Function at 0x1000ad79
Capabilities:
Create thread
Delete registry key
Delete registry value
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe54
push esi
push edi
mov dword [ebp - 0x178], 0x4504cd45
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x178], 3
jmp 0x1000adb4
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x13
je 0x1000aed2
mov dword [ebp - 0x2f8], 0xea983111
mov dword [ebp - 0x2f8], 0xfffffffd
jmp 0x1000ade4
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0x16
jne 0x1000aecd
mov dword [ebp - 0x2bc], 1
mov dword [ebp - 0x1f0], 0
jmp 0x1000ae14
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x1000ae30
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0xd98], 0x3244d513
jmp 0x1000ae07
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1000ae53
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x2bc], 0xffffffe6
jmp 0x1000ae6c
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0xffffffe7
jle 0x1000aec8
mov dword [ebp - 0x1f8], 0x7dcd66a0
mov dword [ebp - 0x1f8], 2
jmp 0x1000ae98
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jl 0x1000aec6
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1000aec4
push 0x1244
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1000ae8b
jmp 0x1000ae5f
jmp 0x1000add7
jmp 0x1000ada7
mov dword [ebp - 0x188], 0x4504cd45
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x188], 3
jmp 0x1000af02
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x13
je 0x1000b020
mov dword [ebp - 0x2e4], 0xea983111
mov dword [ebp - 0x2e4], 0xfffffffd
jmp 0x1000af32
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x16
jne 0x1000b01b
mov dword [ebp - 0x2c4], 1
mov dword [ebp - 0x200], 0
jmp 0x1000af62
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x1000af7e
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0xd50], 0x3244d513
jmp 0x1000af55
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1000afa1
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x2c4], 0xffffffe6
jmp 0x1000afba
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0xffffffe7
jle 0x1000b016
mov dword [ebp - 0x208], 0x7dcd66a0
mov dword [ebp - 0x208], 2
jmp 0x1000afe6
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jl 0x1000b014
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x1000b012
push 0x1244
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1000afd9
jmp 0x1000afad
jmp 0x1000af25
jmp 0x1000aef5
mov dword [ebp - 0xb4c], 0x720e
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000b04b
push 0
push 1
push 0x1428
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1000b06d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x1a4], 0x4504cd45
mov dword [ebp - 0x44], 0x2e91a049
mov dword [ebp - 0x3e0], 0
mov dword [ebp - 0x27c], 0
jmp 0x1000b0a1
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jge 0x1000b0bd
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x9cc], 1
jmp 0x1000b094
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x1000b0d9
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x44], 0
jmp 0x1000b0e9
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffec
jg 0x1000b4c5
mov dword [ebp - 0x54], 0x2124f84b
mov dword [ebp - 0x8ec], 0
mov dword [ebp - 0x8c0], 0x92357994
mov dword [ebp - 0x6f0], 0xffffffff
mov dword [ebp - 0x3e8], 0x4384f3ac
mov dword [ebp - 0x210], 0
jmp 0x1000b13b
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x1000b157
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0xaa4], 9
jmp 0x1000b12e
mov dword [ebp - 0x54], 0xfffffff3
jmp 0x1000b167
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x1000b4c0
mov dword [ebp - 0xfc], 0xe19f
mov dword [ebp - 0x314], 0x1db95674
mov dword [ebp - 0x6e8], 0xfffffffa
mov eax, 0x8d5f
test eax, eax
je 0x1000b2bf
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x44]
jne 0x1000b1b6
cmp dword [ebp - 0xfc], 0
jne 0x1000b1b6
and dword [ebp - 0x8b4], 0
jmp 0x1000b1c0
mov dword [ebp - 0x8b4], 1
cmp dword [ebp - 0x8b4], 0xffffffff
jle 0x1000b1d5
mov dword [ebp - 0x8a0], 1
jmp 0x1000b1dc
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0xc3e1b8d8
jne 0x1000b1f4
mov dword [ebp - 0x8a8], 1
jmp 0x1000b1fb
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x8a8], eax
jge 0x1000b212
mov dword [ebp - 0x8b0], 1
jmp 0x1000b219
and dword [ebp - 0x8b0], 0
cmp dword [ebp - 0x8b0], 0xea1b1489
jbe 0x1000b231
mov dword [ebp - 0x8b8], 1
jmp 0x1000b238
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp - 0x8c0]
cmp dword [ebp - 0x8ec], eax
jl 0x1000b267
mov dword [ebp - 0x8f4], 1
jmp 0x1000b26e
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x8f4], eax
jge 0x1000b285
mov dword [ebp - 0x8fc], 1
jmp 0x1000b28c
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x8fc], eax
jg 0x1000b2a3
mov dword [ebp - 0x910], 1
jmp 0x1000b2aa
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
jne 0x1000b2ce
cmp dword [ebp - 0x44], 0
jne 0x1000b2ce
and dword [ebp - 0x904], 0
jmp 0x1000b2d8
mov dword [ebp - 0x904], 1
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x904], eax
jne 0x1000b2fb
cmp dword [ebp - 0x314], 0
je 0x1000b2fb
mov dword [ebp - 0x6d8], 1
jmp 0x1000b302
and dword [ebp - 0x6d8], 0
cmp dword [ebp - 0x6d8], 0xf7d5
jle 0x1000b31a
mov dword [ebp - 0x3d0], 1
jmp 0x1000b321
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0xfc], eax
je 0x1000b33e
mov dword [ebp - 0x6e0], 1
jmp 0x1000b345
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x6e0]
cmp eax, dword [ebp - 0xfc]
jge 0x1000b363
mov dword [ebp - 0x3d8], 1
jmp 0x1000b36a
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
imul eax, dword [ebp - 0x44]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x6f0], eax
jge 0x1000b3a9
mov dword [ebp - 0x364], 1
jmp 0x1000b3b0
and dword [ebp - 0x364], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x364]
mov dword [ebp + eax - 0xaa4], ecx
mov eax, dword [ebp - 0x364]
sub eax, 0x1cf0b513
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x3e8]
sub eax, 0xffff
je 0x1000b3ed
mov dword [ebp - 0x6f8], 1
jmp 0x1000b3f4
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x6f8], eax
jge 0x1000b40b
mov dword [ebp - 0x3f0], 1
jmp 0x1000b412
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x3f0], eax
jle 0x1000b42c
mov dword [ebp - 0x700], 1
jmp 0x1000b433
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x700], eax
jle 0x1000b45a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xaa4], 0
je 0x1000b45a
mov dword [ebp - 0x3f8], 1
jmp 0x1000b461
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 0xc33490ce
jne 0x1000b479
mov dword [ebp - 0x708], 1
jmp 0x1000b480
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x708], 0xffffffff
jbe 0x1000b495
mov dword [ebp - 0x9b0], 1
jmp 0x1000b49c
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xbe8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xfc]
mov dword [ebp + eax - 0x9cc], ecx
jmp 0x1000b160
jmp 0x1000b0e2
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a4], 3
jmp 0x1000b4eb
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0x13
je 0x1000c2c6
mov dword [ebp - 0x218], 0x1f7e2799
mov dword [ebp - 0x9dc], 0xfffffffe
mov dword [ebp - 0x408], 0xb7e280bf
mov dword [ebp - 0x288], 0
jmp 0x1000b52f
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 3
jge 0x1000b54b
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0xc98], 5
jmp 0x1000b522
mov dword [ebp - 0x218], 0
jmp 0x1000b564
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffe2
jg 0x1000b815
mov dword [ebp - 0x104], 0xffffffff
mov dword [ebp - 0x290], 0
jmp 0x1000b594
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 1
jge 0x1000b5b0
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x36c], 0x678e045
jmp 0x1000b587
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc98]
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x104], 0xd
jmp 0x1000b5dc
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xffffffee
jne 0x1000b810
mov dword [ebp - 0x64], 0
jmp 0x1000b5f9
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1000b60f
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x3a8], 0x48214d2f
jmp 0x1000b5f2
mov dword [ebp - 0x64], 0
jmp 0x1000b61f
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x1000b635
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xd34], 1
jmp 0x1000b618
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
je 0x1000b7cc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
jae 0x1000b665
mov dword [ebp - 0x400], 1
jmp 0x1000b66c
and dword [ebp - 0x400], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x104]
cmp dword [ebp + eax - 0x3a8], ecx
jl 0x1000b68d
mov dword [ebp - 0x710], 1
jmp 0x1000b694
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x400]
cmp eax, dword [ebp - 0x710]
jge 0x1000b6ae
mov dword [ebp - 0x9d4], 1
jmp 0x1000b6b5
and dword [ebp - 0x9d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0xbf0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x36c]
mov dword [ebp - 0xac4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x36c], 2
jle 0x1000b703
mov dword [ebp - 0x718], 1
jmp 0x1000b70a
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 0
jl 0x1000b71f
mov dword [ebp - 0x410], 1
jmp 0x1000b726
and dword [ebp - 0x410], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
cmp dword [ebp - 0x410], eax
jg 0x1000b747
mov dword [ebp - 0x348], 1
jmp 0x1000b74e
and dword [ebp - 0x348], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x348]
mov dword [ebp + eax - 0x36c], ecx
cmp dword [ebp - 0x348], 0xfffffffe
je 0x1000b776
mov dword [ebp - 0x720], 1
jmp 0x1000b77d
and dword [ebp - 0x720], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
cmp dword [ebp - 0x720], eax
jge 0x1000b79e
mov dword [ebp - 0x31c], 1
jmp 0x1000b7a5
and dword [ebp - 0x31c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x31c]
mov dword [ebp + eax - 0xd34], ecx
cmp dword [ebp - 0x31c], 0
je 0x1000b7cc
mov dword [ebp - 0x418], 1
jmp 0x1000b7d3
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x418], eax
jle 0x1000b7ed
mov dword [ebp - 0x728], 1
jmp 0x1000b7f4
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x9dc], eax
cmp dword [ebp - 0x104], 0
je 0x1000b80b
jmp 0x1000b810
jmp 0x1000b5cf
jmp 0x1000b557
mov dword [ebp - 0x220], 0xea983111
mov dword [ebp - 0x220], 0xfffffffd
jmp 0x1000b838
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x16
jne 0x1000c2c1
mov dword [ebp - 0x298], 4
mov dword [ebp - 0xac8], 0
mov dword [ebp - 0xad0], 6
mov dword [ebp - 0xad8], 0
mov dword [ebp - 0xae0], 0x8a11015a
mov dword [ebp - 0xae8], 0xe4f1f13b
mov dword [ebp - 0xaf0], 6
mov dword [ebp - 0xaf8], 0xf97812a3
mov dword [ebp - 0xb00], 0x4e1c2e93
mov dword [ebp - 0xb08], 0xffffffff
mov dword [ebp - 0xb10], 0x3af7806a
mov dword [ebp - 0x7c], 0
jmp 0x1000b8c3
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x1000b8d9
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xe44], 0
jmp 0x1000b8bc
mov dword [ebp - 0x7c], 0
jmp 0x1000b8e9
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x1000b8ff
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xdb4], 0xfffffffd
jmp 0x1000b8e2
mov dword [ebp - 0x298], 3
jmp 0x1000b918
mov eax, dword [ebp - 0x298]
dec eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jl 0x1000b979
mov dword [ebp - 0xb18], 0x696a485b
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x228], 0
jmp 0x1000b94e
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x1000b96a
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xb20], 1
jmp 0x1000b941
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
jmp 0x1000b90b
mov dword [ebp - 0x240], 1
mov dword [ebp - 0x10c], 0xffffffff
mov dword [ebp - 0x230], 0xffffffff
mov dword [ebp - 0x10c], 0
jmp 0x1000b9b0
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffe4
jl 0x1000bd22
mov dword [ebp - 0x14], 0xeec5
mov dword [ebp - 0x970], 0x74aa0d72
mov dword [ebp - 0x96c], 0x74aa0d72
mov dword [ebp - 0x968], 0x74aa0d72
mov dword [ebp - 0x964], 0x74aa0d72
cmp dword [ebp - 0x10c], 0xd1b9849b
jae 0x1000ba04
mov dword [ebp - 0x730], 1
jmp 0x1000ba0b
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x730]
jne 0x1000ba22
mov dword [ebp - 0x428], 1
jmp 0x1000ba29
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x738], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x738]
mov dword [ebp + eax - 0x970], ecx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x738]
sub ecx, eax
cmp ecx, 0xeea5
je 0x1000ba6c
mov dword [ebp - 0x430], 1
jmp 0x1000ba73
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x430], eax
jle 0x1000bccb
mov dword [ebp - 0x4c], 0xfffffffd
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x970]
mov dword [ebp - 0xb28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb30], eax
or eax, 0xffffffff
sub eax, 0x5922
imul eax, eax, 0xf2d
imul eax, dword [ebp - 0x14]
test eax, eax
jae 0x1000baca
mov dword [ebp - 0x740], 1
jmp 0x1000bad1
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x740]
jl 0x1000bae8
mov dword [ebp - 0x438], 1
jmp 0x1000baef
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 0x7c71
jle 0x1000bb07
mov dword [ebp - 0x748], 1
jmp 0x1000bb0e
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x748]
jg 0x1000bb4d
mov dword [ebp - 0x440], 0x1718bc69
mov dword [ebp - 0x4c], 0
jmp 0x1000bb33
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x1000bb48
mov eax, dword [ebp - 0x440]
dec eax
mov dword [ebp - 0x440], eax
jmp 0x1000bb2c
jmp 0x1000bbeb
mov dword [ebp - 0x4c], 0
jmp 0x1000bb5d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x1000bbeb
mov dword [ebp - 0x14], 0
jmp 0x1000bb77
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1000bbbc
mov dword [ebp - 0x2a0], 0xf19716e2
mov dword [ebp - 0x2a0], 0
jmp 0x1000bba0
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 3
jg 0x1000bbba
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x970], 0
je 0x1000bbb8
jmp 0x1000bbba
jmp 0x1000bb93
jmp 0x1000bb70
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x1000bbe6
push 0
push 0x129e
push 0
push 0
push 0x261a
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1000bb56
cmp dword [ebp - 0x230], 0
jne 0x1000bc64
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x230], eax
jne 0x1000bc0e
mov dword [ebp - 0x778], 1
jmp 0x1000bc15
and dword [ebp - 0x778], 0
cmp dword [ebp - 0x778], 0xb8f3be
jle 0x1000bc2d
mov dword [ebp - 0x448], 1
jmp 0x1000bc34
and dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 0xffffffff
je 0x1000bc49
mov dword [ebp - 0x780], 1
jmp 0x1000bc50
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x780], eax
je 0x1000bc64
and dword [ebp - 0x450], 0
jmp 0x1000bc6e
mov dword [ebp - 0x450], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x970]
cmp eax, dword [ebp - 0x450]
jg 0x1000bc8f
mov dword [ebp - 0x788], 1
jmp 0x1000bc96
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x788], eax
jge 0x1000bcb0
mov dword [ebp - 0x458], 1
jmp 0x1000bcb7
and dword [ebp - 0x458], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x458]
mov dword [ebp + eax - 0x970], ecx
jmp 0x1000bcf7
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x1000bcec
push 0xc57
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp dword [ebp - 0x230], 0
je 0x1000bcf7
jmp 0x1000bd22
mov dword [ebp - 0x14], 0
jmp 0x1000bd07
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000bd1d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x970], 0xffffffff
jmp 0x1000bd00
jmp 0x1000b9a3
mov dword [ebp - 0x114], 0xeaa32b1c
mov dword [ebp - 0x28], 0
jmp 0x1000bd3c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000bd52
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x960], 0xfffffffe
jmp 0x1000bd35
mov dword [ebp - 0x28], 0
jmp 0x1000bd62
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1000bd78
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd24], 5
jmp 0x1000bd5b
mov dword [ebp - 0x28], 0
jmp 0x1000bd88
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000bd9e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb68], 0x7cec
jmp 0x1000bd81
mov dword [ebp - 0x114], 0
jmp 0x1000bdb7
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jg 0x1000c1ef
mov dword [ebp - 0xb0], 0xabbf9acf
mov dword [ebp - 0xc4], 4
mov dword [ebp - 0x9ec], 1
mov dword [ebp - 0x9e4], 0x66969e96
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0xb0]
sub eax, 0x52a5ae63
cmp eax, dword [ebp - 0x114]
jl 0x1000be17
mov dword [ebp - 0x790], 1
jmp 0x1000be1e
and dword [ebp - 0x790], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x960]
cmp dword [ebp - 0x790], eax
jne 0x1000be3f
mov dword [ebp - 0x460], 1
jmp 0x1000be46
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0x460]
cmp eax, 0xc1464f16
je 0x1000be66
mov dword [ebp - 0x798], 1
jmp 0x1000be6d
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x798], eax
jle 0x1000be87
mov dword [ebp - 0x468], 1
jmp 0x1000be8e
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
sub eax, 0x47d1afd0
je 0x1000beb7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x960], 0
je 0x1000beb7
mov dword [ebp - 0x7a0], 1
jmp 0x1000bebe
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x7a0]
sub eax, dword [ebp - 0x114]
dec eax
je 0x1000c04e
mov dword [ebp - 0x470], 1
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0xb40], eax
cmp dword [ebp - 0x470], 0xfffe
jne 0x1000bf08
cmp dword [ebp - 0xb0], 0
je 0x1000bf08
mov dword [ebp - 0x7a8], 1
jmp 0x1000bf0f
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x7a8], eax
jl 0x1000bf3b
cmp dword [ebp - 0xb0], 0
je 0x1000bf3b
cmp dword [ebp - 0xb0], 0
je 0x1000bf3b
mov dword [ebp - 0x478], 1
jmp 0x1000bf42
and dword [ebp - 0x478], 0
mov dword [ebp - 0xc4], 0x5290ce96
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x478]
jg 0x1000bf66
mov dword [ebp - 0x7b0], 1
jmp 0x1000bf6d
and dword [ebp - 0x7b0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x960]
cmp dword [ebp - 0x7b0], eax
jle 0x1000bfa1
mov byte [ebp - 0xdc], 0
movzx eax, byte [ebp - 0xdc]
test eax, eax
je 0x1000bf9c
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1000c049
mov dword [ebp - 0x2a8], 0x430688cd
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x2a8], eax
jg 0x1000bfc5
mov dword [ebp - 0x480], 1
jmp 0x1000bfcc
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 2
ja 0x1000bfe1
mov dword [ebp - 0x7b8], 1
jmp 0x1000bfe8
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0xb0]
neg eax
cmp eax, 0x16c28cbd
jl 0x1000c003
mov dword [ebp - 0x488], 1
jmp 0x1000c00a
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x488]
jle 0x1000c030
mov dword [ebp - 0x7c0], 1
jmp 0x1000c037
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x7c0]
sub eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2a8], eax
jmp 0x1000c0d6
mov dword [ebp - 0xb48], 0xa227283a
mov dword [ebp - 0xb50], 1
mov dword [ebp - 0xc8c], 8
mov dword [ebp - 0xc88], 8
mov dword [ebp - 0xc84], 8
mov dword [ebp - 0xc80], 8
mov dword [ebp - 0x490], 0x111919b1
mov dword [ebp - 0x238], 0
jmp 0x1000c0ad
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1000c0c9
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xd80], 0xade45a91
jmp 0x1000c0a0
mov eax, dword [ebp - 0x490]
dec eax
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xb58], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb68], 0
je 0x1000c182
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x960], 0x4f7d9fd5
jl 0x1000c115
mov dword [ebp - 0x7c8], 1
jmp 0x1000c11c
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x9e4]
cmp dword [ebp - 0x7c8], eax
jge 0x1000c136
mov dword [ebp - 0x498], 1
jmp 0x1000c13d
and dword [ebp - 0x498], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb68]
cmp dword [ebp - 0x498], eax
je 0x1000c15e
mov dword [ebp - 0x7d0], 1
jmp 0x1000c165
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x7d0]
test eax, eax
je 0x1000c182
mov dword [ebp - 0x4a0], 1
jmp 0x1000c189
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xc4], eax
jg 0x1000c1af
mov dword [ebp - 0x7d8], 1
jmp 0x1000c1b6
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x9ec]
cmp eax, dword [ebp - 0x7d8]
jge 0x1000c1d0
mov dword [ebp - 0x4a8], 1
jmp 0x1000c1d7
and dword [ebp - 0x4a8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp + eax - 0xd24], ecx
jmp 0x1000bdaa
mov dword [ebp - 0x2b0], 0
jmp 0x1000c208
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jge 0x1000c224
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0xda4], 0x3244d513
jmp 0x1000c1fb
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1000c247
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x240], 0xffffffe6
jmp 0x1000c260
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xffffffe7
jle 0x1000c2bc
mov dword [ebp - 0x2b8], 0x7dcd66a0
mov dword [ebp - 0x2b8], 2
jmp 0x1000c28c
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jl 0x1000c2ba
mov byte [ebp - 0xde], 0
movzx eax, byte [ebp - 0xde]
test eax, eax
je 0x1000c2b8
push 0x1244
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1000c27f
jmp 0x1000c253
jmp 0x1000b82b
jmp 0x1000b4de
mov dword [ebp - 0xc3c], 0x720e
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1000c2f1
push 0
push 1
push 0x1428
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov byte [ebp - 0xe0], 0
movzx eax, byte [ebp - 0xe0]
test eax, eax
je 0x1000c313
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0xc44], 0x720e
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1000c33e
push 0
push 1
push 0x1428
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov byte [ebp - 0xe2], 0
movzx eax, byte [ebp - 0xe2]
test eax, eax
je 0x1000c360
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x170], 5
mov dword [ebp - 0x248], 0
jmp 0x1000c383
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 4
jge 0x1000c39f
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0xde4], 0x8e97eede
jmp 0x1000c376
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x170], 0
jmp 0x1000c3c5
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jg 0x1000c407
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x1000c405
push 0x25eb
push 0
push 0x1bef
push 0x1a80
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x1000c3b8
mov dword [ebp - 0x180], 5
mov dword [ebp - 0x2c0], 0
jmp 0x1000c42a
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 4
jge 0x1000c446
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0xe24], 0x8e97eede
jmp 0x1000c41d
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x180], 0
jmp 0x1000c46c
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jg 0x1000c4ae
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x1000c4ac
push 0x25eb
push 0
push 0x1bef
push 0x1a80
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x1000c45f
mov dword [ebp - 0x34], 0xbac64a68
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x7f0], 0xffffffff
mov dword [ebp - 0x250], 0
jmp 0x1000c4df
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jge 0x1000c4fb
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x1b4], 0xdba33992
jmp 0x1000c4d2
mov dword [ebp - 0x34], 0
jmp 0x1000c50b
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1d
je 0x1000c55b
mov dword [ebp - 0x1ac], 0xda5043c4
mov dword [ebp - 0x1ac], 0
jmp 0x1000c534
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jg 0x1000c559
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [ebp + eax*4 - 0x1b4]
mov dword [ebp + ecx*4 - 0x1b4], eax
jmp 0x1000c527
jmp 0x1000c504
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xc4c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b4]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1b4]
cmp eax, dword [ebp - 0x34]
jne 0x1000c58f
mov dword [ebp - 0x7e0], 1
jmp 0x1000c596
and dword [ebp - 0x7e0], 0
cmp dword [ebp - 0x7e0], 0xfe924f63
je 0x1000c5ae
mov dword [ebp - 0x4b0], 1
jmp 0x1000c5b5
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x4b0], eax
jl 0x1000c5cc
mov dword [ebp - 0x7e8], 1
jmp 0x1000c5d3
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x7e8], eax
jge 0x1000c5ea
mov dword [ebp - 0x4b8], 1
jmp 0x1000c5f1
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x7f0], eax
cmp dword [ebp - 0x7f0], 0x976d9935
jne 0x1000c615
mov dword [ebp - 0x4c0], 1
jmp 0x1000c61c
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x4c0]
jle 0x1000c633
mov dword [ebp - 0x7f8], 1
jmp 0x1000c63a
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x7f8]
imul eax, eax, 0xf34e
cmp eax, dword [ebp - 0x78]
jg 0x1000c664
mov eax, 0xed25e425
test eax, eax
je 0x1000c664
mov dword [ebp - 0x4c8], 1
jmp 0x1000c66b
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x4c8]
jle 0x1000c682
mov dword [ebp - 0x800], 1
jmp 0x1000c689
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x800]
sub eax, dword [ebp - 0x34]
jne 0x1000c6aa
mov eax, 0xc6a6
test eax, eax
jne 0x1000c6aa
and dword [ebp - 0x4d0], 0
jmp 0x1000c6b4
mov dword [ebp - 0x4d0], 1
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x34]
jle 0x1000c6cf
mov dword [ebp - 0x808], 1
jmp 0x1000c6d6
and dword [ebp - 0x808], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b4]
cmp eax, dword [ebp - 0x808]
jg 0x1000c6f7
mov dword [ebp - 0x4d8], 1
jmp 0x1000c6fe
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x4d8], eax
jge 0x1000c715
mov dword [ebp - 0x810], 1
jmp 0x1000c71c
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1b4]
cmp eax, dword [ebp - 0x34]
je 0x1000c746
mov dword [ebp - 0x4e0], 1
jmp 0x1000c74d
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1a0], 0x4504cd45
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x1a0], 3
jmp 0x1000c786
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x13
je 0x1000c8a4
mov dword [ebp - 0x2c8], 0xea983111
mov dword [ebp - 0x2c8], 0xfffffffd
jmp 0x1000c7b6
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x16
jne 0x1000c89f
mov dword [ebp - 0x2d0], 1
mov dword [ebp - 0x258], 0
jmp 0x1000c7e6
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x1000c802
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xd68], 0x3244d513
jmp 0x1000c7d9
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1000c825
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x2d0], 0xffffffe6
jmp 0x1000c83e
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0xffffffe7
jle 0x1000c89a
mov dword [ebp - 0x260], 0x7dcd66a0
mov dword [ebp - 0x260], 2
jmp 0x1000c86a
mov eax, dword [ebp - 0x260]
dec eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jl 0x1000c898
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x1000c896
push 0x1244
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1000c85d
jmp 0x1000c831
jmp 0x1000c7a9
jmp 0x1000c779
mov dword [ebp - 0x190], 5
mov dword [ebp - 0x2d8], 0
jmp 0x1000c8c7
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 4
jge 0x1000c8e3
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0xe04], 0x8e97eede
jmp 0x1000c8ba
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x190], 0
jmp 0x1000c909
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jg 0x1000c94b
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1000c949
push 0x25eb
push 0
push 0x1bef
push 0x1a80
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x1000c8fc
mov dword [ebp - 0xa04], 0xef6f0c3d
mov dword [ebp - 0xa0c], 0xa0197cbb
mov dword [ebp - 0xc], 0
jmp 0x1000c96f
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x1000c985
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x994], 0xf70ad6f2
jmp 0x1000c968
mov dword [ebp - 0xc], 0
jmp 0x1000c995
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x1000c9ab
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x304], 1
jmp 0x1000c98e
mov dword [ebp - 0xc], 0
jmp 0x1000c9bb
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x1000c9d1
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x9fc], 0xffffffff
jmp 0x1000c9b4
mov dword [ebp - 0xc], 0
jmp 0x1000c9e1
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x1000c9f7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x8cc], 0x2044653f
jmp 0x1000c9da
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x304], 0
jmp 0x1000ca25
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x304]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x304], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x304], 2
jg 0x1000cd36
mov dword [ebp - 0x1e4], 0xffffffff
mov dword [ebp - 0x1e4], 0
jmp 0x1000ca5c
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jg 0x1000cb34
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xbc], 2
jmp 0x1000ca8c
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x1000cab3
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1000cab1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1000ca7f
mov dword [ebp - 0xbc], 0
jmp 0x1000cacc
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jg 0x1000cb2f
mov dword [ebp - 0x1b8], 0xfffffff7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x304]
cmp dword [ebp + eax*4 - 0x994], 0
je 0x1000caf8
jmp 0x1000cb2f
mov dword [ebp - 0x1b8], 0
jmp 0x1000cb11
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 3
jge 0x1000cb2d
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x994], 0x7e780ca9
jmp 0x1000cb04
jmp 0x1000cabf
jmp 0x1000ca4f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x304]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x8cc]
cmp dword [ebp + eax*4 - 0x994], ecx
jle 0x1000cb63
mov dword [ebp - 0x818], 1
jmp 0x1000cb6a
and dword [ebp - 0x818], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x818]
inc ecx
cmp dword [ebp + eax - 0x8cc], ecx
jne 0x1000cb8c
mov dword [ebp - 0x4e8], 1
jmp 0x1000cb93
and dword [ebp - 0x4e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x994]
cmp dword [ebp - 0x4e8], eax
jl 0x1000cbb4
mov dword [ebp - 0x9f4], 1
jmp 0x1000cbbb
and dword [ebp - 0x9f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8cc]
mov dword [ebp - 0xc54], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8cc], 0
jne 0x1000cbfe
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x304]
cmp dword [ebp + eax*4 - 0x994], 0
jne 0x1000cbfe
and dword [ebp - 0x820], 0
jmp 0x1000cc08
mov dword [ebp - 0x820], 1
cmp dword [ebp - 0x820], 0x334a
jge 0x1000cc20
mov dword [ebp - 0x4f0], 1
jmp 0x1000cc27
and dword [ebp - 0x4f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x304]
mov eax, dword [ebp + eax*4 - 0x994]
mov dword [ebp - 0x828], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x828]
mov dword [ebp + eax - 0x9fc], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x304]
imul eax, dword [ebp - 0x4f0]
inc eax
mov ecx, dword [ebp - 0x828]
sub ecx, eax
je 0x1000cc7c
mov eax, 0xb8d2
test eax, eax
jne 0x1000cc8e
mov eax, 0x1210cbed
test eax, eax
jne 0x1000cc8e
and dword [ebp - 0x4f8], 0
jmp 0x1000cc98
mov dword [ebp - 0x4f8], 1
cmp dword [ebp - 0x4f8], 0xffffffff
jne 0x1000ccad
mov dword [ebp - 0x830], 1
jmp 0x1000ccb4
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0xa04]
cmp dword [ebp - 0x830], eax
jne 0x1000ccce
mov dword [ebp - 0x500], 1
jmp 0x1000ccd5
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0
jl 0x1000ccea
mov dword [ebp - 0x838], 1
jmp 0x1000ccf1
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x838], eax
jle 0x1000cd0b
mov dword [ebp - 0x360], 1
jmp 0x1000cd12
and dword [ebp - 0x360], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x360]
mov dword [ebp + eax - 0x8cc], ecx
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0xa0c], eax
jmp 0x1000ca0a
mov dword [ebp - 0xc5c], 0x720e
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1000cd61
push 0
push 1
push 0x1428
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1000cd83
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x2c], 0xbac64a68
mov dword [ebp - 0x98], 1
mov dword [ebp - 0x518], 0xffffffff
mov dword [ebp - 0x268], 0
jmp 0x1000cdb7
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 1
jge 0x1000cdd3
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0x198], 0xdba33992
jmp 0x1000cdaa
mov dword [ebp - 0x2c], 0
jmp 0x1000cde3
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1d
je 0x1000ce33
mov dword [ebp - 0x1b0], 0xda5043c4
mov dword [ebp - 0x1b0], 0
jmp 0x1000ce0c
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jg 0x1000ce31
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x1b0]
mov eax, dword [ebp + eax*4 - 0x198]
mov dword [ebp + ecx*4 - 0x198], eax
jmp 0x1000cdff
jmp 0x1000cddc
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xc64], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x198]
cmp eax, dword [ebp - 0x2c]
jne 0x1000ce6a
mov dword [ebp - 0x508], 1
jmp 0x1000ce71
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0xfe924f63
je 0x1000ce89
mov dword [ebp - 0x840], 1
jmp 0x1000ce90
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x840], eax
jl 0x1000ceaa
mov dword [ebp - 0x510], 1
jmp 0x1000ceb1
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x510], eax
jge 0x1000cecb
mov dword [ebp - 0x848], 1
jmp 0x1000ced2
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 0x976d9935
jne 0x1000cef6
mov dword [ebp - 0x850], 1
jmp 0x1000cefd
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x850]
jle 0x1000cf14
mov dword [ebp - 0x520], 1
jmp 0x1000cf1b
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x520]
imul eax, eax, 0xf34e
cmp eax, dword [ebp - 0x98]
jg 0x1000cf4b
mov eax, 0xed25e425
test eax, eax
je 0x1000cf4b
mov dword [ebp - 0x858], 1
jmp 0x1000cf52
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x858]
jle 0x1000cf6c
mov dword [ebp - 0x528], 1
jmp 0x1000cf73
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x528]
sub eax, dword [ebp - 0x2c]
jne 0x1000cf94
mov eax, 0xc6a6
test eax, eax
jne 0x1000cf94
and dword [ebp - 0x860], 0
jmp 0x1000cf9e
mov dword [ebp - 0x860], 1
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x860]
cmp eax, dword [ebp - 0x2c]
jle 0x1000cfbc
mov dword [ebp - 0x530], 1
jmp 0x1000cfc3
and dword [ebp - 0x530], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp eax, dword [ebp - 0x530]
jg 0x1000cfe4
mov dword [ebp - 0x868], 1
jmp 0x1000cfeb
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x868], eax
jge 0x1000d002
mov dword [ebp - 0x538], 1
jmp 0x1000d009
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x198]
cmp eax, dword [ebp - 0x2c]
je 0x1000d039
mov dword [ebp - 0x870], 1
jmp 0x1000d040
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2e0], 1
mov dword [ebp - 0x80], 0
jmp 0x1000d063
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1000d079
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xcec], 0xffffffff
jmp 0x1000d05c
mov dword [ebp - 0x80], 0
jmp 0x1000d089
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1000d09f
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xb78], 0xfffffff9
jmp 0x1000d082
mov dword [ebp - 0x2e0], 2
jmp 0x1000d0b8
mov eax, dword [ebp - 0x2e0]
dec eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
jl 0x1000d2a8
mov dword [ebp - 0x270], 0
jmp 0x1000d0de
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 4
jge 0x1000d0fa
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x930], 0x5a654fdd
jmp 0x1000d0d1
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x930], 2
jmp 0x1000d125
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x930]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x930], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x930], 0
jl 0x1000d282
mov dword [ebp - 0x3c], 0x449c9fb3
mov dword [ebp - 0xa14], 4
mov dword [ebp - 0x3c], 2
jmp 0x1000d159
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1000d191
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x930]
cmp dword [ebp + eax*4 - 0xcec], 0
je 0x1000d177
jmp 0x1000d191
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0x930]
mov dword [ebp + ecx - 0xb78], eax
jmp 0x1000d152
mov dword [ebp - 0x3c], 0
jmp 0x1000d1a1
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x1000d27d
mov dword [ebp - 0x548], 0xffffffff
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb78]
mov dword [ebp - 0xc78], eax
push 4
pop eax
shl eax, 1
imul eax, dword [ebp + eax - 0x930], 9
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x930]
jl 0x1000d1ef
mov dword [ebp - 0x540], 1
jmp 0x1000d1f6
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x540]
jne 0x1000d213
cmp dword [ebp - 0x3c], 0
je 0x1000d213
mov dword [ebp - 0x878], 1
jmp 0x1000d21a
and dword [ebp - 0x878], 0
imul eax, dword [ebp - 0x878], 0x8e48
sub eax, dword [ebp - 0x3c]
jne 0x1000d23c
cmp dword [ebp - 0x3c], 0
jne 0x1000d23c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x930], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x930]
cmp dword [ebp - 0x548], eax
jl 0x1000d262
cmp dword [ebp - 0x548], 0
jne 0x1000d262
and dword [ebp - 0x880], 0
jmp 0x1000d26c
mov dword [ebp - 0x880], 1
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0xa14], eax
jmp 0x1000d19a
jmp 0x1000d10c
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1000d2a3
push 0x1381
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1000d0ab
movzx eax, byte [0x10d89dc4]
test eax, eax
je 0x1000d2c6
mov esi, 0x1008f618
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x100118d5
mov dword [ebp - 0x1a8], 0x4504cd45
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a8], 3
jmp 0x1000d2f6
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x13
je 0x1000d414
mov dword [ebp - 0x2e8], 0xea983111
mov dword [ebp - 0x2e8], 0xfffffffd
jmp 0x1000d326
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x16
jne 0x1000d40f
mov dword [ebp - 0x1e8], 1
mov dword [ebp - 0x278], 0
jmp 0x1000d356
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jge 0x1000d372
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xd5c], 0x3244d513
jmp 0x1000d349
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1000d395
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x1e8], 0xffffffe6
jmp 0x1000d3ae
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0xffffffe7
jle 0x1000d40a
mov dword [ebp - 0x2f0], 0x7dcd66a0
mov dword [ebp - 0x2f0], 2
jmp 0x1000d3da
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
jl 0x1000d408
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1000d406
push 0x1244
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1000d3cd
jmp 0x1000d3a1
jmp 0x1000d319
jmp 0x1000d2e9
mov dword [ebp - 0x1c0], 0x860b4ffb
mov dword [ebp - 0x308], 0
jmp 0x1000d437
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 3
jge 0x1000d453
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0xce0], 0xffffffff
jmp 0x1000d42a
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1000d479
push 0
push 0x1d11
push 0x463
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov dword [ebp - 0x1c0], 0
jmp 0x1000d492
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jg 0x1000d4af
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp + eax*4 - 0xce0], 0
je 0x1000d4ad
jmp 0x1000d4af
jmp 0x1000d485
mov dword [ebp - 0x30], 0xbac64a68
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x898], 0xffffffff
mov dword [ebp - 0x28c], 0
jmp 0x1000d4e3
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jge 0x1000d4ff
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0x18c], 0xdba33992
jmp 0x1000d4d6
mov dword [ebp - 0x30], 0
jmp 0x1000d50f
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x1d
je 0x1000d55f
mov dword [ebp - 0x184], 0xda5043c4
mov dword [ebp - 0x184], 0
jmp 0x1000d538
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
jg 0x1000d55d
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp + eax*4 - 0x18c]
mov dword [ebp + ecx*4 - 0x18c], eax
jmp 0x1000d52b
jmp 0x1000d508
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xc7c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x18c]
cmp eax, dword [ebp - 0x30]
jne 0x1000d596
mov dword [ebp - 0x550], 1
jmp 0x1000d59d
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0xfe924f63
je 0x1000d5b5
mov dword [ebp - 0x888], 1
jmp 0x1000d5bc
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x888], eax
jl 0x1000d5d6
mov dword [ebp - 0x558], 1
jmp 0x1000d5dd
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x558], eax
jge 0x1000d5f7
mov dword [ebp - 0x890], 1
jmp 0x1000d5fe
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 0x976d9935
jne 0x1000d622
mov dword [ebp - 0x564], 1
jmp 0x1000d629
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x564]
jle 0x1000d640
mov dword [ebp - 0x770], 1
jmp 0x1000d647
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0x770]
imul eax, eax, 0xf34e
cmp eax, dword [ebp - 0xa8]
jg 0x1000d677
mov eax, 0xed25e425
test eax, eax
je 0x1000d677
mov dword [ebp - 0x56c], 1
jmp 0x1000d67e
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x56c]
jle 0x1000d698
mov dword [ebp - 0x754], 1
jmp 0x1000d69f
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x754]
sub eax, dword [ebp - 0x30]
jne 0x1000d6c0
mov eax, 0xc6a6
test eax, eax
jne 0x1000d6c0
and dword [ebp - 0x574], 0
jmp 0x1000d6ca
mov dword [ebp - 0x574], 1
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0x574]
cmp eax, dword [ebp - 0x30]
jle 0x1000d6e8
mov dword [ebp - 0x834], 1
jmp 0x1000d6ef
and dword [ebp - 0x834], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18c]
cmp eax, dword [ebp - 0x834]
jg 0x1000d710
mov dword [ebp - 0x57c], 1
jmp 0x1000d717
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x57c], eax
jge 0x1000d72e
mov dword [ebp - 0x75c], 1
jmp 0x1000d735
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x18c]
cmp eax, dword [ebp - 0x30]
je 0x1000d765
mov dword [ebp - 0x584], 1
jmp 0x1000d76c
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xa2c], 0xef6f0c3d
mov dword [ebp - 0xa4c], 0xa0197cbb
mov dword [ebp - 8], 0
jmp 0x1000d799
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x1000d7af
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x9ac], 0xf70ad6f2
jmp 0x1000d792
mov dword [ebp - 8], 0
jmp 0x1000d7bf
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x1000d7d5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x310], 1
jmp 0x1000d7b8
mov dword [ebp - 8], 0
jmp 0x1000d7e5
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x1000d7fb
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa24], 0xffffffff
jmp 0x1000d7de
mov dword [ebp - 8], 0
jmp 0x1000d80b
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x1000d821
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x8d8], 0x2044653f
jmp 0x1000d804
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x310], 0
jmp 0x1000d84f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x310], 2
jg 0x1000db60
mov dword [ebp - 0x1c8], 0xffffffff
mov dword [ebp - 0x1c8], 0
jmp 0x1000d886
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 2
jg 0x1000d95e
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xc0], 2
jmp 0x1000d8b6
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x1000d8dd
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1000d8db
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1000d8a9
mov dword [ebp - 0xc0], 0
jmp 0x1000d8f6
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jg 0x1000d959
mov dword [ebp - 0x1e0], 0xfffffff7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
cmp dword [ebp + eax*4 - 0x9ac], 0
je 0x1000d922
jmp 0x1000d959
mov dword [ebp - 0x1e0], 0
jmp 0x1000d93b
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x1000d957
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x9ac], 0x7e780ca9
jmp 0x1000d92e
jmp 0x1000d8e9
jmp 0x1000d879
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x8d8]
cmp dword [ebp + eax*4 - 0x9ac], ecx
jle 0x1000d98d
mov dword [ebp - 0x8a4], 1
jmp 0x1000d994
and dword [ebp - 0x8a4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8a4]
inc ecx
cmp dword [ebp + eax - 0x8d8], ecx
jne 0x1000d9b6
mov dword [ebp - 0x58c], 1
jmp 0x1000d9bd
and dword [ebp - 0x58c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9ac]
cmp dword [ebp - 0x58c], eax
jl 0x1000d9de
mov dword [ebp - 0xa1c], 1
jmp 0x1000d9e5
and dword [ebp - 0xa1c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8d8]
mov dword [ebp - 0xacc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8d8], 0
jne 0x1000da28
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
cmp dword [ebp + eax*4 - 0x9ac], 0
jne 0x1000da28
and dword [ebp - 0x764], 0
jmp 0x1000da32
mov dword [ebp - 0x764], 1
cmp dword [ebp - 0x764], 0x334a
jge 0x1000da4a
mov dword [ebp - 0x594], 1
jmp 0x1000da51
and dword [ebp - 0x594], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
mov eax, dword [ebp + eax*4 - 0x9ac]
mov dword [ebp - 0x83c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x83c]
mov dword [ebp + eax - 0xa24], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
imul eax, dword [ebp - 0x594]
inc eax
mov ecx, dword [ebp - 0x83c]
sub ecx, eax
je 0x1000daa6
mov eax, 0xb8d2
test eax, eax
jne 0x1000dab8
mov eax, 0x1210cbed
test eax, eax
jne 0x1000dab8
and dword [ebp - 0x59c], 0
jmp 0x1000dac2
mov dword [ebp - 0x59c], 1
cmp dword [ebp - 0x59c], 0xffffffff
jne 0x1000dad7
mov dword [ebp - 0x76c], 1
jmp 0x1000dade
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0xa2c]
cmp dword [ebp - 0x76c], eax
jne 0x1000daf8
mov dword [ebp - 0x2cc], 0x75b57fd5
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x2cc], 0x10
jmp 0x1000db8d
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0x12
je 0x1000dc81
mov dword [ebp - 0x194], 1
mov dword [ebp - 0x774], 0xf996f377
mov dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x194], eax
jge 0x1000dbf0
cmp dword [ebp - 0x194], 0
je 0x1000dbf0
cmp dword [ebp - 0x11c], 0
je 0x1000dbf0
mov dword [ebp - 0x5ac], 1
jmp 0x1000dbf7
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x194]
sub eax, dword [ebp - 0x774]
imul eax, dword [ebp - 0x194]
sub eax, dword [ebp - 0x194]
mov dword [ebp - 0xa54], eax
mov dword [ebp - 0x11c], 0xe
jmp 0x1000dc3b
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 5
jge 0x1000dc7c
mov dword [ebp - 0x5b4], 0x204795ed
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1000dc6d
push 0x19ad
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov eax, dword [ebp - 0x5b4]
dec eax
mov dword [ebp - 0x5b4], eax
jmp 0x1000dc2e
jmp 0x1000db80
mov dword [ebp - 0xbf8], 0x1008f618
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x88], 0
jmp 0x1000dcae
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1000dcca
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x978], 0xffffffff
jmp 0x1000dca1
mov dword [ebp - 0x88], 0
jmp 0x1000dce3
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1000dcff
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x32c], 1
jmp 0x1000dcd6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x978], 0
je 0x1000de06
mov dword [ebp - 0x1d8], 0x5ae649f6
mov dword [ebp - 0xa5c], 0x3d6c1dfe
imul eax, dword [ebp - 0x1d8], 0
cmp dword [ebp - 0x1d8], eax
jle 0x1000dd42
mov dword [ebp - 0x358], 1
jmp 0x1000dd49
and dword [ebp - 0x358], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x358]
mov dword [ebp + eax - 0x32c], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x978]
imul eax, dword [ebp - 0x358]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x844], eax
jl 0x1000dd90
mov dword [ebp - 0x5bc], 1
jmp 0x1000dd97
and dword [ebp - 0x5bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x978]
imul eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x1d8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d8]
cmp dword [ebp + eax - 0x978], ecx
jl 0x1000ddd2
mov dword [ebp - 0x77c], 1
jmp 0x1000ddd9
and dword [ebp - 0x77c], 0
cmp dword [ebp - 0x77c], 0xcdf11bbb
jae 0x1000ddf1
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1000de25
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x32c]
mov dword [ebp + ecx - 0x32c], eax
mov dword [ebp - 0xad4], 0x720e
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x1000de6a
push 0
push 1
push 0x1428
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1000de8c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x19c], 0x4504cd45
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x19c], 3
jmp 0x1000debc
pop edi
pop esi
mov esp, ebp
pop ebp
ret