Function at 0x10009389
Capabilities:
Get file size
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007faca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf78
push esi
push edi
mov dword [ebp - 0xe18], 0
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x100093d2
push 0xbce
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x100093fd
push 0
push 0x1565
push 0
push 0xa33
push 0x180b
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov dword [ebp - 0x7d0], 1
mov dword [ebp - 0xe98], 0xffffffff
mov dword [ebp - 0x60], 0
jmp 0x10009421
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x10009437
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xbc], 1
jmp 0x1000941a
mov dword [ebp - 0x60], 0
jmp 0x10009447
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1000945d
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xe08], 0x64a11600
jmp 0x10009440
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xbc], 0
jmp 0x1000948b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 0xffffffe3
jl 0x1000968c
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xd58], 1
mov dword [ebp - 0xdf4], 0x6a7f4ea1
mov dword [ebp - 0xd60], 1
mov dword [ebp - 0xe78], 0xffffffff
mov dword [ebp - 0xd68], 2
mov dword [ebp - 0xc8c], 0xcb6d64bd
mov dword [ebp - 0xc94], 0x37ae9f90
mov dword [ebp - 0xc9c], 0xfffffff9
mov dword [ebp - 0xca4], 3
mov dword [ebp - 0x800], 0x9a1d127a
mov dword [ebp - 0x258], 0
jmp 0x10009526
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jge 0x10009542
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xee0], 0x122d800f
jmp 0x10009519
mov dword [ebp - 0xc4], 0
jmp 0x1000955b
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xb
jne 0x1000967a
mov dword [ebp - 0x990], 0xf3d3
mov eax, dword [ebp - 0x990]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xbc]
je 0x100095f1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 1
je 0x100095a3
mov dword [ebp - 0x434], 1
jmp 0x100095aa
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x434], eax
jl 0x100095c4
mov dword [ebp - 0x7b8], 1
jmp 0x100095cb
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x7d0]
imul eax, dword [ebp - 0x7b8]
sub eax, dword [ebp - 0xc4]
add eax, 0xca27
je 0x100095f1
mov dword [ebp - 0x7c0], 1
jmp 0x100095f8
and dword [ebp - 0x7c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
cmp dword [ebp - 0x7c0], eax
jge 0x10009619
mov dword [ebp - 0x7c8], 1
jmp 0x10009620
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x7c8], eax
jle 0x1000963a
mov dword [ebp - 0x7f0], 1
jmp 0x10009641
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x7d0]
cmp eax, dword [ebp - 0x7f0]
jl 0x1000965b
mov dword [ebp - 0x7f8], 1
jmp 0x10009662
and dword [ebp - 0x7f8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7f8]
mov dword [ebp + eax - 0xe08], ecx
jmp 0x1000954e
mov eax, dword [ebp - 0x800]
inc eax
mov dword [ebp - 0x800], eax
jmp 0x10009470
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x100096a8
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0xcac], 0
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x11c], 0
jmp 0x100096e2
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x29
je 0x10009794
push 1
lea ecx, [ebp - 0xc10]
call fcn.10016382
and dword [ebp - 4], 0
mov dword [ebp - 0x184], 0xe31d8329
mov dword [ebp - 0x1d0], 0
jmp 0x10009723
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x10009745
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xc10]
call fcn.10016420
mov dword [eax], 0x94a2
jmp 0x10009716
mov dword [ebp - 0x184], 0
jmp 0x1000975e
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x10009780
push dword [ebp - 0x184]
lea ecx, [ebp - 0xc10]
call fcn.10016420
mov dword [eax], 0xfffd
jmp 0x10009751
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc10]
call fcn.10016404
jmp 0x100096d5
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x100097b3
push 0xbce
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov byte [ebp - 0xb2], 0
mov dword [ebp - 0x2a0], 6
mov byte [ebp - 0x114], 0
movzx eax, byte [ebp - 0x114]
test eax, eax
je 0x100097e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2a0], 0xfffffff6
jmp 0x100097f9
mov eax, dword [ebp - 0x2a0]
dec eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0xffffffea
jne 0x1000984a
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x10009822
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x10009848
push 0
push 0xa67
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x100097ec
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1000992c
mov dword [ebp - 0xe60], 0xe91a049f
mov dword [ebp - 0xe5c], 0xe91a049f
mov dword [ebp - 0xe58], 0xe91a049f
mov dword [ebp - 0xe54], 0xe91a049f
mov dword [ebp - 0x94], 0xffffffff
mov dword [ebp - 0x94], 0
jmp 0x100098a4
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jg 0x100098cb
mov byte [ebp - 0x116], 0
movzx eax, byte [ebp - 0x116]
test eax, eax
je 0x100098c9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10009897
mov dword [ebp - 0x94], 0
jmp 0x100098e4
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jg 0x10009913
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x10009911
push 0x1545
push 0x2085
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x100098d7
push 0
push 0x1565
push 0
push 0xa33
push 0x180b
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 3
lea ecx, [ebp - 0x840]
call fcn.10016382
mov dword [ebp - 4], 1
mov dword [ebp - 0x1e0], 0x7563ffa
mov dword [ebp - 0x88], 0
jmp 0x10009963
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1000997f
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xdf0], 1
jmp 0x10009956
mov dword [ebp - 0x88], 0
jmp 0x10009998
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x100099ba
push dword [ebp - 0x88]
lea ecx, [ebp - 0x840]
call fcn.10016420
mov dword [eax], 0xcd453606
jmp 0x1000998b
push 0
lea ecx, [ebp - 0x840]
call fcn.10016420
mov dword [eax], 2
jmp 0x100099f3
push 0
lea ecx, [ebp - 0x840]
call fcn.10016420
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x7b0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x7b0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x840]
call fcn.10016420
cmp dword [eax], 0
jl 0x10009bb6
push 2
lea ecx, [ebp - 0x888]
call fcn.10016382
mov byte [ebp - 4], 2
mov dword [ebp - 0x1d8], 0
jmp 0x10009a33
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 2
jge 0x10009a55
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x888]
call fcn.10016420
mov dword [eax], 0x1738ab65
jmp 0x10009a26
push 0
lea ecx, [ebp - 0x888]
call fcn.10016420
mov dword [eax], 2
jmp 0x10009a8e
push 0
lea ecx, [ebp - 0x888]
call fcn.10016420
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3b0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x888]
call fcn.10016420
cmp dword [eax], 0
jl 0x10009ba2
push 3
lea ecx, [ebp - 0x9a0]
call fcn.10016382
mov byte [ebp - 4], 3
mov dword [ebp - 0x260], 0
jmp 0x10009ace
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x10009af0
push dword [ebp - 0x260]
lea ecx, [ebp - 0x9a0]
call fcn.10016420
mov dword [eax], 0xfffffffa
jmp 0x10009ac1
push 2
lea ecx, [ebp - 0x9a0]
call fcn.10016420
mov dword [eax], 2
jmp 0x10009b29
push 2
lea ecx, [ebp - 0x9a0]
call fcn.10016420
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x618]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x618]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x9a0]
call fcn.10016420
cmp dword [eax], 0
jl 0x10009b8e
mov dword [ebp - 0x8e8], 0xffffffff
push 0
lea ecx, [ebp - 0x840]
call fcn.10016420
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xdf0]
mov dword [ebp - 0x3b8], eax
push 0
lea ecx, [ebp - 0x888]
call fcn.10016420
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3b8]
mov dword [ebp + eax*4 - 0xdf0], ecx
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x8e8], eax
jmp 0x10009b05
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9a0]
call fcn.10016404
jmp 0x10009a6a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x888]
call fcn.10016404
jmp 0x100099cf
mov dword [ebp - 0x1e0], 0
jmp 0x10009bcf
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0xffffffee
jg 0x10009c02
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10009c00
push 0
push 0
push 0x1a9d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x10009bc2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
call fcn.10016404
mov dword [ebp - 0x900], 0xffff
mov dword [ebp - 0x68], 0
jmp 0x10009c2b
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x10009c41
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x310], 0xfffffffb
jmp 0x10009c24
mov dword [ebp - 0x68], 0
jmp 0x10009c51
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x10009c64
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x50], 1
jmp 0x10009c4a
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x310], 0xe0648261
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x50], 1
jmp 0x10009c9a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x50], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
jl 0x10009e83
mov dword [ebp - 0x8f0], 9
mov dword [ebp - 0x8f8], 0xd1cb6a7f
mov eax, 0x7d8cf4c5
test eax, eax
je 0x10009d7f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov eax, dword [ebp + eax*4 - 0x310]
mov dword [ebp - 0x8f0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x310], 5
jbe 0x10009cff
mov dword [ebp - 0x6fc], 1
jmp 0x10009d06
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 0xf3cc
jl 0x10009d1e
mov dword [ebp - 0x3c0], 1
jmp 0x10009d25
and dword [ebp - 0x3c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp - 0x3c0], eax
jle 0x10009d43
mov dword [ebp - 0x5fc], 1
jmp 0x10009d4a
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov eax, dword [ebp + eax*4 - 0x310]
imul ecx, dword [ebp - 0x5fc], 0x664a
imul eax, ecx
test eax, eax
jne 0x10009d73
push 3
pop eax
test eax, eax
je 0x10009d7f
mov dword [ebp - 0x3c8], 1
jmp 0x10009d86
and dword [ebp - 0x3c8], 0
cmp dword [ebp - 0x3c8], 0xe623
je 0x10009d9e
mov dword [ebp - 0x804], 1
jmp 0x10009da5
and dword [ebp - 0x804], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov eax, dword [ebp + eax*4 - 0x310]
cmp dword [ebp - 0x804], eax
jg 0x10009dca
mov dword [ebp - 0x3d0], 1
jmp 0x10009dd1
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x8f8]
cmp dword [ebp - 0x3d0], eax
jl 0x10009deb
mov dword [ebp - 0x604], 1
jmp 0x10009df2
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x900]
cmp dword [ebp - 0x604], eax
jge 0x10009e0c
mov dword [ebp - 0x3d8], 1
jmp 0x10009e13
and dword [ebp - 0x3d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov eax, dword [ebp + eax*4 - 0x310]
cmp eax, dword [ebp - 0x3d8]
jge 0x10009e38
mov dword [ebp - 0x704], 1
jmp 0x10009e3f
and dword [ebp - 0x704], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov eax, dword [ebp + eax*4 - 0x310]
cmp dword [ebp - 0x704], eax
je 0x10009e64
mov dword [ebp - 0x3e0], 1
jmp 0x10009e6b
and dword [ebp - 0x3e0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp + eax - 0x310], ecx
jmp 0x10009c85
mov dword [ebp - 0xcb4], 0
mov dword [ebp - 0x2e0], 8
mov dword [ebp - 0x70], 0x18d5
mov dword [ebp - 0xcc], 0x7a329ef
mov dword [ebp - 0x910], 0x8fa48a2b
mov dword [ebp - 0x2e0], 0
jmp 0x10009ecb
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0x15
jg 0x1000a0ef
mov dword [ebp - 0x1e8], 0
jmp 0x10009ef1
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jge 0x10009f0d
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x398], 0xf33f23e9
jmp 0x10009ee4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xcc4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x70]
cmp dword [ebp + eax - 0x398], ecx
je 0x10009f4d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x398], 0
je 0x10009f4d
mov dword [ebp - 0x60c], 1
jmp 0x10009f54
and dword [ebp - 0x60c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x398]
cmp dword [ebp - 0x60c], eax
jg 0x10009f75
mov dword [ebp - 0x908], 1
jmp 0x10009f7c
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xccc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x398]
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xcdc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x70]
cmp dword [ebp + eax - 0x398], ecx
je 0x10009fc5
mov dword [ebp - 0x3e8], 1
jmp 0x10009fcc
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x3e8], eax
jge 0x10009fe6
mov dword [ebp - 0x784], 1
jmp 0x10009fed
and dword [ebp - 0x784], 0
cmp dword [ebp - 0x784], 1
jl 0x1000a002
mov dword [ebp - 0x3f0], 1
jmp 0x1000a009
and dword [ebp - 0x3f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x398]
cmp dword [ebp - 0x3f0], eax
je 0x1000a030
cmp dword [ebp - 0x70], 0
je 0x1000a030
mov dword [ebp - 0x614], 1
jmp 0x1000a037
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0xfb02
jl 0x1000a04f
mov dword [ebp - 0x3f8], 1
jmp 0x1000a056
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x910], eax
mov dword [ebp - 0xcc], 0
jmp 0x1000a07b
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jg 0x1000a0ea
mov dword [ebp - 0x70], 0
jmp 0x1000a094
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jg 0x1000a0bf
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x1000a0bd
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x1000a08d
mov byte [ebp - 0x118], 0
movzx eax, byte [ebp - 0x118]
test eax, eax
je 0x1000a0e8
push 0x1788
push 0xc1f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x1000a06e
jmp 0x10009ebe
mov dword [ebp - 0x24], 0x324ec2e0
mov dword [ebp - 0xb50], 0x1fe511bd
mov dword [ebp - 0xb4c], 0x1fe511bd
mov dword [ebp - 0xb48], 0x1fe511bd
mov dword [ebp - 0xb44], 0x1fe511bd
lea ecx, [ebp - 0x381]
call fcn.100091d3
push eax
lea eax, [ebp - 0xb40]
push eax
lea eax, [ebp - 0xb50]
push eax
lea ecx, [ebp - 0xee8]
call fcn.1001642f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9b0]
call fcn.100163de
mov dword [ebp - 4], 4
mov dword [ebp - 0x1f0], 0x4e2e0f61
mov dword [ebp - 0x24], 0xfffffffd
jmp 0x1000a174
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe7
jl 0x1000a53a
mov dword [ebp - 0x124], 0xcd329b3a
push 2
lea ecx, [ebp - 0x870]
call fcn.10016382
mov byte [ebp - 4], 5
mov dword [ebp - 0x15c], 5
mov dword [ebp - 0x268], 0
jmp 0x1000a1bc
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x1000a1de
push dword [ebp - 0x268]
lea ecx, [ebp - 0x870]
call fcn.10016420
mov dword [eax], 0xfffffffe
jmp 0x1000a1af
xor eax, eax
jne 0x1000a279
cmp dword [ebp - 0x124], 0
jae 0x1000a1fb
mov dword [ebp - 0x918], 1
jmp 0x1000a202
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xce4], eax
cmp dword [ebp - 0x24], 0
jne 0x1000a22c
cmp dword [ebp - 0x24], 0
jne 0x1000a22c
cmp dword [ebp - 0x124], 0
jne 0x1000a22c
and dword [ebp - 0x920], 0
jmp 0x1000a236
mov dword [ebp - 0x920], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xcec], eax
mov eax, dword [ebp - 0x24]
add eax, 0xe075
cmp eax, 0x70e81de9
je 0x1000a25d
cmp dword [ebp - 0x24], 0
jne 0x1000a25d
and dword [ebp - 0x928], 0
jmp 0x1000a267
mov dword [ebp - 0x928], 1
mov eax, 0x21b0
test eax, eax
jne 0x1000a279
and dword [ebp - 0x70c], 0
jmp 0x1000a283
mov dword [ebp - 0x70c], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x70c], eax
jle 0x1000a29a
mov dword [ebp - 0x368], 1
jmp 0x1000a2a1
and dword [ebp - 0x368], 0
push 1
lea ecx, [ebp - 0x870]
call fcn.10016420
mov ecx, dword [ebp - 0x368]
mov dword [eax], ecx
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x124]
jl 0x1000a2e5
cmp dword [ebp - 0x24], 0
je 0x1000a2e5
mov dword [ebp - 0x400], 1
jmp 0x1000a2ec
and dword [ebp - 0x400], 0
cmp dword [ebp - 0x400], 0x2589
jl 0x1000a304
mov dword [ebp - 0x61c], 1
jmp 0x1000a30b
and dword [ebp - 0x61c], 0
push 2
lea ecx, [ebp - 0x9b0]
call fcn.10016420
mov ecx, dword [ebp - 0x61c]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x9b0]
call fcn.10016420
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xcf4], eax
xor eax, eax
jne 0x1000a34c
cmp dword [ebp - 0x124], 0
jne 0x1000a34c
and dword [ebp - 0x408], 0
jmp 0x1000a356
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x408], eax
jl 0x1000a36d
mov dword [ebp - 0x7c4], 1
jmp 0x1000a374
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
je 0x1000a3fa
mov dword [ebp - 0x624], 0xffffffff
mov dword [ebp - 0x418], 0x4db9bec7
mov dword [ebp - 0x930], 0xdbd3d38e
mov dword [ebp - 0x1f0], 0xafbcae26
mov eax, dword [ebp - 0x1f0]
neg eax
cmp dword [ebp - 0x24], eax
jl 0x1000a3ca
mov dword [ebp - 0x410], 1
jmp 0x1000a3d1
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x930], eax
jmp 0x1000a526
mov dword [ebp - 0x19c], 0xb25bb54a
mov dword [ebp - 0x940], 0xaef1792f
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xcfc], eax
push 1
lea ecx, [ebp - 0x870]
call fcn.10016420
mov esi, dword [ebp - 0x15c]
push 1
lea ecx, [ebp - 0x870]
call fcn.10016420
cmp esi, dword [eax]
jne 0x1000a44a
mov dword [ebp - 0x714], 1
jmp 0x1000a451
and dword [ebp - 0x714], 0
push 2
lea ecx, [ebp - 0x9b0]
call fcn.10016420
mov ecx, dword [ebp - 0x714]
imul ecx, dword [eax]
sub ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x19c], ecx
jne 0x1000a47e
cmp dword [ebp - 0x19c], 0
je 0x1000a487
cmp dword [ebp - 0x19c], 0
jne 0x1000a499
cmp dword [ebp - 0x19c], 0
jne 0x1000a499
and dword [ebp - 0x938], 0
jmp 0x1000a4a3
mov dword [ebp - 0x938], 1
push 2
lea ecx, [ebp - 0x9b0]
call fcn.10016420
push 1
lea ecx, [ebp - 0x870]
call fcn.10016420
imul eax, dword [eax], 0xfffffffb
cmp eax, 0xffff
jb 0x1000a4d3
mov dword [ebp - 0x420], 1
jmp 0x1000a4da
and dword [ebp - 0x420], 0
cmp dword [ebp - 0x420], 0x15e
jl 0x1000a4f2
mov dword [ebp - 0x62c], 1
jmp 0x1000a4f9
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x62c], eax
jg 0x1000a513
mov dword [ebp - 0x428], 1
jmp 0x1000a51a
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x940], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x870]
call fcn.10016404
jmp 0x1000a16d
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1000a556
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b0]
call fcn.10016404
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x1000a650
mov dword [ebp - 0x1f8], 0x25b9b55b
mov dword [ebp - 0x948], 8
mov dword [ebp - 0x2a8], 0
jmp 0x1000a5a8
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 4
jge 0x1000a5c4
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0xf84], 0x8935
jmp 0x1000a59b
mov dword [ebp - 0x1f8], 0xffffffe4
jmp 0x1000a5dd
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0xffffffee
jge 0x1000a643
mov dword [ebp - 0x270], 0x417be18
mov dword [ebp - 0x270], 0
jmp 0x1000a609
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jg 0x1000a637
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1000a635
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x1000a5fc
mov dword [ebp - 0x948], 1
jmp 0x1000a5d0
push 0xbce
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov dword [ebp - 0xd4], 0x5464b5f5
mov dword [ebp - 0x380], 0xfffffff7
cmp dword [ebp - 0xd4], 0
je 0x1000a692
mov dword [ebp - 0x950], 1
mov dword [ebp - 0x958], 0xa2c7c8a6
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x958], eax
jmp 0x1000a92d
mov dword [ebp - 0x338], 0xffb91e60
mov dword [ebp - 0x78c], 0x9d8d9242
mov dword [ebp - 0x144], 0x1b16eb2d
mov dword [ebp - 0x634], 0xa0148014
mov dword [ebp - 0x438], 0xbe6286c8
mov dword [ebp - 0x968], 0xfffffffe
mov dword [ebp - 0x7ec], 2
mov dword [ebp - 0x200], 0
jmp 0x1000a6f1
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 4
jge 0x1000a70d
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0xf40], 0xac92d14b
jmp 0x1000a6e4
mov dword [ebp - 0xd4], 0
jmp 0x1000a726
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x19
jl 0x1000a8e5
mov dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x78c], eax
jl 0x1000a76f
mov dword [ebp - 0x430], 1
jmp 0x1000a776
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x634]
add eax, 0x4307
cmp eax, dword [ebp - 0x2c8]
jge 0x1000a7a1
mov dword [ebp - 0x960], 1
jmp 0x1000a7a8
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x2c8]
neg eax
cmp eax, dword [ebp - 0x438]
jle 0x1000a7d0
mov dword [ebp - 0x71c], 1
jmp 0x1000a7d7
and dword [ebp - 0x71c], 0
cmp dword [ebp - 0x71c], 1
jae 0x1000a7ec
mov dword [ebp - 0x440], 1
jmp 0x1000a7f3
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0xd4]
sub eax, dword [ebp - 0x440]
cmp eax, dword [ebp - 0x968]
jg 0x1000a813
mov dword [ebp - 0x970], 1
jmp 0x1000a81a
and dword [ebp - 0x970], 0
mov eax, 0xf8c5
cmp eax, 0x3279
jge 0x1000a832
mov dword [ebp - 0x63c], 1
jmp 0x1000a839
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x63c], eax
jle 0x1000a853
mov dword [ebp - 0x448], 1
jmp 0x1000a85a
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x7ec]
imul eax, dword [ebp - 0x380]
test eax, eax
jne 0x1000a88f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xf40], 0
jne 0x1000a88f
and dword [ebp - 0x450], 0
jmp 0x1000a899
mov dword [ebp - 0x450], 1
cmp dword [ebp - 0x450], 0x634
jne 0x1000a8b1
mov dword [ebp - 0x644], 1
jmp 0x1000a8b8
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x2c8]
add ecx, dword [ebp - 0x644]
sub eax, ecx
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x2c8], 0
je 0x1000a8e0
jmp 0x1000a719
jmp 0x1000a719
mov dword [ebp - 0x144], 0
jmp 0x1000a8fe
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffe3
jle 0x1000a92d
mov byte [ebp - 0x117], 0
movzx eax, byte [ebp - 0x117]
test eax, eax
je 0x1000a92b
push 0x9df
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x1000a8f1
mov byte [ebp - 0x99], 0
mov dword [ebp - 0xb28], 0xfe0a8eac
mov dword [ebp - 0xb24], 0xfe0a8eac
mov dword [ebp - 0xb20], 0xfe0a8eac
mov dword [ebp - 0xb1c], 0xfe0a8eac
lea ecx, [ebp - 0x325]
call fcn.100091d3
push eax
lea eax, [ebp - 0xb18]
push eax
lea eax, [ebp - 0xb28]
push eax
lea ecx, [ebp - 0xef8]
call fcn.1001642f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x858]
call fcn.100163de
mov dword [ebp - 4], 6
mov dword [ebp - 0x208], 0xffffffff
push 0
lea ecx, [ebp - 0x858]
call fcn.10016420
mov dword [eax], 0xffffffea
jmp 0x1000a9db
push 0
lea ecx, [ebp - 0x858]
call fcn.10016420
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x458]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x858]
call fcn.10016420
cmp dword [eax], 0xfffffff5
jg 0x1000aa0c
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1000aa0a
push 0x1d6c
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x1000a9b7
mov dword [ebp - 0x208], 3
jmp 0x1000aa25
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jl 0x1000ac0b
mov dword [ebp - 0x14c], 0xef6b8f3d
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x1000aa6c
push 0x266c
push 0x2505
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov dword [ebp - 0x14c], 3
jmp 0x1000aa85
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jl 0x1000ac06
mov dword [ebp - 0x278], 0xd29729c
mov dword [ebp - 0x278], 0
jmp 0x1000aab5
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jg 0x1000abc6
push 4
lea ecx, [ebp - 0x810]
call fcn.10016382
mov byte [ebp - 4], 7
mov dword [ebp - 0x210], 0
jmp 0x1000aaec
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 4
jge 0x1000ab0e
push dword [ebp - 0x210]
lea ecx, [ebp - 0x810]
call fcn.10016420
mov dword [eax], 0x7597a61e
jmp 0x1000aadf
push 3
lea ecx, [ebp - 0x810]
call fcn.10016420
mov dword [eax], 3
jmp 0x1000ab47
push 3
lea ecx, [ebp - 0x810]
call fcn.10016420
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x724]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x724]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x810]
call fcn.10016420
cmp dword [eax], 0
jl 0x1000ab95
push 3
lea ecx, [ebp - 0x810]
call fcn.10016420
push dword [eax]
lea ecx, [ebp - 0x858]
call fcn.10016420
mov esi, eax
push 3
lea ecx, [ebp - 0x810]
call fcn.10016420
push dword [eax]
lea ecx, [ebp - 0x858]
call fcn.10016420
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000ab23
cmp dword [ebp - 0x14c], 0
je 0x1000abb2
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x810]
call fcn.10016404
jmp 0x1000aaa8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x810]
call fcn.10016404
jmp 0x1000aaa8
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x1000ac01
push 0x1684
push 0
push 0
push 0x5f9
push 0xc09
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
jmp 0x1000aa78
jmp 0x1000aa18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x858]
call fcn.10016404
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1000ac3e
push 0
push 0x1565
push 0
push 0xa33
push 0x180b
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 1
lea ecx, [ebp - 0xba4]
call fcn.10016382
mov dword [ebp - 4], 8
mov dword [ebp - 0x2b0], 0
jmp 0x1000ac6b
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 1
jge 0x1000ac8a
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0xba4]
call fcn.10016420
and dword [eax], 0
jmp 0x1000ac5e
push 0
lea ecx, [ebp - 0xba4]
call fcn.10016420
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x460]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x460]
mov dword [ecx], eax
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x1000acdb
push 0
push 0
push 0x1604
push 0x227d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba4]
call fcn.10016404
push 1
lea ecx, [ebp - 0xbb0]
call fcn.10016382
mov dword [ebp - 4], 9
mov dword [ebp - 0x218], 0
jmp 0x1000ad17
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 1
jge 0x1000ad36
push dword [ebp - 0x218]
lea ecx, [ebp - 0xbb0]
call fcn.10016420
and dword [eax], 0
jmp 0x1000ad0a
push 0
lea ecx, [ebp - 0xbb0]
call fcn.10016420
mov dword [ebp - 0x64c], eax
mov eax, dword [ebp - 0x64c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x64c]
mov dword [ecx], eax
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1000ad87
push 0
push 0
push 0x1604
push 0x227d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbb0]
call fcn.10016404
mov dword [ebp - 0x28], 0x324ec2e0
mov dword [ebp - 0xb78], 0x1fe511bd
mov dword [ebp - 0xb74], 0x1fe511bd
mov dword [ebp - 0xb70], 0x1fe511bd
mov dword [ebp - 0xb6c], 0x1fe511bd
lea ecx, [ebp - 0x37a]
call fcn.100091d3
push eax
lea eax, [ebp - 0xb68]
push eax
lea eax, [ebp - 0xb78]
push eax
lea ecx, [ebp - 0xf10]
call fcn.1001642f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9c0]
call fcn.100163de
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x220], 0x4e2e0f61
mov dword [ebp - 0x28], 0xfffffffd
jmp 0x1000ae1b
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe7
jl 0x1000b1e1
mov dword [ebp - 0x12c], 0xcd329b3a
push 2
lea ecx, [ebp - 0x828]
call fcn.10016382
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x164], 5
mov dword [ebp - 0x280], 0
jmp 0x1000ae63
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 2
jge 0x1000ae85
push dword [ebp - 0x280]
lea ecx, [ebp - 0x828]
call fcn.10016420
mov dword [eax], 0xfffffffe
jmp 0x1000ae56
xor eax, eax
jne 0x1000af20
cmp dword [ebp - 0x12c], 0
jae 0x1000aea2
mov dword [ebp - 0x978], 1
jmp 0x1000aea9
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xd04], eax
cmp dword [ebp - 0x28], 0
jne 0x1000aed3
cmp dword [ebp - 0x28], 0
jne 0x1000aed3
cmp dword [ebp - 0x12c], 0
jne 0x1000aed3
and dword [ebp - 0x980], 0
jmp 0x1000aedd
mov dword [ebp - 0x980], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xd0c], eax
mov eax, dword [ebp - 0x28]
add eax, 0xe075
cmp eax, 0x70e81de9
je 0x1000af04
cmp dword [ebp - 0x28], 0
jne 0x1000af04
and dword [ebp - 0x988], 0
jmp 0x1000af0e
mov dword [ebp - 0x988], 1
mov eax, 0x21b0
test eax, eax
jne 0x1000af20
and dword [ebp - 0x468], 0
jmp 0x1000af2a
mov dword [ebp - 0x468], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x468], eax
jle 0x1000af41
mov dword [ebp - 0x340], 1
jmp 0x1000af48
and dword [ebp - 0x340], 0
push 1
lea ecx, [ebp - 0x828]
call fcn.10016420
mov ecx, dword [ebp - 0x340]
mov dword [eax], ecx
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x12c]
jl 0x1000af8c
cmp dword [ebp - 0x28], 0
je 0x1000af8c
mov dword [ebp - 0x794], 1
jmp 0x1000af93
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 0x2589
jl 0x1000afab
mov dword [ebp - 0x470], 1
jmp 0x1000afb2
and dword [ebp - 0x470], 0
push 2
lea ecx, [ebp - 0x9c0]
call fcn.10016420
mov ecx, dword [ebp - 0x470]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x9c0]
call fcn.10016420
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xd14], eax
xor eax, eax
jne 0x1000aff3
cmp dword [ebp - 0x12c], 0
jne 0x1000aff3
and dword [ebp - 0x654], 0
jmp 0x1000affd
mov dword [ebp - 0x654], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x654], eax
jl 0x1000b014
mov dword [ebp - 0x478], 1
jmp 0x1000b01b
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x1000b0a1
mov dword [ebp - 0x480], 0xffffffff
mov dword [ebp - 0x65c], 0x4db9bec7
mov dword [ebp - 0x898], 0xdbd3d38e
mov dword [ebp - 0x220], 0xafbcae26
mov eax, dword [ebp - 0x220]
neg eax
cmp dword [ebp - 0x28], eax
jl 0x1000b071
mov dword [ebp - 0x72c], 1
jmp 0x1000b078
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x898], eax
jmp 0x1000b1cd
mov dword [ebp - 0x18c], 0xb25bb54a
mov dword [ebp - 0x8a4], 0xaef1792f
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xd1c], eax
push 1
lea ecx, [ebp - 0x828]
call fcn.10016420
mov esi, dword [ebp - 0x164]
push 1
lea ecx, [ebp - 0x828]
call fcn.10016420
cmp esi, dword [eax]
jne 0x1000b0f1
mov dword [ebp - 0x488], 1
jmp 0x1000b0f8
and dword [ebp - 0x488], 0
push 2
lea ecx, [ebp - 0x9c0]
call fcn.10016420
mov ecx, dword [ebp - 0x488]
imul ecx, dword [eax]
sub ecx, dword [ebp - 0x164]
mov dword [ebp - 0x18c], ecx
jne 0x1000b125
cmp dword [ebp - 0x18c], 0
je 0x1000b12e
cmp dword [ebp - 0x18c], 0
jne 0x1000b140
cmp dword [ebp - 0x18c], 0
jne 0x1000b140
and dword [ebp - 0x8e0], 0
jmp 0x1000b14a
mov dword [ebp - 0x8e0], 1
push 2
lea ecx, [ebp - 0x9c0]
call fcn.10016420
push 1
lea ecx, [ebp - 0x828]
call fcn.10016420
imul eax, dword [eax], 0xfffffffb
cmp eax, 0xffff
jb 0x1000b17a
mov dword [ebp - 0x7cc], 1
jmp 0x1000b181
and dword [ebp - 0x7cc], 0
cmp dword [ebp - 0x7cc], 0x15e
jl 0x1000b199
mov dword [ebp - 0x490], 1
jmp 0x1000b1a0
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x490], eax
jg 0x1000b1ba
mov dword [ebp - 0x664], 1
jmp 0x1000b1c1
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x8a4], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x828]
call fcn.10016404
jmp 0x1000ae14
mov byte [ebp - 0x9f], 0
movzx eax, byte [ebp - 0x9f]
test eax, eax
je 0x1000b1fd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c0]
call fcn.10016404
mov dword [ebp - 0x4a8], 1
mov dword [ebp - 0xd24], 0xffffffff
mov dword [ebp - 0x58], 0
jmp 0x1000b230
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1000b246
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xdc], 1
jmp 0x1000b229
mov dword [ebp - 0x58], 0
jmp 0x1000b256
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1000b26c
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xd74], 0x64a11600
jmp 0x1000b24f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xdc], 0
jmp 0x1000b29a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xdc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdc], 0xffffffe3
jl 0x1000b49b
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xd2c], 1
mov dword [ebp - 0xd34], 0x6a7f4ea1
mov dword [ebp - 0xd3c], 1
mov dword [ebp - 0xd44], 0xffffffff
mov dword [ebp - 0xd4c], 2
mov dword [ebp - 0xd54], 0xcb6d64bd
mov dword [ebp - 0xd5c], 0x37ae9f90
mov dword [ebp - 0xd64], 0xfffffff9
mov dword [ebp - 0xd6c], 3
mov dword [ebp - 0x674], 0x9a1d127a
mov dword [ebp - 0x2d8], 0
jmp 0x1000b335
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 2
jge 0x1000b351
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0xf20], 0x122d800f
jmp 0x1000b328
mov dword [ebp - 0xe4], 0
jmp 0x1000b36a
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xb
jne 0x1000b489
mov dword [ebp - 0xa50], 0xf3d3
mov eax, dword [ebp - 0xa50]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xdc]
je 0x1000b400
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdc], 1
je 0x1000b3b2
mov dword [ebp - 0x498], 1
jmp 0x1000b3b9
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x498], eax
jl 0x1000b3d3
mov dword [ebp - 0x734], 1
jmp 0x1000b3da
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x4a8]
imul eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0xe4]
add eax, 0xca27
je 0x1000b400
mov dword [ebp - 0x4a0], 1
jmp 0x1000b407
and dword [ebp - 0x4a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
cmp dword [ebp - 0x4a0], eax
jge 0x1000b428
mov dword [ebp - 0x66c], 1
jmp 0x1000b42f
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x66c], eax
jle 0x1000b449
mov dword [ebp - 0x79c], 1
jmp 0x1000b450
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x4a8]
cmp eax, dword [ebp - 0x79c]
jl 0x1000b46a
mov dword [ebp - 0x4b0], 1
jmp 0x1000b471
and dword [ebp - 0x4b0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4b0]
mov dword [ebp + eax - 0xd74], ecx
jmp 0x1000b35d
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
jmp 0x1000b27f
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1000b4b7
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x13c], 1
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x13c], 0
jmp 0x1000b4e7
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x29
je 0x1000b59c
push 1
lea ecx, [ebp - 0xbc8]
call fcn.10016382
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x16c], 0xe31d8329
mov dword [ebp - 0x228], 0
jmp 0x1000b52b
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x1000b54d
push dword [ebp - 0x228]
lea ecx, [ebp - 0xbc8]
call fcn.10016420
mov dword [eax], 0x94a2
jmp 0x1000b51e
mov dword [ebp - 0x16c], 0
jmp 0x1000b566
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x1000b588
push dword [ebp - 0x16c]
lea ecx, [ebp - 0xbc8]
call fcn.10016420
mov dword [eax], 0xfffd
jmp 0x1000b559
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc8]
call fcn.10016404
jmp 0x1000b4da
push 1
lea ecx, [ebp - 0xbe0]
call fcn.10016382
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x288], 0
jmp 0x1000b5c9
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jge 0x1000b5e8
push dword [ebp - 0x288]
lea ecx, [ebp - 0xbe0]
call fcn.10016420
and dword [eax], 0
jmp 0x1000b5bc
push 0
lea ecx, [ebp - 0xbe0]
call fcn.10016420
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4b8]
mov dword [ecx], eax
mov byte [ebp - 0xa9], 0
mov dword [ebp - 0x230], 6
mov byte [ebp - 0xa3], 0
movzx eax, byte [ebp - 0xa3]
test eax, eax
je 0x1000b639
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x230], 0xfffffff6
jmp 0x1000b652
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xffffffea
jne 0x1000b6a3
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1000b67b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov byte [ebp - 0xa7], 0
movzx eax, byte [ebp - 0xa7]
test eax, eax
je 0x1000b6a1
push 0
push 0xa67
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1000b645
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1000b787
mov dword [ebp - 0xe74], 0xe91a049f
mov dword [ebp - 0xe70], 0xe91a049f
mov dword [ebp - 0xe6c], 0xe91a049f
mov dword [ebp - 0xe68], 0xe91a049f
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x90], 0
jmp 0x1000b6fd
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jg 0x1000b724
mov byte [ebp - 0xab], 0
movzx eax, byte [ebp - 0xab]
test eax, eax
je 0x1000b722
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1000b6f0
mov dword [ebp - 0x90], 0
jmp 0x1000b73d
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jg 0x1000b76c
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x1000b76a
push 0x1545
push 0x2085
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x1000b730
push 0
push 0
push 0x1604
push 0x227d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe0]
call fcn.10016404
mov dword [ebp - 0x1ac], 0x6f93bd5d
mov dword [ebp - 0x4e8], 0xc2f5a260
mov dword [ebp - 0x4e0], 1
mov dword [ebp - 0x74], 0
jmp 0x1000b7c4
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1000b7d7
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x38], 0x849
jmp 0x1000b7bd
mov dword [ebp - 0x74], 0
jmp 0x1000b7e7
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1000b7fd
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xf4c], 0xe91c
jmp 0x1000b7e0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
mov dword [ebp - 0xd78], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38], 0
jne 0x1000b886
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0xd80], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
mov dword [ebp - 0xd88], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
mov dword [ebp - 0xd90], eax
cmp dword [ebp - 0x1ac], 0
je 0x1000b868
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38], 0
je 0x1000b868
mov dword [ebp - 0x73c], 1
jmp 0x1000b86f
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
sub eax, dword [ebp - 0x1ac]
jne 0x1000b886
and dword [ebp - 0x4c0], 0
jmp 0x1000b890
mov dword [ebp - 0x4c0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
cmp dword [ebp - 0x4c0], eax
jl 0x1000b8ae
mov dword [ebp - 0x67c], 1
jmp 0x1000b8b5
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 0xffffffff
jge 0x1000b8d4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38], 0
jne 0x1000b8d4
and dword [ebp - 0x4c8], 0
jmp 0x1000b8de
mov dword [ebp - 0x4c8], 1
cmp dword [ebp - 0x4c8], 0xd96711db
jae 0x1000b8f6
mov dword [ebp - 0x7fc], 1
jmp 0x1000b8fd
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x7fc], eax
jge 0x1000b917
mov dword [ebp - 0x4d0], 1
jmp 0x1000b91e
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4d0]
sub ecx, dword [ebp + eax - 0x38]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x38]
jl 0x1000b946
mov dword [ebp - 0x684], 1
jmp 0x1000b94d
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x684], eax
jge 0x1000b971
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38], 0
jne 0x1000b971
and dword [ebp - 0x4d8], 0
jmp 0x1000b97b
mov dword [ebp - 0x4d8], 1
mov eax, dword [ebp - 0x4e8]
cmp dword [ebp - 0x4d8], eax
jl 0x1000b995
mov dword [ebp - 0x744], 1
jmp 0x1000b99c
and dword [ebp - 0x744], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
imul eax, dword [ebp - 0x744]
cmp eax, dword [ebp - 0x4e0]
jg 0x1000b9c1
mov dword [ebp - 0x8ac], 1
jmp 0x1000b9c8
and dword [ebp - 0x8ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
mov dword [ebp - 0xd98], eax
cmp dword [ebp - 0x4e0], 0x668d
jg 0x1000b9f0
mov dword [ebp - 0x68c], 1
jmp 0x1000b9f7
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x4e8], eax
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x1000ba1b
call dword [sym.imp.USER32.dll_CreateMenu]
movzx eax, byte [0x10673738]
test eax, eax
je 0x1000ba39
mov esi, 0x100875b4
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x100103bf
mov dword [ebp - 0x134], 0x3cdf
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x48], 3
mov dword [ebp - 0xda0], 0x5d580090
mov dword [ebp - 0xda8], 0
mov dword [ebp - 0x2b8], 0
jmp 0x1000ba81
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 1
jge 0x1000ba9d
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0xdb0], 0x4c996e15
jmp 0x1000ba74
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x238], eax
jle 0x1000bab7
mov dword [ebp - 0x7a4], 1
jmp 0x1000babe
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x238]
add eax, dword [ebp - 0x238]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x7a4]
sub eax, dword [ebp - 0x48]
jne 0x1000baea
mov eax, 0x91509cf1
test eax, eax
jne 0x1000baea
and dword [ebp - 0x4f0], 0
jmp 0x1000baf4
mov dword [ebp - 0x4f0], 1
cmp dword [ebp - 0x4f0], 0xfcfbce00
jb 0x1000bb0c
mov dword [ebp - 0x694], 1
jmp 0x1000bb13
and dword [ebp - 0x694], 0
mov dword [ebp - 0x134], 0xfffffff9
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x694]
jne 0x1000bb47
mov dword [ebp - 0x4f8], 0x2eda8ed4
mov eax, dword [ebp - 0x4f8]
dec eax
mov dword [ebp - 0x4f8], eax
jmp 0x1000be43
mov dword [ebp - 0xdb8], 4
mov dword [ebp - 0xaec], 0x88a97331
mov dword [ebp - 0xae8], 0x88a97331
mov dword [ebp - 0xae4], 0x88a97331
mov dword [ebp - 0xae0], 0x88a97331
lea ecx, [ebp - 0x32d]
call fcn.100091d3
push eax
lea eax, [ebp - 0xadc]
push eax
lea eax, [ebp - 0xaec]
push eax
lea ecx, [ebp - 0xf30]
call fcn.1001642f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xab8]
call fcn.100163de
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xdc0], 0xcf16
push 2
lea ecx, [ebp - 0xbec]
call fcn.10016382
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x290], 0
jmp 0x1000bbe9
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 2
jge 0x1000bc0b
push dword [ebp - 0x290]
lea ecx, [ebp - 0xbec]
call fcn.10016420
mov dword [eax], 0xce71
jmp 0x1000bbdc
mov dword [ebp - 0x134], 0x17
jmp 0x1000bc24
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
je 0x1000bcd0
mov dword [ebp - 0xdc8], 0xfffffff9
mov dword [ebp - 0xdd0], 0x5f84255e
mov dword [ebp - 0xdd8], 0x61e70716
mov dword [ebp - 0xde0], 0x9e62b560
push 2
lea ecx, [ebp - 0xe00]
call fcn.10016382
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x74c], 0x45beac3e
mov dword [ebp - 0x240], 0
jmp 0x1000bc8d
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x1000bcaf
push dword [ebp - 0x240]
lea ecx, [ebp - 0xe00]
call fcn.10016420
mov dword [eax], 0x41b87000
jmp 0x1000bc80
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xe00]
call fcn.10016404
jmp 0x1000bc17
mov dword [ebp - 0x48], 0
jmp 0x1000bce0
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x1000be25
mov dword [ebp - 0x9e8], 0xffffffff
mov dword [ebp - 0x8b4], 0xffffffff
mov dword [ebp - 0x2d0], 0
jmp 0x1000bd17
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
jge 0x1000bd33
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0xebc], 0x84a08deb
jmp 0x1000bd0a
push 1
lea ecx, [ebp - 0xbec]
call fcn.10016420
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x500]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x500]
mov dword [ecx], eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0xab8]
call fcn.10016420
mov ecx, dword [ebp - 0x9e8]
cmp dword [eax], ecx
jne 0x1000bd7b
mov dword [ebp - 0x69c], 1
jmp 0x1000bd82
and dword [ebp - 0x69c], 0
imul eax, dword [ebp - 0x69c], 0xffffffff
test eax, eax
je 0x1000bd9f
cmp dword [ebp - 0x48], 0
je 0x1000bd9f
mov dword [ebp - 0x370], 1
jmp 0x1000bda6
and dword [ebp - 0x370], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x370]
mov dword [ebp + eax - 0xebc], ecx
push dword [ebp - 0x48]
lea ecx, [ebp - 0xab8]
call fcn.10016420
mov eax, dword [eax]
cmp eax, dword [ebp - 0x370]
jge 0x1000bddd
mov dword [ebp - 0x508], 1
jmp 0x1000bde4
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0x9e4a0435
je 0x1000bdfc
mov dword [ebp - 0x7d4], 1
jmp 0x1000be03
and dword [ebp - 0x7d4], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0xab8]
call fcn.10016420
mov ecx, dword [ebp - 0x7d4]
imul ecx, dword [eax]
mov dword [ebp - 0x8b4], ecx
jmp 0x1000bcd9
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xbec]
call fcn.10016404
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab8]
call fcn.10016404
mov dword [ebp - 0x1c], 0x324ec2e0
mov dword [ebp - 0xb14], 0x1fe511bd
mov dword [ebp - 0xb10], 0x1fe511bd
mov dword [ebp - 0xb0c], 0x1fe511bd
mov dword [ebp - 0xb08], 0x1fe511bd
lea ecx, [ebp - 0x371]
call fcn.100091d3
push eax
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0xb14]
push eax
lea ecx, [ebp - 0xf18]
call fcn.1001642f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9d0]
call fcn.100163de
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x298], 0x4e2e0f61
mov dword [ebp - 0x1c], 0xfffffffd
jmp 0x1000bec8
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe7
jl 0x1000c28e
mov dword [ebp - 0x120], 0xcd329b3a
push 2
lea ecx, [ebp - 0x834]
call fcn.10016382
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x174], 5
mov dword [ebp - 0x248], 0
jmp 0x1000bf10
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 2
jge 0x1000bf32
push dword [ebp - 0x248]
lea ecx, [ebp - 0x834]
call fcn.10016420
mov dword [eax], 0xfffffffe
jmp 0x1000bf03
xor eax, eax
jne 0x1000bfcd
cmp dword [ebp - 0x120], 0
jae 0x1000bf4f
mov dword [ebp - 0xa54], 1
jmp 0x1000bf56
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xe3c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1000bf80
cmp dword [ebp - 0x1c], 0
jne 0x1000bf80
cmp dword [ebp - 0x120], 0
jne 0x1000bf80
and dword [ebp - 0x8bc], 0
jmp 0x1000bf8a
mov dword [ebp - 0x8bc], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xe44], eax
mov eax, dword [ebp - 0x1c]
add eax, 0xe075
cmp eax, 0x70e81de9
je 0x1000bfb1
cmp dword [ebp - 0x1c], 0
jne 0x1000bfb1
and dword [ebp - 0x9ec], 0
jmp 0x1000bfbb
mov dword [ebp - 0x9ec], 1
mov eax, 0x21b0
test eax, eax
jne 0x1000bfcd
and dword [ebp - 0x510], 0
jmp 0x1000bfd7
mov dword [ebp - 0x510], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x510], eax
jle 0x1000bfee
mov dword [ebp - 0x348], 1
jmp 0x1000bff5
and dword [ebp - 0x348], 0
push 1
lea ecx, [ebp - 0x834]
call fcn.10016420
mov ecx, dword [ebp - 0x348]
mov dword [eax], ecx
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x120]
jl 0x1000c039
cmp dword [ebp - 0x1c], 0
je 0x1000c039
mov dword [ebp - 0x6a4], 1
jmp 0x1000c040
and dword [ebp - 0x6a4], 0
cmp dword [ebp - 0x6a4], 0x2589
jl 0x1000c058
mov dword [ebp - 0x518], 1
jmp 0x1000c05f
and dword [ebp - 0x518], 0
push 2
lea ecx, [ebp - 0x9d0]
call fcn.10016420
mov ecx, dword [ebp - 0x518]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x9d0]
call fcn.10016420
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xe4c], eax
xor eax, eax
jne 0x1000c0a0
cmp dword [ebp - 0x120], 0
jne 0x1000c0a0
and dword [ebp - 0x754], 0
jmp 0x1000c0aa
mov dword [ebp - 0x754], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x754], eax
jl 0x1000c0c1
mov dword [ebp - 0x520], 1
jmp 0x1000c0c8
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
je 0x1000c14e
mov dword [ebp - 0x528], 0xffffffff
mov dword [ebp - 0x7ac], 0x4db9bec7
mov dword [ebp - 0x8c4], 0xdbd3d38e
mov dword [ebp - 0x298], 0xafbcae26
mov eax, dword [ebp - 0x298]
neg eax
cmp dword [ebp - 0x1c], eax
jl 0x1000c11e
mov dword [ebp - 0x6ac], 1
jmp 0x1000c125
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x6ac]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0x8c4], eax
jmp 0x1000c27a
mov dword [ebp - 0x194], 0xb25bb54a
mov dword [ebp - 0x8cc], 0xaef1792f
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xe7c], eax
push 1
lea ecx, [ebp - 0x834]
call fcn.10016420
mov esi, dword [ebp - 0x174]
push 1
lea ecx, [ebp - 0x834]
call fcn.10016420
cmp esi, dword [eax]
jne 0x1000c19e
mov dword [ebp - 0x530], 1
jmp 0x1000c1a5
and dword [ebp - 0x530], 0
push 2
lea ecx, [ebp - 0x9d0]
call fcn.10016420
mov ecx, dword [ebp - 0x530]
imul ecx, dword [eax]
sub ecx, dword [ebp - 0x174]
mov dword [ebp - 0x194], ecx
jne 0x1000c1d2
cmp dword [ebp - 0x194], 0
je 0x1000c1db
cmp dword [ebp - 0x194], 0
jne 0x1000c1ed
cmp dword [ebp - 0x194], 0
jne 0x1000c1ed
and dword [ebp - 0xa34], 0
jmp 0x1000c1f7
mov dword [ebp - 0xa34], 1
push 2
lea ecx, [ebp - 0x9d0]
call fcn.10016420
push 1
lea ecx, [ebp - 0x834]
call fcn.10016420
imul eax, dword [eax], 0xfffffffb
cmp eax, 0xffff
jb 0x1000c227
mov dword [ebp - 0x6b4], 1
jmp 0x1000c22e
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0x15e
jl 0x1000c246
mov dword [ebp - 0x538], 1
jmp 0x1000c24d
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x538], eax
jg 0x1000c267
mov dword [ebp - 0x75c], 1
jmp 0x1000c26e
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x8cc], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x834]
call fcn.10016404
jmp 0x1000bec1
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x1000c2aa
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d0]
call fcn.10016404
push 3
lea ecx, [ebp - 0x2fc]
call fcn.10016382
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x1b4], 0xfffffff7
mov dword [ebp - 0x78], 0
jmp 0x1000c2e7
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1000c303
push dword [ebp - 0x78]
lea ecx, [ebp - 0x2fc]
call fcn.10016420
mov dword [eax], 0x540d7f82
jmp 0x1000c2e0
mov dword [ebp - 0x78], 0
jmp 0x1000c313
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1000c326
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x10], 0xd8a87013
jmp 0x1000c30c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x10], 2
jmp 0x1000c34b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x10], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10], 0
jl 0x1000c660
mov dword [ebp - 0x17c], 7
mov dword [ebp - 0xa94], 0xffffffff
mov dword [ebp - 0x250], 0
jmp 0x1000c389
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jge 0x1000c3a5
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x8d4], 0xffffffff
jmp 0x1000c37c
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x10]
lea ecx, [ebp - 0x2fc]
call fcn.10016420
mov esi, dword [eax]
push 1
lea ecx, [ebp - 0x2fc]
call fcn.10016420
mov eax, dword [eax]
lea eax, [esi + eax - 0xe70]
test eax, eax
jne 0x1000c4e6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x10]
mov dword [ebp - 0x17c], eax
mov esi, dword [ebp - 0x17c]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x10]
lea ecx, [ebp - 0x2fc]
call fcn.10016420
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x10]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x10]
lea ecx, [ebp - 0x2fc]
call fcn.10016420
cmp esi, dword [eax]
je 0x1000c43e
mov dword [ebp - 0x540], 1
jmp 0x1000c445
and dword [ebp - 0x540], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x10]
lea ecx, [ebp - 0x2fc]
call fcn.10016420
mov ecx, dword [ebp - 0x540]
add ecx, dword [eax]
cmp ecx, 9
jne 0x1000c473
mov dword [ebp - 0x6bc], 1
jmp 0x1000c47a
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 0xea445a8c
ja 0x1000c492
mov dword [ebp - 0x9f4], 1
jmp 0x1000c499
and dword [ebp - 0x9f4], 0
push 1
lea ecx, [ebp - 0x2fc]
call fcn.10016420
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x10]
lea ecx, [ebp - 0x2fc]
call fcn.10016420
imul esi, dword [eax], 0x9919
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x10]
lea ecx, [ebp - 0x2fc]
call fcn.10016420
imul esi, dword [eax]
test esi, esi
jne 0x1000c4e6
and dword [ebp - 0x548], 0
jmp 0x1000c4f0
mov dword [ebp - 0x548], 1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x10]
lea ecx, [ebp - 0x2fc]
call fcn.10016420
mov ecx, dword [ebp - 0x548]
sub ecx, dword [eax]
mov dword [ebp - 0x1b4], ecx
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x10]
lea ecx, [ebp - 0x2fc]
call fcn.10016420
cmp dword [eax], 0
jne 0x1000c53f
cmp dword [ebp - 0x17c], 0
jne 0x1000c53f
and dword [ebp - 0x7f4], 0
jmp 0x1000c549
mov dword [ebp - 0x7f4], 1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x10]
lea ecx, [ebp - 0x2fc]
call fcn.10016420
cmp dword [eax], 6
jne 0x1000c56f
mov dword [ebp - 0x550], 1
jmp 0x1000c576
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x7f4]
cmp eax, dword [ebp - 0x550]
jne 0x1000c590
mov dword [ebp - 0x6c4], 1
jmp 0x1000c597
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0xfffffff7
jb 0x1000c5b8
mov dword [ebp - 0x558], 1
jmp 0x1000c5bf
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x6c4]
cmp eax, dword [ebp - 0x558]
jle 0x1000c5d9
mov dword [ebp - 0x764], 1
jmp 0x1000c5e0
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x10]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x10]
jge 0x1000c615
mov dword [ebp - 0x388], 1
jmp 0x1000c61c
and dword [ebp - 0x388], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x388]
mov dword [ebp + eax - 0x8d4], ecx
cmp dword [ebp - 0x388], 0
je 0x1000c648
xor eax, eax
je 0x1000c648
mov dword [ebp - 0x560], 1
jmp 0x1000c64f
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0xa94], eax
jmp 0x1000c336
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.10016404
mov dword [ebp - 0x8e4], 0xffff
mov dword [ebp - 0x5c], 0
jmp 0x1000c689
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1000c69f
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x318], 0xfffffffb
jmp 0x1000c682
mov dword [ebp - 0x5c], 0
jmp 0x1000c6af
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1000c6c2
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x4c], 1
jmp 0x1000c6a8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x318], 0xe0648261
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4c], 1
jmp 0x1000c6f8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 0
jl 0x1000c8e1
mov dword [ebp - 0x8dc], 9
mov dword [ebp - 0x9fc], 0xd1cb6a7f
mov eax, 0x7d8cf4c5
test eax, eax
je 0x1000c7dd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
mov eax, dword [ebp + eax*4 - 0x318]
mov dword [ebp - 0x8dc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x318], 5
jbe 0x1000c75d
mov dword [ebp - 0x6cc], 1
jmp 0x1000c764
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0xf3cc
jl 0x1000c77c
mov dword [ebp - 0x568], 1
jmp 0x1000c783
and dword [ebp - 0x568], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
cmp dword [ebp - 0x568], eax
jle 0x1000c7a1
mov dword [ebp - 0x7b4], 1
jmp 0x1000c7a8
and dword [ebp - 0x7b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
mov eax, dword [ebp + eax*4 - 0x318]
imul ecx, dword [ebp - 0x7b4], 0x664a
imul eax, ecx
test eax, eax
jne 0x1000c7d1
push 3
pop eax
test eax, eax
je 0x1000c7dd
mov dword [ebp - 0x570], 1
jmp 0x1000c7e4
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 0xe623
je 0x1000c7fc
mov dword [ebp - 0x6d4], 1
jmp 0x1000c803
and dword [ebp - 0x6d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
mov eax, dword [ebp + eax*4 - 0x318]
cmp dword [ebp - 0x6d4], eax
jg 0x1000c828
mov dword [ebp - 0x578], 1
jmp 0x1000c82f
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x9fc]
cmp dword [ebp - 0x578], eax
jl 0x1000c849
mov dword [ebp - 0x76c], 1
jmp 0x1000c850
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x8e4]
cmp dword [ebp - 0x76c], eax
jge 0x1000c86a
mov dword [ebp - 0x580], 1
jmp 0x1000c871
and dword [ebp - 0x580], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
mov eax, dword [ebp + eax*4 - 0x318]
cmp eax, dword [ebp - 0x580]
jge 0x1000c896
mov dword [ebp - 0x6dc], 1
jmp 0x1000c89d
and dword [ebp - 0x6dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
mov eax, dword [ebp + eax*4 - 0x318]
cmp dword [ebp - 0x6dc], eax
je 0x1000c8c2
mov dword [ebp - 0x588], 1
jmp 0x1000c8c9
and dword [ebp - 0x588], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x588]
mov dword [ebp + eax - 0x318], ecx
jmp 0x1000c6e3
mov dword [ebp - 0x20], 0x324ec2e0
mov dword [ebp - 0xb3c], 0x1fe511bd
mov dword [ebp - 0xb38], 0x1fe511bd
mov dword [ebp - 0xb34], 0x1fe511bd
mov dword [ebp - 0xb30], 0x1fe511bd
lea ecx, [ebp - 0x35d]
call fcn.100091d3
push eax
lea eax, [ebp - 0xb2c]
push eax
lea eax, [ebp - 0xb3c]
push eax
lea ecx, [ebp - 0xec8]
call fcn.1001642f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa70]
call fcn.100163de
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x1c0], 0x4e2e0f61
mov dword [ebp - 0x2c], 0x324ec2e0
mov dword [ebp - 0xb64], 0x1fe511bd
mov dword [ebp - 0xb60], 0x1fe511bd
mov dword [ebp - 0xb5c], 0x1fe511bd
mov dword [ebp - 0xb58], 0x1fe511bd
lea ecx, [ebp - 0x38d]
call fcn.100091d3
push eax
lea eax, [ebp - 0xb54]
push eax
lea eax, [ebp - 0xb64]
push eax
lea ecx, [ebp - 0xf28]
call fcn.1001642f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa60]
call fcn.100163de
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x1c4], 0x4e2e0f61
mov dword [ebp - 0x2c], 0xfffffffd
jmp 0x1000c9d8
cmp dword [ebp - 0x2c], 0xffffffe7
jl 0x1000cd9e
mov dword [ebp - 0x128], 0xcd329b3a
push 2
lea ecx, [ebp - 0x84c]
call fcn.10016382
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x1a4], 5
mov dword [ebp - 0x2c0], 0
jmp 0x1000ca20
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jge 0x1000ca42
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0x84c]
call fcn.10016420
mov dword [eax], 0xfffffffe
jmp 0x1000ca13
xor eax, eax
jne 0x1000cadd
cmp dword [ebp - 0x128], 0
jae 0x1000ca5f
mov dword [ebp - 0xa3c], 1
jmp 0x1000ca66
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xe84], eax
cmp dword [ebp - 0x2c], 0
jne 0x1000ca90
cmp dword [ebp - 0x2c], 0
jne 0x1000ca90
cmp dword [ebp - 0x128], 0
jne 0x1000ca90
and dword [ebp - 0x8ec], 0
jmp 0x1000ca9a
mov dword [ebp - 0x8ec], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe8c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xe075
cmp eax, 0x70e81de9
je 0x1000cac1
cmp dword [ebp - 0x2c], 0
jne 0x1000cac1
and dword [ebp - 0xa04], 0
jmp 0x1000cacb
mov dword [ebp - 0xa04], 1
mov eax, 0x21b0
test eax, eax
jne 0x1000cadd
and dword [ebp - 0x7e0], 0
jmp 0x1000cae7
mov dword [ebp - 0x7e0], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x7e0], eax
jle 0x1000cafe
mov dword [ebp - 0x350], 1
jmp 0x1000cb05
and dword [ebp - 0x350], 0
push 1
lea ecx, [ebp - 0x84c]
call fcn.10016420
mov ecx, dword [ebp - 0x350]
mov dword [eax], ecx
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x128]
jl 0x1000cb49
cmp dword [ebp - 0x2c], 0
je 0x1000cb49
mov dword [ebp - 0x590], 1
jmp 0x1000cb50
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0x2589
jl 0x1000cb68
mov dword [ebp - 0x6e4], 1
jmp 0x1000cb6f
and dword [ebp - 0x6e4], 0
push 2
lea ecx, [ebp - 0xa60]
call fcn.10016420
mov ecx, dword [ebp - 0x6e4]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0xa60]
call fcn.10016420
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe94], eax
xor eax, eax
jne 0x1000cbb0
cmp dword [ebp - 0x128], 0
jne 0x1000cbb0
and dword [ebp - 0x598], 0
jmp 0x1000cbba
mov dword [ebp - 0x598], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x598], eax
jl 0x1000cbd1
mov dword [ebp - 0x774], 1
jmp 0x1000cbd8
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
je 0x1000cc5e
mov dword [ebp - 0x6ec], 0xffffffff
mov dword [ebp - 0x5a8], 0x4db9bec7
mov dword [ebp - 0x8f4], 0xdbd3d38e
mov dword [ebp - 0x1c4], 0xafbcae26
mov eax, dword [ebp - 0x1c4]
neg eax
cmp dword [ebp - 0x2c], eax
jl 0x1000cc2e
mov dword [ebp - 0x5a0], 1
jmp 0x1000cc35
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x6ec], eax
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x8f4], eax
jmp 0x1000cd8a
mov dword [ebp - 0x150], 0xb25bb54a
mov dword [ebp - 0x8fc], 0xaef1792f
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xe9c], eax
push 1
lea ecx, [ebp - 0x84c]
call fcn.10016420
mov esi, dword [ebp - 0x1a4]
push 1
lea ecx, [ebp - 0x84c]
call fcn.10016420
cmp esi, dword [eax]
jne 0x1000ccae
mov dword [ebp - 0x7bc], 1
jmp 0x1000ccb5
and dword [ebp - 0x7bc], 0
push 2
lea ecx, [ebp - 0xa60]
call fcn.10016420
mov ecx, dword [ebp - 0x7bc]
imul ecx, dword [eax]
sub ecx, dword [ebp - 0x1a4]
mov dword [ebp - 0x150], ecx
jne 0x1000cce2
cmp dword [ebp - 0x150], 0
je 0x1000cceb
cmp dword [ebp - 0x150], 0
jne 0x1000ccfd
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x84c]
call fcn.10016404
jmp 0x1000c9d1
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x1000cdba
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xa60]
call fcn.10016404
mov dword [ebp - 0x20], 0xfffffffd
jmp 0x1000cdd9
cmp dword [ebp - 0x20], 0xffffffe7
jl 0x1000d19f
mov dword [ebp - 0x130], 0xcd329b3a
push 2
lea ecx, [ebp - 0x864]
call fcn.10016382
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x158], 5
mov dword [ebp - 0x1cc], 0
jmp 0x1000ce21
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jge 0x1000ce43
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x864]
call fcn.10016420
mov dword [eax], 0xfffffffe
jmp 0x1000ce14
xor eax, eax
jne 0x1000cede
cmp dword [ebp - 0x130], 0
jae 0x1000ce60
mov dword [ebp - 0xa0c], 1
jmp 0x1000ce67
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xea4], eax
cmp dword [ebp - 0x20], 0
jne 0x1000ce91
cmp dword [ebp - 0x20], 0
jne 0x1000ce91
cmp dword [ebp - 0x130], 0
jne 0x1000ce91
and dword [ebp - 0x904], 0
jmp 0x1000ce9b
mov dword [ebp - 0x904], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xeac], eax
mov eax, dword [ebp - 0x20]
add eax, 0xe075
cmp eax, 0x70e81de9
je 0x1000cec2
cmp dword [ebp - 0x20], 0
jne 0x1000cec2
and dword [ebp - 0xa44], 0
jmp 0x1000cecc
mov dword [ebp - 0xa44], 1
mov eax, 0x21b0
test eax, eax
jne 0x1000cede
and dword [ebp - 0x77c], 0
jmp 0x1000cee8
mov dword [ebp - 0x77c], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x77c], eax
jle 0x1000ceff
mov dword [ebp - 0x378], 1
jmp 0x1000cf06
and dword [ebp - 0x378], 0
push 1
lea ecx, [ebp - 0x864]
call fcn.10016420
mov ecx, dword [ebp - 0x378]
mov dword [eax], ecx
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x130]
jl 0x1000cf4a
cmp dword [ebp - 0x20], 0
je 0x1000cf4a
mov dword [ebp - 0x5c0], 1
jmp 0x1000cf51
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 0x2589
jl 0x1000cf69
mov dword [ebp - 0x5e8], 1
jmp 0x1000cf70
and dword [ebp - 0x5e8], 0
push 2
lea ecx, [ebp - 0xa70]
call fcn.10016420
mov ecx, dword [ebp - 0x5e8]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0xa70]
call fcn.10016420
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xeb4], eax
xor eax, eax
jne 0x1000cfb1
cmp dword [ebp - 0x130], 0
jne 0x1000cfb1
and dword [ebp - 0x5c8], 0
jmp 0x1000cfbb
mov dword [ebp - 0x5c8], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x5c8], eax
jl 0x1000cfd2
mov dword [ebp - 0x5f8], 1
jmp 0x1000cfd9
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
je 0x1000d05f
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1000d1bb
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa70]
call fcn.10016404
mov dword [ebp - 0x168], 0x6f93bd5d
mov dword [ebp - 0x404], 0xc2f5a260
mov dword [ebp - 0x3f4], 1
mov dword [ebp - 0x64], 0
jmp 0x1000d1f8
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1000d20b
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x40], 0x849
jmp 0x1000d1f1
mov dword [ebp - 0x64], 0
jmp 0x1000d21b
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1000d231
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xf58], 0xe91c
jmp 0x1000d214
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0xc74], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
jne 0x1000d2ba
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xc84], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0xd7c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0xc80], eax
cmp dword [ebp - 0x168], 0
je 0x1000d29c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
je 0x1000d29c
mov dword [ebp - 0x3ac], 1
jmp 0x1000d2a3
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x3ac]
sub eax, dword [ebp - 0x168]
jne 0x1000d2ba
and dword [ebp - 0x3b4], 0
jmp 0x1000d2c4
mov dword [ebp - 0x3b4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
cmp dword [ebp - 0x3b4], eax
jl 0x1000d2e2
mov dword [ebp - 0x3bc], 1
jmp 0x1000d2e9
and dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 0xffffffff
jge 0x1000d308
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
jne 0x1000d308
mov dword [ebp - 0x3c4], 1
cmp dword [ebp - 0x3c4], 0xd96711db
jae 0x1000d32a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret