eax
lea eax, [esi + ecx]
cdq
sub eax, edx
sar eax, 1
push eax
lea eax, [ecx + ecx]
sub eax, esi
push eax
push 0x1000785c
call fcn.100597a7
add esp, 0x10
jmp 0x1000b29c
sub eax, ecx
push eax
lea eax, [ecx + ecx]
sub eax, esi
push eax
push edi
call fcn.100597a7
add esp, 0xc
xor ecx, ecx
inc ecx
mov esi, ecx
cmp dword [0x10664dc8], ecx
jle 0x1000b2e5
mov eax, dword [esi*4 + 0x111e39b0]
sub eax, dword [esi*4 + 0x111e39ac]
mov dword [ebp - 0x34c], eax
movzx eax, byte [0x1182c732]
push eax
lea eax, [ebp - 0x34c]
push eax
push ecx
lea eax, [ebp - 0xc00]
push eax
call fcn.1001f24e
inc esi
cmp esi, dword [0x10664dc8]
jl 0x1000b2a9
xor ecx, ecx
inc ecx
mov eax, dword [0x1182c670]
cmp eax, ecx
jne 0x1000b33c
cmp dword [0x1182c678], ecx
jne 0x1000b30c
push dword [0x111e39b0]
push 0x10007854
call fcn.100597a7
pop ecx
jmp 0x1000b3d8
mov eax, dword [0x1182c66c]
mov ecx, dword [0x10664dc8]
mov eax, dword [eax]
mov ecx, dword [ecx*4 + 0x111e39ac]
add ecx, dword [eax + 0x10]
push ecx
mov ecx, dword [0x111e39b0]
sub ecx, dword [eax + 0x10]
push ecx
push edi
call fcn.100597a7
add esp, 0xc
jmp 0x1000b3d9
cmp eax, 2
jne 0x1000b3ce
mov eax, dword [0x1182c66c]
lea ecx, [ebp - 0x388]
mov eax, dword [eax]
mov esi, dword [eax + 0x10]
mov dword [ebp - 0x388], eax
call fcn.1001a38b
mov eax, dword [eax]
mov ebx, dword [eax + 0x10]
lea eax, [esi + esi]
cmp eax, ebx
jne 0x1000b3c2
mov edi, dword [0x10664dc8]
xor eax, eax
inc eax
xor edx, edx
mov ecx, eax
cmp edi, eax
jle 0x1000b3c2
mov esi, dword [ebp + 8]
mov eax, dword [ecx*4 + 0x111e39b0]
sub eax, dword [ecx*4 + 0x111e39ac]
cmp eax, ebx
jne 0x1000b395
inc edx
mov esi, ecx
inc ecx
cmp ecx, edi
jl 0x1000b380
cmp edx, 1
jne 0x1000b3c2
mov eax, dword [esi*4 + 0x111e39ac]
add eax, dword [esi*4 + 0x111e39b0]
cdq
sub eax, edx
sar eax, 1
push eax
push 0x10007854
call fcn.100597a7
pop ecx
xor ebx, ebx
jmp 0x1000b3d8
push 0x10007874
call fcn.10059c06
jmp 0x1000b3be
push 0x10007874
call fcn.10059c06
pop ecx
mov dword [ebp - 0x20], 5
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1000b3f0
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x20], 1
jmp 0x1000b411
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1000b40e
push 0x824
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x18
jl 0x1000b3f9
push 4
pop esi
push esi
lea ecx, [ebp - 0x80c]
call fcn.1001a0d2
mov dword [ebp - 4], esi
mov edi, 0xb79f6a71
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], ebx
jmp 0x1000b447
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x948], 0x4ec2e0cf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b436
mov dword [ebp - 0x14], ebx
jmp 0x1000b461
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x80c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b451
mov esi, dword [ebp - 0x80c]
xor ecx, ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [esi + 0xc], 3
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x20], ecx
jmp 0x1000b498
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb84], 0x3a92bd42
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1000b487
mov byte [ebp - 0x25], cl
cmp byte [ebp - 0x25], 0
je 0x1000b4ab
push ecx
push ecx
call ebx
mov eax, dword [esi + 0xc]
cmp dword [ebp + eax*4 - 0x948], 0xffffffff
je 0x1000b4ea
mov eax, dword [esi + 0xc]
mov ecx, 0x6d0374c7
mov eax, dword [ebp + eax*4 - 0x948]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x34], 1
mov edx, dword [ebp + eax*4 - 0x948]
mov eax, dword [ebp - 0x34]
sub ecx, eax
cmp ecx, edx
je 0x1000b4ea
xor ecx, ecx
xor edx, edx
mov eax, ecx
inc edx
jmp 0x1000b4f1
xor edx, edx
inc edx
xor ecx, ecx
mov eax, edx
dec dword [esi + 0xc]
mov dword [ebp - 0xb7c], eax
jns 0x1000b47b
mov dword [ebp - 0x1c], 0xfffffffa
jmp 0x1000b58c
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x7f4]
push edx
call fcn.1001a0d2
xor edx, edx
mov dword [ebp - 0x20], 0
inc edx
jmp 0x1000b53e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7f4]
mov dword [eax + ecx*4], 0xf087
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1000b52b
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, 2
setl dl
xor ecx, ecx
add edx, 0x3b16aac8
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7f4]
mov dword [eax], ecx
lea ecx, [ebp - 0x7f4]
call fcn.1001ad14
dec dword [ebp - 0x1c]
push 1
pop edx
cmp dword [ebp - 0x1c], 0xffffffe6
je 0x1000b50c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80c]
call fcn.1001ad14
push 4
pop esi
push esi
lea ecx, [ebp - 0x758]
call fcn.1001a0d2
mov dword [ebp - 4], 5
xor ecx, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], ecx
jmp 0x1000b5d6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x964], 0x4ec2e0cf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b5c5
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], esi
jge 0x1000b5fa
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x758]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b5e3
xor ecx, ecx
mov esi, dword [ebp - 0x758]
push 3
pop edi
mov dword [esi + 0xc], edi
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x20], ecx
jmp 0x1000b623
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xba8], 0x3a92bd42
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000b612
mov byte [ebp - 0x25], cl
cmp byte [ebp - 0x25], 0
je 0x1000b635
push ecx
push ecx
call ebx
mov eax, dword [esi + 0xc]
cmp dword [ebp + eax*4 - 0x964], 0xffffffff
je 0x1000b671
mov eax, dword [esi + 0xc]
mov ecx, 0x6d0374c7
mov eax, dword [ebp + eax*4 - 0x964]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x34], 1
mov edx, dword [ebp + eax*4 - 0x964]
mov eax, dword [ebp - 0x34]
sub ecx, eax
cmp ecx, edx
je 0x1000b671
xor ecx, ecx
mov eax, ecx
jmp 0x1000b676
xor eax, eax
inc eax
xor ecx, ecx
dec dword [esi + 0xc]
mov dword [ebp - 0xba0], eax
jns 0x1000b606
xor ebx, ebx
mov dword [ebp - 0x1c], 0xfffffffa
inc ebx
cmp dword [ebp - 0x1c], 0xffffffe6
jne 0x1000b710
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x584]
push ebx
call fcn.1001a0d2
mov dword [ebp - 0x20], 0
jmp 0x1000b6c0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x584]
mov dword [eax + ecx*4], 0xf087
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000b6ad
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, 2
setl dl
xor ecx, ecx
add edx, 0x3b16aac8
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x584]
mov dword [eax], ecx
lea ecx, [ebp - 0x584]
call fcn.1001ad14
dec dword [ebp - 0x1c]
jmp 0x1000b68b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x758]
call fcn.1001ad14
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x5c], 0x261f9c28
mov dword [ebp - 0x38], 0x87cf2e56
mov dword [ebp - 0x5c], 0xdc345fe4
mov dword [ebp - 0x1c], 0x87a5eafb
mov dword [ebp - 0x5c], 0x4c5530c4
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x54], 0x1771
cmp dword [ebp - 0x54], 0x551
jge 0x1000b929
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0xa8]
push eax
push 0x10007878
call fcn.10058e8b
mov eax, dword [ebp - 0x108]
xor edx, edx
mov ecx, dword [ebp - 0x104]
add esp, 0x18
sub eax, dword [ebp - 0x100]
mov edi, ebx
mov ebx, edx
sbb ecx, dword [ebp - 0xfc]
add eax, 1
adc ecx, edx
js 0x1000b7c4
jg 0x1000b7c0
cmp eax, 1
jb 0x1000b7c4
mov edi, eax
mov ebx, ecx
mov edx, dword [ebp - 0x1a0]
mov eax, edx
sub eax, dword [ebp - 0x188]
mov esi, dword [ebp - 0x19c]
mov ecx, esi
sbb ecx, dword [ebp - 0x184]
add eax, 1
adc ecx, 0
cmp ebx, ecx
jg 0x1000b7f4
jl 0x1000b7f0
cmp edi, eax
ja 0x1000b7f4
mov edi, eax
mov ebx, ecx
mov eax, dword [ebp - 0x108]
sub eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x104]
sbb ecx, dword [ebp - 0x184]
sub eax, dword [ebp - 0x100]
sbb ecx, dword [ebp - 0xfc]
add eax, edx
adc ecx, esi
add eax, 1
adc ecx, 0
cmp ebx, ecx
jg 0x1000b830
jl 0x1000b82c
cmp edi, eax
ja 0x1000b830
mov edi, eax
mov ebx, ecx
mov eax, dword [ebp - 0xa8]
mov ecx, eax
sub ecx, dword [ebp - 0x100]
mov edx, dword [ebp - 0xa4]
mov esi, edx
sbb esi, dword [ebp - 0xfc]
add ecx, dword [ebp - 0x108]
adc esi, dword [ebp - 0x104]
cmp edx, esi
jl 0x1000b866
jg 0x1000b862
cmp eax, ecx
jb 0x1000b866
mov eax, ecx
mov edx, esi
mov ecx, dword [ebp - 0xa8]
sub ecx, dword [ebp - 0x188]
mov esi, dword [ebp - 0xa4]
sbb esi, dword [ebp - 0x184]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp - 0x1a0]
add dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x30], esi
adc dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x30]
jl 0x1000b8ae
jg 0x1000b8a8
cmp eax, dword [ebp - 0x18]
jb 0x1000b8ae
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x100]
sbb esi, dword [ebp - 0xfc]
add ecx, dword [ebp - 0x108]
adc esi, dword [ebp - 0x104]
add ecx, dword [ebp - 0x1a0]
adc esi, dword [ebp - 0x19c]
cmp edx, esi
jl 0x1000b8e0
jg 0x1000b8dc
cmp edx, ebx
jl 0x1000b909
mov dword [ebp - 0x34], 0x9baaa4f6
xor ebx, ebx
push 4
mov dword [ebp - 0x54], 0x1bb39d90
mov dword [ebp - 0x20], ebx
pop esi
jmp 0x1000b952
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xad8], 0x29be1d92
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b941
inc dword [ebp - 0x34]
push 8
pop eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe2
jle 0x1000bbd1
mov esi, 0xd2
push 2
lea ecx, [ebp - 0x338]
call fcn.1001a0d2
push edi
lea ecx, [ebp - 0x59c]
mov dword [ebp - 4], 6
call fcn.1001a0d2
mov byte [ebp - 4], 7
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1000b9b2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x338]
mov dword [eax + ecx*4], 0x69b4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000b99f
mov dword [ebp - 0x14], ebx
jmp 0x1000b9d0
push 2
pop edi
mov dword [ebp - 0x2c], edi
xor edx, edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x3c], 0xef874ac
mov dword [ebp - 0x54], 9
mov dword [ebp - 0x34], 0xbd04657e
mov dword [ebp - 0x44], 3
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
test ecx, ecx
setg al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jne 0x1000bc33
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jne 0x1000beb3
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], 0xc63b
mov dword [ebp - 0x14], 0xfffffffc
jmp 0x1000be94
mov dword [ebp - 0x54], 0xfffffff6
cmp dword [ebp - 0x14], ebx
jne 0x1000bedb