Function at 0x10008e64
Capabilities:
Accept command line arguments
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080ec8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf88
push esi
push edi
mov dword [ebp - 0xe50], 0xffff
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10008eaf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x10008ecb
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x2f4], 0xffffffff
mov dword [ebp - 0xe1c], 0x10977a12
mov dword [ebp - 0x23c], 4
mov dword [ebp - 0x8c4], 0x4ff5452f
push 2
lea ecx, [ebp - 0xba4]
call fcn.100169cf
and dword [ebp - 4], 0
mov dword [ebp - 0x8dc], 0
mov dword [ebp - 0x174], 0
jmp 0x10008f27
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jge 0x10008f49
push dword [ebp - 0x174]
lea ecx, [ebp - 0xba4]
call fcn.10016a3c
mov dword [eax], 5
jmp 0x10008f1a
cmp dword [ebp - 0x23c], 1
jl 0x10008f5e
mov dword [ebp - 0x60c], 1
jmp 0x10008f65
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x23c]
imul eax, dword [ebp - 0x60c]
imul eax, dword [ebp - 0x2f4]
cmp eax, dword [ebp - 0x23c]
je 0x10008f8d
mov dword [ebp - 0x828], 1
jmp 0x10008f94
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x2f4]
cmp dword [ebp - 0x828], eax
jle 0x10008fae
mov dword [ebp - 0x830], 1
jmp 0x10008fb5
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x2f4]
cmp dword [ebp - 0x830], eax
jne 0x10008fcf
mov dword [ebp - 0x854], 1
jmp 0x10008fd6
and dword [ebp - 0x854], 0
imul eax, dword [ebp - 0x854], 0xb064
cmp eax, dword [ebp - 0x8c4]
jle 0x10008ff4
mov dword [ebp - 0x244], 1
jmp 0x10008ffb
and dword [ebp - 0x244], 0
push 1
lea ecx, [ebp - 0xba4]
call fcn.10016a3c
mov ecx, dword [ebp - 0x244]
mov dword [eax], ecx
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x8dc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba4]
call fcn.10016a37
mov dword [ebp - 0xd2c], 0xffff
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x10009056
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x10009072
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x90], 0xfa51
mov dword [ebp - 0xc38], 0
mov dword [ebp - 0xc34], 0
mov dword [ebp - 0xc30], 0
mov dword [ebp - 0xc2c], 0
mov dword [ebp - 0x338], 3
mov dword [ebp - 0x8ec], 2
cmp dword [ebp - 0x90], 0x941f
jge 0x100090d0
mov dword [ebp - 0x2a4], 1
jmp 0x100090d7
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xe90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xd34], eax
xor eax, eax
imul eax, eax, 6
test eax, eax
jne 0x10009104
mov dword [ebp - 0x330], 1
jmp 0x1000910b
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x330]
add eax, 0xee61
je 0x1000912a
cmp dword [ebp - 0x90], 0
je 0x1000912a
and dword [ebp - 0x718], 0
jmp 0x10009134
mov dword [ebp - 0x718], 1
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x718], eax
jl 0x1000914e
mov dword [ebp - 0x720], 1
jmp 0x10009155
and dword [ebp - 0x720], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp + eax - 0xc38], ecx
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
sub eax, 0x13abe9af
cmp eax, dword [ebp - 0x720]
jg 0x10009193
mov dword [ebp - 0x340], 1
jmp 0x1000919a
and dword [ebp - 0x340], 0
cmp dword [ebp - 0x340], 0
jg 0x100091af
mov dword [ebp - 0x728], 1
jmp 0x100091b6
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x728], eax
jl 0x100091d0
mov dword [ebp - 0x348], 1
jmp 0x100091d7
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x348], eax
je 0x100091f1
mov dword [ebp - 0x8e4], 1
jmp 0x100091f8
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xe68], eax
mov dword [ebp - 0x8ec], 0x3d5943e2
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x1000923e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x13c], 0x7d65121a
push 4
lea ecx, [ebp - 0x944]
call fcn.100169cf
mov dword [ebp - 4], 1
mov dword [ebp - 0x2d4], 0xfffffffa
mov dword [ebp - 0x738], 0xfd522803
mov dword [ebp - 0x358], 0xa8db8846
mov dword [ebp - 0x8f4], 0x7c8a
mov dword [ebp - 0x380], 1
mov dword [ebp - 0x10], 0
jmp 0x1000929e
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100092ba
push dword [ebp - 0x10]
lea ecx, [ebp - 0x944]
call fcn.10016a3c
mov dword [eax], 0xfffffffd
jmp 0x10009297
mov dword [ebp - 0x10], 0
jmp 0x100092ca
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100092e0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb68], 5
jmp 0x100092c3
mov dword [ebp - 0x10], 0
jmp 0x100092f0
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10009306
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xec8], 0xffffffff
jmp 0x100092e9
mov dword [ebp - 0x10], 0
jmp 0x10009316
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1000932c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xed4], 0x6c5533f2
jmp 0x1000930f
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xd54], eax
cmp dword [ebp - 0x13c], 1
jg 0x1000934d
mov dword [ebp - 0x24c], 1
jmp 0x10009354
and dword [ebp - 0x24c], 0
push 2
lea ecx, [ebp - 0x944]
call fcn.10016a3c
mov ecx, dword [ebp - 0x24c]
mov dword [eax], ecx
cmp dword [ebp - 0x24c], 1
jle 0x1000937e
mov dword [ebp - 0x730], 1
jmp 0x10009385
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x730], eax
jl 0x1000939f
mov dword [ebp - 0x350], 1
jmp 0x100093a6
and dword [ebp - 0x350], 0
mov eax, 0xfd81
sub eax, dword [ebp - 0x350]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0xe30], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb68], 0x4a6b2c4e
jg 0x100093ee
mov dword [ebp - 0x740], 1
jmp 0x100093f5
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x740]
jg 0x1000941e
push 1
lea ecx, [ebp - 0x944]
call fcn.10016a3c
cmp dword [eax], 0
jne 0x1000941e
and dword [ebp - 0x360], 0
jmp 0x10009428
mov dword [ebp - 0x360], 1
mov eax, dword [ebp - 0x360]
add eax, 0x9e14
jne 0x10009453
push 2
lea ecx, [ebp - 0x944]
call fcn.10016a3c
cmp dword [eax], 0
jne 0x10009453
mov dword [ebp - 0x748], 1
jmp 0x1000945a
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x748], eax
jge 0x10009474
mov dword [ebp - 0x368], 1
jmp 0x1000947b
and dword [ebp - 0x368], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x368]
sub ecx, dword [ebp + eax - 0xb68]
mov dword [ebp - 0x13c], ecx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x750], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x750]
mov dword [ebp + eax - 0xec8], ecx
cmp dword [ebp - 0x750], 0
jne 0x100094ce
cmp dword [ebp - 0x13c], 0
jne 0x100094ce
and dword [ebp - 0x370], 0
jmp 0x100094d8
mov dword [ebp - 0x370], 1
mov eax, dword [ebp - 0x8f4]
cmp dword [ebp - 0x370], eax
jl 0x100094f2
mov dword [ebp - 0x758], 1
jmp 0x100094f9
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x758], eax
je 0x10009513
mov dword [ebp - 0x378], 1
jmp 0x1000951a
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 6
je 0x1000952f
mov dword [ebp - 0x760], 1
jmp 0x10009536
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0xd5c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb68]
mov dword [ebp - 0xe6c], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xed4], 8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x944]
call fcn.10016a37
mov dword [ebp - 0xd64], 0xffff
mov dword [ebp - 0xa0], 0x540d7f82
push 3
lea ecx, [ebp - 0xa6c]
call fcn.100169cf
mov dword [ebp - 4], 2
mov dword [ebp - 0x3a8], 0xfffffffc
mov dword [ebp - 0x1cc], 0
jmp 0x100095cb
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jge 0x100095ed
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0xa6c]
call fcn.10016a3c
mov dword [eax], 0xfffffffd
jmp 0x100095be
mov dword [ebp - 0xa0], 0
jmp 0x10009606
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xfffffff8
jg 0x10009b0d
push 3
lea ecx, [ebp - 0x884]
call fcn.100169cf
mov byte [ebp - 4], 3
mov dword [ebp - 0xe38], 0xd0357257
mov dword [ebp - 0xd6c], 0x3f0244c3
mov dword [ebp - 0x17c], 1
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2ac], 1
mov dword [ebp - 0x254], 0x4e7f
mov dword [ebp - 0x14], 0
jmp 0x1000966d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10009689
push dword [ebp - 0x14]
lea ecx, [ebp - 0x884]
call fcn.10016a3c
mov dword [eax], 0xfc0272a
jmp 0x10009666
mov dword [ebp - 0x14], 0
jmp 0x10009699
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100096af
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe28], 0x81eca6c8
jmp 0x10009692
mov dword [ebp - 0x14], 0
jmp 0x100096bf
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x100096d5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xeac], 0x5a60c437
jmp 0x100096b8
mov dword [ebp - 0x14], 0
jmp 0x100096e5
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100096fb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa34], 0x158e
jmp 0x100096de
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x8fc]
cmp eax, dword [ebp - 0x904]
je 0x1000973a
mov dword [ebp - 0x398], 1
jmp 0x10009741
and dword [ebp - 0x398], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xeac]
inc eax
mov dword [ebp - 0x768], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x768]
mov dword [ebp + eax - 0xeac], ecx
cmp dword [ebp - 0x768], 0
je 0x10009790
push 2
lea ecx, [ebp - 0x884]
call fcn.10016a3c
mov eax, dword [eax]
neg eax
je 0x10009790
mov dword [ebp - 0x388], 1
jmp 0x10009797
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xe74], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xd7c], eax
push 0
lea ecx, [ebp - 0xa6c]
call fcn.10016a3c
mov dword [eax], 0xfffffff6
imul eax, dword [ebp - 0x3a8], 0xfffffff6
cmp dword [ebp - 0x388], eax
jge 0x100097dd
mov dword [ebp - 0x90c], 1
jmp 0x100097e4
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0xe40], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa34]
cmp dword [ebp - 0xa0], eax
je 0x10009811
mov dword [ebp - 0x770], 1
jmp 0x10009818
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x770], eax
jg 0x10009832
mov dword [ebp - 0x390], 1
jmp 0x10009839
and dword [ebp - 0x390], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe28]
cmp dword [ebp - 0x390], eax
jg 0x1000985a
mov dword [ebp - 0x778], 1
jmp 0x10009861
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
sub eax, dword [ebp - 0x24]
cmp dword [ebp - 0x398], eax
jne 0x1000987e
mov dword [ebp - 0x780], 1
jmp 0x10009885
and dword [ebp - 0x780], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa34]
cmp dword [ebp - 0x780], eax
jge 0x100098a6
mov dword [ebp - 0x3a0], 1
jmp 0x100098ad
and dword [ebp - 0x3a0], 0
imul eax, dword [ebp - 0x3a0], 0x5465
cmp eax, dword [ebp - 0xa0]
jne 0x100098cb
mov dword [ebp - 0x788], 1
jmp 0x100098d2
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x788], eax
jge 0x100098e9
mov dword [ebp - 0x790], 1
jmp 0x100098f0
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0x790], eax
je 0x1000990a
mov dword [ebp - 0x3b0], 1
jmp 0x10009911
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x3b0], 0xc462
je 0x10009929
mov dword [ebp - 0x798], 1
jmp 0x10009930
and dword [ebp - 0x798], 0
push 2
lea ecx, [ebp - 0x884]
call fcn.10016a3c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x798]
jle 0x10009953
mov dword [ebp - 0x3b8], 1
jmp 0x1000995a
and dword [ebp - 0x3b8], 0
imul eax, dword [ebp - 0x3b8], 0x426c
test eax, eax
je 0x1000997b
push 3
pop eax
test eax, eax
je 0x1000997b
mov dword [ebp - 0x7a0], 1
jmp 0x10009982
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
je 0x100099e0
mov dword [ebp - 0x24], 0
jmp 0x100099a7
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100099bd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa34], 0x7f49
jmp 0x100099a0
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x100099db
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x10009af9
push 2
lea ecx, [ebp - 0xb80]
call fcn.100169cf
mov byte [ebp - 4], 4
mov dword [ebp - 0x20c], 0
jmp 0x10009a0a
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x10009a2c
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xb80]
call fcn.10016a3c
mov dword [eax], 0xfffffff6
jmp 0x100099fd
mov dword [ebp - 0x24], 0
jmp 0x10009a3c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x10009aea
push dword [ebp - 0x24]
lea ecx, [ebp - 0x884]
call fcn.10016a3c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x884]
call fcn.10016a3c
mov dword [ebp - 0x3c0], eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x884]
call fcn.10016a3c
mov ecx, dword [ebp - 0x3c0]
mov eax, dword [eax]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb80]
call fcn.10016a3c
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x7a8]
mov ecx, dword [ebp - 0x3c0]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7a8]
cmp dword [eax], 0x87f9bd85
jb 0x10009abd
mov dword [ebp - 0x3c8], 1
jmp 0x10009ac4
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x2ac], eax
mov esi, dword [ebp - 0x2ac]
push 0
lea ecx, [ebp - 0xa6c]
call fcn.10016a3c
mov dword [eax], esi
jmp 0x10009a35
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb80]
call fcn.10016a37
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x884]
call fcn.10016a37
jmp 0x100095f9
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x10009b35
push 0x1fd6
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa6c]
call fcn.10016a37
mov dword [ebp - 0xd8c], 0xbaf43b7c
mov dword [ebp - 0x7b0], 0xffffffff
mov dword [ebp - 0xe88], 2
mov dword [ebp - 0xd9c], 0
mov dword [ebp - 0xe48], 0x6f5a9c4c
mov dword [ebp - 0xdac], 0xfffffffa
mov dword [ebp - 0xaac], 0x8f0aa6e6
mov dword [ebp - 0xaa8], 0x8f0aa6e6
mov dword [ebp - 0xaa4], 0x8f0aa6e6
mov dword [ebp - 0xaa0], 0x8f0aa6e6
lea ecx, [ebp - 0x232]
call fcn.10008c23
push eax
lea eax, [ebp - 0xa9c]
push eax
lea eax, [ebp - 0xaac]
push eax
lea ecx, [ebp - 0xf1c]
call fcn.10016a4b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd78]
call fcn.10016a11
mov dword [ebp - 4], 5
mov dword [ebp - 0xe78], 0xffffffff
mov dword [ebp - 0xca0], 0x598aaf0a
mov dword [ebp - 0xa98], 0x674f
mov dword [ebp - 0xa94], 0x674f
mov dword [ebp - 0xa90], 0x674f
mov dword [ebp - 0xa8c], 0x674f
mov dword [ebp - 0xafc], 0x39150040
mov dword [ebp - 0xaf8], 0x39150040
mov dword [ebp - 0xaf4], 0x39150040
mov dword [ebp - 0xaf0], 0x39150040
lea ecx, [ebp - 0x233]
call fcn.10008c23
push eax
lea eax, [ebp - 0xaec]
push eax
lea eax, [ebp - 0xafc]
push eax
lea ecx, [ebp - 0xf0c]
call fcn.10016a4b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xeec]
call fcn.10016a11
mov byte [ebp - 4], 6
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa98]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xa98], eax
mov dword [ebp - 0x7b0], 1
mov esi, dword [ebp - 0x7b0]
push 3
lea ecx, [ebp - 0xd78]
call fcn.10016a3c
mov dword [eax], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xeec]
call fcn.10016a37
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd78]
call fcn.10016a37
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x10009cf8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [ebp - 0x138], 1
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x138], 0
jmp 0x10009d28
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xa
jge 0x10009d7f
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x184], 7
jmp 0x10009d54
mov eax, dword [ebp - 0x184]
dec eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0xfffffff6
jg 0x10009d7d
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x10009d7b
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x10009d47
jmp 0x10009d1b
mov dword [ebp - 0xd0], 0xe2db
mov dword [ebp - 0xc98], 0xfffffff8
mov dword [ebp - 0xc94], 0xfffffff8
mov dword [ebp - 0xc90], 0xfffffff8
mov dword [ebp - 0xc8c], 0xfffffff8
mov dword [ebp - 0x3f8], 0x8530de9b
mov dword [ebp - 0xca8], 0x83e7
mov dword [ebp - 0x25c], 0xb221494f
mov dword [ebp - 0x1d4], 0
jmp 0x10009de8
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 4
jge 0x10009e04
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0xc88], 0xffffffff
jmp 0x10009ddb
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd0], 0
jmp 0x10009e2a
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jg 0x1000a0a9
mov dword [ebp - 0x3d8], 0xe3e4
mov dword [ebp - 0xcb0], 0xac06e326
mov dword [ebp - 0x914], 0xc8e12b6a
mov dword [ebp - 0x18c], 0
jmp 0x10009e6e
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x10009e8a
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0xbb0], 3
jmp 0x10009e61
cmp dword [ebp - 0x3d8], 0xbbde
jle 0x10009ea2
mov dword [ebp - 0x3d0], 1
jmp 0x10009ea9
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x7b8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7b8]
mov dword [ebp + eax - 0xc98], ecx
mov eax, dword [ebp - 0x3d0]
cmp eax, dword [ebp - 0x7b8]
je 0x10009ee2
mov dword [ebp - 0x7c8], 1
jmp 0x10009ee9
and dword [ebp - 0x7c8], 0
cmp dword [ebp - 0x3d8], 0
jne 0x10009f0a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc88], 0
jne 0x10009f0a
and dword [ebp - 0x7c0], 0
jmp 0x10009f14
mov dword [ebp - 0x7c0], 1
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x7c0], eax
jl 0x10009f2e
mov dword [ebp - 0x3e0], 1
jmp 0x10009f35
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
imul eax, dword [ebp - 0x3e0]
cmp dword [ebp - 0x7c8], eax
jl 0x10009f63
mov dword [ebp - 0x3e8], 1
jmp 0x10009f6a
and dword [ebp - 0x3e8], 0
imul eax, dword [ebp - 0x3e8], 0
sub eax, 0xdf454e1
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xc88]
jge 0x10009f90
mov dword [ebp - 0x7d0], 1
jmp 0x10009f97
and dword [ebp - 0x7d0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbb0]
cmp dword [ebp - 0x7d0], eax
jle 0x10009fb7
mov dword [ebp - 0x3f0], 1
jmp 0x10009fbe
and dword [ebp - 0x3f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbb0]
cmp dword [ebp - 0x3f0], eax
jg 0x10009fdf
mov dword [ebp - 0x7d8], 1
jmp 0x10009fe6
and dword [ebp - 0x7d8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc88]
cmp dword [ebp - 0x7d8], eax
jl 0x1000a006
mov dword [ebp - 0x7e0], 1
jmp 0x1000a00d
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x3f8]
cmp eax, dword [ebp - 0x7e0]
jl 0x1000a027
mov dword [ebp - 0x400], 1
jmp 0x1000a02e
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x914]
cmp dword [ebp - 0x400], eax
jg 0x1000a048
mov dword [ebp - 0x7e8], 1
jmp 0x1000a04f
and dword [ebp - 0x7e8], 0
cmp dword [ebp - 0x7e8], 0xc8cdab0b
jb 0x1000a067
mov dword [ebp - 0x408], 1
jmp 0x1000a06e
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
add eax, 0x46bb
mov dword [ebp - 0x7f0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7f0]
mov dword [ebp + eax - 0xc88], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7f0]
mov dword [ebp + eax - 0xbb0], ecx
jmp 0x10009e1d
mov byte [ebp - 0xc9], 0
mov dword [ebp - 0x34], 0x99dada43
mov dword [ebp - 0x7f8], 0xc8100c43
mov dword [ebp - 0x1fc], 0
jmp 0x1000a0da
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x1000a0f6
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x86c], 1
jmp 0x1000a0cd
mov dword [ebp - 0x34], 2
jmp 0x1000a106
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1000a1fa
mov dword [ebp - 0x418], 4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x86c], 0
jne 0x1000a136
mov dword [ebp - 0x410], 1
jmp 0x1000a13d
and dword [ebp - 0x410], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x86c]
cmp dword [ebp - 0x410], eax
jge 0x1000a15e
mov dword [ebp - 0x91c], 1
jmp 0x1000a165
and dword [ebp - 0x91c], 0
mov dword [ebp - 0x7f8], 0xffffffff
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x86c]
cmp dword [ebp - 0x7f8], eax
jg 0x1000a190
mov dword [ebp - 0x924], 1
jmp 0x1000a197
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x86c]
mov dword [ebp - 0xcb8], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x86c]
mov dword [ebp - 0xcc0], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xcc8], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x86c]
mov dword [ebp - 0xcd0], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x86c]
mov dword [ebp - 0xcd8], eax
mov dword [ebp - 0x418], 0x4f230135
cmp dword [ebp - 0x418], 0
je 0x1000a1f5
jmp 0x1000a1fa
jmp 0x1000a0ff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x86c]
imul eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1000a48f
mov dword [ebp - 0x264], 0x34392f20
mov dword [ebp - 0x92c], 0xd635
mov dword [ebp - 0x6c], 0
jmp 0x1000a241
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1000a257
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x15c], 3
jmp 0x1000a23a
mov dword [ebp - 0x6c], 0
jmp 0x1000a267
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1000a27d
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xa08], 4
jmp 0x1000a260
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x15c], 0x19
jmp 0x1000a2ab
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x15c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x15c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x15c], 0xfffffffa
jge 0x1000a485
mov dword [ebp - 0x130], 0x48f69f7f
mov dword [ebp - 0xd8], 2
mov dword [ebp - 0x2ec], 0xc8d46758
mov dword [ebp - 0x130], 0
jmp 0x1000a2f6
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jg 0x1000a480
mov dword [ebp - 0x140], 0x657689a
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp + eax*4 - 0xa08]
mov dword [ebp - 0x800], eax
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x800]
mov dword [ebp + eax*4 - 0xa08], ecx
cmp dword [ebp - 0x800], 0
jne 0x1000a358
mov dword [ebp - 0xd8], 0xfffa
cmp dword [ebp - 0xd8], 0
jne 0x1000a358
and dword [ebp - 0x810], 0
jmp 0x1000a362
mov dword [ebp - 0x810], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x15c], 0xfd06
jne 0x1000a38a
cmp dword [ebp - 0x140], 0
je 0x1000a38a
mov dword [ebp - 0x420], 1
jmp 0x1000a391
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x2ec], eax
jne 0x1000a3b7
mov dword [ebp - 0x808], 1
jmp 0x1000a3be
and dword [ebp - 0x808], 0
cmp dword [ebp - 0x808], 0
jne 0x1000a3d9
cmp dword [ebp - 0x2ec], 0
jne 0x1000a3d9
and dword [ebp - 0x428], 0
jmp 0x1000a3e3
mov dword [ebp - 0x428], 1
mov eax, dword [ebp - 0x140]
sub eax, dword [ebp - 0x428]
cmp dword [ebp - 0x810], eax
je 0x1000a403
mov dword [ebp - 0x430], 1
jmp 0x1000a40a
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x140], 0xffffffe3
jmp 0x1000a43b
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xc
jl 0x1000a47b
mov dword [ebp - 0xd8], 0
jmp 0x1000a45d
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x1000a479
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0xa08], 0xfbb9cf7d
jmp 0x1000a450
jmp 0x1000a42e
jmp 0x1000a2e9
jmp 0x1000a290
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x98], 0xfa51
mov dword [ebp - 0xc68], 0
mov dword [ebp - 0xc64], 0
mov dword [ebp - 0xc60], 0
mov dword [ebp - 0xc5c], 0
mov dword [ebp - 0x43c], 3
mov dword [ebp - 0x9fc], 2
cmp dword [ebp - 0x98], 0x941f
jge 0x1000a4ed
mov dword [ebp - 0x2b4], 1
jmp 0x1000a4f4
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xce8], eax
xor eax, eax
imul eax, eax, 6
test eax, eax
jne 0x1000a521
mov dword [ebp - 0x818], 1
jmp 0x1000a528
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x818]
add eax, 0xee61
je 0x1000a547
cmp dword [ebp - 0x98], 0
je 0x1000a547
and dword [ebp - 0x820], 0
jmp 0x1000a551
mov dword [ebp - 0x820], 1
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x820], eax
jl 0x1000a56b
mov dword [ebp - 0x65c], 1
jmp 0x1000a572
and dword [ebp - 0x65c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2b4]
mov dword [ebp + eax - 0xc68], ecx
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x43c]
sub eax, 0x13abe9af
cmp eax, dword [ebp - 0x65c]
jg 0x1000a5b0
mov dword [ebp - 0x444], 1
jmp 0x1000a5b7
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0
jg 0x1000a5cc
mov dword [ebp - 0x76c], 1
jmp 0x1000a5d3
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x76c], eax
jl 0x1000a5ed
mov dword [ebp - 0x44c], 1
jmp 0x1000a5f4
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x44c], eax
je 0x1000a60e
mov dword [ebp - 0x934], 1
jmp 0x1000a615
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xcf0], eax
mov dword [ebp - 0x9fc], 0x3d5943e2
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x1000a65b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x194], 0x7ad95e17
mov dword [ebp - 0xcf8], 0xfffffff7
push 1
lea ecx, [ebp - 0xd88]
call fcn.100169cf
mov dword [ebp - 4], 7
mov dword [ebp - 0xd00], 1
mov dword [ebp - 0x664], 1
mov dword [ebp - 0x58], 0
jmp 0x1000a6a7
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1000a6bd
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xd08], 0x4e2db58
jmp 0x1000a6a0
mov dword [ebp - 0x58], 0
jmp 0x1000a6cd
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1000a6e9
push dword [ebp - 0x58]
lea ecx, [ebp - 0xd88]
call fcn.10016a3c
mov dword [eax], 1
jmp 0x1000a6c6
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
mov dword [ebp - 0x194], 0xffffffeb
jmp 0x1000a70f
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xffffffe7
jne 0x1000a73b
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1000a739
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x1000a702
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd88]
call fcn.10016a37
push 2
lea ecx, [ebp - 0xd98]
call fcn.100169cf
mov dword [ebp - 4], 8
push 1
lea ecx, [ebp - 0x954]
call fcn.100169cf
mov byte [ebp - 4], 9
mov dword [ebp - 0x74], 0
jmp 0x1000a77f
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1000a798
push dword [ebp - 0x74]
lea ecx, [ebp - 0xd98]
call fcn.10016a3c
and dword [eax], 0
jmp 0x1000a778
mov dword [ebp - 0x74], 0
jmp 0x1000a7a8
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1000a7c4
push dword [ebp - 0x74]
lea ecx, [ebp - 0x954]
call fcn.10016a3c
mov dword [eax], 0x2ee76f50
jmp 0x1000a7a1
push 0
lea ecx, [ebp - 0x954]
call fcn.10016a3c
and dword [eax], 0
jmp 0x1000a7fa
push 0
lea ecx, [ebp - 0x954]
call fcn.10016a3c
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x454]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x954]
call fcn.10016a3c
cmp dword [eax], 1
jg 0x1000a861
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1000a83b
push 0xb17
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1000a85c
push 0
push 0x23b7
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
jmp 0x1000a7d6
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x954]
call fcn.10016a37
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd98]
call fcn.10016a37
mov dword [ebp - 0x2dc], 0xffffffff
mov dword [ebp - 0xd10], 0x10977a12
mov dword [ebp - 0x26c], 4
mov dword [ebp - 0x8d8], 0x4ff5452f
push 2
lea ecx, [ebp - 0xbc8]
call fcn.100169cf
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xa4c], 0
mov dword [ebp - 0x1dc], 0
jmp 0x1000a8de
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 2
jge 0x1000a900
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xbc8]
call fcn.10016a3c
mov dword [eax], 5
jmp 0x1000a8d1
cmp dword [ebp - 0x26c], 1
jl 0x1000a915
mov dword [ebp - 0x7f4], 1
jmp 0x1000a91c
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x26c]
imul eax, dword [ebp - 0x7f4]
imul eax, dword [ebp - 0x2dc]
cmp eax, dword [ebp - 0x26c]
je 0x1000a944
mov dword [ebp - 0x45c], 1
jmp 0x1000a94b
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x45c], eax
jle 0x1000a965
mov dword [ebp - 0x66c], 1
jmp 0x1000a96c
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x66c], eax
jne 0x1000a986
mov dword [ebp - 0x464], 1
jmp 0x1000a98d
and dword [ebp - 0x464], 0
imul eax, dword [ebp - 0x464], 0xb064
cmp eax, dword [ebp - 0x8d8]
jle 0x1000a9ab
mov dword [ebp - 0x274], 1
jmp 0x1000a9b2
and dword [ebp - 0x274], 0
push 1
lea ecx, [ebp - 0xbc8]
call fcn.10016a3c
mov ecx, dword [ebp - 0x274]
mov dword [eax], ecx
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0xa4c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc8]
call fcn.10016a37
mov dword [ebp - 0x8c], 0xfa51
mov dword [ebp - 0xc48], 0
mov dword [ebp - 0xc44], 0
mov dword [ebp - 0xc40], 0
mov dword [ebp - 0xc3c], 0
mov dword [ebp - 0x674], 3
mov dword [ebp - 0xa10], 2
cmp dword [ebp - 0x8c], 0x941f
jge 0x1000aa40
mov dword [ebp - 0x2bc], 1
jmp 0x1000aa47
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xd18], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xd20], eax
xor eax, eax
imul eax, eax, 6
test eax, eax
jne 0x1000aa74
mov dword [ebp - 0x774], 1
jmp 0x1000aa7b
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
add eax, 0xee61
je 0x1000aa9a
cmp dword [ebp - 0x8c], 0
je 0x1000aa9a
and dword [ebp - 0x46c], 0
jmp 0x1000aaa4
mov dword [ebp - 0x46c], 1
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x46c], eax
jl 0x1000aabe
mov dword [ebp - 0x474], 1
jmp 0x1000aac5
and dword [ebp - 0x474], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp + eax - 0xc48], ecx
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x674]
sub eax, 0x13abe9af
cmp eax, dword [ebp - 0x474]
jg 0x1000ab03
mov dword [ebp - 0x84c], 1
jmp 0x1000ab0a
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 0
jg 0x1000ab1f
mov dword [ebp - 0x47c], 1
jmp 0x1000ab26
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x47c], eax
jl 0x1000ab40
mov dword [ebp - 0x67c], 1
jmp 0x1000ab47
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x67c], eax
je 0x1000ab61
mov dword [ebp - 0x8e0], 1
jmp 0x1000ab68
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xd28], eax
mov dword [ebp - 0xa10], 0x3d5943e2
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x1000abae
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x19c], 0x7ad95e17
mov dword [ebp - 0xd30], 0xfffffff7
push 1
lea ecx, [ebp - 0xda8]
call fcn.100169cf
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xd38], 1
mov dword [ebp - 0x484], 1
mov dword [ebp - 0x4c], 0
jmp 0x1000abfa
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1000ac10
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xd44], 0x4e2db58
jmp 0x1000abf3
mov dword [ebp - 0x4c], 0
jmp 0x1000ac20
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1000ac3c
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xda8]
call fcn.10016a3c
mov dword [eax], 1
jmp 0x1000ac19
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x19c], 0xffffffeb
jmp 0x1000ac62
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xffffffe7
jne 0x1000ac8e
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1000ac8c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x1000ac55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xda8]
call fcn.10016a37
mov dword [ebp - 0x2fc], 0xffffffff
mov dword [ebp - 0xd48], 0x10977a12
mov dword [ebp - 0x27c], 4
mov dword [ebp - 0x8e8], 0x4ff5452f
push 2
lea ecx, [ebp - 0xbe0]
call fcn.100169cf
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xa3c], 0
mov dword [ebp - 0x21c], 0
jmp 0x1000acfc
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jge 0x1000ad1e
push dword [ebp - 0x21c]
lea ecx, [ebp - 0xbe0]
call fcn.10016a3c
mov dword [eax], 5
jmp 0x1000acef
cmp dword [ebp - 0x27c], 1
jl 0x1000ad33
mov dword [ebp - 0x77c], 1
jmp 0x1000ad3a
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x27c]
imul eax, dword [ebp - 0x77c]
imul eax, dword [ebp - 0x2fc]
cmp eax, dword [ebp - 0x27c]
je 0x1000ad62
mov dword [ebp - 0x48c], 1
jmp 0x1000ad69
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x48c], eax
jle 0x1000ad83
mov dword [ebp - 0x684], 1
jmp 0x1000ad8a
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x684], eax
jne 0x1000ada4
mov dword [ebp - 0x494], 1
jmp 0x1000adab
and dword [ebp - 0x494], 0
imul eax, dword [ebp - 0x494], 0xb064
cmp eax, dword [ebp - 0x8e8]
jle 0x1000adc9
mov dword [ebp - 0x284], 1
jmp 0x1000add0
and dword [ebp - 0x284], 0
push 1
lea ecx, [ebp - 0xbe0]
call fcn.10016a3c
mov ecx, dword [ebp - 0x284]
mov dword [eax], ecx
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0xa3c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe0]
call fcn.10016a37
mov dword [ebp - 0xe0], 0x860b4ffb
mov dword [ebp - 0x1a4], 0
jmp 0x1000ae23
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x1000ae3f
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x8b4], 0
jmp 0x1000ae16
mov dword [ebp - 0xe0], 2
jmp 0x1000ae58
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x1000afad
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe8], 2
jmp 0x1000ae88
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x1000afa8
mov eax, dword [ebp - 0xe8]
cmp dword [ebp + eax*4 - 0x8b4], 0x62da
jne 0x1000aeb4
mov dword [ebp - 0x68c], 1
jmp 0x1000aebb
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp + eax*4 - 0x8b4], 0
jne 0x1000aed9
xor eax, eax
inc eax
jne 0x1000aed9
and dword [ebp - 0x7fc], 0
jmp 0x1000aee3
mov dword [ebp - 0x7fc], 1
cmp dword [ebp - 0x7fc], 0x4c03
jle 0x1000aefb
mov dword [ebp - 0x49c], 1
jmp 0x1000af02
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x8b4]
cmp dword [ebp - 0x49c], eax
jne 0x1000af23
mov dword [ebp - 0x4a4], 1
jmp 0x1000af2a
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x68c]
sub eax, dword [ebp - 0x4a4]
cmp eax, 0xd5d70512
jbe 0x1000af49
mov dword [ebp - 0x784], 1
jmp 0x1000af50
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
sub eax, dword [ebp - 0xe8]
cmp eax, 0xccfd66c4
je 0x1000af6f
mov dword [ebp - 0x8f0], 1
jmp 0x1000af76
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x8b4]
mov dword [ebp - 0xd50], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe8]
mov eax, dword [ebp + eax - 0x8b4]
mov dword [ebp + ecx*4 - 0x8b4], eax
jmp 0x1000ae7b
jmp 0x1000ae4b
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1000afd5
push 0x1fd6
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
mov dword [ebp - 0x1e4], 0x7ad95e17
mov dword [ebp - 0xd58], 0xfffffff7
push 1
lea ecx, [ebp - 0xdb8]
call fcn.100169cf
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xd60], 1
mov dword [ebp - 0x4ac], 1
mov dword [ebp - 0x7c], 0
jmp 0x1000b021
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1000b037
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xd68], 0x4e2db58
jmp 0x1000b01a
mov dword [ebp - 0x7c], 0
jmp 0x1000b047
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1000b063
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xdb8]
call fcn.10016a3c
mov dword [eax], 1
jmp 0x1000b040
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x1e4], 0xffffffeb
jmp 0x1000b089
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xffffffe7
jne 0x1000b0b5
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1000b0b3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x1000b07c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb8]
call fcn.10016a37
push 1
lea ecx, [ebp - 0x318]
call fcn.100169cf
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c4], 9
mov dword [ebp - 0x68], 0
jmp 0x1000b0f9
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1000b115
push dword [ebp - 0x68]
lea ecx, [ebp - 0x318]
call fcn.10016a3c
mov dword [eax], 4
jmp 0x1000b0f2
mov dword [ebp - 0x68], 0
jmp 0x1000b125
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1000b13b
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xbf8], 0x1d6b3bfa
jmp 0x1000b11e
mov dword [ebp - 0x2c], 0
jmp 0x1000b14b
cmp dword [ebp - 0x2c], 0
jg 0x1000b395
mov dword [ebp - 0x4b4], 1
mov dword [ebp - 0x83c], 0xc8ddac0f
mov dword [ebp - 0x4cc], 0xdae4
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x1ac], 0
jmp 0x1000b196
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 4
jge 0x1000b1b2
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0xf94], 0xfffffff9
jmp 0x1000b189
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbf8], 0
jne 0x1000b219
push 0
lea ecx, [ebp - 0x318]
call fcn.10016a3c
cmp dword [eax], 1
jg 0x1000b1df
mov dword [ebp - 0x694], 1
jmp 0x1000b1e6
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x4b4], eax
mov esi, dword [ebp - 0x4b4]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x318]
call fcn.10016a3c
sub esi, dword [eax]
mov dword [ebp - 0x83c], esi
jne 0x1000b219
and dword [ebp - 0x4bc], 0
jmp 0x1000b223
mov dword [ebp - 0x4bc], 1
mov eax, dword [ebp - 0x4cc]
cmp dword [ebp - 0x4bc], eax
jl 0x1000b23d
mov dword [ebp - 0x69c], 1
jmp 0x1000b244
and dword [ebp - 0x69c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbf8]
cmp dword [ebp - 0x69c], eax
je 0x1000b264
mov dword [ebp - 0x4c4], 1
jmp 0x1000b26b
and dword [ebp - 0x4c4], 0
mov esi, dword [ebp - 0x4c4]
add esi, 0x4868fdad
push 0
lea ecx, [ebp - 0x318]
call fcn.10016a3c
cmp esi, dword [eax]
jne 0x1000b294
mov dword [ebp - 0x2c], 0x1c
jmp 0x1000b3a5
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 8
jge 0x1000b3ea
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbf8]
mov dword [ebp - 0xe20], eax
mov eax, 0x8025
test eax, eax
jne 0x1000b3d3
mov dword [ebp - 0x4e4], 1
jmp 0x1000b3da
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
neg eax
mov dword [ebp - 0x2c4], eax
jmp 0x1000b39e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x318]
call fcn.10016a37
mov dword [ebp - 0x2e4], 0xffffffff
mov dword [ebp - 0xe2c], 0x10977a12
mov dword [ebp - 0x28c], 4
mov dword [ebp - 0x9cc], 0x4ff5452f
push 2
lea ecx, [ebp - 0xc10]
call fcn.100169cf
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x8f8], 0
mov dword [ebp - 0x204], 0
jmp 0x1000b458
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jge 0x1000b47a
push dword [ebp - 0x204]
lea ecx, [ebp - 0xc10]
call fcn.10016a3c
mov dword [eax], 5
jmp 0x1000b44b
cmp dword [ebp - 0x28c], 1
jl 0x1000b48f
mov dword [ebp - 0x794], 1
jmp 0x1000b496
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x28c]
imul eax, dword [ebp - 0x794]
imul eax, dword [ebp - 0x2e4]
cmp eax, dword [ebp - 0x28c]
je 0x1000b4be